June 25, 2024
The Agency for Identification Documents, Registers, and Data Exchange of Bosnia and Herzegovina (IDDEEA) would like to once again inform the citizens of Bosnia and Herzegovina and the public about the inaccurate claims that have been reiterated regarding our services of digital identity and electronic signature.
Namely, for the second time, the Ministry of the Interior of Republika Srpska (MUP RS) has issued statements regarding digital identity and electronic signature, although according to the Law on Police and Internal Affairs of RS, they are not responsible at all for the mentioned topics, nor are they authorised to perform any tasks related to digital certificates or digital signatures. Therefore, it is not surprising that they persistently spread misinformation, thereby confusing the citizens of Bosnia and Herzegovina with untrue information.
At this point, we take this opportunity to invite them, as well as other interested parties, despite their lack of competence but only curiosity, to contact IDDEEA so that we can clarify and respond to any questions and doubts regarding the aforementioned matter. This is the best way to protect the citizens of Bosnia and Herzegovina, as it is evident in this case that ignorance has become active, which is highly dangerous.
In their statements and information, intentionally, unintentionally, or out of extreme carelessness or ignorance, MUP RS interprets IDDEEA responsibilities as it suits them. For the sake of proper interpretation, we must remind MUP RS that Article 8 of the Law on the Agency for Identification Documents, Registers, and Data Exchange of Bosnia and Herzegovina (IDDEEA) states, among other things, that:
- The Agency proposes and implements the development strategy and policy in Bosnia and Herzegovina in the field of identification documents, in line with ICAO 9303 and other relevant standards.
This means that IDDEEA is fully competent for all activities related to identification documents, both in line with the ICAO standard and all other relevant standards.
- It maintains and manages databases where data from registers defined by this law and information systems are stored, enabling access to these registers.
- It provides adequate infrastructure, special working conditions, data protection, and other technical prerequisites for the uninterrupted functioning of databases under its jurisdiction and those under the jurisdiction of other ministries, institutions, and bodies upon their request and in compliance with the law.
Therefore, IDDEEA is fully competent for databases and all registers defined by this law.
- It establishes standards for equipment to be procured and used by competent, receiving, and source authorities in the process of data processing and exchange in compliance with this law.
- It establishes standards necessary at locations where access to the central data exchange system is made to ensure the security and protection of data and systems.
IDDEEA is responsible for digital signing in the field of identification documents, specifically electronic certificates and electronic signatures related to identification documents, in compliance with the law regulating electronic signatures.
Subject to the current Law on Electronic Signatures of BiH as well as the valid Law on IDDEEA, all types of digital signing and electronic certificates related to identification documents fall exclusively within the jurisdiction of IDDEEA, regardless of how they are named.
In one part of the statement, MUP RS states: “We remind that there is no legal framework at the level of BiH for establishing digital identity in compliance with the current EU regulations, so before any activities related to digital identification and trust services, it is necessary to harmonise the legal system with EU regulations adopted at the level of the European Union this year. Digital identity is closely related to information security, and there is no legal regulation in BiH in this area, significantly increasing the risk of data misuse.”
On the other hand, we take this opportunity to remind MUP RS, as well as the citizens of Bosnia and Herzegovina, of certain events from the recent past that are completely contrary to what MUP RS is falsely claiming:
- As early as 2018, we were informed that RS was establishing a National Centre for Managing Digital Identities, costing citizens 2.8 million BAM. The result was intended to enable citizens to handle internal and state administration matters without signatures and stamps. The former director of the RS Agency for Information Society, Mr. Rajčević, stated: “We have been waiting for this for ten years since the adoption of the Law on Electronic Signatures, and electronic signatures will now be widely applicable in practice for the first time. This is the beginning of the digitalization of Republika Srpska, which is necessary for us. Once we complete this project and issue digital certificates on smart cards, people will possess a digital identity, a personal digital card. With this, they will be able to conduct all electronic administration tasks with administrative authorities and conclude contracts electronically.”
2.8 Million BAM without signatures and stamps
We would like to ask MUP RS if they responded to this in 2018, as we cannot find any information on it! Are these services active for citizens of Bosnia and Herzegovina living in RS? Were these services funded from the RS budget? Does, as you claim, legal regulation exist at the BiH level for the above-mentioned digital personal card, digital identity, and digital certificates on smart cards that are issued or planned to be issued in RS?
In 2020, the RS Government published a “Price List for Fees for Electronic Certification Services of the Certification Authority.” According to this price list, the fee for issuing a qualified electronic certificate for electronic sealing by administrative authorities, firms, and entrepreneurs is 1,000 BAM. It is defined that citizens must pay 150 BAM for issuing a qualified electronic certificate for an electronic signature.
We ask the MUP RS: Who approved the body’s certification? We assume you are aware that, under current international regulations and standards, only one accreditation and supervisory body is recognised in each country. Without international traceability, authentication cannot be proven, which means users are misled. How is international traceability of certificates ensured, i.e., by the certificate authority and supervision? Are the solutions offered by IDDEEA, which are free or priced at 0 BAM for people in BiH, genuinely a “problem” that is leading MUP RS to unjustly interfere with the work of the state Agency?
HALCOM, as a certification authority operating throughout Bosnia and Herzegovina, offers the possibility of creating a digital identity, issuing an electronic signature on a smart card, USB key, or in the cloud.
https://www.halcom.com/ba/kvalifikovana-digitalna-potvrda/
Certain banks in Bosnia and Herzegovina have publicly advertised and created digital wallets that process citizen data, including JMB and biometric data (iris scans, fingerprints, etc.). We are curious as to whether there is a legitimate justification for these services to be established in these cases, as well as whether there has been any acknowledged concern for the security of the personal information of BiH citizens.
We would like MUP RS to send us their statements and information for these cases, as we could not find them. We wonder why MUP RS only objects to IDDEEA.
Finally, we remind that competent authorities, such as MUPs of KS, USK, and BPK, have publicly expressed their support for the work of IDDEEA in the processes of issuing electronic certificates and their readiness to support further digital transformation steps and activities as well as tasks pertaining to electronic signatures. We would like MUP RS to address the aforementioned queries. Only after receiving answers to these questions will we consider all other information that the incompetent MUP RS disseminates to the public, and thereafter we will pose new questions, much more specific and precise.
IDDEEA BiH