Without much ado the tenders for the road-pricing system for the Netherlands have been started. (See
this and
here).
One of the hot topics in this system is privacy versus security/fraud prevention.
Having a unit in your car that tracks your whereabouts, stores that information for later use by the government triggers a lot of sensivities. Who can access that information? Is Big Brother watching you all the time?
At the same time you want to prevent fraudulent use (evasion of road charge, identity theft) and to be able to contest an incorrect charge in court succesfully.
Bart Jacobs is one of a group of experts in the world who consistently warns us of the dangers of unsafe IT systems, like voting computers. Their main point is that the only safe IT-systems are the ones where the security design is publicized so experts can check and validate the security. Secrecy gives a false sense of security, only when the best minds cannot find a flaw or a way to compromise a system you can have some reasonable confidence in the system. And when bright minds find a flaw, at least you can take corrective measures. Otherwise you might be sleeping through years of fraud unknowingly.
This architecture allows a lot of flexibility while keeping the privacy level as high as you as an individual care for. You can even break up the calculation of the roadcharge in little pieces, to be executed by different providers as you choose it, so nobody has a complete picture but yourself. The system design can be with a "thick" onboard-unit (OBU) that does all the calculations, or a "thin" OBU that off-loads as much as possible to other systems. They present how a "granny", "gadgetfreak" or "geek" would create totally different solutions with or without the help of providers, suited to their wishes.
At the same time it is quite difficult to defraud the system. With a minimal number of spot-checks (less than 1 %) the authorities can verify that the roadcharges calculated are based on actual driving behaviour.
The actual design can be found in the paper (sending committed hashes of trajectories and seperately of roadcharges). In my opinion a very elegant solution. And above all something that can be subjected to the best test possible: of all the bright minds in the world.
(Continued after the break)