IRMA enables privacy-friendly calls to local authorities

Decentralised architecture

IRMA is a privacy-friendly identity platform created by Privacy by Design, a foundation dedicated to developing and maintaining open-source software that puts user privacy first. With IRMA – an acronym of 'I Reveal My Attributes' – a special app is used to set up an 'online passport'. That's a secure document recording a number of key pieces of information about the user, known as 'attributes'. The attributes might include the user's Citizen Register details and e-mail address, for example. An organisation that wants to enable IRMA-based logins installs the IRMA software and specifies which attributes they need from users who access their services. Then, when the user logs in, only the information that's actually needed is shared with the service provider. What makes IRMA unique is its decentralised architecture. No data is stored centrally; all the user's attributes are kept in their digital passport. That's created locally (on the user's device) by the IRMA app. During set-up, the app retrieves data from authoritative sources such as government agencies and uses it to compile the passport. After that one-off procedure, the user is ready to log in directly with any service provider that supports IRMA, such as a hospital or a webshop. The local authority attaches a digital signature to the user's attributes, so that businesses with which they're shared later know they're genuine.

IRMA-enabled calls to local authorities

Until now, IRMA has been used mainly for logging in online, in much the same way as DigiD and iDIN. However, various new applications are being developed, including IRMA-enabled calling. At the 2019 Digital Identity Lab – an initiative involving the Association of Netherlands Municipalities (VNG), the Ministry of the Interior, plus various municipal authorities and others – developers demonstrated how IRMA could be used in combination with telephony. "At that time, IRMA-enabled calling was still a work in progress, but a group of us who were there representing our local authorities – Arnhem, Nijmegen and the Drecht Alliance – realised immediately that the technology had great potential for us," recalls Dennis van der Valk. "So we decided to get together to collectively support further development of the functionality on an open-source basis." "Currently, when you call your local authority, the usual procedure is that you're asked for your surname and date of birth. It's a very superficial form of authentication, far from watertight. IRMA would enable us to confirm a caller's identity much more reliably." Dennis illustrates how IRMA-enabled calling could help: "A user installs the IRMA app on their phone and adds their personal attributes to their digital passport. When the user wants to call the local authority, they go to the city's website, where a phone number and QR code are displayed. The user scans the code with the IRMA app. The app responds by asking, 'You are about to call the City of X. The City of X wants to receive your personal details. Do you agree?' The local authority will have defined in advance what info it needs from callers under given circumstances. If the user agrees to sharing their details, the call is made to the number given in the QR code. The city department taking the call is told who's calling and given the info they need to process the call." As well as having user benefits, such as control over attribute sharing and the privacy assurance afforded by decentralised architecture, IRMA-enabled calling helps the local authority. City hall staff don't lose time identifying callers, because their details are automatically shared when the call is initiated. IRMA also opens up all sorts of opportunities for the delivery of online and telephone services.

Online service enrichment

"It's important that we explore ways of making more use of decentralised architecture. Such architecture can enable us to expand and enhance the services we provide to our communities, without raising concerns about personal data security or requiring people to come to the city hall every time they need something," asserts Dennis. "We're currently working with a developer in Nijmegen to build the software for IRMA-enabled calling. Once the code is ready, we'll organise a pilot. That'll probably take place in the summer. However, before we can roll out the module for everyday use, we'll need to adapt and optimise our work processes and technology," Dennis adds. "A more robust infrastructure set-up will be needed, for example. First things first, though. Before we turn our attention to that, we have to make sure that the software's right, that the system is convenient for staff and users, and that it meets their needs. Those are process-related issues, which we plan to address during testing."

Transparency and digital security

SIDN manages IRMA's primary network, or 'backbone'. Because the backbone is centralised, it's vital that operational continuity and security are assured. SIDN's role is therefore crucial. "The system will rely on SIDN for the robustness that's going to be needed for the production rollout of IRMA-enabled calling," says Dennis. "It's really important for an application like IRMA, which guarantees digital security, to be in the hands of an independent non-profit organisation. An organisation that can provide the reassurance of a safe haven. I'm confident that IRMA is going to enrich our online services," says Dennis. "You'll soon be able to choose how you access the services you need: by coming to the city hall, by logging in online, by calling the traditional way, or by IRMA-enabled calling. The ultimate goal of the local authorities I work for is to enable further service improvements and to make our operations more case-focused," Dennis concludes.

Want to know more?

For more information about IRMA, visit the Privacy by Design website. If you're interested in learning how IRMA could work for your organisation or sector, drop a line to SIDN's Proposition Developer Bob Kronenburg at bob.kronenburg@sidn.nl.