What can Estonia offer to the European digital identity?

February 26, 2024

by Peeter Vihma

Estonia introduced digital identity more than 20 years ago. It is the cornerstone of the functioning e-Estonia that connects the physical identity to an electronic identity in cyberspace. In light of the updates to the current eIDAS directive, we discuss how Estonia has influenced the new European regulation. And what Estonia has to offer for its implementation.

Arguing for an interoperable Europe

During the development of the eIDAS 2 regulation, all European countries were duly consulted. With the fast developments in digital identity technologies and use cases, there is no shortage of extremely competent specialists. So, instead of technical discrepancies, the discussions on the European level have mostly been between schools of thought.

“The two general principles — that all member states must issue an eID and that everyone can give an electronic signature that is equal to a handwritten signature were Estonia’s positions that we defended in the negotiations and that were eventually included at a generalised level,” says Mait Heidelberg, counsellor to the ministry in the Ministry of Economic Affairs and Communications on information society issues.

“For one, being so used to using digital identity, Estonia has always wanted secure, sensible electronic identity tools to be available all over Europe. For two, electronic signing is so widespread in Estonia that Estonians often encounter problems in other European countries. Where the ideas about electronic signatures are different or absent. As with the new eIDAS regulation, both of these issues seem to be solved; this is a very good development from our point of view,” says Mr Heidelberg.

One of the key developments proposed in eIDAS is the electronic identity wallet. The wallet is an app that can be used for identification, signing, and storing digital documents safely on a mobile phone. For Estonians, this would be a nice development which would build on existing eID and interoperable systems. In many other countries, the wallet would actually make the eID more popular.

“For Estonians, having an digital identity in itself is important. Everyone uses it daily. If we finally have something like a wallet in our mobile phone, it is reasonable to put various other attestations besides the identity,” says Riho Kurg, architect at the Information System Authority’s (RIA’s) electronic identity department.

“However, in many European countries, it is the reverse. For example, the Austrian wallet lets you put a driver’s license in it. Since people want to have their digital license, they will get a wallet. But to make full use of the wallet’s other possibilities, such as electronic signatures, people apply for an ID card that is otherwise not compulsory.”

Estonia offers a security solution that works

Since the first eIDAS regulation in 2014, new technologies have become available that can alter the way the security concerns of the wallet can be addressed. Since some of these have come from Estonian companies such as Cybernetica, Nortal and SK ID, we can provide new solutions that were not thought about previously.

“In developing the wallet for a mobile phone, people are naturally concerned about how it is kept safe,” says Riho Kurg. “Indeed, security features of mobile phones by Samsung or Apple or others can be very good. And we know that, for example, Singapore uses a mobile security element in its wallet. But relying on mobile phone security features may be an issue.”

“The first question is whether they will ever get certified or the manufacturers are even interested in certification. Europe is a relatively small market. This whole topic of trust services is very “foreign” when viewed in America or Korea,” explains Mr Kurg.

“The other thing is that we will be dependent on the latest models of phones. Quite a few people either don’t have the latest model or never want one.”

Estonia is developing its wallet on technologies independent of mobile hardware. The “split-key” technology it relies upon is actually being used in a “smart-iD” app. A large percentage of Estonians have been using it, and it has been recognised as a QSCD (Qualified Signature Creation Device) since 2018.

“The benefit of our wallet is that we can already share our European experience that such solutions exist, and they work well,” says Mr Kurg. “What we need to make sure is that this is recognised also elsewhere in Europe. If the regulation states that the private key must always be in one place, this technology won’t work. Luckily, we are not alone; the Netherlands are arguing for the same principle.”

Implementing eIDAS 2 for creating a lasting change

eIDAS is still quite fresh, and some of the aforementioned questions still hang in the air. The technical implementation of the identity wallet is yet to come. A legitimate question is whether the dream of interoperability in Europe can be achieved after all. At least everyone interviewed for this article seems to be carefully optimistic.

Laura Kask, Legal expert and CEO of Proud Engineer, a consultancy, suggests that eIDAS is a step in the right direction. It forces countries to issue an electronic identity. With this, for example, entering state portals to get immediate information about state services in other countries should become possible soon.

“However, in the hope that in the tailwind of eIDAS, we will quickly develop more profound interoperability between countries, I am not very optimistic. This would require that we think about identity in a similar way. But identity is very much a cultural issue,” says Ms Kask.

More probable is the quick development of interoperable business register solutions. There are not such big cultural differences in Europe with the identification of companies.

Substantial hope comes from the consortia that are focused on a specific domain. Estonia is engaged in one, named Potential, which aims to develop an interoperable driving license.

“The developments are promising. Besides us, RIA, and the IT companies, the Estonian Transport Administration is on board and very enthusiastic,” explains Mr Kurg. “They are actually looking to add the vehicle’s registration certificate into the wallet, too. The technical standards are ready for the driver’s licence, and we are waiting for the lawyers to do their part.”

With the enthusiasm and working examples developed in Potential and other consortia, Europe is proceeding case by case towards international interoperability. New eIDAS regulation is just the first push. This can lead to a wider and deeper cultural turn regarding how we think about electronic identity in Europe.

Riho Kurg’s photo: Rene Riisalu
Laura Kask’s photo: Jaana Süld

Recouse: e-estonia

The (bumpy) road to European Digital Identity

September 21, 2022

by Peeter Vihma

At a recent discussion organised by the e-Estonia Briefing Centre, different experts discussed the new version of the EU’s regulation on electronic identification and trust services (eIDAS) and what can be learned from Estonia’s 20+ year-long experience with digital identity. 

Europe catches up with Estonia

Estonia’s acclaimed digital ecosystem was established already in the 1990s, and the digital identity based on this has become a seamless part of its public services. Based on interoperable databases, secure authentication through x-road and personal identifier number allows access with the same identifier and linkability of medical records, banking, driving licence etc.

However, cross-border use of eID-s has been lacking, and to that end, current efforts of the EU to develop eIDAS are a step in the right direction. Even if  billions in financial benefits are exaggerated, the true value of digital transactions has become evident because of COVID. An opportunity to continue life more-or-less as before, even without physical access to government (or other) offices, is more alluring than ever. Also, the proposed cross-border identification and sharing of records is a push toward creating a true single market in Europe.

In addition, the process of adapting digital identity in Europe can be seen as improving over existing approaches combined with technological progress, which in political science literature is known as policy learning. As such, it can only be applauded.

The curves and bumps of rapid policy learning

Yet, every policy process has its bumps and curves. The first version of eIDAS was ready in 2014 and implemented in 2016. Now, the Commission is already working on an updated version. This accelerating speed of policy updates may seem good, but it is not without its discontents.

The official explanation behind updating the regulation so quickly is that the older version of digital identities was not obligatory for EU countries. As a result, only 14 of them completed their eID schemes which were all different. The new policy will be mandatory for countries, which punishes those who have already achieved more and makes finding a common solution difficult.

Madis Ehastu, Estonian Seconded National Expert at the European Commission who is actively developing the new eIDAS policy, said that one of the key difficulties lies in finding common approaches considering substantial variations in legislations and cultures.

“For instance, eID-s depend on their surrounding ecosystem. If it has been decided that two banks or ministries should not use the same identifier for customers, exchanging data about them is seriously more difficult than in Estonia where a common personal identifier is used across organisations and domains,” he commented.

Second, technological development processes’ logic may not match quick policy development. According to Laura Kask, CEO of Proud Engineers, a consultancy for digital development, the full adaptation of new technologies takes 7-8 years. The policy process of elections is much faster, and politicians may lose patience.

“As an example, also Estonian ID-card took several years until it could be used for the variety of services we see today. We need enough time to allow people and businesses to get used to new solutions,” she said.

Thirdly, rapid policy change is detrimental to investments and development. According to Kalev Pihl, CEO at SK ID Solutions, the company behind much of the technology used in Estonian digital identity, the sales of digital identity solutions in Europe have virtually halted in anticipation of the new regulation.

“The new policy is promising an “EU wallet” and “EU identity” to be available for everyone and mandatory to issue and use for service providers. It is such a large shift in mindset and no real data on what it involves that it is hard to prepare for it practically. There are many questions in the air and leaders in public and private sectors are reluctant to make decisions until they are answered,” says Mr Pihl.

Identity management: state vs business

At the same time, tech giants like Apple and Google are developing their own digital identity solutions. This is not bad. But some voices advocate for relying more on existing technological solutions instead of developing state-centred ones. According to the discussants, this may be a mistake, but as much of the mistake would be to ignore that or go against it.

The main issue boils down to privacy vs comfort. People may be willing to forgo a bit of their privacy for services (such as personalised medical treatment), but the governments have to assure that this trade-off is a fair one. At the same time, the discussants pointed out that in many countries trust in the government’s handling of personal data is low. Still, we can justly ask, how much of this trust exists in tech giants?

“States and tech giants have completely different aims for identifying their “clients”, “says Mr Pihl. “Tech giants are not so much interested in data integrity, in making sure that the single person is connected to a single account or that they know everyone, but more about profiling, so that they can raise the sales value of their user base. This is well displayed to the public in the debate in Twitter valuation and interpretation of the user amounts there.”

Currently, the European Commission aims to develop its own eID solutions, which will compete with the tech giants’. In doing so, EC should learn from the tech companies’ successes, such as user comfort, and develop their own accordingly. Otherwise, the clients will not start using the app the European Commission is providing.

“In addition to developing an interoperable Wallet solution, we also depend on other policy domains,” says Mr Ehastu. “For example, the authorities in charge of driving licences in all EU countries should mutually recognise digital licences from other countries, even when they are presented on a mobile phone.”

What to learn from Estonian experience?

Since Estonia has successfully used digital identity for three decades, the country can offer some suggestions. According to Ms Kask, there are two main ones.

First, identity, it’s handling, authentication, and technical solution should be centralised within countries. Without it, the adaptation of any digital solution suffers. Also, without one responsible entity in charge of maintaining accurate data of individuals, the responsibility will windle, and data quality will suffer.

Second, there should be a multitude of carriers and tools for identification. In this, Estonia offers a crucial example from the ID-card crisis of 2017. Back then, the ID-card chips were under potential attack and Estonia had to suspend the certificates of 750 000 ID-cards, but this did little to disturb transactions because mobile-ID identification functioned well. Now, there are at least four ways of using digital identification (ID-car, Smart-ID, mobile-ID, and PIN-calculator for banks), all following the same framework and principles. This offers high resilience and is user-friendly.

We wish goodspeed for the new digital identity regulation and hope these lessons can smooth the way for new policy development and adaptation.

Resouce: e-estonia

Will machines replace us all? The end of human work can wait

January 2019

by Federico Plantera

We all know the story, it’s something we’ve heard pretty often in the last couple of years – robots are taking over, machines will be the new workforce, humans will have to find something else to do. But is that quite the case?

Although it is true that robots and AI-based technologies are having a huge impact in certain sectors, such as deliveries and customer care to name a few, it is safe to assume that machines are not actually going to definitively take over most of our jobs in twenty years from now.

Various media outlets, or even tech executives in some cases, have pushed this narrative quite far in recent times. Examples can be found not only on the BBC, but also on The Guardian, on blogs, and of course on less prominent sources too. It seems that humanity is actually faced with an industrial revolution that will pose a serious threat to the structure of society and its institutions as we know them. If medical experts, writers, lawyers, accountants, front-desk bank operators can be replaced by machines, then let’s not even think about what could happen to factory employees, the unskilled workers, or the lower strata of the income distribution.

Let’s put the catastrophism aside and look at the data – a good exercise sometimes way too easily forgotten. According to authors Carl Benedikt Frey and Michael A. Osborneand their 2013 report, relative to the US context, about 47% of the States’ total employment is at risk due to automation. And it seems accurate if we look at occupations. Concerned much? You can check how likely is your job to be replaced by robots, just by typing your occupation and seeing the score it gets. But indeed, occupationis the magic word.

The authors are addressing a phenomenon called occupational change. It happened in the past, it’s happening now, it will happen in the future. For those not familiar with the debate, occupational change is related to the process of disappearance, creation, and transformation of jobs in the labour market – determinants, external collateral factors, dynamics. If we decide to stick with the analysis provided by Frey and Osborne, in about twenty years we will be ready to pack our stuff and dedicate ourselves to a life of otium, while only a few people will be able to keep their office duties safe from the revolution of work. And though technological advancements are not the only factor impacting the structure of our labour markets, the significance of such changes remains undeniable.

But what gives us hope, and why we can assume that that’s not what is going to happen? First of all, let’s shift the focus from occupations as a whole to a smaller unit of analysis – tasks. A recent study by Katharina Dengler and Britta Matthes published on Technological Forecasting and Social Change (2018) shows how the numbers are not wrong, and if we take into account entire occupations, about 47% of the workforce in Germany (country of reference for the study) in 2013 is engaged in jobs with high automation replacement rates. However, if we assume that only certain tasks can be substituted, 15% of the employees are at risk. Fun fact: occupations concerned with the production of technology, with business management, and with the IT sector, appear to be in the top 5 categories with the highest likelihood of being replaced by machines.

Percentage of substitution potentials by occupational segments in Germany, 2013. Source: Dengler and Matthes (2018)

In order to understand how technological change will trigger jobs transformation, and what we can do to limit the shortcomings of such disruption, we spoke to Luís Ortiz Gervasi, Associate Professor at Pompeu Fabra University in Barcelona (Catalonia, Spain) and expert in the field of labour market studies and employment policies. In Europe, we will witness an unevenly polarized occupational change, “where growth is going to be steeper in the upper part of the job quality distribution, with the bestoccupations paying off more, while the worst ones are going to grow as well and much more than the middle ones”, Ortiz says.

“It’s not only about technology, as if politics do not count at all, but that is one of the factors that can make income inequality increase more acutely”, Ortiz warns, with the result of fostering conflicts already present in the society between locals and migrants, or the losers and winners of globalization. Institutions and policies, then, will likely have the responsibility to compensate for the inequalities that partly will be generated by technological change.

In a recent interview on e-Estonia, Rene Tammist, the Estonian Minister of Entrepreneurship and Information Technology, posed the attention on how we should focus on the development of work-related digital skills, but also vocational education and academic studies. The nature of the Estonian labour market still presents a high demand for ICT specialists and highly trained workers, but skills remains a keyword of extreme importance, as also highlighted by a piece on Politico.eu.

Aside from specialization in ICT, what are the skills of the future in line with the forecasts and that will shelter workers from being replaced by machines? “Creative skills, social skills, et similia. But it’s not only a matter of skills, as much as of an effort to rethink tasks: we should focus on developing tasks within occupations, trying to adopt a human resource management approach, and designing jobs in a way that can make technological elements compatible with human capital development”, Ortiz states. Among the tools and policies that can make it work, “vocational training is an institution that is quite salient, in particular, durable vocational training. Then welfare measures, and Active Labour Market Policies (ALMP) to improve the employability of the labour force that we feel could be insufficiently trained once it is already in the labour market”, Ortiz concludes.

Everything’s not lost. It’s not that we need a message of encouragement, but it is somewhat comforting to know that the end of work is not as close as we may think. David Autor, Professor and Economist at MIT (US), puts it very clearly: “Automating some subsets of those tasks [within occupations] does not make the other ones unnecessary, it makes them more important, and it increases their economic value”, he states. We stand by that, valuing technological innovation and valuing people, together. The way work will look like in the future is not determined by an unforeseeable divine will, but by the direction we want to give to growth and development in society.

Source: e-estonia

Net Group bags top prize on Estonia’s first e-governance hackathon competition

December 2018

The runner-up was the Proekspert team who solved the problem regarding the inefficiency of museum inventories, which had been set forth by the Ministry of Culture. Third place went to the application intended to automate the company name verification process in the e-Business Register upon setting up a company, created by the Flow-Itteam. Several additional special prizes and mentions were granted as well.

Nineteen IT enterprises presented their solutions in the competition for new e-governance solutions, organised by the Ministry of Economic Affairs and Communications and Garage48. Net Group, who offered a solution to the problem raised by the Emergency Centre regarding submission of images and videos during emergency calls, was chosen as the winner.

“The three-day hackathon was our test project on how to conduct this type of a competition in regard to resolving the challenges of e-governance. We wish to carry out several other similar events in the next two years and we hope to see familiar faces as well as new companies and state authorities participating,” noted Rene Tammist, Minister of Entrepreneurship and Information Technology.

“I hope that this year’s hackathon results in the continuation of actual cooperation between various state authorities and companies. Several solutions developed during the event are ready for use after finishing touches and would increase the efficiency and simplify state functions, as well as make them more user-friendly,” added the minister.

The development campaign, which was carried out from 12 to 14 December at the Telliskivi Creative City, saw companies seeking solutions to real problems in the public sector over the course of 48 hours.

In the hackathon, 18 companies (listed in alphabetical order) presented their solutions to problems set forth by 14 state authorities: AlphaBlues, CGI, Credit Info, Datel, Finestmedia, Flow-it, Fujitsu, Helmes, Mikaels Labs, Mooncascade, Net Group,Optimist Digital, Producement, Pro-Ekspert, Reach U (two teams), Taltech, TIIM B, Vumonic.

Source: Ministry of Economic Affairs and Communications

Estonia’s Online Voting Would Solve A Lot Of Our Election Problems

 By alev Leetaru

As US voters went to the polls Tuesday, many encounteredthe myriad inevitable breakdowns of America’s obsolete voting technology. From machines running versions of Windows that were discontinued half a decade ago to malfunctioning scanners and even missing power cords, not to mention lines snaking around the block, voting in America today can be a disaster. It doesn’t have to be this way and Estonia’s electronic voting system offers a vision of what voting of the future will look like.

Despite its small size, Estonia has become a global model of the power of a fully digital government to serve its citizens. While the US helped usher in the modern web and brought the world everything from search engines to social networks, it has focused nearly exclusively on commercializing the web as a consumer product. It was Estonia that pioneered how to harness the web for governance.

Estonia offers a truly remarkable story of what is possible when a Silicon Valley mindset is applied to reimagining how governments can serve their citizens. Instead of focusing a nation’s engineers on how to get their fast food faster or a luxury chauffeur on demand or an internet connected organic juicer, Estonia shows what happens when you instead focus on how to use the digital world to power a democracy. In Estonia it takes just a few mouse clicks and less than five minutes to file one’s taxes, about the time it takes to place an online shopping order here in the US.

For all the talk in the US over the past decade of revolutionizing our governmental functions through technology, the reality has been disappointing, to put it mildly.

Instead, in Estonia, nearly every interaction an Estonian citizen has with their government can be conducted online today, including voting. Estonia’s online voting, called “i-Voting” is used today by more than 30% of its citizens. In 2005 the country became the first in the world to hold national elections using online voting, following two years later with the first online parliamentary election voting.

In Estonia’s system citizens can vote from the comfort of their own homes, including from abroad while traveling. Unlike the electronic voting machines used in the US, Estonia’s system is completely web-based, meaning voters use their own computers. Each citizen’s unique cryptographic identity, stored on their smart identity card, certifies their vote.

Imagine in the US, if instead of waiting an hour at a polling station for a half-broken machine using software that was discontinued half a decade ago, you could just pull up your web browser and vote from home. This would be especially powerful for the nation’s rural voters and those without easy transportation to their assigned polling station.

Estonia’s model even takes into account concerns over vote buying and coercion. Voters are permitted to vote as many times as they like during the assigned voting period, with only the most recent vote counting. While multiple voting is rare, it allows voters to change their minds as new information emerges, unlike in the US where advance voting is fixed in time, even if new information about a candidate emerges the day before the election.

In the US once you cast your vote it is out of your hands and you must blindly trust that election officials do not lose, discard or discount your voice. As voters discovered with Florida’s “hanging chads,” even if you cast your vote it may not ultimately be counted and you’ll have no idea it was your vote that was thrown away.

Estonia solves this problem by allowing citizens to vote from their computer and separately log into the electoral website using their smartphone to verify that their vote was received and correctly recorded for the proper candidates. This adds an additional level of security not found in traditional electronic voting systems. If an attacker manages to place malware on electronic voting systems in the US, they can silently change votes without the voter being aware. In Estonia’s system your smartphone is connected directly to the central electoral database showing you the actual vote that was recorded for you. This means that even if the computer from which you cast your vote has been secretly infected or hacked with software designed to alter your vote, you can verify that your vote was received correctly by the government.

For those who don’t wish to use digital voting, traditional paper voting is still fully available.

If voting in the US no longer required a physical trip to a polling station or requesting and mailing a paper ballot, imagine how much easier it would be to mobilize the legions of voters who have become accustomed to conducting their entire lives online. From born-digital millennials who prefer online services on through those who don’t have easy transportation to a polling station, offering web-based voting could dramatically reduce barriers to having our voices heard. In Estonia, the percent of voters over age 55 casting their local election votes online has nearly doubled from 15% to 27%.

With online voting, all votes are stored and tallied centrally, meaning that once polls close the results can be announced rapidly and without the uncertainty and weeks-long recounts of paper ballots.

Putting this all together, for more than a decade Estonia has proven the effortlessness and security of online voting, offering a model for the world that perhaps one day the US may embrace. Just imagine what the American government of the future might look like if the engineers that brought us the modern web spent a little less time creating web-connected organic juicers and a bit more time redesigning our obsolete paper-obsessed bureaucracy. Estonia offers us a vision of this incredible future.

Based in Washington, DC, I founded my first internet startup the year after the Mosaic web browser debuted, while still in eighth grade, and have spent the last 20 years working to reimagine how we use data to understand the world around us at scales and in ways never before.

Resourse: Forbes

Refresh 2018 – going deeper into the world of product team

On 7th September, Refresh Conference takes over the Tallinn Creative Hub, to host the annual product, design and front-end conference. On the fourth year, the conference programme has grown bigger by one more stage with 6 talks dedicated to design topics, and mini-workshops for specialists who want a more hands-on learning experience.

“Previously the design and product talks were sharing the same stage and the emphasis was more on product. We got a lot of feedback from the attendees that they would love to see more presentations on design and it was just logical to add the design stage to the programme,“ comments Janika Liiv, the Founder of Refresh. “The importance of design in software development has changed drastically even during the four years we have organized Refresh. Few years ago you just needed engineers to build a startup, but today designer is one of the first important hires next to developers. Having a separate stage for design means, we will also have more talks on product management and the whole event is more thorough.” Refresh will feature 21 international speakers, who will be going in depth into these 4 key topics:

Focus on customer

Great teams know that to build a successful product, you need to understand and care about your customer. Rebekah Mueller, Senior Product Manager at the biggest audiobook platform Audible will be talking about how to fit into customer’s life without losing sight of humanity; Anna Jozanis, UX Designer from the biggest Polish e-commerce site Allegro, will be sharing her experience how to redesign an old product, when customers are used to bad solutions; Laura Carvajal, Software Engineer from the Financial Times will uncover the things we can do in development to make the product more accessible to the disabled.

Team collaboration

Good communication and collaboration inside the team are major factors that help a company be more effective in what they do. The topics will be ranging from designing design processes that help you keep your focus on the right place to sharing your research results in a most effective way with the whole team.

Personal growth and leadership

It wouldn’t be a learning experience, if the topic of personal growth wouldn’t come up! The lack of growth is number 1 reason of people leaving their jobs and discussing is crucial to relieve stress and to avoid burnout. Alexandra Lung from Pivotal Labs will be sharing the 7 things she wish she could have known before becoming a product manager, Wilson Albert, Engineering Lead form Farfetch will talk about being first-time team lead and the confusion what comes with it and Tim Wantland, Design Lead from Google AI, will talk about intuitive intelligence and how to grow as a creative professional.

New technologies

It’s interesting to play around with new technologies, but isn’t always clear what are the practical implementations, trades-offs or challenges we might face if we want to use them in a production environment. Hence it is crucial to hear others’ experience and case-studies on to get a better understanding of the technology. At Refresh you will learn what to keep in mind when developing a voice-based interface, why you should host your single page apps in a serverless environment and some practical tips for using web components.

“Refresh is the only conference in Estonia dedicated to creating digital products, which covers all the important topics starting from figuring out to whom and why the products are necessary, how to design them, to how you actually technically build them,” says Pärtel Vurma, Partner at the award-winning design agency Velvet, sponsor and a avid fan of Refresh. The value of Refresh is really clear to him – “Participating Refresh should be mandatory to every self-respecting Estonian designer, front-end developer and product manager working on digital products!”

With its unique concept, Refresh is bringing together the whole product team and gives the participants a chance to peek to the world beyond their own and be curious about the bigger picture. Join Refresh already on 7th September at Tallinn Creative Hub!

More info on the event and the programme: http://refresh.rocks/

Font: Startupestonia.ee