Questionpool Discussion Paper

[christianheimann]

You can use this thread for questions concerning the discussion paper for the tech evaluation: https://github.com/e-id-admin/open-source-community/blob/main/discussion-paper-tech-proposal/discussion-paper-tech-proposal.md

[dune73]

OK, time to get going. Thanks for publishing this tech proposal paper.

I have a question on how to address / implement a suggestion. While your repo is called "open source community", the term "open source" is not used int he discussion paper. It's missing completely and I think it vital to be listed in the section on "3 Design Principles and Criteria".

This is even more important since the "EMBAG (Bundesgesetz über den Einsatz elektronischer Mittel zur Erfüllung von Behördenaufgaben)", active from Jan 2024, demands the use of Open Source licenses for the implementation of new federal software (with small loopholes).

https://www.fedlex.admin.ch/eli/fga/2023/787/de, Article 9.

I see 3 approaches:

• Place this proposal here in this thread
• Create an issue
• Create a pull request

Guidance welcome.

[christianheimann]

Thank you for bringing up this topic. We did not refer on the criteria "open source", because it is completely independent from the technology decision. The explicit will to have the elements of the trust infrastructure published as open source is written in the draft act, Art. 11 BGEID; so it is even a regulation having more impact as the EMBAG.

Details to open source publications may soon be discussed; already for the current pilot projects the team is advancing on that topic..

Having named that repo "open source community" was the idea to separate the more "technical discussions" from the more "general" one. The code will be published in other repos, that are not defined yet.

I hope this helps!

[dune73]

Thank you for the swift response.

It's not correct though.

BGEID has less impact than EMBAG

The coverage in the draft BGEID, Art. 11, is much weaker than the EMBAG. Namely the provisions in EMBAG Art. 9.2 are completely missing. There is a difference between publishing code and allowing people to re-use it as EMBAG Art. 9.2 stipulates. The BGEID "Botschaft" is in line with this, since it does not mention the re-use but only the testing. If the use of an open source license was indeed a given, then the "Botschaft" would mention it and it would also name the re-use and other advantages of that development model.

Furthermore, the draft BGEID names four elements of the trust infrastructure where Art. 11 is being applied. I do not know if this covers everything or if there are elements beyond the named four items. Ultimately, it will be left to the implementing parties to define that an element is now outside this list and thus no longer covered by BGEID. EMBAG on the other hand provides full coverage.

So I still think that the BGEID has less impact than the EMBAG.

The choice of the license is technical

Now let's look at the idea whether an Open Source approach touches on the more "technical discussion" or stays in the "general" domain.

The choice of an open source license has a significant technical impact on software. Open source licenses influence the accessibility, transparency, and security of government software, directly shaping public perception and confidence. The open source development model will bring more people to the table, which improves the technical implementation and also the discourse itself. Given the open source discourse is bigger than the more limited E-ID discourse, the addition of this criteria signals the desire to promote accessibility, collaboration, and security and it demonstrate a commitment to public engagement in a stronger way than the architectural discourse alone.

When reading through your section 3.1, I see several principles or goals that are non-technical. Let me quote The Swiss e-ID should be launched as soon as possible. The absence of open source, which was also mentioned during the public consultation, seems to be an arbitrary choice.

TL&DR: You are not losing anything by adding Open Source as design principle to your section 3.1.

[AnAnalogGuy]

The open source development model will bring more people to the table, which improves the technical implementation and also the discourse itself

As a side note: That's not guaranteed at all. There are examples in the community where this is true while there are also examples where the oppsite is true. And in reverse, there are examples where closed source led to results potentially not possibe with an oss approach.

--

Reading your initial comment, i got the impression there might be a different understanding of what open source means. My personal understanding is, open source means sharing code but does not implicitly mean "right to contribute"/"open source development model". There are not many FOSS projects where the community actually has a right to contribute. Most often, it's a right to participate, meaning, a right of being heard/to propose (i.e. as a pull request), besides the right to use the code to fork and enhance it.

You are not losing anything by adding Open Source as design principle to your section 3.1.

While " [..] you are not losing [..] " might be true, still, open source isn't a software design principle at all, it's more like a legal or organizational or cultural dimension, so it simply does not belong into a tech paper. Furthermore, it also does not need to be included in the tech paper because as you correctly pointed out, it's already there in the EMBAG, which is one of the legal foundations the E-ID is built upon.

[dune73]

But you do agree that the BGEID draft is less rigid than the EMBAG?

[christianheimann]

I try to put things down to create hopefully more clarity:

• The Open Source Software Article in EMBAG (Art. 9) applies to every listed federal authority. So yes, EMBAG has a huge impact in general.
• Art. 9 Abs. 1 EMBAG restricts the obligation, when third party rights or a security relevant reason hinder this. In Art. 11 Abs. 2 BGEID the third party right clause was excluded; so there is the will having nothing in these elements that is closed source due to the rights of a third party provider.
• Currently the E-ID team is having disussions on open source licence models for the elements that shall be published. We will let the community know when a first draft idea is ready.

[dune73]

This sounds quite positive. Thank you.

I read Art. 11 Abs. 2, but did not understand the consequence. This makes sense now.

Where I am still not sure is the "four elements of the trust infrastructure". Is this a comprehensive list, or could there be another 6 elements (in the future / as an adhoc definition) where the BGEID would not apply?

[christianheimann]

There could be other elements in the future; but as a revision/change of the law would be needed to add elements, this comprehensive list would be object to change as well.

[brunozuber]

For following references/links I get the error:
Die angefragte Datei konnte nicht ausgelesen werden: http://intranet.nsbc-p.admin.ch/NSBSubscriber/message/attachments/84260.pdf

Draft Act e-ID

German: https://www.newsd.admin.ch/newsd/message/attachments/84263.pdf
French: https://www.newsd.admin.ch/newsd/message/attachments/84264.pdf
Italian: https://www.newsd.admin.ch/newsd/message/attachments/84265.pdf
Dispatch to the draft Act e-ID

German: https://www.newsd.admin.ch/newsd/message/attachments/84260.pdf
French: https://www.newsd.admin.ch/newsd/message/attachments/84261.pdf
Italian: https://www.newsd.admin.ch/newsd/message/attachments/84262.pdf