EU pushes €10m into open source privacy management

By Dave Nixon

The European Union is contributing 10 million euro (around £8 million) in sponsorship to a project named PrimeLife, which intends to grow open source tools for personal privacy management and protection, and get the community at large to accept them.

PrimeLife’s co-ordinator is IBM’s Zurich research laboratory, and it continues from an earlier EU-backed project into identity management systems, called Prime (Privacy and Identity Management in Europe).

Where Prime was typically concerned with identity management, PrimeLife will go further than that to address privacy management and trust issues across a user’s entire lifespan from childhood to old age, said IBM cryptography researcher Jan Camenisch, who is the project’s technical leader.

“When we started, the privacy world was still thinking along the lines of Microsoft Passport,” he added. “We brought together a group of people who wondered why identity management technologies weren’t being used, and now PrimeLife is geared to bringing this technology into the world. Prime was concerned with how people did identification on the Internet, only releasing the minimum information and so on. But now with user-contributed content and social networks, people are broadcasting their data - how can we help those people keep that safe, for example from future harvesting?”

Camenisch said that PrimeLife will engage around 60 researchers from 15 organisations, and will open-source as much as feasible of any software and mechanisms it generates. It furthermore aims to co-operate with organisations that are defining identity management frameworks, such as Liberty Alliance.

“For example, Liberty Alliance focuses mainly on how to do identity,” he said. “We go a step further and say you should think about how to authorise, not just identify, and how to protect the data used.”

The project encompasses usability, as well as technical methods such as encryption, he said, pointing out that if users don’t appreciate how they can manage their privacy, it’s all in vain.

“For example, your browser has a little padlock symbol, but if you click it and all you get is meaningless bit-strings, it’s useless to you,” he added.

“Another area we want to work on is policy languages. That is about explaining to the user what data is needed and why, and how it will be treated.”

The PrimeLife project is not completely European - one of the 15 organisations involved is Brown University in the US. The others include universities and research institutes in Austria, Belgium, France, Germany, Italy, the Netherlands and Sweden. On the commercial side, there is SAP, Microsoft’s Germany-based European Innovations Centre, and of course IBM.