trans european petitions and the eci - pep-net summit

E-Petitioning systems

European specific aspects

Peter Cruickshank

International Teledemocracy Centre

Edinburgh Napier University

@spartakan

1www.EuroPetition.eu

PETITIONING IN EUROPE

Language and


Political dialog in the EU

Multiple languages

Need for single dialog


LPS = Local & Euro Petitioning System

€CA = Euro Cluster Admin

€CA €CA€CA €CA €CA

European

Parliament

European

Commission

Euro Institutions

English English English English

SpanishEnglish Swedish Italian Dutch

= Euro Flag button

LPS LPS

LPS LPS

UK

LPS EPS

NetherlandsSpain

LPS LPS

LPS

Italy

LPS

Sweden

EPS

EuroPetition translated into English to

check for duplicates across all Euro clusters

Translation of EuroPetition back into

Local language to collect signatures across 5 regions

A EuroPetition checked locally

with help of local Euro cluster

Once a EuroPetition closes

it can be presented to Euro Institutions

EPS = Euro only Petitioning System

The Journey of a EuroPetition

www.EuroPetition.eu

The journey of a Europetition

Citizens see petitions and dialog in their own language

Petitioners still have to use English as common language

They are responsible for coordinating local translations

Cluster coordinators can help petitioners but cannot become too involed


EUROPEAN CITIZENS INITIATIVE

Aspects of the

www.EuroPetition.eu6

ECI Process


Organiser e-ECI system provider

Think of subject for

ECI

Find online ECI

system

Submit ECI and

name service provider

Basic Approval of wording

of ECI

OK

Set up ECI

(multilingual) Configure online

system

Collect paper

signatures

Obtain certification

Collate signatures by

country etc

National Competent Authorities

Give

certification

Collate e-signatures

by country etc Validate signatures according to

national practice

Target reached (in time)?

Collate certificates & submit to Commission

Verify submission

conditions met

YES

Into legislative / policy process

Advanced e-signatures

Collect e-signatures

Certificate Ref

Log Rejection reason

Record on system

ECI number, admin access

Translations

Approx 100,000 signatures

Target not reached

Confirm wording acceptable

Formal & informal

agree‟t processes

Destroy records

within onemonth

To Commission

?

European

Commission

ECI Process




ECI

Find online ECI

system

Submit ECI and



of ECI

OK

Set up ECI


system

Collect paper

signatures



country etc


Give

certification



national practice



Verify submission

conditions met

YES




Certificate Ref


Record on system


Translations


Target not reached


Formal & informal

agree‟t processes

Destroy records

within onemonth

To Commission

?

European

Commission

What is a system?How is it

approved? By whom?


Quality Audited Business

ECI application designed built

and tested

Registered with Data Protection

Authorities

Apply for certification(Art 4)

Functionality tested by National Competent Body

System certified(And certification logged and made visible somehow)

Registrations verified by National Competent Body

Registration of ECI system under Art 6.4

ECI Process




ECI

Find online ECI

system

Submit ECI and



of ECI

OK

Set up ECI


system

Collect paper

signatures



country etc


Give

certification



national practice



Verify submission

conditions met

YES




Certificate Ref


Record on system


Translations


Target not reached


Formal & informal

agree‟t processes

Destroy records

within onemonth

To Commission

?

European

Commission

Will the EC allow unofficial

translations?

How to audit signatures?

What can be used from e-petitioning systems?

A quick look at security…


Journey of an ECI signature

www.EuroPetition.eu14

National Identity

Database(s)

Se

cu

re

Sto

rag

e

Certified,

tamper-proof

records

Signature

records

Va

lida

tion

By N

atio

na

l Au

tho

rities

10

0%

or s

am

ple

ba

se

d

Certification

Authority

eg Verisign,

EuroPKI

Ve

rifi

ca

tio

n

First line verification

Handwritten

Signature

Confirmation

emailOther

methods

Identity

Spam checks

CAPTCHA etc

Record

signature


• Verification is conceptually split between

• Authentication: proving who you are

• Authorisation: whether you are entitled to sign

• But in practice it seems best to start with the two together. A range of authentication techniques can be used.

• A statistical approach can be taken

• Storage should ensure data retains integrity and is auditable, confidential and available to authorised

users only

– And the minimum required should be used

– How much auditability is needed?

The ECI and Information Security

• Protecting privacy

• Is too much information currently required?Confidentiality

• Protection from accidental or deliberate (malicious) modification – where?Integrity

• …for legitimate users

• How defined?Availability

• who are you – supports non-deniabilityAuthentication

• what can you do? Are you an EU citizen?Authorization

• Key to non-repudiation. How can this work if signature records must be destroyed?Auditing

CONCLUDING NOTES

The ECI


Some thoughts and issues

• The process has more in common with e-petitions than e-voting

• A ECI system is the technology-in-use – it‟s the organisation providing the ECI that matters. Just checking code is a diversion.

• The system must be online – but allow for multichannel , multilingual campaigns, including the use of paper

– dealing with campaigns and initiatives in multiple languages has to be at the core of the system. It is unacceptable to force citizens to work in English.

• Data protection/privacy is central– Data Protection Directive should act as the basis for the security requirements

– including different application of the law in Member States

• Signature verification…– I‟d prefer a loose checks on who can sign, with tighter (statistical) checks later on

– relationship to electoral registers or national identity databases

– verification must be auditable

• Need for standards for recording and sharing details of Initiatives– to share, compare and campaign across systems

– along the lines that have been discussed for e-petitions in England


Some questions

•Will they be reserved to the big lobbying organisations?

•What set up will support the „little people‟

Who will run ECI campaigns

•What is meant by „system‟

•What process can certify it?

ECI systems providers

•Role for national/ regional clusters

•Wordings will appear on official ECI website

•Can EC avoid responsibility?

Clustering & Translations

•To share, compare and campaign across systems

• standards for recording and sharing details of ECIsECI as service


Helping shape the ECI

ECI Campaign

http://www.citizens-initiative.eu/

Current timeline

•30.9. AFCO/PETI meeting with National Parliaments (COSAC)

•5.10 EP: expert hearing with Sylvia-Yvonne Kaufmann and Prof. Jürgen Meyer

•8.11. AFCO discussion of the draft report

•November PETI and AFCO adopt their reports•October / November: trilogy negotiations on basis of the draft report

ECI Board

Jan Linhart

http://www.youreci.org/

Focus on the “e-” aspects of ECI

Call for papers/suggestions for improvement by 4 October





http://www.youreci.org/

trans european petitions and the eci - pep-net summit

News & Politics