E-government: from hype to reality

1
E-governmentfrom hype to reality
Frank Robben General manager Crossroads Bank for
Social Security Sint-Pieterssteenweg 375 B-1040
Brussels E-mail Frank.Robben_at_ksz.fgov.be Website
http//www.law.kuleuven.ac.be/icri/frobben
Crossroads Bank for Social Security
2
What is E-government ?

• E-government is a continuous optimization of
  service delivery and governance by transforming
  internal and external relationships through
  technology, internet and new media
• external relationships
• government lt-gt citizen
• government lt-gt business
• internal relationships
• government lt-gt government
• government lt-gt employees
• all relationships
• are bidirectional
• can be within a country or border-crossing

3
Government

• not monolithic
• EU
• in every country
• federal level
• regions
• communities
• provinces
• municipalities
• parapublic institutions
• private instutions participating in delivery of
  public services
• integrated E-government is based upon common
  strategy, multilateral agreements and
  interoperability
• E-government contains the opportunity to realize
  one virtual electronic government with full
  respect for every specific competence

4
Advantages

• efficiency gains
• in terms of costs same services at lower total
  costs, e.g.
• unique information collection using co-ordinated
  notions and administrative instructions
• less re-encoding of information by electronic
  information exchange
• less contacts
• functional task sharing concerning information
  management, information validation and
  application development (distributed information
  systems)
• in terms of quantity more services at same total
  cost, e.g.
• all services are available at any time, from
  anywhere and from any device
• integrated service delivery
• in terms of speed same services at same total
  cost in less time
• reduction of waiting and travel time
• direct interaction with competent governmental
  institution
• real time feedback for the user

5
Advantages (ctd)

• effectiveness gains
• in terms of quality same services at same total
  cost in same time, but to a higher quality
  standard, e.g.
• more correct service delivery
• personalized and participative service delivery
• more transparant and comprehensive service
  delivery
• more secure service delivery
• possibility of quality control on service
  delivery process by customer
• in terms of type of services new types of
  services, e.g.
• push system automatic granting of or information
  about services
• active search of non-take-up using
  datawarehousing techniques
• controlled management of own personal information
• personalized simulation environments

6
E-government a structural reform process

• ICT is only a means by which a result may be
  obtained
• E-government requires
• considering information as a strategic resource
  for all government activity
• change of basic mindset from government centric
  to customer centric
• re-engineering of processes within each
  government institution, each government level and
  across government levels
• clear definition of mission and core tasks of
  every governmental institution

7
E-government a structural reform process (ctd)

• E-government requires (ctd)
• co-operation between governmental institutions
  one virtual electronic government, with respect
  for mission and core tasks of each governmental
  institution and government level
• co-operation between government and private
  sector
• adequate legal environment elaborated at the
  correct level
• interoperability framework ICT, security, unique
  identification keys, harmonized concepts
• implementation with a decentralized approach, but
  with co-ordinated planning and program management
  (think global, act local)
• adequate measures to prevent a digital divide

8
Information as resource implications

• information modelling
• information is being modelled in such a way that
  the model fits in as close as possible with the
  real world
• definition of information elements
• definition of attributes of information elements
• definition of relations between information
  elements
• information modelling takes into account as much
  as possible the expectable use cases of the
  information
• the information model can be flexibly extended or
  adapted when the real world or the use cases of
  the information change

9
Information as resource implications (ctd)

• unique collection and re-use of information
• information is only collected for well-defined
  purposes and in a proportional way to these
  purposes
• all information is collected once, as close to
  the authentic source as possible
• information is collected via a supplier-chosen
  channel, but preferably in an electronic way,
  using uniform basic services (single sign on,
  arrival receipt of a file, notification for each
  message, )
• information is collected according to the
  information model and on the base of uniform
  administrative instructions

10
Information as resource implications (ctd)

• unique collection and re-use of information (ctd)
• with the possibility of quality control by the
  supplier before the transmission of the
  information
• the collected information is validated once
  according to an established task sharing, by the
  most entitled institution or by the institution
  which has the greatest interest in a correct
  validation
• and then shared and re-used by authorized users

11
Information as resource implications (ctd)

• management of information
• information in all forms (e.g. voice, print,
  electronic or image) is managed efficiently
  through its life cycle
• a functional task sharing is established
  indicating which institution stores which
  information in an authentic way, manages the
  information and keeps it at the disposal of the
  authorized users
• information is stored according to the
  information model
• information can be flexibly assembled according
  to ever changing legal notions
• all information is subject to the application of
  agreed measures to ensure integrity and
  consistency

12
Information as resource implications (ctd)

• management of information (ctd)
• every institution has to report probable
  improprieties of information to the institution
  that is designated to validate the information
• every institution that has to validate
  information according to the agreed task sharing,
  has to examine the reported probable
  improprieties, to correct them when necessary and
  to communicate the correct information to every
  known interested institution
• information will be retained and managed as long
  as there exists a business need, a legislative or
  policy requirement, or, preferably anonimized or
  encoded, when it has historical or archival
  importance

13
Information as resource implications (ctd)

• electronic exchange of information
• once collected and validated, information is
  stored, managed and exchanged electronically to
  avoid transcribing and re-entering it manually
• electronic information exchange can be initiated
  by
• the institution that disposes of information
• the institution that needs information
• the institution that manages the interoperability
  framework
• electronic information exchanges take place on
  the base of a functional and technical
  interoperabilty framework that evolves
  permanently but gradually according to open
  market standards, and is independent from the
  methods of information exchange

14
Information as resource implications (ctd)

• electronic exchange of information (ctd)
• available information is used for the automatic
  granting of benefits, for prefilling when
  collecting information and for information
  delivery to the concerned persons

15
Information as resource implications (ctd)

• protection of information
• security, integrity and confidentiality of
  government information will be ensured by
  integrating ICT measures with structural,
  organizational, physical, personnel screening and
  other security measures according to agreed
  policies
• personal information is only used for purposes
  compatible with the purposes of the collection of
  the information
• personal information is only accessible to
  authorized institutions and users according to
  business needs, legislative or policy requirement
• the access authorisation to personal information
  is granted by an independent institution, after
  having checked whether the access conditions are
  met
• the access authorizations are public

16
Information as resource implications (ctd)

• protection of information (ctd)
• every concrete electronic exchange of personal
  information is preventively checked on compliance
  with the existing access authorisations by an
  independent institution managing the
  interoperability framework
• every concrete electronic exchange of personal
  information is logged, to be able to trace
  possible abuse afterwards
• every time information is used to take a
  decision, the used information is communicated to
  the concerned person together with the decision
• every person has right to access and correct his
  own personal data

17
Customer centric

• unique declaration of every event during the life
  cycle/business episode of a customer and
  automatic granting of all related services, e.g.

18
Customer centric (ctd)

• delivery of services that cannot be granted
  automatically to a customer
• in an integrated way
• information
• interaction
• transaction
• re-using all available information
• harmonized concepts
• back-office integration
• prefilled information

19
Customer centric (ctd)

• delivery of services that cannot be granted
  automatically to a customer (ctd)
• in a personalized way
• look feel and interface
• content
• only relevant information and transactions
• personalized support
• contextual help
• own language
• adapted vocabulary
• on-line simulations
• or at least based on the way of thinking of the
  customer group
• life events (birth, marriage, etc.) or business
  episodes (starting a company, recruiting
  personnel, etc.)
• life styles (sport, culture, etc.)
• life status (unemployed, retired, etc.) or
  business sectors
• specific target groups

20
Customer centric (ctd)

• declaration of events and service delivery via an
  access method chosen by the customer
• various end-user devices
• PC, GSM, PDA, digital TV, kiosks,
• file transfer
• use of intermediaries
• accessible to disabled
• use of integrated customer relation management
  tools
• service delivery in principle free of charge

21
(No Transcript)
22
(No Transcript)
23
(No Transcript)
24
(No Transcript)
25
(No Transcript)
26
(No Transcript)
27
(No Transcript)
28
(No Transcript)
29
(No Transcript)
30
(No Transcript)
31
(No Transcript)
32
(No Transcript)
33
(No Transcript)
34
(No Transcript)
35
Re-engineering of processes

• BPR programs started within every federal
  ministry
• but need for transversal BPR programs between
• federal ministries
• institutions of other government levels (e.g.
  municipalities, regions, communities, )
• parapublic institutions or private institutions
  delivering public services (e.g. social security
  institutions)
• integration is the key
• processes (back office and front office)
• information management

36
Integration is the key

• lack of integration leads to
• overloading of the citizens/companies
• multiple collection of the same information by
  several governmental institutions
• no re-use of available information
• avoidable contacts with citizens/companies due to
  multiple, unco-ordinated quality checks
• waste of efficiency and time within the
  governmental institutions
• suboptimal support of the policy made by
  government
• higher possibilities of fraud

37
Principles used in social security sector

• co-ordinated information modelling
• decentralized but unique information collection
• decentralized and distributed information
  management
• functional task-sharing between social security
  institutions
• principle of the authentic source
• electronic information exchange and work flow
• every social security institution can be supplier
  or user of information
• information exchange can be initiated
• by the governmental institution that needs the
  information
• by the governmental institution that disposes of
  new information
• by the Crossroads Bank for Social Security
• application to application (no manual
  intervention)

38
Principles used in social security sector (ctd)

• unique identification key for each entity
• control mechanisms by independent institutions
  (cf. information is often sensible)
• Control Committee designated by Parliament
• preventive autorisation of legitimacy of the
  exchange of personal data
• complaint handling
• security policies
• Crossroads Bank for Social Security
• preventive access control
• loggings

39
Co-operation between government levels

• co-operation agreement has been signed between
  federal government, regions and communities
• coordinated offer of e-services to
  citizens/companies
• guarantee that a citizen/company can use the same
  tools
• terminal
• software
• electronic signature
• guarantee of a unique data collection from the
  citizen/company
• with respect for the partition of competences
  between government levels

40
Co-operation agreement between government levels

• co-ordinated, customer oriented service delivery
• agreements have to be made on common standards
• mutual tuning of portals, middleware, websites
  and back offices
• use of common identification keys and electronic
  signature
• mutual tuning of business processes when
  necessary
• gradual mutual task-sharing on data storage in
  authentic form
• common policy on SLAs and security

41
Co-operation government and private sector

• private companies as service providers (sharing
  of investments), e.g.
• network and security management
• co-sourcing in BPR and development/maintenance/hou
  sing of ICT building blocks, e.g.
• certification authorities
• portals
• private companies as partners
• integrated work flow with their own information
  systems, e.g.
• e-procurement
• tax declaration
• social security declarations

42
Changes of the legal environment

• organization of integrated data management and
  electronic service delivery legal base for Royal
  Decree exists
• functional task sharing on information management
• obligation to respect unique data collection from
  the customer
• obligation to exchange information in an
  electronic way
• permission or obligation to use unique
  identification keys
• harmonization of basic concepts

43
Changes of legal environment (ctd)

• ICT-law
• data protection
• public access to information
• electronic signature
• probative value
• no overregulation
• only basic principles
• technology-neutral, but not technology unaware

44
Interoperability framework

• goal to guarantee the ability of government
  organizations and customers to share information
  and integrate information and business processes
  by use of
• interoperable ICT
• common security framework
• common identification keys/sets for every entity
• harmonized concepts and data modelling

45
ICT interoperability

• examples on
• www.govtalk.gov.uk and www.e-government.govt.nz
  (recent frameworks based on actual open ICT
  standards, to be implemented)
• www.ksz.fgov.be (framework started in 1991 and
  implemented between 2.000 Belgian social security
  institutions, with unique gateway to foreign
  social security institutions within the EU, and
  continuously adapted to evolving and proven ICT
  standards with backwards compatibility)
• tendency to use of open ICT standards
• but ICT is so dynamic and fast changing that ICT
  standards are in an almost constant state of
  evolution
• huge need to agreements on how to ensure
  functional interoperability, far beyond technical
  interoperability

46
Functional ICT interoperability

• standardized codification (e.g. institutions,
  return codes, )
• standardized use of objects and attributes
• standardized layout of header of messages,
  independent from information exchange format
  (EDI, XML, ) and type of information exchange
• version management
• backwards compatibility
• SLAs on disponibility and performance of
  services
• access autorisation management
• anonimization rules
• acceptation and production environments
• priority management

47
Common security framework

• issues see Stijn Bijnens
• confidentiality
• integrity
• availability
• authentication
• autorisation
• non-repudiation
• audit

48
Common security framework (ctd)

• specific points of interest
• risk awareness based on risk analysis
• security policies
• structural and organisational aspects
• encryption standards
• interoperability of
• PKI
• electronic certificates
• procedures (registration authority, certification
  authority)
• difference between identification certificates
  and attribute certificates
• attributes, optional fields
• revocation lists
• directories
• application security

49
Common identification keys

• at least common identification keys and
  identification sets for every entity
• person
• company
• patch of ground
• between nations
• unique schemes
• conversion tables
• regulation of interconnection of information
  based on unique identification keys

50
Common identification keys (ctd)

• characterictics
• unicity
• one entity one identification key
• same identification key is not assigned to
  several entities
• exhaustivity
• every entity to be identified has an
  identification key
• stability through time
• identification key doesnt contain variable
  characterics of the identified entity
• identification key doesnt contain references to
  the identification key or characteristics of
  other entities
• identification key doesnt change when a quality
  or characteristic of the identified entity changes

51
Harmonized concepts and data model

• harmonized concepts and datamodel example on
  www.socialsecurity.be (best practice of
  combination of back office integration and
  e-portal solution in web-based survey on
  electronic public services by DG Information
  Society (European Commission) April 2002)

52
Harmonized concepts and data model

• standard elements
• with well defined characteristics
• used within all services
• OO-oriented, e.g. inheritance in a multilingual
  environment
• version management in an ever changing
  environment
• define once, use many (different presentations)
• workflow for validation of standard elements and
  characteristics
• multi criteria search
• by element
• by scheme
• by version

53
OO-oriented inheritance
54
OO-oriented inheritance
55
OO-oriented inheritance
56
Version management
57
Version management
58
Validation workflow
59
Validation workflow
60
Define once, publish many
61
Define once, publish many
62
Multi criteria search
63
Multi criteria search
64
Multi criteria search
65
A methodology to harmonize concepts

• inventory of all documents (frequently) used for
  information collection
• inventory of collected information
• classification of collected information using a
  clustering methodology
• decomposition of collected information into real
  life classes with description of the asked
  attributes
• analysis of goals what is every real life
  classes used for ?
• setting up of simplification propositions (e.g.
  senseless different treatment of same real life
  object)

66
A methodology to harmonize concepts (ctd)

• based on the simplification propositions, framing
  out of an OO information model for information to
  be collected
• design of XML-schemas for the collecting of the
  information, corresponding to the OO information
  model
• legislative adaptations in order to introduce the
  uniform definitions of the information classes
• procedures in order to guarantee the consistency
  of the OO information model in an ever changing
  legal environment

67
Preventing digital divide

• no creation of information haves and information
  have-nots
• possible measures
• promoting automatic granting of services
• electronic services are (for the time being)
  considered as extra services, tradional services
  remain
• access to electronic services in public places
• role of intermediaries and front office
  organisations
• education and life-long learning
• promoting usability of portals and websites

68
Some interesting Belgian projects

• electronic identity card
• network of service integrators
• unique identification keys
• portal sites

69
Electronic identity card

• retained functions
• visual and electronic identification of the
  holder
• electronic authentication of the holder via the
  technique of the digital signature
• generation of electronic signature via the
  technique of the digital signature (non
  repudiation)
• proof of characteristics of the holder via the
  technique of the digital signature on the
  initiative of the holder
• only identification data storage
• no electronic purse
• no biometry

70
Electronic identity card content

• visual
• identification data name, first names, sex, date
  and place of birth
• National Register number
• photograph
• card number
• validity period
• electronic
• serial number (sn)
• National Register number (nrn)
• card number (cn)
• visual identification data sn nrn cn
  (signed by National Register sig1)
• address sig1 (signed by National Register
  sig2)
• photograph sig1 (signed by National Register
  sig3)

71
Organization model

• government chooses card producer and
  certification authority issuing the identity
  certificates as a result of a public call for
  tenders
• the municipality calls the holder for the issuing
  of the electronic identity card
• the municipality acts as registration authority
  for 2 certificates authentication and electronic
  signature
• 2 key pairs are generated within the card at
  production time and the private keys are stored
  within the chip of the card

72
Organization model (ctd)

• the 2 certificates are created by the
  certification authority, but published only when
  the holder agrees
• the use of the private keys within the chip needs
  an activation of the card by a municipal official
  using his PUK2 and the PUK1 sent to the holder
• first authentication within one session (first
  private key) and every generation of an
  electronic signature (second private key)
  requires the PIN code of the holder
• the second private keys and the identity
  certificate on the electronic identity card can
  be used to generate an electronic signature
  within the scope of E-government applications
  which require such a signature

73
Organization model (ctd)

• the electronic identity card contains the
  necessary space to store other private keys
  associated to attribute certificates that holder
  can obtain at the certification authority of his
  choice

74
Organization model
1
1
75
No storage of electronic data on the card

• why not ?
• preventing perception of the card as a big
  brother
• preventing loss of data, when the card is lost
• preventing frequent updates of the card
• stimulation of the controlled access to data over
  networks, using the card as an access tool,
  rather than storage of data on the card
• thus, no integration of SIS-card and electronic
  identity card

76
Technical characteristics

• security policy conform to the BelPIC document
• secure infrastructure between National Register
  and service providers
• smart card
• support
• format ID-1 (ISO 7816-1)
• rainbowprint
• fluorescent marks (UV)
• an other substrat for impression
• printing in OVI
• micro-letter
• kinegram
• photograph
• card number

77
Technical characteristics (ctd)

• smart card (ctd)
• chip ISO 7816-2 to 9 (format, command) and
  PKCS15 (structure file and identifier)
• protocol T0
• functions PKCS11 ISO 7816-4-8-9
• certificates X.509 V3
• concrete implementation proposal of JavaCard
  SLE66CX322P - 32KB
• identity certificate status validation OCSP

78
Network of service integrators
Service integrator
R/CPS
R/CPS
Services repository
Extranet region or community
Service integrator (FEDICT)
Services repository
FPS
FPS
FedMAN
Internet
Municipality
SSI
FPS
Publilink
SSI
Extranet social security
Services repository
Service integrator (BCSS)
Province
Municipality
SSI
Services repository
79
Network of service integrators (ctd)

• type of exchanged information
• structured data
• documents
• images
• multimedia
• metadata
• business processes
• using web services

80
Network of service integrators (ctd)

• useful functions of service integrators (FEDICT,
  CBSS, )
• secure messaging
• business logic and work flow support
• directory of authorized users and applications
• list of users and applications
• definition of authentication means and rules
• definition of authorization profiles
• which service is accessible to which type of
  user/application for which persons/companies in
  which capacities in which situation and for which
  periods
• directory of data subjects
• which persons/companies in which capacities have
  personal files in which institutions for which
  periods
• subscription table
• which users/applications want to receive
  automatically which services in which situations
  for which persons in which capacities

81
Network of service integrators (ctd)
Information Exchange
ServicesRepository
Interconnection
Services Register ( UDDI)Agreements
( ebXML)PoliciesVocabularia (content
metadata)
TCP/IPSMTPLDAPFTPS/MIME
XMLXSLSOAPWSDLmetadata (RDF, XTM, XMI, )
Security (e.g. PKI)
Open standards
82
Network of service integrators (ctd)

• key issues
• evolution of standards
• collaboration with vendors
• not limited to public agencies
• national, European international standards
• every partner is free to implement internally in
  his own way black box philosophy

83
FEDICT TANGO

• Target Architecture for Networked Government
  Operations

84
Service oriented architecture
Internet
Services
Intranet
Source Peter Strickx - FEDICT
85
Service oriented architecture
Intranet
Source Peter Strickx - FEDICT
86
Unique identification keys

• citizens
• generalization of the use of the social security
  number (national register number or CBSS-number)
• (electronically) readable from the electronic
  identity card
• controlled access to basic identification data in
  National Register and CBSS
• companies
• unique company number (based on VAT-number)
• unique number for every plant of business
• generalized access to basic identification data
  in Company Register
• regulation on data interconnection

87
Portal sites actual situation
intermediaries
employees
suppliers

• customers
• citizens
• companies

partners

• PORTAL B
• single sign on
• personalization
• user groups
• multi-channel
• aggregation

• PORTAL A
• single sign on
• personalization
• user groups
• multi-channel
• aggregation

content management
business intelligence
business intelligence
content management

• back-end
• systems, e.g.
• ERP
• groupware
• DBs
• applications

directory

• back-end
• systems, e.g.
• ERP
• groupware
• DBs
• applications

directory
88
Portal sites (ctd)

• need to strike the right balance between roles in
  delivering e-government services not a single,
  but many one-stop shops (public and private)

Content and Services
Public
Private
Private
Channel
PPP
Public
Source Andrea Di Maio - Gartner
89
Portal sites (ctd)

• public institutions need to concentrate on core
  activities, such as
• information
• modular
• up to date
• information blocks concerning public services
• with standardized metadata
• based on standardized thesauri
• in generally accessible content management
  systems
• with separation between content and metadata
  (reuse, dont rewrite)
• that can be submitted to automatical
  re-indexation
• transactions
• applications that can be easily integrated in
  private or public portal sites

90
Portal sites (ctd)

• public portals should have added value
• integration of services
• information
• work flow based on life events of the customers
• integration with work flow of customers
• coordinated basic services for own customers
• single sign on
• ticketing
• logging
• notification service

91
Portal sites to be situation
intermediaries
employees
suppliers

• customers
• citizens
• companies

partners

• PORTAL B
• single sign on
• personalization
• user groups
• multi-channel
• aggregation

• PORTAL A
• single sign on
• personalization
• user groups
• multi-channel
• aggregation

• back-end
• systems, e.g.
• ERP
• groupware
• DBs
• applications

• back-end
• systems, e.g.
• ERP
• groupware
• DBs
• applications

directory
directory
content management
business intelligence
business intelligence
content management
92
Portal sites (ctd)

• other key issues
• multidimensionality accessibility of same
  services through different  views 
• multi channel enabling
• citizen/company relation management
• integrated service delivery, across all used
  channels
• personalization of service delivery
• first step personalized home page for every
  company on social security portal
• evolution to push system
• quality control
• feedback mechanisms for permanent improvement of
  service delivery
• contact center

93
Most important barriers

• privacy and security
• average public sector project is more complex
  than average private sector project, due to
• interaction with a larger number of stakeholders
  (elected officials, public employees, members of
  interest groups, voters, tax payers, recipients
  of public services, other governmental
  institutions, other government levels, )
• execution in a less stable environment
• complexity of BPR in a government environment
• race for quick wins (cf surveymania) doesnt
  stimulate development of well conceived systems
  based on re-engineering

94
Most important barriers

• public sector tends, perhaps for reason of
  prestige, to favour tailor-made, high-risk,
  state-of-the-art solutions even when alternative,
  off-the-shelf, cheap, tried and tested systems
  are available
• in the public sector, there is typically no
  financial margin of value to be added by
  innovation
• intermediaries often perceive e-government as a
  threat
• skills and knowledge

95
Most important barriers

• need for radical cultural change within
  government, e.g.
• from hierarchy to participation and team work
• meeting the needs of the customer, not the
  government
• empowering rather than serving
• rewarding entrepreneurship within government
• ex post evaluation on output, not ex ante control
  of every input

96
Th_at_nk you !
Crossroads Bank for Social Security