{"id":136721,"date":"2023-12-08T15:34:59","date_gmt":"2023-12-08T15:34:59","guid":{"rendered":"https:\/\/www.techopedia.com"},"modified":"2023-12-13T12:49:18","modified_gmt":"2023-12-13T12:49:18","slug":"eidas-2-0-controversies-a-real-threat-to-internet-freedom","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/eidas-2-0-controversies-a-real-threat-to-internet-freedom","title":{"rendered":"eIDAS 2.0 Controversies: A Real Threat to Internet Freedom?"},"content":{"rendered":"
After years of negotiations between the major European regulators, the European Union is enacting a new set of digital identity rules: eIDAS 2.0<\/a>.<\/p>\n The aim is to provide a shared framework to ensure security and control over digital ID data at the continental level instead of relying only on national solutions.<\/p>\n However, a controversy stemmed between the key EU legislative bodies and several civil society groups, including the free software community Mozilla<\/a>.<\/p>\n According to Mozilla, there’s a serious concern about the balance between the control power provided to the ‘government-approved’ Certificate Authorities<\/a> (CAs).<\/p>\n Browsers will be left with very little range to apply any countermeasure in a situation where CAs can potentially start surveilling people.<\/p>\n What are the foundations of eIDAS and the reasons for revising it? Why are these revisions so controversial? How is the future of digital IDs in Europe going to evolve? Let’s try to find an answer to all these questions to obtain a clearer picture of what’s going on.<\/p>\n eIDAS is a regulation<\/a> that established a shared framework between all 27 European Union (EU) countries for safe and efficient business electronic interactions.<\/p>\n Its acronym stands for “electronic Identification, Authentication, and trust Services,” and it was passed in 2014. eIDAS regulates all forms of electronic identification (eID), such as electronic signatures, digital certificates, and electronic seals, as well as trust services for electronic transactions within the EU market.<\/p>\n The purpose is to provide a safe way for individuals and businesses to transfer electronic funds or perform transactions without needing paper-based documents.<\/p>\n The European Commission established eIDAS as part of the broader Europe’s Digital Agenda. Its implementation aimed to drive innovation and information security by focusing on interoperability and transparency while conducting cross-border business. eIDAS constituted the regulatory framework under which several components of the Digital Agenda eventually fell. Among these, some of the most important ones were:<\/p>\n Fast-forward to a decade later.<\/p>\n On February 9, 2023, the Industry, Research and Energy Committee (ITRE) adopted a revision of the eIDAS that would change several aspects<\/a> to adapt it to the changes in technologies in the years since.<\/p>\n The changes recommended in the ‘eIDAS 2.0’ include several aspects of the original regulation \u2014 these range from privacy and security to cross-border identification, digital identity wallets, and QWACs.<\/p>\n While most of these revisions or updates were accepted nominally, the change in QWACs and establishing of government-endorsed Certificate Authorities (CAs) was widely condemned by groups of cyber security experts, NGOs, and researchers. The main subject matter of the dispute is, in particular, Article 45.<\/p>\n Hundreds of globally respected cybersecurity experts, NGOs, and several industry organizations such as Cloudflare, the Linux Foundation, and Mozilla vocally asked the EU lawmakers<\/a> to take a step back on eIDAS 2.0.<\/p>\n According to them, the updated proposal seriously threatens privacy and human rights since it can potentially undermine online security and allow governments to conduct unwanted surveillance operations on encrypted internet communication.<\/p>\n Let’s try to untangle the knot and understand all this.<\/p>\n First, we need to understand what a quality certificate is. Whenever we check a website that is using a secured Hypertext Transfer Protocol<\/a> (HTTPS), we can see a small padlock on the left of the URL.<\/p>\n That padlock indicates that all communications between the web browser and the server are secure since the identity of the server has been authenticated.<\/p>\n This is particularly important to prevent man-in-the-middle attacks with malicious entities intercepting network traffic and faking the user’s actual destination.<\/p>\n But who decides when these connections are secure and can, therefore, be trusted? That’s where CAs come in \u2013 intermediators who release the certificates, and they are verified by hosts and browsers to ensure that when they release a certificate, it can be trusted.<\/p>\n These CAs are where the European Commission wants to intervene. According to the proponents of the EU regulation changes<\/a>, browsers are both controllers and controlled, centralizing too much authority in their hands. They are the ones who vet the certificates and issue them to cloud hosting services, owning much more power than intended.<\/p>\n On top of that, the European Signature Dialog argues that the rules established by browsers to determine when a certificate is valid are subjective and potentially exist simply to promote their commercial interests.<\/p>\n The answer that would move this excessive power from their hands to the hands of governmental authorities is, indeed, QWACs.<\/p>\n These certificates will replace those issued by CAs and will add another layer of transparency to show who the operator and legal owner of the website are.<\/p>\n According to opponents of Article 45 of eIDAS 2.0, however, this change is not just bad, it’s terrible.<\/p>\n QWACs will be issued by CAs that will be endorsed by governments rather than private corporations. This would be a very good thing when it comes to issuing certificates to government-issued identities, such as governmental websites and services. However, when it comes to the vastness of the internet, things can become a little bit sketchier.<\/p>\n The root certificates controlled by CAs (whether they are government-endorsed or fully private entities) provide the authentication mechanisms to ensure that the cryptographic keys used by that website are the property of that website alone.<\/p>\n This means that whoever owns the root certificate can intercept that website’s traffic by substituting its cryptographic keys with others owned by them.<\/p>\n This is extremely dangerous, as there are several cases in which national governmental-backed CAs allegedly used this tactic to spy on citizens both inside Europe \u2014 such as in France<\/a> \u2014 and outside of it, such as in Kazakhstan<\/a> or Turkey<\/a>.<\/p>\n Even when it’s not the government spying on citizens, governmental CAs could be the target of attacks from malicious entities, as when a Dutch CA was hacked<\/a> to intercept the internet activities of Iranian users.<\/p>\nWhat is eIDAS, and What Does 2.0 Entail?<\/span><\/h2>\n
\n
Which Part of eIDAS is so Controversial?<\/span><\/h2>\n
Why Could Article 45 be Dangerous to Internet Freedom?<\/span><\/h2>\n