About the project
Systems for electronic identification (eID) play an increasingly important role in the digitalisation of society. Through the use of eID, both citizens and businesses can access a wide range of public and private services, including reporting to tax authorities, viewing health information, conducting payment transactions, transferring property, and signing loan agreements. As a "universal key" to societal participation, lack of access to eID can lead to digital exclusion, while misuse of eID can have serious financial and legal consequences for individuals, businesses, and society as a whole.
The interdisciplinary collaborative research project Societal Security and Digital Identities (SODI) has examined how the risks associated with both exclusion and misuse of eID can be prevented and managed through an interplay between legal and technological solutions. The aim has been to contribute to safer and more inclusive digitalisation.
Results
The project has focused primarily on eID systems in Norway, with comparisons to similar solutions in Estonia. The project has been carried out by researchers from several research institutions in Norway and Estonia, in close collaboration with public authorities, private actors, and civil society organisations.
A key element of the project has been the establishment of a legal aid clinic called the ID-Lawyer. During the period 2021–2024, the ID-Lawyer provided free legal aid to individuals who were either denied access to eID or been exposed to identity theft and digital fraud. This legal aid work has provided the researchers with valuable insight into how eID-related problems arise in practice, which groups are affected, and what rule-of-law challenges users face when dealing with both private and public actors. The clinic has collected data for the project and provided unique insights into the problems caused by the transition from physical to electronic identification, who is affected, and what consequences it has. The ID-lawyer has directly contributed to increased legal security, regulatory compliance, and legal development, for example, by reporting findings directly to supervisory authorities and bringing several principle cases before the Financial Complaints Board, as well as one case before the Supreme Court. Approximately 200 unpublished district court judgments on eID misuse have also been collected, and a representative survey has been conducted.
The technical research within the project has developed methods for analysing vulnerabilities in eID systems, including by studying the interplay between technical solutions and human behaviour. Through laboratory testing of possible future eID solutions and advanced security analyses, the project has contributed to increased understanding of the overall technical risk in digital identity systems.
The legal research has, among other things, analysed who bears the losses resulting from eID fraud, what obligations eID providers have, how anti-discrimination rules apply in cases of lack of access to eID, and what legal consequences digital identity violations may have in different contexts.
In the final phase of the project, in close collaboration with the projectʼs partners, a normative framework for holistic, secure, and inclusive digital identity governance was developed, including more than 100 concrete recommended measures. The project has also placed strong emphasis on dissemination, including through conferences, open seminars, and dialogue with public and private actors, to ensure that the research results are put to practical use.
The projects main pages is in Norwegian.
.jpg)
