Replacement Scanning in line with BSI TR-RESISCAN

This is the DXC WebScan story of the Ministry of Justice and Migration Baden-Württemberg 

Purpose

As part of the move to a fully digital way of working within the courts and Public Prosecutor’s Public Prosecutor’s offices of the state of Baden-Württemberg, a software was needed that would receive and capture electronic recordings of paper documents. This would then both enable
the further electronic processing of the electronic version of the document as well as the subsequent deletion of the paper-based originals.

In addition, and to be in line with German legislation, the Federal Office for Information Security (BSI) released the technical guideline TR-RESISCAN. As a result, a second key goal for the project was to ensure that the new scan-software was successfully certified with regards to TR-RESISCAN.

Solution

In a joint effort both the Ministry of Justice and Migration Baden-Württemberg and DXC Technology adopted a cooperative and holistic approach to the scan solution as part of the Ministry’s overall transformation program “eJustice“.

Beside the DXC WebScan Team, DXC also provided consulting services in regards to both process and organisational management as well as IT Security. With this comprehensive project execution both oranisational and technical requirements of the TR-RESISCAN where implemented and the project was awarded second place in the eGovernment awards for “Best Modernisation Project” in 2017.

Context

In January 2015 the program “eJustice” started with the goal to transform the way working in the courts and public prosecutor's offices of the state of Baden-Württemberg away from a paper based into a fully digital environment. This transformation would enable 2.5 million legal proceedings (per annum) to move away from paper files and letters by scanning both incoming documents and document archives with the software “eJustice WebScan” as the entry point for future digital solutions introduced within the overall program.

Beside changing the way of working for around 12.000 employees, another important aspect of the program was the introduction of a scanning solution. For this the project “eJustice WebScan” was started, implementing a process to digitalise incoming mail.

Challenges

At the start of the project in 2015 two key goals were defined. The first was to implement the scan solution. The second was to ensure compliance with all German laws by achieving certification from the Federal Office for Information Security (BSI) for the published the technical guidelines TR-RESISCAN to define proper replacement scanning. These guidelines had only be published two years before this project had started. Only this would ensure the digital copies were legally valid and therefore the destruction of the paper originals (instead of archiving them) would be permitted.

Beside the legal aspects, the TR-RESISCAN also specified organisational and IT-Security requirements that must be followed. Only parts of them are connected to the software solution.

Regarding the organisation specifications, the facilities where the solution would be housed as well as the persons using it would need to adhere to specific requirements. The ways of working had to be well-defined, taught and documented. Compliance with these specifications would be required for the handling of classified documents.

At the same time the software DXC WebScan had to follow the defined processes to check and document the work done by each user. Also the storage and transmission of the data had to comply with the IT-Security guidelines. This had to be checked and proven for all locations included in the solution rollout.

Success Factors

The solution was successfully certified in 2019 by the German BSI confirming compliance to TR-RESISCAN for documents up to “normal” integrity and “high” confidentiality and availability. This was a first for a web-based scan-solution in the justice-area and was made possible by three key success factors:

1.  The result of a holistic approach that did not differentiate between software and non-software-related or technical and non-technical requirements.

2.  The automated distribution of the client-software-components and the central administration of DXC WebScan, all software-related aspects of the solution remained consistent throughout the environment even during roll-out.

3.  Since DXC WebScan runs on standard IT infrastructure, that had already been checked regarding German BSI security requirements, the work of the security experts could focus on checking the web-application.