What Will Happen to Your ID Card in Case of Suspension of the Electronic Identification Certificate? 0 17

The Ministry of the Interior proposes to establish that if the qualified electronic signature certificate or electronic identification certificate included in the identity document is revoked or its validity is suspended or terminated, the identity document will remain valid for in-person identification and legal status.

It is assumed that the holder of the identity document will retain the ability to apply for alternative means of electronic signature, including using the identity document as a valid identification document even if the certificates included in it are revoked, suspended, invalidated, or their validity is terminated, and if the identity document has not become invalid for other reasons.

Changes are necessary as there is a risk that the qualified electronic signature certificate or electronic identification certificate included in the electronic ID card may be revoked, suspended, and become invalid during the validity period of the electronic ID card.

In Latvia, electronic ID cards are mainly issued with a validity period of ten years; however, the European Parliament and the European Council adopted regulations two years ago stating that the validity of the certification of qualified signature creation devices (QSCD) cannot exceed five years, provided that vulnerability assessments are conducted every two years. If vulnerabilities are detected and not addressed, the QSCD certificate is revoked. Thus, in Latvia, the validity period of electronic ID cards and the associated electronic signature is longer than what is required by European Union (EU) regulations.

The Ministry of the Interior explains that previously there was no unified time limit for QSCD certification among EU member states, and it was assumed that the product should be certified at least at the time of its issuance, rather than throughout its entire period of use.

For the chips with software used in the current electronic ID cards provided by the Office of Citizenship and Migration Affairs (OCMA), the QSCD certification was provided by the identity document supplier, and it was certified by a French certification body.

However, the OCMA acknowledges that there are several potential risks if QSCD recertification for identity document chips is not possible or a vulnerability is discovered. For example, the chips of issued electronic ID cards or even the blanks of identity documents stored at the OCMA may lose QSCD status; the compliance of electronic signatures created using such identity documents with QSCD may be questioned, as well as the validity of the transactions confirmed by them; addressing the identified vulnerabilities of QSCD identity documents cannot be achieved solely through software patches for the chip, so the OCMA would have to provide new identity documents with chips that have valid QSCD certification, which, in turn, would create a greater additional burden related to customer service and costs.

In such circumstances, it has been decided to amend the law so that electronic ID cards can always be used at least as a document for in-person identification.