The role of trust in the adoption of cooperative arrangement types in e-credentials markets

2.1 Different actors, and cooperative arrangements in a state-recognized e-credentials market

In short, e-ID is about providing services in a secure, efficient, and trustworthy way, for public administration as well as for citizens and businesses (Melin et al., 2016; Strauss, 2011). A key security concern is to reduce online fraud, i.e. to combat identity theft and thereby enable secure online communications and transactions. e-ID is considered to be a strong, secure technology for online authentication. It can reduce fraudulent activity on the Internet by ensuring that the online (legal or natural) person is in fact who they claim to be. This is particularly relevant in areas where citizens are expected to provide detailed personal information (Seltsikas & O’Keefe, 2010). It prevents the misuse of personal data and creates transparency regarding access to personal data (Hornung & Rossnagel, 2010). An additional advantage of a national e-ID solution is the increased process integration it offers concerning government applications. e-ID-based services are also expected to increase convenience of usage. Citizens will be able to use a wide range of electronic services at any time of the day and from any geographical location. This gives online users access to a much wider range of electronic services that are offered in an integrated way. The increased availability and convenience of e-ID-based services is expected to positively impact on user satisfaction with electronic services (Seltsikas & O’Keefe, 2010). Further, not only at national but also at supranational level, e-ID can help address identity fraud and can establish e-services that go beyond national borders (Arora, 2008). In Europe, for instance, e-ID is seen as a key tool for the provision of e-services and the detection and tracing of fraud transnationally. The ability to interact and communicate with different governmental agencies, even across national borders, is seen as an important prerequisite for digital transformation and the creation of a digital single market (Gomes de Andrade et al., 2013).

Today, there are different cooperative arrangements in place for e-ID issuance and the maintenance of a national e-ID infrastructure, all with the aim of exploiting the different opportunities offered by e-ID and keeping potential threats under control. A national (or cross-border) e-ID infrastructure may vary in terms of the technical architecture, institutional actors involved, and the range of services that can be accessed by citizens using digital identities (Spagnoletti et al., 2019). Before explaining the different arrangements on how to organize an e-credentials market, we will first briefly define who the key actors are (see Fig. 1).

Identity providers (IdPs) are the entities that are responsible for issuing e-ID. This is generally a government agency or a trusted third party. They develop and maintain the technical infrastructure required for the authentication and identification of citizens, ensure the infrastructure’s security and operational reliability, assign and manage personal requests for e-IDs, store user account and profile information, and bear the responsibility and liability for the authenticity and validity of identities (Arora, 2008; Mettler & Guenduez, 2019).

Certification authority: Depending on the cooperation arrangement, the state may refrain from issuing e-IDs, focusing instead on the regulation of the e-credentials market and the certification of third parties. This may include the definition of a coherent and applicable legal framework, quality control, and the sanctioning of misconduct by actors involved in the e-credentials market. However, certification may also be done by another private firm on behalf of the state. IdPs that comply with the defined standards and regulations regarding security, data protection, and interoperability may then receive a certificate and are then entitled to call themselves a preferred or a state-recognized IdP.

Online service providers – also called relying parties – can be private companies or government agencies that offer digital services such as e-banking or electronic medical records for which they require reliable proof of a citizen’s identity. Online service providers offer services to users with an e-ID from an official identity provider with whom they have an agreement. When providing online services, they rely on IdPs for user authentication.

Users: Citizens who meet the requirements (usually a valid identity card or minimum age) can obtain an e-ID, thereby becoming identity owners. As owner of an e-ID, citizens have mainly two touchpoints with other actors: with the OsP from which they request digital services and with the e-ID provider to define which information to share with which OsP.

Depending on the role(s) a government wants to play, we see three generic organizational arrangements of a state-recognized e-credentials market, as shown in Table 1.

OPEN IN VIEWER

The characteristic feature of a public e-credentials market is that e-ID issuance is centralized and managed by the state. Here, the government has multiples roles. The government is on the one hand responsible for the development, implementation, management, and maintenance of the e-ID. It is the certifier, identity provider, and service provider, all at the same time. In its role as a regulatory authority, the government lays down the rules and procedures to which it is subject as a provider when issuing, managing the e-IDs and providing related services to users. The objectives of such a solution often relate to e-government services, where e-ID builds on existing identity verification tools and extends or adapts them to the online world (Muñoz-Cañavate & Hípola, 2011). e-ID is seen as part of a wider program aimed at improving and modernizing the government services. Thus, the primary objective of implementing e-ID is to improve the delivery of public services to citizens and businesses. The business model for a state e-ID is simple. Citizens have little or no financial obligations because government subsidizes e-ID implementation.

In a fully private but government-approved e-ID, government outsources e-ID provision to private sector vendors, recognizing and certifying them for this service. The responsibility for the implementation, maintenance, and control of e-ID lies with the certified companies. They act as IdPs under the supervision of governmental actors. The IdPs must guarantee the identification and authentication of citizens and must securely manage their personal data and enable access to services offered by public and private service providers (Spagnoletti et al., 2019). The government therefore focuses primarily on certifying e-ID providers as suppliers of state-recognized identity information and regulating the market, while private identity providers use the digital environment to develop new and innovative revenue sources. Moreover, e-ID issued by private vendors, provide access to both public and private services such as for storing health insurance information. However, typically these e-ID integrate private services of their relying partners. The business model relies on the payments of the online service providers, which are charged a transaction fee by the IdP that manages the citizens’ identities and that performs the authentication. Citizens may also have to pay fees for additional services (e-signature, higher security levels, etc.). The state becomes a trusted third party and pays the fees for the provision of e-government services. Nonetheless, in this model, the implementation of e-ID is considered to be more cost-effective than a state-centered model, because large investments by the government are avoided (Grönlund, 2010).

In the case of a PPP, government authorities work with one or more private companies in issuing e-ID. While private vendors are often involved in developing e-ID and infrastructure, the state retains strong control over the e-credentials market. The PPP aims to make both services accessible electronically with a single e-ID and also strives to reduce costs and make e-government services available to more citizens, thereby meeting the national e-government strategy’s objectives. e-ID also enables access to services offered by private businesses, such as logging into bank, insurance, or health accounts. The PPP business model depends on cooperation between private companies and the government. Generally, the less the state is involved, the fewer costs it bears. Depending on the specific arrangements, the costs are also passed on to private companies and/or to customers.

Irrespective of the cooperative arrangements of e-credentials markets, the creation of national e-ID systems is associated with far-reaching changes that concern technological, legal, political, and organizational aspects. In this sense, e-ID is more than a technology for identifying citizens and organizations; it affects the core of citizenship. It is therefore becoming a political issue (Strauss, 2011). Closely related to this is the question whether the state or private vendors should provide e-ID. We will now look at the role of trust, which we believe helps one to understand why some governments issue e-ID in-house and others contract it out to private vendors. To this end, we will now consider trust in technology, trust in the government, and trust in the economy.

Trust is a complex construct that is hard to define and even harder to measure (Simpson, 2007). It has received widespread theoretical and empirical studies, but has remained an elusive concept that has been conceptualized and used in very divergent ways (McKnight & Chervany, 1996). However, trust is a crucial component of any social interaction, whether offline or online (Friedman et al., 2000; Wang & Emurian, 2005). It influences how a person copes with their social context (McKnight et al., 2002). It fundamentally affects a person’s interaction with their social environment (Rousseau et al., 1998). This also applies to interactions in the digital sphere, particularly because the risk of cyberattacks on critical information infrastructures is omnipresent (Alcaraz & Zeadally, 2015). National e-ID systems are as vulnerable to attacks as any other IT infrastructure. Besides security concerns, the technical requirements for e-ID are already in place, but the social aspects for developing trust lag behind. In some countries, the required legal framework for implementing e-ID is not yet in place. Efforts to harmonize national regulations are also still needed (Wihlborg, 2013). Further, human error, which can occur at any stage of interaction with a system, is a further threat to the e-credentials market. Even the simplest mistake, such as entering incorrect data during registration, can jeopardize e-ID usage (Arora, 2008). Further challenges to e-ID adoption relate to the lack of intergovernmental coordination, the lack of private-public sector cooperation, and tensions such as the tradeoff between usability and security. Also, privacy concerns and related demands to enhance transparency and enable citizens to effectively control their personal data are major challenges faced by governments (Melin et al., 2016; Spagnoletti et al., 2019; Strauss, 2011).

Thus, we distinguish between three key aspects of trust that may influence e-credentials markets, namely trust in a government, trust in economic institutions, and trust in technology.

Trust in a government is often conceptualized as whether or not the political authorities and institutions operate in accordance with citizens’ normative expectations (Grimmelikhuijsen et al., 2013). Trust in government relates closely to whether citizens perceive and judge a government’s actions as honest, efficient, right, and fair. Thus, trust in a government is a key indicator of citizens’ satisfaction with a state’s policies and whether its related actions are perceived as legitimate (Blind, 2006; Cheema, 2010; Tolbert & Mossberger, 2006). The credibility and transparency of a government, its services and institutions, and the behaviors of its public officials strongly influence whether or not citizens trust their government (Cheema, 2010; Grimmelikhuijsen et al., 2013). Trust is often seen as a cause of or a correlate for various behaviors that directly or indirectly impact on policy outcomes (Llewellyn et al., 2013). For instance, low trust is therefore associated with low political participation (Putnam, 1993). Trust’s role is particularly evident in the implementation of e-government projects. A lack of trust for instance in a government’s ability to implement appropriate programs can result in citizens becoming unwilling to accept the corresponding services (Morgeson et al., 2011; Seltsikas & O’Keefe, 2010). A lack of trust also may lead to opportunistic behaviors and may contribute to ‘free-riding’ behavior (Cheema, 2010). Thus, some studies have focused on how trust in organizations can be repaired and enhanced (Kramer & Lewicki, 2010): In order for citizens to support e-government initiatives, they need to be convinced that government authorities have the expertise and the technical skills to implement and secure such projects (Belanger & Carter, 2008).

Trust in economic institutions is critical, for several reasons. Trust in the economic system is particularly important, because a good economic situation increases the security of people and their businesses, promoting growth and economic prosperity (Enste & Grunewald, 2017). Such trust in economic institutions is necessary to strengthen investor and consumer confidence and is crucial for economic activities (OECD, 2019). It also plays a decisive role concerning stability. Cross-country studies have shown that economic trust is negatively linked to macroeconomic instability. Higher confidence reduces the frequency of crises. Further, trust in the economy also reduces the volatility of investment but not of public expenditure, suggesting that it is likely a key factor for macroeconomic stability (Sangnier, 2013). Notably, trust in a government and trust in the economy are interrelated. People trust governments and their institutions that spur economic growth, create jobs, provide access to education, and deliver services in a simple and transparent way (Blind, 2006; Cheema, 2010).

Finally, trust in technology exists when “a user depends on the technology for an outcome, with the expectation that the hoped-for outcome come true, but the possibility exists that the technology may not enable that outcome.” (Lankton et al., 2016). To date, while the relationship between trust and technology has been the subject of many studies (Hengstler et al., 2016; Komiak & Benbasat, 2006; Lee et al., 2011; Luo et al., 2010; Sicari et al., 2015), there are still no consistent findings across the different research fields. This also applies to research into technology adoption in the public sector. Studies on e-government services have found that willingness to adopt e-government services does not depend only on trust in technology, but significantly, rather on trust in the institution that delivers these services (Teo et al., 2008; Welch et al., 2005). However, other studies suggest that trust in technology also plays an important role in e-government adoption (Carter & Belanger, 2005).

3.1 Inductive approach

To develop our hypotheses, we decided to use an inductive, data-driven qualitative research approach. An inductive approach involves “using detailed readings of raw data to derive concepts, themes, or models through interpretations made from the data by researchers.” (Thomas, 2006, p. 238). The generation of theoretical statements draws on the wealth of information available in the data. Our research strategy can best be described as a sequential qual-qual multimethods design that allowed us to obtain different information types and to answer our research question more comprehensively (Morse, 2010).

Our starting point was a review of the literature concerning e-ID studies. We followed Webster and Watson’s (2002) methodology for a systematic literature review. We sought to identify patterns, themes, and issues and to thereby gain an understanding of how the literature addresses e-ID, e-credentials markets, and trust. When searching and reviewing the literature, we not only focused on the public administration discipline, but also on interdisciplinary studies. We used Web of Science as the database for the literature search. We identified research articles on e-ID in three search steps: (1) initial search, (2) main search, and (3) a forward and backward search. The initial search was used to define the search criteria to be used in the primary search. During the initial search process, it turned out that we needed to apply multiple terms and other spellings for e-ID, such as ‘electronic identity’ or additional terms such as ‘digital identity,’ in order to obtain an appropriate article sample set. We refined our search in step 2, and obtained 264 research articles. We then manually filtered by further examining each article’s abstract and screening the article’s content. We only included papers with a clear focus on e-ID that had been peer-reviewed in journals or conferences and that were published in English. In step 3, we reviewed the articles’ references to obtain additional sources (backward search) and also reviewed sources that cited the key articles identified in the previous steps (forward search). At the end of this review process, 21 articles remained. We then proceeded with an inductive evaluation of the concepts and results in these articles. Concretely, we independently read the article to gain an overview over the academic field. We identified relevant sections of text that provided insights into the characteristics of e-credentials markets. We focused on understanding key characteristics of e-credentials markets. However, we were unable to collect all relevant characteristics of the e-reference markets mentioned in the literature. While some were discussed in detail, for others only limited information was available. Therefore, following Bowen (2009), we simultaneously conducted document analysis of the publicly available descriptions of the e-credentials markets we had identified in the literature. We searched the Internet for official documents that described the cooperation arrangements of the e-credentials markets in more detail and analyzed them. Analyzing these documents had two advantages. First, by studying the documents derived from the national e-ID websites or from supranational institutions such as the Digital Government Factsheets of the European Commission (see Table 2), we identified and analyzed further e-credentials systems that were not identified in the literature. Second, the information from these documents complemented the insights already obtained from the literature. Studying the e-ID reports also enabled us to gather the latest information on e-ID systems. This was particularly important, because the date of publication of numerous studies is far behind and the data were not up to date. We then analyzed the data obtained from the literature and official documents, focusing on e-credentials markets for which sufficient valid data were available. This resulted in a dataset of 14 e-credentials markets, the focus being limited to European countries. We read the literature and the documents several times. Our objective was to inductively identify broad emerging themes and to “determine if there are any systematic patterns among the data ‘worthy’ of further attention.” (Sabherwal & King, 1991, p. 192). Table 2 includes a sample overview over the documents we used.

After analyzing the literature and the documents, we found two main concepts to be particularly important for e-credentials markets: trust in political institutions and economic institutions as well as cooperative arrangement of how the different actors in the e-credentials market are working together. The literature and the document analyses allowed us to get first insights into these concepts as well as to further classify and identify variables that explain the variations between e-credentials markets. In our research, for instance, this initial analysis led to a working hypothesis that in a country, the trust level in the economic and political institutions seems to have a key role in the choice of e-ID systems. To substantiate our assumptions and to enhance our understanding, we conducted interviews with government officials ( n = 4), an IT service provider ( n = 1), private e-ID providers ( n = 3) and online service providers ( n = 4) from the UK, Belgium, the Netherlands, Germany, Hungary, Austria, and Switzerland that are managing e-ID projects. Table 3 includes a sample overview over the interviewees and samples of their thoughts on trust.

Based on the analyses and the interactions with practitioners, we proceeded to define our theory constructs. The main units of any testable proposition – whether enumerative, associative, relational, statistical, or complex (Dubin, 1978) – are the constructs that help to describe the phenomena of interest in the theory. Our theory has two main constructs: cooperative arrangement and trust.

We defined cooperative arrangement as the implicit or explicit agreement between the state and other private or public service providers to collaborate with one another for the purpose of delivering and managing the services required for the digital identification and authentication of citizens in a way that it is equivalent to a paper-based procedure and that complies with the applicable privacy laws. This definition entails multiple implications and limitations of scope. First, many providers of online services (such as Facebook and Google) grant users access to their accounts via a user name and a password (the login credentials). These identities are both how citizens identify themselves to service providers and how service providers authenticate or verify that users are who they say they are. However, we concentrated on state-recognized e-ID. State-recognized means that a government agency acknowledges a person’s real identity. This stands in contrast to the abovementioned example relating to common social media or online services where this usually doesn’t take place. Anyone can create an account under a false name or can have multiple fictitious identities. Second, we acknowledge that different agreement types and divisions of labor between the state and third parties are possible. There may or may not be a legal basis or formalized structures in place that ensure the coordination and integration of services. We did not specify any base requirements or maturity or capability level, which are needed for an e-credentials market to be optimal. Third, we were interested in digital-only identification and authentication services. Hybrid forms are conceivable, where for instance a citizen physically identifies themselves once at the counter of a trusted party (e.g. a bank or a telecommunications provider) and then gains access to certain online services.

By trust, we mean citizens’ expectations that the state or an involved third party (e.g. an IdP or OsP) is capable of providing secure digital services and will not exploit any vulnerabilities inherent in the e-credentials market, such as those caused by a lack of governance, regulation, or improper maintenance and management of technology. As noted, our understanding of trust addresses both interpersonal characteristics (i.e. how citizens feel about technology) and an institutional perspective (i.e. how they perceive the trustworthiness of the state or the economy). Again, our definition implies implications and assumptions. First, we understand trust as a relational (and not an absolute) concept. At any point in time, citizens’ expectations can change based on the actions of an actor in the e-credentials market, such as providing a better service experience, or the lifting or imposing of certain constraints to getting access to e-ID services. Accordingly, what the state does or fails to do (consciously and/or unconsciously) influences how citizens assess the trustworthiness of the other stakeholders in an e-credentials market. The same applies to private service providers. Second, trust exists in an environment of mutuality, i.e. it is both time-bound and situation-specific. Inherent in many analyses of trust is the belief in an innate level of trustworthiness that may be shared among several like-minded persons or large parts of society in a specific situation (e.g. after a specific incident or crisis, such as a pandemic). Third, reflecting on trust only makes sense when we assume that the environment is uncertain or risky. In our case, we have outlined that the e-credentials market is a prime target of cybercrime but also a potential source for boundless profit-making or surveillance by private or public entities. Trust is an expression of predictability. The statement “I trust the governmental institutions” or “I trust the economic institutions” says nothing necessarily good or bad about them, but rather reflects the notion of trust as a prediction of the behavior of a government or a private sector.

3.3 The relationship between cooperative arrangement types and trust

Having outlined the main constructs, we will now define some statements of relationship. According to Dubin (1978), the nature of a specified relationship depends on a theory’s purpose. We seek to develop early substantive (not formal) theory that may help to better explain the choice or dominance of a specific cooperative arrangement in a country’s e-credentials market. The relationships we will now formulate are more associative (A may be linked to B) than predictive (when A, then necessarily B). Thus, we make no claims regarding the future or universal or statistical regularities. Nonetheless, we seek to define statements that can be empirically tested and that may shed light on finding the optimal organizational arrangement, given a specific level of citizens’ trust.

OPEN IN VIEWER

Building on the findings of the trust index of the Institute of German economy in Cologne (Enste & Grunewald, 2017) and our own inductive inquiry, Fig. 2 shows how trust and cooperative arrangements are related. Two distinct clusters can be identified: first, a group of e-credentials markets where only one state-issued e-ID exists; second, e-credentials markets where different cooperative arrangements prevail. The first group includes Greece, Italy, Poland, Portugal, and Spain. They are all characterized by low or moderate trust in the political institutions, yet the state is the only issuer of e-IDs. This is also true for Ireland, which also has a state e-ID. Ireland, for instance, launched MyGovID, which allows citizens to have an online identity. MyGovID is built on the Public Services Card and links a citizen’s physical identity to an online identity. Poland with its pl.ID and Portugal both have similar solutions to Ireland. Greece’s ERMIS, Italy’s SPID, and Spain’s DNIe are used not only to access public services, but also to verify users’ identity in the private sector.

The second cluster, where trust in the government and the economy are both high, is characterized by the existence of different cooperative arrangement types. This cluster also includes the one outlier, Ireland. Besides Ireland, however, the main characteristic compared to group 1 of e-credentials markets group 1, is that private vendors are somewhat involved in e-ID issuance. Belgium, Germany, Sweden, and Switzerland have both state-driven and private solutions. Belgium strongly relies on its state beID solution, which in 2018 was used by approximately five million users for online authentication. Belgium’s citizens also have a private identity scheme, itsme, which was developed by banks and by telecommunication service providers. Likewise, Germany offers an e-ID based on the German identity card neuer Personalausweis (‘new identity card’). Further, various e-ID solutions are provided by private vendors. Unlike Belgium and Germany, Sweden primarily relies on e-ID schemes provided by private organizations such as BankId and Telia e-legitimation. Sweden’s government only recently issued its own e-ID initiative, Freja ID. Finally, Switzerland, a strongly federalist state, does not yet have a national, state-recognized e-ID; some cantons issue their own e-ID, such as the Cantons of Schaffhausen and city of Zug (Canton of Schaffhausen, 2020; City of Zug, 2020). Other cantons such as Grisons use the e-ID scheme SwissID, which is issued by a private consortium of private and semi-public companies.

Interesting constellations can be found in Austria, Denmark, Finland, and the Netherlands, where the e-credentials markets are mainly based on PPPs. Denmark’s government approved a new e-ID solution, MitID, which will replace the existing NemID solution in 2022. The system will be developed in a partnership between the government and Finance Denmark, the Danish banking association. In Austria, there are two e-ID schemes: the Bürgerkarte (‘citizen card’), a PPP e-ID solution managed by A Trust GmbH and e-Identifikation, a private e-ID alternative issued by banks. Finland and the Netherlands are two e-credentials markets where all e-ID system types exist: PPP-based, public, and private e-ID. Finland has a state-issued e-ID (FINeID), which has not achieved widespread use and acceptance among citizens, who prefer the banks’ One Time Password (OTP) scheme. This led to the development of a PPP solution called Tupas in partnership with the banking sector. Mobiilivarmenne is another private e-ID available in Finland. Finally, the Netherlands also has three e-ID schemes: DigiD, a state solution used by around 12 million citizens; eHerkenning, a PPP between the Ministry of the Interior, Kingdom Relations, and the business community; and iDIN, a private system that relies on bank credentials.

To enable empirical testing of our observations and claims, we ended our theory development by defining testable propositions:

H1: In countries where citizens have high trust in government and economy, there is high likelihood of e-credentials markets with competing cooperative models.

Our analysis revealed that, in countries where citizens generally have high trust in both the government and the economy, there is a higher likelihood of more dynamic and competitive e-credentials markets. This could be explained by the fact that citizens may not have a strong preference or are used to (or even demand) options. Also, governments may have high trust in economic institutions, which increases the likelihood of outsourcing certain activities to or engage with private vendors in PPP constellations. A state official responsible for the e-ID implementation said this about mutual trust:

Multiple, competing cooperative arrangements seem not to be perceived as a hindrance, but rather as a possibility to experiment or explore which cooperative arrangement may result as the dominant design in a national e-credentials market with a high citizen adoption rate.

Paradoxically, our analysis showed that state-driven, monopolistic e-credentials markets emerge in countries where citizens seem to have lower trust in the state than in the economy. However, there is a general mistrust toward both the state and the private sector in cases where only a state solution exists. Pointing to the importance of a long tradition of dealing with citizens’ confidential documents, an interviewee noted:

Governments have a long tradition of issuing citizens’ identity documents. A possible explanation may be that they consider e-ID issuance simply as an extension of existing identity documents and therefore as a sovereign task of the state. Even though citizens may distrust the government more than the economy, in these countries, the state usually acts as market-maker. There may be many alternative explanations for this phenomenon, including the culturally or historically high influence of the government to take a dominant role in ‘sensible’ market areas, a reluctance to or ignorance concerning collaborating with businesses, the unavailability of capable and/or trustworthy private vendors, or a risk aversion on the part of private vendors to invest and build an e-ID infrastructure in these countries. Our analysis did not enable us to provide a single coherent answer to this.

Governments play a central role, regardless of whether the trust in them is high or low. Our analysis (see Fig. 2) revealed that even though citizens may trust economic institutions more than a government, this does not necessarily always lead to PPP constellations or to a private e-credentials market. Based on this observation, we hypothesized:

Thus, comparatively high trust in the economic institutions is no guarantee that private entities will be involved in issuing these traditionally governmental tasks. There can be multiple reasons, such as legal requirements that hinder the establishment of a private e-credentials market, or simply a lack of interest among private vendors in entering the market owing to unfavorable financial revenues. Interviews indicated that there are also concerns about the data repurposing by private e-ID providers:

Whether or not these or further factors are decisive must be examined closely in each individual case. Our general conclusion is that high trust in the economic institutions seems necessary, but not sufficient for the emergence of an e-credentials market where the state competes with private sector offerings.