The (bumpy) road to European Digital Identity

September 21, 2022

by Peeter Vihma

At a recent discussion organised by the e-Estonia Briefing Centre, different experts discussed the new version of the EU’s regulation on electronic identification and trust services (eIDAS) and what can be learned from Estonia’s 20+ year-long experience with digital identity. 

Europe catches up with Estonia

Estonia’s acclaimed digital ecosystem was established already in the 1990s, and the digital identity based on this has become a seamless part of its public services. Based on interoperable databases, secure authentication through x-road and personal identifier number allows access with the same identifier and linkability of medical records, banking, driving licence etc.

However, cross-border use of eID-s has been lacking, and to that end, current efforts of the EU to develop eIDAS are a step in the right direction. Even if  billions in financial benefits are exaggerated, the true value of digital transactions has become evident because of COVID. An opportunity to continue life more-or-less as before, even without physical access to government (or other) offices, is more alluring than ever. Also, the proposed cross-border identification and sharing of records is a push toward creating a true single market in Europe.

In addition, the process of adapting digital identity in Europe can be seen as improving over existing approaches combined with technological progress, which in political science literature is known as policy learning. As such, it can only be applauded.

The curves and bumps of rapid policy learning

Yet, every policy process has its bumps and curves. The first version of eIDAS was ready in 2014 and implemented in 2016. Now, the Commission is already working on an updated version. This accelerating speed of policy updates may seem good, but it is not without its discontents.

The official explanation behind updating the regulation so quickly is that the older version of digital identities was not obligatory for EU countries. As a result, only 14 of them completed their eID schemes which were all different. The new policy will be mandatory for countries, which punishes those who have already achieved more and makes finding a common solution difficult.

Madis Ehastu, Estonian Seconded National Expert at the European Commission who is actively developing the new eIDAS policy, said that one of the key difficulties lies in finding common approaches considering substantial variations in legislations and cultures.

“For instance, eID-s depend on their surrounding ecosystem. If it has been decided that two banks or ministries should not use the same identifier for customers, exchanging data about them is seriously more difficult than in Estonia where a common personal identifier is used across organisations and domains,” he commented.

Second, technological development processes’ logic may not match quick policy development. According to Laura Kask, CEO of Proud Engineers, a consultancy for digital development, the full adaptation of new technologies takes 7-8 years. The policy process of elections is much faster, and politicians may lose patience.

“As an example, also Estonian ID-card took several years until it could be used for the variety of services we see today. We need enough time to allow people and businesses to get used to new solutions,” she said.

Thirdly, rapid policy change is detrimental to investments and development. According to Kalev Pihl, CEO at SK ID Solutions, the company behind much of the technology used in Estonian digital identity, the sales of digital identity solutions in Europe have virtually halted in anticipation of the new regulation.

“The new policy is promising an “EU wallet” and “EU identity” to be available for everyone and mandatory to issue and use for service providers. It is such a large shift in mindset and no real data on what it involves that it is hard to prepare for it practically. There are many questions in the air and leaders in public and private sectors are reluctant to make decisions until they are answered,” says Mr Pihl.

Identity management: state vs business

At the same time, tech giants like Apple and Google are developing their own digital identity solutions. This is not bad. But some voices advocate for relying more on existing technological solutions instead of developing state-centred ones. According to the discussants, this may be a mistake, but as much of the mistake would be to ignore that or go against it.

The main issue boils down to privacy vs comfort. People may be willing to forgo a bit of their privacy for services (such as personalised medical treatment), but the governments have to assure that this trade-off is a fair one. At the same time, the discussants pointed out that in many countries trust in the government’s handling of personal data is low. Still, we can justly ask, how much of this trust exists in tech giants?

“States and tech giants have completely different aims for identifying their “clients”, “says Mr Pihl. “Tech giants are not so much interested in data integrity, in making sure that the single person is connected to a single account or that they know everyone, but more about profiling, so that they can raise the sales value of their user base. This is well displayed to the public in the debate in Twitter valuation and interpretation of the user amounts there.”

Currently, the European Commission aims to develop its own eID solutions, which will compete with the tech giants’. In doing so, EC should learn from the tech companies’ successes, such as user comfort, and develop their own accordingly. Otherwise, the clients will not start using the app the European Commission is providing.

“In addition to developing an interoperable Wallet solution, we also depend on other policy domains,” says Mr Ehastu. “For example, the authorities in charge of driving licences in all EU countries should mutually recognise digital licences from other countries, even when they are presented on a mobile phone.”

What to learn from Estonian experience?

Since Estonia has successfully used digital identity for three decades, the country can offer some suggestions. According to Ms Kask, there are two main ones.

First, identity, it’s handling, authentication, and technical solution should be centralised within countries. Without it, the adaptation of any digital solution suffers. Also, without one responsible entity in charge of maintaining accurate data of individuals, the responsibility will windle, and data quality will suffer.

Second, there should be a multitude of carriers and tools for identification. In this, Estonia offers a crucial example from the ID-card crisis of 2017. Back then, the ID-card chips were under potential attack and Estonia had to suspend the certificates of 750 000 ID-cards, but this did little to disturb transactions because mobile-ID identification functioned well. Now, there are at least four ways of using digital identification (ID-car, Smart-ID, mobile-ID, and PIN-calculator for banks), all following the same framework and principles. This offers high resilience and is user-friendly.

We wish goodspeed for the new digital identity regulation and hope these lessons can smooth the way for new policy development and adaptation.

Resouce: e-estonia

“Digital signature is a wonder” – an expatriate shares her experience in Estonia

September 19, 2022

by Erika Piirmets

“I have to confess, I did not know about Estonia whatsoever before I met an Estonian in Brazil during my student exchange,” says Dalisa, born in Mexico City, but living in Estonia for already 7 years. “But now I am absolutely enchanted, and I call Estonia my home.”

From that encounter with an Estonian, Dalisa was curious to learn more about this distant country, so in the summer of 2015, she landed in Tallinn, equipped with a backpack full of clothes for only a week’s stay. Since then, she hasn’t left.

“As we were getting ready to land, I could get a glimpse of the landscape and thought to myself how different this country is, nothing I had seen before, with all these woods, bogs and water all around – so many lakes and rivers.” A few weeks of summer in Saaremaa convinced Dalisa to stay in Estonia.

When asked about her visa and permanent residency applications, she admits it “being a bit of a hassle in the beginning. As I was about to marry the Estonian I met in Brazil, then the most curious justification I had to present from Mexico was the proof of me being unmarried. But thanks to having already judge’s appointments registered in Estonia, my visa was extended so I could follow through with all legalities. I took it quite natural that my birth certificate and other documentation had to be sent to me from Mexico, translated into English and apostilled.”

From the moment Dalisa got married and presented all the required documentation until she received the residence permit, approximately a month had passed. “I was impressed how smooth the process itself was, including the possibility to book all the appointments online beforehand,” remembers Dalisa.

Mandatory National Identity Card and eID

Estonian ID card is a mandatory document issued by the Police and Boarder Guard Board (PBGB) for all Estonian citizens. An ID card is issued also to the citizen of the European Union who holds right of residence in Estonia. Additionally, a residence permit is also issued to foreigners who are not citizens of EU member states and who are in Estonia based on a residence permit or right of residence. Due to the digital component of the cards mentioned, it is convenient, easy, and secure to use electronic services.

99% of public services are available digitally in Estonia via valid eID carriers and can be accessed by the citizens and residents alike. From safe authentication and legally binding digital signing to the consumption of convenient e-services – all these are at your fingertips thanks to the government-issued electronic ID.

“In all fairness, back in the day when I had just gotten the eID, my partner then was a great help in introducing me the procedures. But I experimented a lot on my own, and all the transactions seemed so intuitive to me that I had no problems with getting used to the e-services,” recalls Dalisa.

However, learning to use eID or e-services does not have to be a journey you need to figure it out yourself. Free public courses have been provided for many years to all interested in acquiring ICT skills or curious to understand how Estonia’s e-state functions. Over 10% of the population received ICT training in just a few years. Governance tools based on electronic ID are also available to enhance inclusion and democracy, such as the petitions portal rahvaalgatus.ee where, to this day, a virtual environment to practice your digital signature is available. So, you will know what to do when the real signing will take place

How accessible is (digital) Estonia?

“I experienced a language barrier in the beginning, as I discovered that many digital services were described in detail in Estonian but when I switched over to English, a mere summary was provided. I believe this barrier has reduced significantly, not only because I speak Estonian, but because I have also seen the quality of the translation of services increase over the past years. There is still much work to be done, but I love this step towards inclusiveness and solidarity.”

Estonia is a small but sparsely populated country. “Having lived in Tallinn and Tartu, I have always had access to additional training programmes and also to fellow expat-community groups that function as a wonderful peer-to-peer support network. But I imagine people, especially foreigners, might feel cut off in more remote areas. Yes, the e-services are available regardless of location, but the support might not be.

I appreciate that even in the most remote locations, you can always pay by card. I have drastically reduced the use of cash since I moved to Estonia, and I enjoy the comfort it gives me. Village shops, festivals, not to mention restaurants, supermarkets, or public offices, all have a card terminal at my disposal to make fast cashless payments,” says Dalisa.

Any favourites among e-services?

“The standard for all countries should be Estonia’s e-Health system. I truly appreciate all my medical data being made available in one portal. Both public and private medical service providers contribute to creating a wholesome dataset of my health. This is the essence of the citizen-centric approach as my freedom to have an appointment with any medical specialist I choose is fully respected. I still benefit from the government’s Patient Portal and trust it to have wholesome data available to me. Moreover, the legal rights that come with my data and my possibilities to execute them are outstanding.”

Dalisa

In Estonia, the ownership of personal data lies with the respective citizen, the data does not belong to the authority storing it. Deriving from this principle, the Patient Portal offers the possibility to, temporarily or definitively, lock any data corresponding to the individual from the medical specialists. This gives people the liberty to display medical data as they please. Additionally, the Patient Portal enables people to submit statements of intention (organ donorship, blood transfusion, or body donation).

“Gone are the days when I spend the first minutes of my doctor’s appointment retelling my medical history. The Patient Portal is an evidence-based updated data source, so my doctor could spend their time treating me and not waste time on duplication. Also, e-Prescription is extremely convenient – I will never lose another medical prescription again, and in case I need a refill, a quick call to my doctor will be needed, and fairly fast I can buy the medicine from the pharmacy using the ID card,” Dalisa shares her experience.

Is it worth learning to use eID and digital services?

“I believe the COVID pandemic was a big wake-up call to many governments around the world realising they might not meet the needs in changed conditions. Even though I was familiar with Estonia’s digital capabilities, I was still amazed to see how life carried on, as usual, just a little more remote.

I established an NGO recently while being physically in Germany. Even though I am not a native Estonian, I went through a culture shock similar to what Estonians might feel living abroad – now exposed to endless bureaucracy, loads of paperwork and hours wasted trying to sort through all the documents. I couldn’t handle the tiresome procedures after being completely spoiled by fast, hassle-free, and convenient services in Estonia.”

Compared to Estonia, other countries are lagging far behind was the thought that went through Dalisa’s mind while she was digitally signing her founder’s agreement from across Europe with a co-founder based in Estonia.

Dalisa works as a Project Assistant at International Organisation for Migration (IOM), a UN agency, and is a founder of International Women’s Network in Estonia.

Resouce: e-estonia

This year’s Tallinn Digital Summit will focus on delivering trusted connectivity

September 6, 2022

Tallinn Digital Summit (TDS) has evolved into an annual digital flagship event, bringing the newest in cutting-edge human-centered digital policy and offering a successful platform for launching new topics in the global arena.

TDS brings together leaders from like-minded and digitally-advanced countries, international organisations, and the private sector to address the most pressing issues of today and tomorrow. Based on the practical experience gained in Estonia and that of like-minded friends, we seek to push the dialogue, partnerships and practical projects towards a more transparent, secure, and accountable future based on values.

Trust is the core principle of our approach toward the digital presence and future. Trusting the governments, trusting the technology, trusting the connectivity, be it physical, digital or virtual. Yet, we see that our road to the digital future, built upon our shared democratic values, has collided with the grim realities of geopolitics and the malign influence of autocracies. Our democracies seek to harness digital transformation to build a more accessible, prosperous, and sustainable future. In contrast, autocracies seek to exploit technology to inflict coercion both at home and abroad. In today´s reality, we need to seize the moment and stand decisively as a united front against authoritarianism and for trusted partnerships based on shared interests, democratic values and the highest standards – the very essence of trusted connectivity.

At last year’s Tallinn Digital Summit, Estonia introduced Trusted Connectivity as a shared conceptual framework to consolidate and amplify the many connectivity initiatives of like-minded democracies. This year’s Summit will focus on delivering trusted connectivity through trusted partnerships. The Summit will build bridges among various connectivity initiatives and elaborate on what constitutes a trusted and secure digital society. Also, giving concrete steps for governments, financial institutions, international organisations, technical experts, and the private sector to take to ensure our democratic values, our commitments to human freedom and human dignity, and the rules-based international order prevail.

We will explore the role of trusted connectivity and partnerships across global stability, supply chains, energy, economic and cyber security, digital policy, international standards, artificial intelligence, clouds and satellites, digital public goods, and Web 3.0. An essential part of our discussion will be how these topics will support the reconstruction of a free and democratic Ukraine.

To put the ideas into practice, it needs political, institutional and entrepreneurial ecosystems and increased public and private investments in connectivity. And we need trust, an architecture of trust within the international system where plurilateral arrangements, such as the transatlantic alliance, G7, and the Quad, play a central role in ensuring a democratic, values-based and prosperous future.

For more information: digitalsummit.ee
To watch the event online, please register here: https://1oulbfcw.sendsmaily.net/landing-pages/c2150bf2-b79c-46b5-b0d6-f5d074398b31/html/

Resouce: e-estonia

Estonia to pilot a national mobile app based on the Ukrainian Diia application

September 2, 2022

Estonia and Ukraine have signed a cooperation agreement in Kyiv to promote an exchange of experiences in digital transformation. The work focuses on cyber security and national digital solutions.

According to the Minister of Entrepreneurship and Information Technology Kristjan Järvan, Estonia and Ukraine have learned a lot from each other in the course of their cooperation to date, which has helped with preparing for crises. “Cybersecurity is one of the cornerstones of national security, as in addition to physical combat, active battles are increasingly being fought online. Ukraine’s success in countering cyber attacks shows that the exchange of knowledge between the two countries is fruitful,” said Järvan. Järvan noted that Estonia is one of the most highly valued advocates of cybersecurity in the world and local experts have consistently advised Ukraine in increasing the country’s cyber resilience. “Estonia continues to offer Ukraine broad-based assistance in ensuring cyber security both during the current brave fight against Russia and in the future,” the minister assured.

Järvan added that Ukraine sees Estonia as the key partner in developing its digital government, as we are one of the most innovative and developed digital societies in the world. “Estonia is happy to promote the integration of Ukrainian digital services with Europe, supporting their cyber capability and continued work on creating a digital state,” said the minister.

“Estonia was the first country whose´​example we followed when we started establishing the Ministry of Digital Transformation. Their vision of digital transformation and the creation of a digital state inspired and inspires us to launch services in a few clicks. It is very nice that now Estonia will be able to adopt our mobile first-state experience, where all important data and services are right in the smartphone,” said Deputy Prime Minister and Minister of Digital Transformation of Ukraine, Mykhailo Fedorov.

As part of the cooperation agreement, Estonia and Ukraine plan to increase cooperation in developing user-centered and mobile-based digital government. The Estonian Information System Authority and Ukrainian agency Diia shall pilot a national mobile application based on the Diia application in Estonia.

Cooperation between Estonia and Ukraine has quite a long history. The first large project, EGOV4UKRAINE, was led by the e-Governance Academy – between 2016 and 2021 – and it laid the digital architecture for current developments. Today e-Governance Academy (eGA) is tasked with harmonizing Ukraine with the EU Digital Single Market and implementing the EU-Ukraine Association Agreement. European and Ukrainian experts are cooperating to develop Trembita, state registers, digital identity, e-services and strengthen cybersecurity capabilities. Thus, it is paving the way for even closer embeddedness of Ukraine into Europe.

Estonia has a lot to learn from Ukraine

Undersecretary for Digital Transformation Luukas Kristjan Ilves emphasized that the capability of Ukraine’s digital government has grown rapidly in recent years. “In the last five years, Ukraine has built a powerful digital state, which follows Estonia’s lead in many ways. Ukraine’s data exchange layer Trembita was developed by the Estonian company Cybernetica and is very similar to our X-Road. Ukraine has also relied on our experience in creating its digital identity and many sector-specific services. We have much to learn from Ukraine, whose new services are user-friendly and mobile-based. During the war, Ukrainians have demonstrated incredible agility, creating completely new e-services within days and weeks,” said Ilves.

Estonia considers it important to ensure that sharing digital government experiences and code goes both ways. “Estonia contributes to developing digital public goods to make our digital government more effective and sustainable. Therefore we cooperated with Finland to create NIIS for the joint development of X-Road and contribute to the GovStack initiative,” Ilves explained.

Cybersecurity-related cooperation between Estonia and Ukraine is also mutually beneficial. Since the start of the war, Estonian authorities have supported the continuity of Ukrainian digital government services and boosted Ukraine’s resilience against cyber attacks. According to Ilves, this cooperation also benefits Estonia. “By helping to ward off attacks against Ukraine, we also boost our own ability to defend ourselves from cyber attacks. We also learn from Ukraine’s experience in ensuring the uninterrupted functioning of both its communications networks and e-services in a state of war,” said Ilves.

Ukraine and Estonia are also planning to deepen cooperation in the international arena. Ukraine is on the road to membership in the NATO Cooperative Cyber Defence Centre of Excellence located in Tallinn at the invitation of Estonia, which is also inviting Ukraine to participate in various international projects. “I am convinced that the development of Ukraine’s digital society will continue on a positive course after the war has ended. The partnership with Ukraine makes us both stronger and contributes to the security and digital development of Western societies in general,” said Ilves.

Resouce: e-etonia