<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/swisspost-putting-another-nail-in-the-coffin-of-swiss-sovereignty/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://danielpocock.com/swisspost-swissid-another-nail-in-the-coffin-sovereignty"> DanielPocock.com - r-project</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<div>
<div>
<div>
<p>A few people have recently asked me about the <em>SwissID</em>, as SwissPost has just been sending spam emails out to people telling them “Link your Swiss Post user account to SwissID”.</p>
<p><em>SwissID</em> is not the only digital identity solution in Switzerland but as it is run by SwissPost and has a name similar to another service it is becoming very well known.</p>
<p>In 2010 they began offering a solution which they call <em>SuisseID</em> (notice the difference?) based on <a rel="nofollow" href="https://postsuisseid.ch/en/questions/faq/258-is-suisseid-also-available-to-download-as-a-software-certificate" target="_blank">digital certificates and compliant with Swiss legislation</a>. Public discussion <a rel="nofollow" href="https://www.srf.ch/sendungen/kassensturz-espresso/themen/geld/suisseid-mehr-als-ein-teurer-flop" target="_blank">focussed on the obscene cost</a> with little comment about the privacy consequences and what this means for Switzerland as a nation.</p>
<p>Digital certificates often embed an email address in the certificate.</p>
<p>With <em>SwissID</em>, however, they have a web site that looks like <a rel="nofollow" href="https://www.swissid.ch/" target="_blank">little more than vaporware</a>, giving no details at all whether certificates are used. It appears they are basically <a rel="nofollow" href="https://www.swisssign.com/media/wysiwyg/BilderReDesign/SwissIDPresseKit/170516_swisssign_factsheet_B2B_en.pdf" target="_blank">promoting an app</a> that is designed to harvest the email addresses and phone numbers of any Swiss people who install it, lulling them into that folly by using a name that looks like their original <em>SuisseID</em>. <em>If it looks like <a rel="nofollow" href="https://en.wikipedia.org/wiki/Phishing" target="_blank">phishing</a>, if it feels like <a rel="nofollow" href="https://en.wikipedia.org/wiki/Phishing" target="_blank">phishing</a> and if it smells like <a rel="nofollow" href="https://en.wikipedia.org/wiki/Phishing" target="_blank">phishing</a> to any expert takes a brief sniff of their FAQ, then what else is it?</em></p>
<p>The thing is, the original <em>SuisseID</em> runs on a standalone smartcard so it doesn’t need to have your mobile phone number, <a rel="nofollow" href="https://play.google.com/store/apps/details?id=com.nth.swisspost&hl=en" target="_blank">have permissions to all the data in your phone</a> and be limited to working in areas with mobile phone signal.</p>
<p>The emails currently being sent by SwissPost tell people they must “Please use a private e-mail address for this purpose” but they don’t give any information about the privacy consequences of creating such an account or what their app will do when it has access to read all the messages and contacts in your phone.</p>
<h3>The actions you can take that they didn’t tell you about</h3>
<ul>
<li>You can post a registered letter to SwissPost and tell them that for privacy reasons, you are immediately retracting the email addresses and mobile phone numbers they currently hold on file and that you are exercising your right not to give an email address or mobile phone number to them in future.</li>
<li>If you do decide you want a <em>SwissID</em>, create a unique email address for it and only use that email address with SwissPost so that it can’t be cross-referenced with other companies. This email address is also like a <a rel="nofollow" href="https://en.wikipedia.org/wiki/Sentinel_species" target="_blank">canary in a coal mine</a>: if you start receiving spam on that email address then you know SwissPost/<em>SwissID</em> may have been hacked or the data has been leaked or sold.</li>
<li>Don’t install their app and if you did, remove it and you may want to change your mobile phone number.</li>
</ul>
<p><img src="https://i2.wp.com/danielpocock.com/sites/danielpocock.com/files/canary2.jpg?w=456&ssl=1" data-recalc-dims="1"></p>
<p>Oddly enough, none of these privacy-protecting ideas were suggested in the email from SwissPost. Who’s side are they on?</p>
<h3>Why should people be concerned?</h3>
<p>SwissPost, like every postal agency, has seen traditional revenues drop and so they seek to <a rel="nofollow" href="https://www.postfinance.ch/en/about-us/media/newsroom/press-releases/q3-2017-swiss-post-achieves-good-result-in-difficult-environment.html" target="_blank">generate more revenue from direct marketing</a> and they are constantly looking for ways to extract and profit from data about the public. They are also a huge company with many employees: when dealing with vast amounts of data in any computer system, it only takes one employee to compromise everything: just think of how <a rel="nofollow" href="https://en.wikipedia.org/wiki/Edward_Snowden" target="_blank">Edward Snowden</a> was able to act alone to extract many of the NSA’s most valuable secrets.</p>
<p>SwissPost is going to great lengths to get accurate data on every citizen and resident in Switzerland, including deploying an app to get your mobile phone number and demanding an email address when you use their web site. That also allows them to cross-reference with your IP addresses.</p>
<ul>
<li>Any person or organization who has your email address or mobile number may find it easier to get your home address.</li>
<li>Any person or organization who has your home address may be able to get your email address or mobile phone number.</li>
<li>When you call a company from your mobile phone and their system recognizes your phone number, it becomes easier for them to match it to your home address.</li>
<li>If SwissPost and the SBB successfully convince a lot of people to use a <em>SwissID</em>, some other large web sites may refuse to allow access without getting you to link them to your <em>SwissID</em> and all the data behind it too. Think of how many websites already try to coerce you to give them your mobile phone number and birthday to “secure” your account, but worse.</li>
</ul>
<h3>The Google factor</h3>
<p>The creepiest thing is that over seventy percent of people are apparently using Gmail addresses in Switzerland and these will be a dependency of their registration for <em>SwissID</em>.</p>
<p>Given that <em>SwissID</em> is being promoted as a solution compliant with <a rel="nofollow" href="https://en.wikipedia.org/wiki/ZertES" target="_blank">ZertES legislation</a> that can act as an interface between citizens and the state, the intersection with such a powerful foreign actor as Gmail is extraordinary. For example, if people are registering to vote in Switzerland’s renowned <a rel="nofollow" href="https://en.wikipedia.org/wiki/Popular_initiative_(Switzerland)#Federal_popular_initiative" target="_blank">referendums</a> and their communication is under the surveillance of a foreign power like the US, that is a mockery of democracy and it makes the allegations of Russian election hacking look like child’s play.</p>
<p>Switzerland’s referendums, decentralized system of Government, part-time army and privacy regime are all features that maintain a balance between citizen and state: by centralizing power in the hands of <em>SwissID</em> and foreign IT companies, doesn’t it appear that the very name <em>SwissID</em> is a mockery of the Swiss identity?</p>
<p><a rel="nofollow" href="http://yellow-in-motion.swisspost.ch/" target="_blank"><img alt="Yellow in motion" src="https://i2.wp.com/danielpocock.com/sites/danielpocock.com/files/dead_canaries.jpg?w=456&ssl=1" data-recalc-dims="1"></a></p>
<p><em>No canaries were harmed in the production of this blog.</em></p>
</div>
</div>
</div>
	<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="https://danielpocock.com/swisspost-swissid-another-nail-in-the-coffin-sovereignty"> DanielPocock.com - r-project</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a rel="nofollow" href="https://www.r-project.org/" title="The R Project for Statistical Computing">R</a> news and <a rel="nofollow" href="https://www.r-bloggers.com/search/tutorial" title="R tutorials">tutorials</a> on topics such as: <a rel="nofollow" href="https://www.r-bloggers.com/search/data%20science" title="Data science">Data science</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data" title="Big Data">Big Data, <a rel="nofollow" href="https://www.r-users.com/" title="R jobs">R jobs</a>, visualization (<a rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2" title="ggplot and ggplot2 tutorials">ggplot2</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/boxplot" title="Boxplots using lattice and ggplot2 tutorials">Boxplots</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/map" title="Maps and gis">maps</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/animation" title="Animation in R">animation</a>), programming (<a rel="nofollow" href="https://www.r-bloggers.com/search/RStudio" title="RStudio IDE for R">RStudio</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/sweave" title="Sweave and literate programming">Sweave</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX" title="LaTeX in R">LaTeX</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/SQL" title="SQL and databases">SQL</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/eclipse" title="Eclipse IDE for R">Eclipse</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/git" title="git and github, Version Control System">git</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/hadoop" title="Large data in R using Hadoop">hadoop</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping" title="Web Scraping of google, facebook, yahoo, twitter and more using R">Web Scraping</a>) statistics (<a rel="nofollow" href="https://www.r-bloggers.com/search/regression" title="Regressions and ANOVA analysis tutorials">regression</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/PCA" title="principal component analysis tutorial">PCA</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/time+series" title="Time series">time series</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/trading" title="finance trading">trading</a>) and more...
<img width="1" alt="" src="http://feeds.feedburner.com/~r/RBloggers/~4/sImmPdSq1ds" height="1"></a></div>