Estonia, the Digital Republic

source

37 highlights

• They do so through the “once only” policy, which dictates that no single piece of information should be entered twice. Instead of having to “prepare” a loan application, applicants have their data—income, debt, savings—pulled from elsewhere in the system. There’s nothing to fill out in doctors’ waiting rooms, because physicians can access their patients’ medical histories.

• But, apart from transfers of physical property, such as buying a house, all bureaucratic processes can be done online.

• Digitizing processes reportedly saves the state two per cent of its G.D.P. a year in salaries and expenses. Since that’s the same amount it pays to meet the NATO threshold for protection (Estonia—which has a notably vexed relationship with Russia—has a comparatively small military), its former President Toomas Hendrik Ilves liked to joke that the country got its national security for free.

• Previously, Estonia’s best-known industry was logging, but Skype was built there using mostly local engineers, and countless other startups have sprung from its soil.

• She pulled out her I.D. card; slid it into her laptop, which, like the walls of the room, was faced with blond wood; and typed in her secret code, one of two that went with her I.D. The other code issues her digital signature—a seal that, Estonians point out, is much harder to forge than a scribble.

• Data aren’t centrally held, thus reducing the chance of Equifax-level breaches. Instead, the government’s data platform, X-Road, links individual servers through end-to-end encrypted pathways, letting information live locally.

• Finland, Estonia’s neighbor to the north, recently began using X-Road, which means that certain data—for instance, prescriptions that you’re able to pick up at a local pharmacy—can be linked between the nations.

• X-Road is appealing due to its rigorous filtering: Piperal’s teachers can enter her grades, but they can’t access her financial history, and even a file that’s accessible to medical specialists can be sealed off from other doctors if Piperal doesn’t want it seen.

• A tenet of the Estonian system is that an individual owns all information recorded about him or her. Every time a doctor (or a border guard, a police officer, a banker, or a minister) glances at any of Piperal’s secure data online, that look is recorded and reported.

• Peeping at another person’s secure data for no reason is a criminal offense.

• The openness is startling. Finding the business interests of the rich and powerful—a hefty field of journalism in the United States—takes a moment’s research, because every business connection or investment captured in any record in Estonia becomes searchable public information.

• Polling-place intimidation is a non-issue if people can vote—and then change their votes, up to the deadline—at home, online. And heat is taken off immigration because, in a borderless society, a resident need not even have visited Estonia in order to work and pay taxes under its dominion.

• The program that resulted is called e-residency, and it permits citizens of another country to become residents of Estonia without ever visiting the place.

• Smart contracts are encoded on a digital ledger and, notably, don’t require an outside administrative authority.

• In the U.S., it is generally assumed that private industry leads innovation. Many ambitious techies I met in Tallinn, though, were leaving industry to go work for the state.

• The putative grandfather of Estonia’s digital platform is Tarvi Martens, an enigmatic systems architect who today oversees the country’s digital-voting program from a stone building in the center of Tallinn’s Old Town.

• In what may have been the seminal insight of twenty-first-century Estonia, Martens realized that whoever offered the most ubiquitous and secure platform would run the country’s digital future—and that it should be an elected leadership, not profit-seeking Big Tech.

• That year, seven Western researchers published a study of the i-voting system which concluded that it had “serious architectural limitations and procedural gaps.”

• Using an open-source edition of the voting software, the researchers approximated a version of the i-voting setup in their lab and found that it was possible to introduce malware. They were not convinced that the servers were entirely secure, either.

• Earlier this fall, when a Czech research team found a vulnerability in the physical chips used in many I.D. cards, Siim Sikkut, the Estonian C.I.O., e-mailed me the finding.

• When Sikkut held a small press conference, reporters peppered him with questions: What did the government gain from disclosing the vulnerability? How disastrous was it?

• Sikkut looked bemused. Many upgrades to phones and computers resolve vulnerabilities that have never even been publicly acknowledged, he said—and think how much data we entrust to those devices.

• From time to time, Russian military jets patrolling Estonia’s western border switch off their G.P.S. transponders and drift into the country’s airspace.

• NATO troops on the ground scramble an escort. Estonia calls up the Russian Ambassador to complain; Russia cites an obscure error. The dance lets both parties show that they’re alert, and have not forgotten the history of place.

• Since the eleventh century, Estonian land has been conquered by Russia five times. Yet the country has always been an awkward child of empire, partly owing to its proximity to other powers (and their airwaves) and partly because the Estonian language, which belongs to the same distinct Uralic family as Hungarian and Finnish, is incomprehensible to everyone else.

• In 2007, a Russian cyberattack on Estonia sent everything from the banks to the media into chaos. Estonians today see it as the defining event of their recent history.

• Beyond X-Road, the backbone of Estonia’s digital security is a blockchain technology called K.S.I.

• “Our No. 1 marketing pitch is Mr. Snowden,” Martin Ruubel, the president of Guardtime, the Estonian company that developed K.S.I., told me. (The company’s biggest customer group is now the U.S. military.)

• The average time until discovery of a data breach is two hundred and five days, which is a huge problem if there’s no stable point of reference. “In the Estonian system, you don’t have paper originals,” Ruubel said. “The question is: Do I know about this problem, and how quickly can I react?”

• The blockchain makes every footprint immediately noticeable, regardless of the source.

• Earlier this year, the Estonian government created a server closet in Luxembourg, with a backup of its systems. A “data embassy” like this one is built on the same body of international law as a physical embassy, so that the servers and their data are Estonian “soil.”

• Today, the old fatuities of the nation-state are showing signs of crisis. Formerly imperialist powers have withered into nationalism (as in Brexit) and separatism (Scotland, Catalonia).

• One September morning, a car pulled up in front of the Tallinn Creative Hub, a former power station, and Kersti Kaljulaid, the President of Estonia, stepped out. She is the country’s first female President, and its youngest.

• Theresa May had told her people, after Brexit, “If you believe you’re a citizen of the world, you’re a citizen of nowhere.” With May in the audience, Kaljulaid staked out the opposite view. “Our citizens will be global soon,” she said. “We have to fly like bees from flower to flower to gather those taxes from citizens working in the morning in France, in the evening in the U.K., living half a year in Estonia and then going to Australia.”

• Estonian folklore includes a creature known as the kratt: an assembly of random objects that the Devil will bring to life for you, in exchange for a drop of blood offered at the conjunction of five roads. The Devil gives the kratt a soul, making it the slave of its creator.

• His office now speaks of kratt instead of robots and algorithms, and has been using the word to define a new, important nuance in Estonian law. “Basically, a kratt is a robot with representative rights,” he explained. “The idea that an algorithm can buy and sell services on your behalf is a conceptual upgrade.”

• Kaevats told me it irked him that so many Westerners saw his country as a tech haven. He thought they were missing the point. “This enthusiasm and optimism around technology is like a value of its own,” he complained. “This gadgetry that I’ve been ranting about? This is not important.” He threw up his hands, scattering ash. “It’s about the mind-set. It’s about the culture. It’s about the human relations—what it enables us to do.”