Source: Europese digitale identiteit is straks niet veilig genoeg, waarschuwen experts - NRC
INTERVIEW DENIS ROIO SOFTWARE DEVELOPER ‘European digital identity will soon not be secure enough’
In the rush to better protect the privacy of EU citizens and to limit the power of American ‘Big Tech’, experts say design errors are being made in the development of the European digital identity.vMarloes de Koning AMSTERDAM
Denis Roio will not be using the European digital identity, which he helped develop himself. The Italian software developer and entrepreneur has lost his confidence in the ambitious European project.
By the end of 2026, every EU country must have a secure app ready that citizens can use when they need to share data about themselves online. For example, to prove that they are over 18 years old, that they have a driver's license or are registered with a municipality. They must also be able to use it to provide medical data.
Companies, governments and online platforms are legally obliged to accept the evidence from these apps. The application is similar to that of DigiD in the Netherlands, but the app will soon be available for many more services and throughout Europe. For example, you can also rent a car, buy alcohol online or gamble.
The app should ensure a significant improvement in the privacy of European citizens. It is now almost impossible to operate online without unintentionally leaving behind all kinds of data about yourself. Companies earn a lot of money from trading in this personal data. The apps should ensure that citizens can choose for themselves how much data they share about themselves.
Big mistakes
But in the rush to better protect the privacy of European citizens and reduce the power of American ‘Big Tech’, big mistakes are being made in Brussels, experts say, causing supporters from the very beginning to drop out. Roio (47) is a clear example of this. He describes himself as a ‘conscientious objector’.
In principle, Roio, like many privacy activists and software experts, is a great supporter of a European digital identity. “It is intended to protect us from data theft by Big Tech.” He is a convinced European. Born and raised in Italy, but has been in the Netherlands for twenty years.
With his company, he carries out research projects for the European Commission that revolve around digital encryption, among other things. Like many experts, he actively participates in discussions about how the EUID should be built. These are technical discussions about fundamental questions. How high should the security be against cyber attacks? Will the EUID be ‘quantum-proof’, i.e. resistant to attacks by supercomputers? Can you remain completely anonymous when using the app? The EU has standard procedures for such a technical process: after a political decision, a working group first comes up with a technical elaboration in broad outline, after which it develops increasingly detailed specifications. This elaboration and specifications are published online in draft form, so that experts can respond to them and point out errors. After a vote, the process moves to the next phase.
For the EUID, the technical framework, the so-called ‘Architectural Reference Framework’, was put online this spring. Many cryptographers, including Roio, provided feedback. They have broadly the same fundamental objections. The most important is that the so-called cryptographic protection is too weak. This makes it possible for malicious parties with technical knowledge to discover the identity of users.
Back to the drawing board
Jaap-Henk Hoepman, associate professor at Radboud University and specialized in online privacy, also drew up an extensive document with feedback with a group of fifteen renowned European colleagues. "If it is done well technologically, Europe can become a forerunner with private and secure identification mechanisms in the digital space," the sixteen scientists wrote in it.
Software developer and entrepreneur Denis Roio. “There has been no active attempt to involve civil society in the EU ID. So far, only technicians are working on it.”
elieve the project should first go back to the drawing board, because they too have noted that the intended anonymity of users is not properly arranged. In the eyes of the cryptographers, the EUID should use what they call zero-knowledge cryptography, instead of the chosen method of encryption.
The discussion revolves around the evidence that is placed in the app (‘wallet’) developed for this purpose on your phone. Imagine these evidences as the digital equivalent of, for example, a physical passport, driver’s license or diploma. You request them (via the app) from the relevant authority every few years. You can then use them as often as you like without the issuer (the municipality, the educational institution) being able to see where and when you do so.
Anonymous identity documents with zero knowledge proof, which Hoepman and his colleagues would prefer to see introduced, do not leave any digital traces when used. You could call them disposable proofs, for one-time use. “A gambling website that has to check my age cannot see whether it is me who comes to gamble a hundred times a day. Or whether it concerns a hundred digerent people who are all of legal age,” Hoepman gives as an example.
“Apple and Google are the dealers in this game. They deal the cards” Denis Roio softwareontwikkelaar
A second concern of Hoepman and his colleagues is that no mechanism is built in to prevent users from being asked for unnecessary information, which they usually provide without question. That also agects privacy. An example: a porn site that is not allowed to have children as customers only needs to know whether a user is old enough. Not whether he is Dutch and what his name is. If the EUID really values online privacy, consumers will automatically be protected from sharing unnecessary amounts of data, the cryptographers argue.
There are alternatives to the proposal of the European Commission working group. Professor Bart Jacobs, a colleague of Hoepman at Radboud University, developed an app in the Netherlands more than ten years ago, for example, that makes it possible to log in and share only the most essential 'evidence'. That app was first called IRMA and is now Yivi. About a hundred thousand Dutch people have it on their phones. "So it is indeed possible," says the professor, a pioneer in this field in the Netherlands. “We have been using it for ten years.” He calls it “incomprehensible” that the EU does not also opt for this.
Make haste
A vote on the technical design was initially postponed this fall, probably because of the many objections from experts to the first concept. But on November 21, the Brussels working group met and decided to continue on the chosen path.
The Netherlands voted against this draft in Brussels, but did not have enough support to stop it
The working group includes representatives from all European member states. Tech companies involved also regularly join. The Netherlands voted with six other countries against the decision to continue in the current format, but did not have enough support to stop it. The Dutch ogicials involved used similar arguments as Roio, Hoepman and Jacobs. They would have liked to see ‘additional privacy protection measures’, ‘for example in the area of cryptographic security of data in EUDI wallets’, a spokesperson confirmed.
Postponing the decision, or going back to the drawing board, would have meant that the ID wallets would not be ready before the end of 2026. Within Europe, Germany and France in particular are pushing for haste.
One of the arguments is that Europe is actually already terribly late in trying to do something about the power of the large (usually American) tech companies. They are now rapidly strengthening their grip on the online identity of Europeans. They do this, among other things, by ogering to log in via Google or Facebook, for example. Or verify your identity on LinkedIn. In this way, they increase the dependency of consumers and they learn more and more about people. "Apple and Google are like the croupiers in this game. They deal the cards," says Roio.
The committed Italian software developer – he once taught himself programming to help in the fight against the mafia by hacking – fears that the EU is doing the wrong thing by being so hasty. Because the ID apps have to run on mobile phones, access to the operating systems is required. In the draft that has now been adopted, the American companies Apple (iOS) and Google (Android) therefore have the de facto role of gatekeeper, says Roio. Without their cooperation, European governments can do nothing. “We, Europe, ask those companies to open their infrastructure to us. We are not the owners ourselves.”
The alternatives he proposes will cause delays, he acknowledges. But as far as Roio is concerned, governments should not worry about that.
Trust required for use
Companies and governments will soon be forced to accept the EUID as a way to verify an identity online. Citizens will be allowed to choose whether they want to use it - as is the case in the Netherlands with DigiD. After a hesitant start, most people now choose to use this system because they trust it and because of its convenience. Roio does not plan to do that with the EUID, because of the objections he has to it, he says. "If it were to be mandatory, I would have a serious problem with it. Now I think it's all just a waste of money."
Hoepman has little confidence that the ID app will be embraced by citizens due to the haste that is being made, he explains by telephone, while it is so crucial that citizens trust the app 100 percent. If you make the app above all criticism, the developers are digging their own grave and the European digital identity is heading for failure in advance, in his view.
Because the option that is best for privacy has not been chosen, "the project makes itself vulnerable to social criticism, especially from suspicious quarters", fears professor Jacobs. Hoepman makes the same point.
Criticism of the introduction of a European digital identity has so far mainly come from political parties that are often already suspicious of governments. They see government initiatives for further digitalization as steps that make digital surveillance possible, and warn of 'China 2.0'. This debate was fueled during the corona pandemic, when digital vaccination certificates were used to determine whether people were allowed to enter restaurants or were allowed to travel.
There has been no healthy public debate on the European digital identity, Roio points out. “So far, only engineers are working on it,” he says. Publishing complex technical proposals is not the same as a real exchange of views on fundamental questions, such as what the minimum security of the wallets should be. “There has been no active attempt to involve civil society in the process.” He finds it a nasty thought that his feedback, which is intended to improve the EUID, could be hijacked by populist parties he strongly disagrees with. “But that should not be a reason not to talk about it.”
Jacobs believes that the move towards a European digital identity is such an important step in the right direction that he is not giving up hope yet, despite his fundamental objections to the technical choices. “ID wallets will become a new building block of European digital infrastructure.”
A spokesperson for the European Commission emphasizes that the technical specifications are a ‘living document’, but does not provide any explanation. Where Roio fears that design errors in the first phase of an IT project are virtually irreparable, Jacobs remains hopeful. “If all goes well, the identity wallets will be set up in such a way that they can be updated regularly. Not only for fixing software bugs, but also to renew the cryptographic mechanisms used. I will continue to strive for improvement.”