OECD Peer Review of E-Government in Denmark - ePractice.eu

the public or private sectors worldwide. It is very complex and costly to implement within
government, and also presents significant challenges in terms of equipping external users (both people
and businesses) with the required knowledge, software and/or hardware to use the digital certificates
that are the publicly visible manifestation of the technology. To date, PKI implementations in OECD
countries have been challenged by their complexity, risk and high costs, which become especially
acute when the size of the PKI user base is expanded beyond relatively small numbers.
PKI is an area of e-government where some significant failures have been seen in recent years.
This is not the case in Denmark, which has recently implemented a working government PKI and is
making ever increasing use of digital signatures in delivering services to both individuals and
businesses. Under the leadership of the Joint Board of e-Government, development of the PKI and
public sector adoption of digital signatures have been key parts of Project e-Government.
In late 2001, following passage of Denmark’s electronic signature legislation in 2000, the Joint
Board took a major decision that free software-based digital signatures would be offered to citizens
and businesses. Based on the results of digital signature pilot projects initiated by the Ministry of
Research and Information Technology in 1998, the MVTU put in place a project to establish the
necessary technological and organisational framework required for the introduction and use of digital
signatures (i.e. to develop the PKI). Through a project called OCES (Offentlige certifikater til
elektronisk service – Public Certificates to Electronic Services) the MVTU, with the support of the
National IT and Telecom Agency (ITST), set out to create a PKI that would enable:
• An accessible, effective, secure and inexpensive digital infrastructure for citizens, businesses
and public authorities.
• An innovative and co-ordinated implementation of government ICT initiatives.
• Optimal and secure use of ICT and other technologies by citizens and businesses.
Key project activities included establishing standards for digital certificates used to communicate
with public authorities, creating contracts for implementation of the PKI and providing support to
public authorities in implementing digital signatures. By 2003, OCES standards for the production and
management of digital certificates had been developed, and TeleDanmark A/S (TDC) had been
selected as the supplier of these certificates and the supporting PKI infrastructure and management
services to government. It is worth noting that a pragmatic decision was made to make
OCES-approved certificates software-based and “non-qualified”, which means they are not included
under the provisions of the Act on Electronic Signatures and consequently need not meet requirements
for face-to-face identification when applying for a certificate; something that had been an obstacle to
take-up of digital signatures in Denmark.
Now that the PKI is implemented, the ITST is focused on regulating the PKI provider and
providing guidance and advice to public authorities and the public on the implementation and use of
digital signatures. To do this it has established a Web site (www.digitalsignatur.dk) offering
information targeted to the needs of both groups. This includes an explanatory video presentation on
digital signatures, marketing material for public authorities to use in promoting digital signatures, and
guidelines on digital signature implementation. In addition to maintaining the Web site, the ITST also
provides active consultation and guidance for digital signature implementation projects. This guidance
has proved very important to the introduction of digital signatures in Denmark. As the OECD survey
shows, it is the second highest area of State government provision of e-government guidance (see
Figure 6.4).
95