IDDEEA's Reaction: Obstructing the Legal Work of a State Institution and Creating Legal Uncertainty

(Patria) - The Agency for Identification Documents, Records and Data Exchange of Bosnia and Herzegovina (IDDEEA) has sent a request to the Patria News Agency for the publication of a denial regarding the text published last night under the title "Badnjević Ignores the BiH Court Ruling: IDDEEA Collects Electronic Signatures of Citizens 'Remotely' Without Legal Basis".

Patria, we remind you, carried this text from the portal Istraga.ba.

IDDEEA emphasizes that "the mentioned publications contain claims aimed at obstructing the legal work of a state institution, creating legal uncertainty, as well as tendentious conclusions aimed at creating general pressure on the Agency and its employees".

We are publishing the complete denial from IDDEEA below.

We are addressing you regarding the untrue claims and legally unfounded interpretations presented on the portal istraga.ba, with the aim of obstructing the legal work of a state institution and creating legal uncertainty, along with elements of tendentious conclusions aimed at creating general pressure on the Agency and its employees.

Namely, at the very beginning of your article, you correctly stated: “Representatives of the Agency for Identification Documents, Records and Data Exchange of Bosnia and Herzegovina (IDDEEA) and the Ministry of Internal Affairs of Sarajevo Canton presented the eDokumenti – CIPS service last week, through which citizens of Sarajevo Canton, as stated, can now obtain CIPS certificates electronically, provided they possess a valid electronic signature deposited with IDDEEA. A few days before this event, which was promoted as an important step towards digitalization of processes and modernization of public administration, the Appellate Panel of the Court of Bosnia and Herzegovina issued a ruling rejecting IDDEEA's lawsuit against the Decision of the Personal Data Protection Agency in BiH. By that Decision, IDDEEA was previously prohibited from assigning electronic identity to citizens without a legal basis, and was ordered to delete the personal data of BiH citizens collected during the testing phase of the citizen electronic identity system”.

However, the rest of your article is not related to the introduction mentioned above at all, but rather it continues with untruths that have been disseminated by representatives from Republika Srpska for months. Therefore, we will repeat the undisputed facts on the given topic to you as well.

Claim 1.: “Despite the aforementioned court ruling and the prohibition issued by the Personal Data Protection Agency, IDDEEA has continued to develop e-services within which it collects citizens' electronic signatures. The Director of IDDEEA, Almir Badnjević, claims that the prohibition does not apply to the eDokumenti service because, as he says, 'electronic identity and qualified electronic signature have nothing to do with each other'.

Denial 1.: “IDDEEA did not develop the eDokumenti e-service; rather, it is an e-service of the MUP KS, as you can verify from the official website: https://edokumenti-mup.ks.gov.ba/.

Claim 2.: “However, it is evident from the ruling of the Court of BiH that, contrary to Badnjević's claims, the electronic signature is mentioned in the largest part of the ruling. As confirmed by the ruling of the Appellate Panel of the Court of BiH of November 28, IDDEEA established a system and processed data in the testing phase that are not prescribed by law, and this system also includes citizens' electronic signatures. Namely, the Law on Electronic Signatures does not recognize the terms 'remote signature' or 'cloud signature', nor does the said law regulate the processing of personal data, so the Agency has no legal basis to issue cloud or remote signatures, given that it is legally authorized to issue qualified digital signatures which are an integral part of the identity card. Therefore, the electronic identity system is not prescribed, so neither remote signature nor cloud signature is regulated, and the Law on IDDEEA BiH does not prescribe this system either – states the ruling of the Court of BiH.”

Denial 2.: The website of the Personal Data Protection Agency of BiH (AZLP) publishes Decision No. UP1 03-1-37-5-148-9/24 of 02.07.2024, which states the following:

I The IDDEEA Agency is prohibited from assigning electronic identity to BiH citizens without a legal basis;

II The IDDEEA Agency is ordered to delete the personal data of BiH citizens collected during the testing phase of the BiH citizen electronic identity system;

III The IDDEEA Agency is prohibited from processing biometric data of visitors and from identifying them by using and comparing with biometric photos and other personal data stored by the original authorities in the Register of Citizens' Identity Cards of Bosnia and Herzegovina;
IV The IDDEEA Agency is ordered to delete the personal data of visitors collected through the Biometric Control and Search System;
V The IDDEEA Agency is obliged, within 15 days of receiving the Decision, to notify the AZLP in writing about the measures taken to implement the issued prohibitions, and to provide evidence of the execution of the ordered administrative measures.

As can be seen, the aforementioned Decision of the AZLP relates to the technical aspects of data processing in the testing phase, and in no way affects the issue of qualified electronic signatures. Therefore, it concerns the testing phase of assigning electronic identity, based on which citizens could also use that electronic signature. IDDEEA immediately acted upon the relevant decision, but also filed an appeal with the Court of BiH. The aforementioned appeal against this decision was rejected by the Court of BiH through ruling No. S1 3 U 048584 25 Uvp of 28.11.2025, stating: “The request for judicial review is rejected”. Therefore, the Court of BiH did not issue any ruling against IDDEEA regarding the issuance of qualified electronic signatures, but confirmed that the aforementioned decision of the AZLP was made in accordance with the law.

Furthermore, IDDEEA subsequently passed a new international recertification of the system according to the EIDAS regulation and adopted new Certification Policies, which enabled BiH citizens to activate their qualified electronic signature by physically visiting one of the RA offices of the IDDEEA certifier.

Claim 3.: “Based on court and administrative decisions, it is clear that IDDEEA currently has no legal basis to collect and deposit remote electronic signatures from citizens. Nevertheless, Director Badnjević decided to ignore the court ruling and exploit a legal vacuum to establish a system for electronic issuance of CIPS, and is tirelessly opening offices for electronic signature activation in cities across BiH these days. Municipalities of Novo Sarajevo, Doboj Jug, Usora, Čitluk, Bihać, Brčko are some of the places where IDDEEA registration offices for the activation of qualified electronic signatures have already been established.”

Denial 3.: The competence of the Agency for Identification Documents, Records and Data Exchange of Bosnia and Herzegovina (IDDEEA) regarding qualified electronic signatures stems from two laws: the Law on the Agency for Identification Documents, Records and Data Exchange of BiH (lex generalis) and the Law on Electronic Signatures of BiH (lex specialis).

According to Article 8, Paragraph (6) of the Law on the Agency: “The Agency is competent for digital signing in the area of identification documents, i.e., it is responsible for electronic certificates and electronic signatures related to identification documents, in accordance with the law regulating electronic signatures.” Thus, the Law on the Agency itself grants explicit competence for electronic signatures, referring to the lex specialis – the Law on Electronic Signatures.

According to Article 2, point f of the same law: “An electronic certificate is a confirmation in electronic form that guarantees that the person who signed the document issued in electronic form has verified their signature with an authorized certification body.” IDDEEA was registered in the Register of Certifiers of the Ministry of Communications and Transport of BiH on April 15, 2022, under serial number 3, thus being an authorized certification body. This makes it the only institution that simultaneously has the legal authority to issue qualified certificates and manage the electronic signature verification process.

The Law on Electronic Signatures of BiH, as lex specialis, further confirms this competence. Article 7, Paragraph (1) stipulates: “The certifier does not require a special permit to commence operations and provide services related to electronic signatures and certification.” Articles 8 and 9 detail the obligations of certifiers issuing qualified certificates, including identity verification, maintaining a register, and applying security standards. Articles 14 and 15 prescribe the technical and security requirements and the accreditation of bodies confirming their fulfillment. IDDEEA uses accredited technical means and procedures, confirmed by the Institute for Accreditation of BiH, and its PKI system was recertified in November 2025 in accordance with international standards and the eIDAS regulation.

The Ministry of Communications and Transport of Bosnia and Herzegovina (MKT BiH), through its Office for Supervision and Accreditation of Certifiers, is the only competent body in the country that decides who meets the conditions to be a certifier (Certification Authority - CA). MKT BiH, through its official announcement and decision, unequivocally confirmed that IDDEEA is registered in the certifiers' registry and lawfully issues qualified electronic certificates for electronic signatures. The MUP RS, Snježana Novaković Bursać, or any third party has neither the legal competence nor the professional capacity to review the decisions of the competent state ministry or to arbitrarily interpret who is a certifier, given that they are not one of the certifiers in Bosnia and Herzegovina, nor are they responsible for assessing the legality of operations in accordance with the Law on Electronic Signatures of Bosnia and Herzegovina (“Official Gazette of BiH”, 91/06).

Your claims, such as those by the MUP RS that IDDEEA “has no legal basis” for qualified electronic signatures, contradict Article 8, Paragraph (6) of the Law on the Agency and the entire Chapter III of the Law on Electronic Signatures. The claim that the Agency is “not authorized” to designate registration bodies contradicts Article 9 of the Law on Electronic Signatures, which explicitly allows the certifier to authorize legal entities to perform registration. The claim that IDDEEA “unlawfully processes data” contradicts Article 8, Paragraph (4) of the Law on the Agency, which states that the Agency is exclusively responsible for the technical maintenance and electronic archiving of data as public property at the BiH level. Selective interpretation of regulations by the MUP RS, Snježana Bursać Novaković, or any third party cannot supersede the valid laws of Bosnia and Herzegovina.

Claim 4.: “For the modernization projects of the document personalization center, network infrastructure, and equipment for personalization and software integration alone, an expenditure of almost five million euros is planned.”

Denial 4.: “IDDEEA fully relocated to the most modern Center for Personalization, Storage, and Transport of Documents in the region at the beginning of 2025. Therefore, it does not plan to spend any additional money on this matter. Furthermore, we inform you that the budget for 2026 has not yet been adopted, so no one can see what anyone has planned. Also, IDDEEA does not express its budget requests in Euros, but in BAM.

Claim 5.: “Istraga contacted several cybersecurity experts who assessed that opening local offices for electronic signatures without first establishing adequate security systems poses a serious risk of possible hacker attacks and theft and misuse of citizens' data. Namely, local IT systems often have insecure networks that are vulnerable to attacks, and the issue of the training of RA office officials to respond to potential security incidents also arises.”

Denial 5.: “Every cyber expert has a name and surname, and if someone stated what you have written, it tells us enough that they do not understand at all how IDDEEA functions, nor do they know anything about our Certification Policies.”

Claim 6.: “Instead of responding to specific legal and security dilemmas, Director of IDDEEA Almir Badnjević is trying to turn the numerous criticisms he is receiving these days into a political problem, accusing those who point out the shortcomings of the existing system of trying to undermine the competence of the state agency. Political interests regarding the work of IDDEEA certainly exist, not only in Republika Srpska where the current government consistently obstructs everything that carries the state prefix, but also in the Federation of BiH. Digital transformation and the 'revolution of public administration' is a priority project of the Minister of Communications and Transport Edin Forto, who insists on its swift implementation, and there is no doubt that Naša stranka will use this segment as one of the key arguments for the success of its political representatives in the upcoming election year. Although the European Commission stated in its 2025 Enlargement Report that there has been no progress in BiH in the area of digital transformation, Forto and Badnjević claim that 'such an assessment does not reflect the actual situation' and that Bosnia and Herzegovina has a digital infrastructure that 'functions according to EU standards'. The question is not whether digitalization should be implemented, but whether it will be implemented legally, securely, and in the interest of citizens, or whether the price of an accelerated 'revolution' will be paid by those whose data is collected in the legal and security gray zone.”

Denial 6.: IDDEEA accuses no one. IDDEEA exclusively denies the untruths being presented to BiH citizens through the media from RS, and we are also witnessing some from FBiH. IDDEEA firmly rejects any political interests from FBiH, RS, or any political party. IDDEEA acts exclusively in accordance with BiH legal regulations and the Agency's adopted Plans and Strategies.

Furthermore, all announcements and acts without legal force serve certain interests from RS and now FBiH for an attempt to derogate state laws in the relevant area and represent a direct attack on the exclusive competence of the Agency, which, in accordance with Article 3, Paragraph (1) of the Law on the Agency, is responsible for the central keeping of records and data exchange. According to Article 8, Paragraph (4), the Agency is responsible for the technical maintenance and electronic archiving of data and information kept in the records, defined as “public property at the level of Bosnia and Herzegovina”. Therefore, the claim that IDDEEA “endangers the security of citizens” is aimed exclusively at creating a sense of insecurity and danger for the Agency's management and its employees, and is contrary to all relevant legal regulations.

Therefore, the claims of individuals from RS, as well as those presented on your portal, are not only legally unfounded but also create serious legal uncertainty and institutional endangerment. Citizens and business entities are placed in a legal dilemma – whether to use the legally qualified electronic signature or improvised entity and private solutions. This jeopardizes the legal certainty of business operations, the functioning of e-government, and the international recognition of Bosnia and Herzegovina's systems. If the instructions of individuals from RS were followed, a legal vacuum would arise: electronic documents would not be valid before courts and international institutions.
Furthermore, correspondence from the MUP RS, as well as articles like this one, further delegitimize a state institution by declaring its work “illegal” and thus directly endanger the safety of employees, as it creates an atmosphere of lynching and political pressure. Such conduct constitutes institutional violence and an attempt to destabilize state infrastructure.

Ultimately, the individuals from RS whom you quote in your article, in this specific case, act as a court, taking it upon themselves to interpret legal regulations, make decisions, and issue administrative measures to local self-government units – which they must not and cannot do. Such behavior constitutes acting outside of legal competencies, misuse of names and positions they hold, intimidation of the business sector, and absolute misuse of the institution for purposes for which it has no legal authorization.

Therefore, the entire legal framework unequivocally confirms that IDDEEA is the only state institution competent for qualified electronic signatures. It has a dual authorization: lex specialis (Law on Electronic Signatures) and lex generalis (Law on the Agency).

Therefore, we call on all institutions and business entities to continue with their regular activities and use of IDDEEA services, as they have full legal coverage for this, confirmed by the competent Ministry of Communications and Transport of BiH.