Electronic trust services: a radical change in our lives

Original article published in Expansión, on 12/01/2022

Electronic trust services are a set of highly regulated and controlled services by EU governments related mainly to the identity of individuals and companies. The main objective is to ensure that digital interactions between them meet all necessary technical and security procedures to ensure that digital identities and information shared electronically are real, confidential, and trustworthy.

But how do you guarantee trust in these services? “At various levels. In the first place, there is a set of technical regulations developed by international, European and national standardization bodies that define in detail the mandatory requirements to be able to provide these services, both at a technological, management and security level. Secondly, the Government obliges companies and organizations that want to offer them, also known as Qualified Trusted Electronic Service Providers or QTSP (Qualified Trust Service Providers) to be approved, carrying out a series of audits that verify that products, infrastructures and organizations comply with these regulations and standards.Finally, both the Spanish Government and the EU publish a list with the set of certified companies, which allows anyone to directly check the validity and status of approval of each service and provider”, explains Pere Barba, CTO of Víntegris, the company that, since 2004, manufactures innovative systems and applications for the digital certificates management, legally binding digital signatures and strong authentication. These services are used around the word by the main banks, insurance companies, health and retail companies, government and public sector.

The best-known services and transactions are the issuance of digital certificate services or electronic signature, but the list is much longer and includes many of the aspects that cover the communication process between two parties (people and organizations) in digital environments, primarily the Internet, such as electronic notifications or time stamps. “In any case, the list of trust services evolves and grows to adapt to market developments. Recently, for example, the remote identification service that allows the creation of digital identities with the same value has been approved in Spain, allowing the authenticity of people and organizations to be guaranteed in digital ecosystems with absolute confidence.This new situation represents a radical paradigm shift. In fact, for the first time it is aligned from an operational and legal recognition of the interaction capacity of people in the digital world and in the metaverse with the physical world”, comments Barba.

This trusted remote identification process is a video identification process, similar to the one that the banking sector has been using for some years, but with a series of improvements and additional controls that make it possible to ensure the identity of people with greater guarantees. These controls include the use of biometric technology that certifies the authenticity of the documentation presented and its correspondence with the applicant’s facial features, a proof of life that guarantees that pre-recorded videos are not being used, a validation against the data verification service. and documentation from the National Police.

“Additionally, the set of evidence resulting from this process is reviewed by the service provider before authorizing the creation of the digital identity and enabling the person to interact with the rest of the ecosystem members”, points out the CTO of Víntegris. And he adds that, “this process represents a before and after in the digital transformation capacity that companies and public administrations can offer to citizens, since until recently physical presence was necessary for all procedures with a minimum of implications legal or the possibility of fraud, which limited the ability to transform processes and procedures to those with a minimal legal burden”.

With remote identification service’s creation and approval also known as qualified video identification, the door is opened to the creation of solutions that allow interaction between people, organizations and public administrations that are one hundred percent remote, digital and reliable. For this reason, the range of procedures that can be done digitally from now on opens to “Practically all the paperwork can be processed,” says Pere Barba. “With the Public Administrations, for example, there are still an endless number of operations that require citizens to travel to the town halls, councils and ministerial agencies, among others. Today, trust services already offer all the necessary elements so that these procedures can be digitized, improving the efficiency of these organizations and saving the time invested in travel and generating savings in carbon footprint unprecedented up to now. On the other hand, the possibility of issuing remote electronic certificates is also introduced, which means savings in time and money, not only for citizens, but also for many companies and self-employed professionals who can, with this new tool, introduce electronic signature processes with the highest legal recognition in a very simple way and any situation”.

As in many other technological scenarios, the main challenge is to educate all parties about the risks of incorrect or uncontrolled use of our identity in the digital world. “From here, it is important to know how to identify organizations and companies that offer approved trust services, since they represent the only real mechanism that allows us to guarantee that the digital transformation of our society is done by guaranteeing our rights as EU citizens and the reliable treatment of the data that we share among ourselves and with third parties.In the same way, it is important to be wary of companies that manage our data without any type of supervision and that either do not meet the security criteria necessary to guarantee the custody of our data, or they can share them for economic purposes. You must constantly look for the Electronic Provider of Qualified Trust Services label, – concludes Pere Barba, CTO of Víntegris.