Secure Da Bag
Veteran
Estonia Already Lives Online—Why Can’t the United States?
Estonia recorded its first case of COVID-19 on February 27, and by March 12, the government approved emergency measures to combat its spread. The next day, the government began conducting most of its business digitally, and instructed schools to transition from in-person to distance learning. If they weren’t already using digital tools (and many were), municipal councils quickly shifted to online operations.
None of this is much of a departure from normal life. Using a digital identification card and a secure electronic signature, people in Estonia can bank, apply for government assistance, file for sick leave, order prescriptions, and get medical care online—no mask or hand sanitizer required. If an election were scheduled to take place while the country was under lockdown, citizens would simply use their ID cards to vote securely from the comfort and safety of their homes, as they have done since 2005. In the most recent parliamentary elections in 2019, 43 percent of voters cast ballots online.
The United States, meanwhile, is experiencing a carnival fun-house version of attempted technological innovation, running into trick walls and watching as tasks that could be much simpler contort into nightmarish versions of themselves. In April, the website through which small-business owners apply for a loan from the Paycheck Protection Program crashed due to the unanticipated load. The Senate, without provisions to work remotely, has returned to Capitol Hill, despite warnings from health-care professionals.
These are shortcomings that the U.S. and other Western countries (Britain began allowing lawmakers to videoconference into Parliament only once the pandemic began) have created and perpetuated. If the coronavirus has one positive effect, it’s the opportunity to begin a technological revolution that could leave our governments better functioning, more accessible, and more representative.
“We have this expression that [Estonia] is ‘digital Narnia,’” Toomas Hendrik Ilves, Estonia’s president from 2006 to 2016, told me over the phone from Palo Alto, California. “It’s a lot better than other places, but we’re not digital Narnia. We don’t fax our pizzas!”
Now a Distinguished Visiting Fellow at Stanford University, Ilves said the secret of what made “e-Estonia” tick—leaving the country well prepared for the pandemic, from a governing point of view—is not magic, but the secure, microchip-emblazoned ID card issued to every citizen. The document is residents’ bridge between the physical and digital worlds, allowing them an extremely secure way to sign documents, pay taxes, and access their bank accounts and public records online. People in Estonia need to show up in person for only three reasons: marriage, divorce, and the sale or transfer of real estate. “For 20 years, we haven’t had to go anywhere, to any office, to stand in line,” Ilves said.
To access any basic government service or complete a transaction that requires a signature, they have to insert their physical ID card into a reader connected to their computer, or use their smartphone, equipped with a special SIM card, to punch in a PIN code. Once they’re in the system, Estonians don’t need to fill out forms, thanks to the country’s “once-only” rule, which mandates that the government is allowed to ask for any given piece of information only one time. Authenticated digital signatures are also more secure than their handwritten counterparts, a source of bemusement to Estonians, who “think it’s crazy that much of the world still signs with a pen,” Taavi Rõivas, the former prime minister who is now a member of Parliament, told me.
Read: ‘How could the CDC make that mistake?’
Rõivas underscores the importance of the ID card, not only for individual citizens, but also for the functioning of government. “Having a proper digital ID, and having a digital signature very widely used in society … helps us a lot in this crisis,” he tells me from Tallinn, Estonia’s capital. “It gives certainty.” That could be certainty that the person is indeed a member of Parliament casting a vote on legislation or calling in to a committee meeting; or is indeed an individual requesting their own tax returns.
Though the ID card and signature are central to the functioning of government, innovation permeates all aspects of society, according to Kristina Reinsalu, a municipal-governance expert at the e-Governance Academy, an NGO that assists governments around the world as they undergo digital transformations. Over Skype—invented in Estonia—from her home in Tartu, the country’s second-largest city, she told me that many of Estonia’s municipal councils “have found thousands of digital ways to do their work using digital tools.” They can make their business entirely paperless, webcast and archive all their events, and seek feedback from constituents on budgets and other consultative measures. For the municipalities that have been slow adopters, the pandemic “has been a really good driving force, or boost, to make them use the tools that are already available,” all of which function with the digital ID card and signature at their core. “The country functions perfectly on ‘digital mode,’” Reinsalu said.
Can something similar be built in the U.S. and other countries struggling to govern at a distance? Maybe, but it won’t happen overnight. Rõivas said he’s seen an understandable interest in Estonia’s digital voting system as pandemic-stricken countries prepare for elections, but both he and Ilves warned that the infrastructure first needs to be built up and has to have time to mature. “You need the ecosystem,” Ilves told me, “and even with the ecosystem, we only tried it after five years.”
Even on a smaller scale, such as Capitol Hill, digital voting for members of Congress would be difficult without a secure form of verification, Ilves said. As the 2016 election and subsequent revelations of foreign interference proved, the security situation is dire—malicious actors regularly probe the professional and personal email and social-media accounts of elected officials and their staff, yet digital security systems vary across Washington. Though practices such as two-factor authentication and encrypted messaging are widely used by the federal government and recommended by cybersecurity experts employed by Congress, individual members and their offices typically do not adopt them.
Read: Putin is well on his way to stealing the next election
To those who suggest that tiny Estonia isn’t an appropriate comparison to the mammoth U.S. government: In 2007, the country was the victim of a digital offensive, known as a “distributed denial-of-service attack,” that originated in Russia. Some media and banking sites were overwhelmed, but Estonians’ personal data was not compromised. Awareness of what is perceived as an ever-present threat from its much larger and more powerful neighbor is part of the reason that Estonia is so far ahead of the U.S., Lorelei Kelly, who studies congressional modernization at Georgetown University’s Beeck Center for Social Impact and Innovation, told me. Estonians “see democracy as a defense issue,” she said. “Their creativity and courage is remarkable, but it’s for a reason. It’s not inexplicable. American inaction is inexplicable, and it’s inexcusable.”
