From medical records to taxes to ID cards, Estonians rely on – and trust – information technology more than any other nation in the world. In the process they have also created a lively entrepreneurial spirit that is not held back by the country’s small size.
It’s a happy coincidence that the country’s name begins with “e”, because in Estonia just about everything involves the fifth letter of the alphabet: e-Voting, e-Taxes, e-Governance, e-Medicine, e-Identity. In little more than a decade, the small Baltic nation (pop. 1.3 million), which became independent only after the breakup of the Soviet Union in 1991, has reinvented itself as one of the globe’s most dynamic laboratories for all things electronic.
In parallel, Estonia has become the Silicon Valley of the North, gestating start-ups that go on to expand far beyond the country’s boundaries. Skype is the most famous, but in the financial community the name TransferWise is becoming a household word, and in cybersecurity the American military is reaching out to GuardTime to protect its most closely held secrets. From cramped quarters in Tallinn’s 14th-century Old Town to the modern Tehnopol complex adjacent to the airport, entrepreneurs are fine-tuning ventures that they hope will conquer the world. “This is a good place from which to dream about success,” says Mait Müntel, CEO of a language-learning start-up called Lingvist. It all begins with a can-do mindset that is nurtured from childhood and reaches the highest levels of business and government. Internet access is considered a social right In Estonia: unless you’re deep in a pine forest or kayaking in the Gulf of Finland, it’s hard not to be connected. Children receive an e-mail address at birth, and from the earliest grades they learn to use computers. At age 15 every Estonian receives an electronic ID card that provides access to everything from police records to medical data to tax forms – provided they are your own, of course.
When Estonians want to impress visitors from countries groaning under bureaucracy, they point out with a smile that, thanks to their e-Identity cards, they can start a company or pay taxes in 30 minutes. All contracts – whether to buy a car or fund a company – can be signed electronically, avoiding the need for paper and travel. Karli Suvisild, Project Manager at the e-Estonia Showroom, likes to tell the story of how he signed his current job contract on his mobile phone while on a fishing trip.
The showroom is an information centre connected to an e-Governance Academy that has been created to export Estonia’s e-prowess, not only to fellow members of the European Union but to nations as far afield as Georgia, Qatar and Oman. U.S. presidential candidate Jeb Bush stopped by this summer, and a year earlier President Barack Obama visited Tallinn, where he declared: “The entrepreneurial spirit of the Estonian people has been unleashed. Your innovations are transforming the world”.
Estonia’s latest and most ambitious innovation is e-Residency, which basically allows non-Estonians to piggyback the country’s electronic infrastructure. E-Residency does not offer any physical perks, like the right to live in Estonia or a bank account, but it does allow you to have a verified electronic signature. Thus an e-Resident in Brazil could sign a legally binding contract electronically with an e-Resident in Germany, even if neither of them is Estonian. “It’s an awesome concept,” says Müntel. “It completely does away with the hassle of a foreign investor having to come here to sign each page of a 100-page document.” Estonians stress that e-Residency is totally transparent, therefore an unattractive vehicle for anyone who wants to launder money or escape taxes. Some of the details still need to be ironed out, but no one is worried. “This government acts like a start-up,” says Aman Kumar, a young Stanford graduate brought in from Silicon Valley to advise the Estonian government. “Fail fast, don’t always know where you’re going, but the important thing is to have tried.”
If Estonians are comfortable with this mindset, it may be because their country is in fact a start-up. Under foreign domination – Danish, Swedish, German, Russian – for much of the past millennium, Estonia emerged from the collapsing Soviet Union in 1991 with few assets other than its brains. Technology provided the opportunity both to leap ahead and to establish an identity. Beyond that, says Kumar, “there’s a security implication behind everything this country does.” Estonians are aware that if someday their land is once again taken away from them, their national identity will be secure.
The Russian legacy
A half-century of life as part of the Soviet Union left Estonia with two major legacies. One was a quality educational system that produced a lot of people with advanced degrees in engineering and computer science. The other was a totally decrepit infrastructure. “We had to build everything from scratch,” recalls Taavi Kotka, a successful entrepreneur who is now the government’s chief information officer. With no money to speak of, Estonia could not turn to major European or North American suppliers for expensive new products. Instead, it put all those Soviet-trained computer scientists to work creating custom software at low cost.
A decade and a half after independence, Estonia received another unintended gift from Russia in the form of the world’s first cyberattack on a nation. In retaliation for the removal of a Soviet-era monument, Russia launched a denial-of-service attack on Estonian banking and government websites, briefly bringing the country to a halt. The silver lining is that Estonian engineers were able to identify the weaknesses in their system. They reacted by rethinking their entire e-Governance architecture, using “blockchain” technology so secure that an Estonian company is now selling it to the U.S. Department of Defence. One Russian legacy that no one can remove is their common 294-km border, which has been repeatedly violated over the centuries. With that in mind, e-Governance has been set up with the explicit goal of enabling Estonia to preserve all its records – on citizenship, population, land ownership, etc. – if the country is ever invaded again. The data is saved not only to the cloud but also on servers in a half dozen embassies abroad. “For the first time in our history, we’re in a position to have a country even if we don’t have land,” says Kotka. “No one can burn our records, or arbitrarily change the ownership of anything.”
Keeping the data safe
In most countries the state owns data, and the citizens may see it. In Estonia, people own data, and the state may use it.” This pithy summary, by Doris Pöld of the Estonian Association of Information Technology, aptly describes a level of mutual trust not often seen, even in advanced democracies. But trust alone cannot protect a citizen’s data. The country’s e-Governance system relies on two features designed to protect the integrity of all data:
- Decentralization of information
There is no single repository for the data on Estonian citizens. The police, population office, tax authorities, land registry and other services each have their own servers, protected in turn by a security server, linked within a sort of Estonian intranet called X-road. No department can see another’s data without explicit authorisation. The police, for example, can access the weapons registry but not the tax rolls. Citizens access their data – a traffic violation or medical record – with their ID cards or mobile phones. But neither the ID card nor the mobile phone contains actual data. They are merely encrypted authentication devices that, together with the user’s PIN code, confirm his identity.
- KSI (Keyless signature) Technology
This is Estonia’s killer app. It is not a firewall but a system that protects the integrity of every shred of data by assigning it a unique fingerprint. Anytime anyone so much as looks at information, not to mention changes it, a transparent record is created. So if an official looks up your driver’s license, you can see who it was. If he checks your driver’s license too often, you can ask why. “Whatever you may think of Edward Snowden, he couldn’t have done what he did if the National Security Agency had KSI”, says Matthew Johnson, chief technology officer of GuardTime, the Estonian company that created KSI. GuardTime now has a Washington office that sells KSI to the U.S. government.
“We had to build everything from scratch”
A special report by Henry Muller