Estonia is a pioneer in public sector digitisation. Every citizen has a digital ID card, which means inter alia that they can use their computers or smartphones to vote in election
The relentless increase in the number of areas of the economy and people’s everyday lives in which the Internet plays a role poses one major challenge: online identity. Whether we are talking about a meeting website, an e-commerce platform, or an online bank, the fact that you cannot be absolutely certain of your interlocutor‘s identity exposes you to a number of risks. On the one hand this issue is hampering the development of the online economy, and on the other imposing cumbersome procedures – document scanning, verification, etc – to prove one’s identity. This issue is however perhaps starting to be resolved, not in the United States, Japan, or even Norway, but in a small Baltic state of one million, three hundred thousand inhabitants: Estonia. At birth, every Estonian is provided with an online national identifier, the hospital supplies an electronic birth certificate, and health insurance begins automatically. At fifteen, s/he receives an electronic card which enables identification on the Internet. To maintain security, the card shows only a minimum amount of data and it can be cancelled very easily if lost. Every Estonian has two PIN codes, one for authentication – enabling the owner to prove his/her identity – and the other to give agreement or approval, e.g. to sign a document or make a payment. An authentication service uses a central database to check that the card and code correspond. The system has already been up and running for ten years and to date no security breach has been reported.
Estonia set out to digitise its public sector
To the (online) polls, everyone!
Online shopping, banking transactions, signing contracts, setting up a company – the digital identity card can be used for these and many more purposes. Estonians can fill in their tax returns on the Internet in record time, obtain reimbursement very quickly, and set up a company in just fifteen minutes. The administration offers citizens a total of no less than 600 e-services and 2,400 services are available online to businesses. In addition, by enabling Estonians to cast a vote remotely in just a few minutes, the digital identity approach is helping to strengthen the democratic process and reduce voter abstentions. Authentication software allows people to cast their ballot online. Votes are then encrypted to maintain anonymity and forwarded to the relevant polling office. Estonians can also use a special SIM card, which identifies the user, to vote from their mobile devices. An increasing number are finding this option very appealing: 31% of those voting in parliamentary elections in 2014 did so on the Internet, up from the 2% who chose to vote online at the first opportunity in the 2005 local elections.
The Prime Minister of Estonia explains how to vote online
System being imitated but still controversial
Online voting has been copied in other parts of the world. Alaska is currently trying out a system which allows voters to fill in an electronic form, save it in pdf format and then send it to the local polling office. However, doubts have been raised about the system’s security. Moreover, in spite of the apparent convenience of online voting, many people are still mistrustful. Researchers at the University of Michigan, in the US, having made a thorough security analysis of the Estonian system, found that “the I-voting system has serious architectural limitations and procedural gaps that potentially jeopardize the integrity of elections”. While recognising that Estonia’s digital ID system makes it much more difficult for hackers to breach the system, they nevertheless argue that there is still a substantial risk that ‟attackers could target the election servers or voters’ clients to alter election results or undermine the legitimacy of the system”. In their conclusions, the report’s authors go as far as to say: ‟…we recommend that Estonia discontinue use of the I-voting system”. Whether or not the risks of using the system are acceptable, the Baltic state is today showing both pragmatism and an innovative spirit in its use of digital tools. Time to rename the country E-stonia?