1

REPORT OF 13TH e-MOBIDIG MEETING, ROTTERDAM, 8-9 JULY 2015

SUMMARY

This is the report of the 13th meeting of the e-MOBIDIG EU working group for mobile solutions for the police, immigration, border control and similar enforcement agencies held on 8 and 9 July 2015 in Rotterdam. The meeting was kindly hosted by the Police of the Netherlands. e-MOBIDIG is a subgroup of the European Network of Law Enforcement Technology Specialists (ENLETS). Continued leadership of the group was made possible by funding that ENLETS receives from the European Commission's DG Home.

The meeting covered a broad range of issues from government, operational enforcement and industry and was well received by participants. Over several meetings of e-MOBIDIG, more mature and strategic solutions for substantial numbers operational users have become a more apparent, never more so than at this meeting. Large-scale rollouts offering significant change and benefit for operational users in police, at borders and in other enforcement services are now being delivered… increasingly the expectation will be on others to do the same, to deliver the efficient services expected of them. e-MOBIDIG aims to help European states to understand and adopt best practice in this area effectively.

Discussion in the meeting reported here included:

Mobile solutions in operational use—Netherlands Police (MEOS); Police Service Northern Ireland (PUMA solution) with Crossmatch; Finnish Border Guard; and the Greek maritime patrol (Interior Ministry); German Border Guard with Secunet on defining requirements for the future border guard solution; and EU EasyPass project.

The draft e-MOBIDIG paper on mobile security was presented as an initial draft to be revised, taking into account many useful points on security discussed during the meeting.

Electronic and mobile identity—Dutch chipped driving licence (RDW government agency); Eurosmart trade association with presentations from Veridos and Gemalto.

Industry presentations—IBM on their business partnership with Apple; and Microsoft on the developing trends in information technology and the implications for mobile solutions.

Rotterdam Seaport Police—optional visit following the main meeting.

e-MOBIDIG business—organisation and liaison with ENLETS; draft security paper; evaluation of Rotterdam meeting; the proposal is for the next meeting to be hosted by the Slovenian Police on 4 and 5 November 2015.

Also in this report: a List of the 50 participants at the meeting and a Glossary of terms used.

Many thanks to all who took part in and supported the meeting.

Frank Smith, Chair, e-MOBIDIG. frank@bidborough.com

The Police of the

Netherlands

2

MOBILE SOLUTIONS POLICE OF THE NETHERLANDS—MOBILE ENABLING FOR OPERATIONAL SUPPORT (MEOS) Edwin Delwin presented the mobile solution for the Police of the Netherlands, MEOS, being used

operationally for a range of front line police work such as authenticating someone’s identity, checking

vehicle details, entering a crime report or issuing a penalty notice. The solution is based on a handheld

smartphone.

Key principles emphasised in the design were:

Focusing the use of mobile solution on business benefit, e.g. improving and simplifying business

processes, reducing errors and duplication. “This is not about building apps, it is about improving

police work”, said Edwin Delwin. The use and benefit of the mobile solution is maximised by a

‘technology unless’ approach: provide an efficient technology-based solution unless there is a

good reason not to.

Closely involving operational police officers in the design of the solution—gaining buy-in and

producing a better solution that is fit-for-purpose. Two uniformed Dutch police officers

demonstrating the solution made a strong impression when one said ‘I use this operationally and

it is very good. I am proud of it… I helped design it’.

Making officer safety a prime consideration—if a name check on a suspect reveals a warning of

violence, the officer’s mobile will alert the officer discreetly with a subtle vibration.

Recognising that identification was a key challenge for operational policing so providing efficient

ways to check a claimed identity against a variety of IT-based records, e.g. police / criminal

records, voter records, vehicle / driver licence records, fingerprint searching of biometric

databases… federated searching available under a number of possible ways of requesting

information integrated onto the solution.

Re-using functionality wherever possible—for example the same transaction for a person search

is re-used in multiple police processes in the solution.

Considering changing legislation to enable better technology-based processes to be adopted, if

justified e.g. to enable an officer to generate a penalty notice without issuing paper at that time.

3

POLICE SERVICE NORTERN IRELAND (PSNI) Two representatives of PSNI (business and technical) described the new mobile solution developed for PSNI called PUMA (Providing Users with Mobile Applications). Previously UK police forces had had access to mobile fingerprinting; and also to mobile access to police information about persons of interest (criminal records, warrants for arrest, etc.). However joining the two together was awkward as the officer had to use one device to identify someone from the fingerprint using the police fingerprint system (IDENT1), producing a criminal records office (CRO) number if one existed; and then to input that CRO number manually into a second mobile device connecting to the Police National Computer (PNC) to discover what was known about the person. In addition in the case of Northern Ireland the fingerprint system in use there had been separate from the main UK police fingerprint system (IDENT1). Immigration fingerprint records might also be of interest to the police and vice versa but these too had been maintained separately. All police fingerprint records across the UK including the Northern Ireland collection had now been consolidated into IDENT1. The new mobile solution for PSNI, PUMA, has made a significant improvement over previous systems because having searched for fingerprints and obtained a ‘hit’ on IDENT1 (e.g. a CRO number), it automatically makes a further check on PNC and other local systems to find out what is known about the person, before reporting the combined result to the user. In effect the response can say ‘here is a summary of the information we know about the person you just fingerprinted’—a much faster and easier business process for the user. PUMA is proving effective and popular in initial operational use with PSNI. A full rollout will follow. It is also hoped that future UK services and infrastructure could improve, strategically. CROSSMATCH

Andrew Griffiths (business) and Vito Fabbrizio (technical) of Crossmatch, one of the contractors involved in the PSNI solution, spoke about some of the implications the kind of approach being adopted in Northern Ireland and the UK had for the design of mobile devices and supporting infrastructure.

There were a variety of possible use cases in this area including identification (who is this?), refugee management, authentication (is this who they say they are?) and enrolment to anchor future identification and authentication. The context was on increasing volumes of people, need for more efficiency and faster service, austerity on costs, a need for real business transformation, security, and an increasing use of biometrics to assure identity (and detect identity fraud).

Mobile platforms suitable for this environment needed high trust and integrity: that had implications for the platform, user, device, applications and the secure environment. Mobile Device Management (MDM) was also important to control efficiently a large number of devices in the field, ensure controls were in place and observed, software updates were applied correctly and access was controlled correctly. This needs a multi-layer security control (what is authorised when, for many different types of case) not a simple authorisation model (yes, or no). Various technologies were around to help implement such a model, authenticating and autorising access such as public key encryption and infrastructure (PKI), Kerberos, Security Assertion Markup Language (SAML) and secure elements to hold critical security data.

4

GERMAN BORDER GUARD—SELECTION OF MOBILE DEVICES

Mathias Grell of the German Border Guard described an exercise to determine a replacement mobile workstation for the current equipment, which will remain in use for some time, the Panasonic CF-U1 (photo). This device was described in the previous meeting and in use by Germany, Switzerland and Poland. This is fully supported but is no longer manufactured.

Business requirements were determined by the German Border Guard prior to Secunet considering the actual specification of equipment. A tender is planned for 2016/17.

SECUNET Lukasz Kubik explained the work Secunet had done to elaborate on the German Border Guard requirements, summarised as:

• Tablet-PC attached to the forearm

• Single digit fingerprint scanner connected by cable / USB

• Passport reading: MRZ scan via built-in camera; chip reading by built-in RFID with clip to hold document

• Mobile connectivity through the builtin WiFi and 3G/4G modules (including support for high power antennas in vehicles); in-car usage is also possible

• Environmental (IPxx) certification for all components; base unit designed to be used in difficult environmental conditions, e.g. bright sunlight and usable when wearing gloves

• Battery runtime > 8 hours

• Total weight should be just around 1KG

He presented a design concept as illustrated here based on an arm-mounted tablet…

MOBILE PASS

Bernhard Strobl of the Austrian Institute of Technology described

work in the MobilePass project under EU finding to investigate forms of mobile device for use by Border

Guards. It was notable to see the similarity with the work for the German Border Guard including a very

similar design concept to the one pictured above.

5

FINNISH BORDER GUARD

Pasi Nokelainen, Finnish Border Guard, updated the group on progress in rolling out

the new Finish mobile border control solution based on the Panasonic FZ-M1 tablet,

primarily for use is on trains from St Petersburg in Russia to Helsinki.

Security accreditation and testing of the operating system (for multiple users across the Ministry) and the

multi-component configuration for this use, and testing and configuring the remote access and

communication from the trains had proved slower and more complex than initially expected… essential

work, but a lesson learned that others might wish to bear in mind. He was also interested in

developments in configuration and availability of new peripherals discussed at the meeting. The new

border check application has been ordered and is due to be delivered in November 2015.

GREEK BORDER GUARDS PROJECT

Evangelos Sakkopoulos of the Greek Ministry of Interior described work

developed at the University of Patras for specialist maritime mobile

functionality, giving high visibility to shipping and background information to support maritime

operations in the waters surrounding the Greek mainland and islands. Considerable functionality and data

processing at the central facility selected and presented information needed by particular maritime units,

providing high quality information to those policing maritime waters and shipping. See also Rotterdam

Seaport Police, below.

GOOD PRACTICE PAPER ON MOBILE SECURITY

Frank Smith introduced the draft e-MOBIDIG good practice paper on mobile security and invited

comment and discussion. He thanked Arnoud Goudbeek of the Dutch Fiscal Intelligence and Investigation

Service (FIOD), a security specialist, for helpful written comments. Several important matters relating to

mobile security were raised and discussed during the course of the meeting. Frank undertook to revise

the paper to take all of this into account and to discuss further with Arnoud before presenting a further

draft to the group.

6

ELECTRONIC AND MOBILE IDENTITY

RDW—DUTCH CHIPPED DRIVING LICENCES

During 2014 the Netherlands began and completed the introduction of a replacement Driving Licence (DL), now permitted by EU Directive. Bas Berkhout (project manager) described the project to create and produce the chipped licence, which had some similarities with the EU / ICAO electronic Machine Readable Travel Document (eMRTD).

As with an eMRTD the decision was taken to require an optical scan of the card before the chip could be opened. This is tricky with eMRTDs on mobile devices where a Machine Readable Zone (MRZ) must be scanned. In the Dutch DL this was implemented as a QR barcode, given reliable QR readers for mobile phones. This was working well. The Dutch DL uses RFID to talk to the chip which is generally seen as more durable and less easy to use than a contact plate inserted into a slot on the reader.

The Dutch DL and MEOS mobile device for the police work end-to-end: a chipped DL has been created, and can be read securely on the police mobile reader in the same country.

EUROSMART—MOBILE IDENTITY

EUROSMART was represented by two speakers: Frank Schmalz (Veridos) and Patrice Plesis (Gemalto).

Frank pointed to the growing transition taking place from (1) identification documents such as the DL or passport being solely in physical form, to (2) including an electronic chip (well established for eMRTDs / passports; more recent for DLs); and increasingly on the horizon, to (3) being represented in secure electronic form on a mobile device such as a smart phone, nevertheless meeting the requirements for standards relating to secure chipped traditional documents.

Relevant standards in this area include:

ISO/IEC 18013—for electronic driving licences. A mobile ID device used as an electronic version of a physical DL would have to meet the same standard of functionality, security, trust, resistance to attack as the conventional physical version of the licence.

EU eIDAS Regulation 910/2014—this is an EU initiative for electronic ID.

Privacy by Design—an EU Mandate (M/530) being developed by CEN together with ETSI.

Security Framework, ISO 27000 series—common standard

Common Criteria, ISO/IEC 15408—this sets a framework for defining (in a Protection Profile) and certifying security properties of a particular type of product, e.g. a secure chip in a passport

A secure element or TPM may be required to store critical data such as private encryption keys to sign data. Not all national implementations deal with this kind of authentication and trust as rigorously. There is also an important need for interoperability, made harder when different variants are chosen by different countries; and a view should be taken on whether someone should be able to hold multiple secure identity / authentication tokens—could someone hold an ID card, passport, mobile ID card, mobile electronic passport (if created)? Does this increase the risk spare documents can be passed around to others?

Patrice said that work was under way for a new standard for secure electronic documents e.g. to deliver the equivalent of an ISO/IEC 18013 DL but on a mobile smartphone. This may recognise a graduated levels of trust with which identity can be authenticated, the least secure being based on simple username / password, up to very rigorous, high degree of assurance (to be defined).

7

INDUSTRY

IBM: MOBILE COLLABORATION WITH APPLE

Alan Thurlow of IBM described the partnership between IBM and Apple to provide mobile solutions focused on particular business sectors.

The partnership came about through the two companies recognising their complementary skills, aiming to deliver not just business applications but complete solutions that innovate to transform businesses, exploiting Apple’s mobile technology with IBM’s industrial-strength computing hosted on the cloud such as Watson, a natural language analytics engine. A fully developed solution will therefore address the applications and data but also the support environment with security, performance, and mobile device management, delivered as a managed service. A key area for development is where a new application can be targeted on a significant industry ‘pain point’… something that time and time again proves problematic, so users and businesses wish ‘if only there could be an easier solution…’.

A few reflections during Alan’s presentation… the IBM / Apple partnership is designed to make mobile solutions easier for a business, but the truth is mobile can be a long journey. Supporting multiple device types and at the extreme Bring Your Own Device (BYOD) can sound attractive, but can greatly increase the complexity of supporting different devices and therefore the cost e.g. of running far more testing.

MICROSOFT

Robert Hayes of Microsoft gave a broad overview of the radical changes taking place in technology and the implications this is having for mobile solutions and for governments and law enforcement. Changes include:

Universal social media—the glare of attention and the speed with which bad news can be propagated globally, 24 x 7, means organisations are on point to defend their actions all the time.

Internet of things—is radically expanding into completely new areas where technology is playing a part of our lives… how far does your imagination extend?

Mobile flexibility with central analytical power—mobile solutions now harness the enormous power of central databases, geo data mapping, analytics.

Global scale of operations—transcend traditional boundaries. Cloud computing provides location independence and concentrates vast, sharable computing power economically. Bob gave an insight to large-scale cloud computing: a unit comprising 3,000 processors on a lorry-sized unit, self-managing to bypass failed processors; replaced as a whole when required.

Global scale of criminality and cyber threats—crime groups operate on a global scale, hiding in more conducive countries, taking care not to alienate the local law enforcement agencies, focusing cyber attacks, botnet attacks and internet frauds on developed, affluent countries at scale and staying ahead of the policing in the target countries. Higher profit and lower risk. Commercial web services are available to sell virus and cyber attack products.

Industry and law enforcement can improve—international co-operation, business change to allow crime reporting over the internet, development of new operating systems and products that protect identity more robustly than before… next release of Windows comes out shortly.

8

ROTTERDAM SEAPORT POLICE

After the end of the meting there was an

opportunity for government, police, borders and

other enforcement staff to visit the Rotterdam

seaport Police, patrolling the largest port in

Europe and one of the largest in the world.

The range of challenges facing this specialist

branch of the Dutch Police was extensive,

including crime / policing, customs, maritime

enforcement, immigration and a wide range of

practical problems to tight operational pressures.

The Seaport Police are backed up by a range of

information systems for example displaying ship identifiers from the automated ship identification system

and giving ready access to further information about the ship and any previous difficulties encountered…

where necessary scrutiny is conducted by visiting or intercepting ships but a lot more assurance is

obtained by screening traffic remotely. Where intervention is required the police have powerful patrol

boats fitted with a range of technology, or can use a road vehicle to meet a vehicle arriving at a dock.

Some officers train professionally to operate the boats and can qualify as captains after 4 years’ training.

A significant difficulty has been accessing land-based mobile communications networks: whichever

network is selected, there will be some areas to be patrolled where there is no coverage. New mobile

communications equipment is just being installed which has multiple SIM cards giving access to all land-

based mobile networks surrounding the seaport. The equipment will automatically select whichever gives

best coverage and this means there should always be acceptable coverage over the entire patrol area.

This is enabling the boats to be fitted with all the real-time backup IT systems previously only available in

the control room on shore, which will be welcomed by the boat crews. ENLETS saw similar equipment for

land-based communications at the Security and Policing Exhibition in the UK in March 2015.

The visit was of interest to all participants but linked particularly with the presentation by the Greek

representative and other services where maritime operations are involved.

9

e-MOBIDIG BUSINESS ORGANISATION; LINK WITH ENLETS GROUP Frank Smith reported that the approach proposed at the previous meeting in Bern, Switzerland had been implemented. He was continuing to Chair the working group, now as a part-time contractor to the Dutch Police to run e-MOBIDIG as a subgroup of ENLETS. This was made possible by funding that ENLETS receives from the European Commission's DG Home. Frank confirmed he was working closely with the ENLETS Core Group co-ordinator, Patrick Padding also of the Dutch Police. The outcome of the Rotterdam meeting showed that the new arrangements were working successfully. REVIEW OF THE ROTTRDAM MEETING A questionnaire was issued to participants of which 36 (72%) of the 50 attending responded…

Very positive evaluation: 55% rated the meeting as very good; 42% as good; the remaining

respondent (3%) as OK.

Feedback from operational officers was particularly well received… more, please.

Useful thoughts and suggestions was given by participants which we will consider.

Seating arrangements (picture, below) had worked well for a large audience but more discussion

and opportunity to meet with different interests would be useful.

e-MOBIDIG website needs more promotion and faster update—being considered.

NEXT MEETING

Proposal from Slovenian Police to host next meeting on 4 and 5 November

2015. Welcomed: will proceed on that basis.

Key themes of integration and of sharing solutions were proposed; updates on

national solutions to promote wider understanding; completion of the security

paper.

We will write to potential participants again soon.

Comments and suggestions for the next meeting are, as ever, welcome from all concerned. Please

email frank@bidborough.com. Many thanks.

10

PARTICIPANTS 50 participants took part in the meeting…

Frank Smith Chair, e-MOBIDIG

Ad Van der Meijden The Police of the Netherlands—Meeting Host

Alessandro Alessandroni ISG Italia, Principal consultant

Jasper Andersson Swedish Police Authority

Bas Berkhout RDW Netherlands, Project Manager, chipped licenses

Stefan Danielsson Polismyndigheten (Swedish Police Authority), eMRTD Ops Manager

Edwin Delwen The Police of the Netherlands—Manager, MEOS mobile programme

Vito Fabbrizio Crossmatch

Marco Facchini Italian Ministry of Interior, Immigration / Borders

Laura Fenton BAE Systems, UK

John Flahive UK Home Office Biometric Programme

Juan José Álvarez García Spanish Police—Telecoms and Computer Unit

Arnoud Goudbeek Fiscal Intelligence + Investigation Service (FIOD), Netherlands

Mathias Grell German Border Guard

Andrew Griffiths Crossmatch

Lukasz Grudzinski Polish Border Guard

Robert Hayes Microsoft, Senior Director, Cybersecurity

Daniel Heeb Swiss Customs: head of unit for applications and data

Szabolcs Horvath FRONTEX, Joint Operations Unit, Air Border Sector

Alin-Alexandrou Iacătă Romanian Police, Central Unit for Information Analysis

Cor de Jonge Dutch Ministry of Justice

Ab Khaoiri Dutch Ministry of Social Affairs + Employment, Senior Investigator

Lukasz Kubrik Secunet

Torgeir Magnussen Norwegian Police

Isabel de Santo Martín Spanish Police, Head of Operative Group, Central Border Ops.

Stefan Maxwell UK Home Office, Biometric Programme

Robert Mortensen Danish Police

Pasi Nokelainen Finnish Border Guard, System Manager for Border Checks

Patrice Plessis EUROSMART (Gemalto)

Pawel Sadownik FRONTEX ICT Unit

Evangelos Sakkopoulos Ministry of Interior, Greece - Immigration Information Systems

Ragnhild Sandberg Norwegian National Police Directorate, ID-control

Frank Schmalz EUROSMART (Veridos)

Celina Sliwa-Tomaszewska Polish Border Guard

Marjo Van Seventer ENLETS / Dutch Police

11

Brendan Smith An Garda Síochána (Police), Ireland

Kristien Steensma Dutch Ministry of Social Affairs + Employment, Investigator

Martin Stettler Swiss Border Guard, Identification and Biometrics Service

Bernhard Strobl Austrian Institute of Technology (AIT) GmbH

Jeen de Swart Dutch Ministry of Justice

Alan Thurlow IBM

Andre Uuldriks Dutch driver / vehicle licensing agency (RDW), Unitmanager Rijbewijzen

Igor Vučko Slovinian Police, Information And Telecommunications Office

Stefan Wendt German Bundespolizeipräsidium

Anton Zbinden Swiss Border Guard

Sebastian Zehetbauer Austrian State Printing House

Two operational Dutch Police officers from the MEOS project and front-line policing

Two representatives of Police Service Northern Ireland, PUMA mobile project

Meeting support

Rina Wieringa Dutch National Police Academy

Maika Vandentol Dutch National Police Academy

Apologies

Paul van Musscher Chief of Police, The Hague, and National Policing Lead, Identity Portfolio. (Keynote address + welcome presented by Ad Van der Meijden)

Coralie Mesnard Gemalto, Mobile ID (presentation delivered by Patrice Plessis)

Cyril Murie Vice Chair, e-MOBIDIG

Patrick Padding Core Group Co-ordinator, ENLETS / Police of the Netherlands (represented by Marjo Van Seventer, ENLETS / Dutch Police)

12

GLOSSARY

Bluetooth Local wireless connection between two devices as an alternative to connection by cable

BWV Body Worn Video

BYOD Bring Your Own Device—employees are permitted to use their own (any) mobile device for business

Contact Card a card where communication is possible from a reader device via an electrical contact plate (in contrast to an RFID or NFC radio interface)

CEN Committee for European Standardisation (Normalisation)

CRO UK: Criminal Record Office [number]—the unique reference number for one person’s criminal record

COSI Standing Committee on Internal Security (senior level EU committee: secretariat provided by DG Home)

DG Home Directorate General for Home Affairs (European Commission)

DL Driving Licence

EES Entry / Exit System (European: proposed)

eIDAS Electronic Identification and Trust Services (EU initiative: regulation, task force, etc.)

e-MOBIDIG European mobile identification interoperability working group for police and immigration, etc.

eMRTD electronic machine readable travel document e.g. Passport, Residence Permit or ID card containing a chip

ENLETS European Network for Law Enforcement Technology Specialists, reporting to LEWP and COSI

ETSI European Telecommunications Standards Institute

EU European Union

FAP Fingerprint Access Profile - as SAP but exclusively for fingerprint accuracy. For mobile devices FAP 30 is good and FAP 45 is excellent.

FRONTEX EU Agency promoting co-operation on enforcement of frontiers (borders), HQ in Prague

HSM Hardware Security Module is a card or external device that safeguards and manages digital encryption keys for strong authentication and cryptographic processing, typically attached to a computer or network server

ICAO International Civil Aviation Organisation, HQ in Montreal, Canada

ICAO 9303 ICAO standard for e-MRTDs: Volume 2 of both Part 1 (Passports) and Part 3 (ID documents)

ID Identity / identification

IDENT1 UK police fingerprint system

IEC International Electrotechnical Commission—international standards body alongside ISO

ISO International Standards Organisation. See also JTC1.

JTC1 Joint Technical Committee 1 of both ISO and IEC. Standards are developed under JTC1 when both ISO and IEC have a significant interest, in the relevant Sub-Committee (e.g. SC17, cards and personal identification or SC37, biometrics) and their Working Groups. Such standards have the designation ISO/IEC [number].

Kerberos A network authentication protocol using ‘tickets’ to allow network nodes communicating over a non-secure network to prove their identity to each other securely

LTE Long Term Evolution—radio connection from a device to the network for 4G

MDM Mobile Device Management—a special purpose system used to (semi-) automate administering a large population of mobile devices, e.g. managing software updates, access rights, blocking lost or stolen units

MEOS Dutch Police mobile solution: Mobile Enabling for Operational Support

MRTD Machine Readable Travel Document—a passport or card conforming to ICAO 9303 at least to Part 1 (MRZ) so that it can be read automatically by a reader device. Does not necessarily contain a chip (= an e-MRTD)

MRZ Machine Readable Zone printed on the document (defined in ICAO 9303)

NFC Near Field Communication - similar to RFID

NIT Unit of measure of brightness of a screen in candelas per square metre (cd/m2)

NIST National Institute for Science and Technology: issued BPR on Mobile ID version 1, 2009. See: www.nist.gov/itl/iad/ig/upload/MobileID-BPRS-20090825-V100.pdf and www.nist.gov/itl/iad/ig/mobileid.cfm for revision from version 1 to version 2.

13

OCR Optical Character Reading of printed text by an automated reader, e.g. of an MRZ (ICAO 9303 Part 1)

PIV Personal Identity Verification standard for US Federal government employees + contractors (FIPS 201)

PKI Public Key Infrastructure

PNC UK Police National Computer—criminal records, wanted / missing, vehicle registrations and lost / stolen

PSNI Police Service Northern Ireland

PUMA Providing Users with Mobile Applications—name of mobile solution for PSNI

RDW Dutch government agency responsible for driver and vehicle licensing

RFID Radio Frequency ID -

SAML Security Assertion Markup Language—used to send security / trusted status from one system where a person is accepted to another system where for example he is unknown but is requesting access

SAP Subject Access Profile - concept / metric introduced in NIST BPR on Mobile ID for specifying the accuracy of a biometric reader or process for authenticating someone’s identity (see also FAP)

Secure Element A component e.g. in a mobile device used to store critical information such as private encryption keys, with an appropriate mechanism to control access, thus safeguarding its confidentiality. See also TPM

SIM Subscriber Identity Module—a card used in a mobile device. Contains a unique serial number (ICCID), international mobile subscriber identity (IMSI), authentification, cryptographic and services information, and a Personal Identification Number (PIN) and Personal Unblocking Code (PUK)

SSD Solid state Storage Drive: an all-electronic, solid-state data storage device able to store data permanently, equivalent to a conventional disk drive but with no moving parts—typically lighter weight

TPM Trusted Platform Module—standard for secure crypto co-processor, as defined by ISO/IEC 11889, introduced in 2009, now version 2.0 (2014). Can provide secure key generation, storage, crypto processing, authentication, etc. Relevant to establishing trust e.g. in mobile ID. See also secure element; HSM.

UK United Kingdom

UMTS Universal Mobile Telecommunications System: used to support the 3G mobile cellular system supporting the GSM standard

VPN Virtual Private Network: use of encryption and PKI authentication to provide a secure, private and trusted network connection even over a public network such as the internet