June 7, 2017

E-stonia: One Small Country’s Digital Government Is Having a Big Impact

graphic of lock and hand

If you were a small country with a population of 1.26 million, a former republic of the Soviet Union, how would you drive your country’s future?

That was the question Estonia faced in 1991.

The answer it chose was technological revolution.

When Estonia became independent after the fall of the Soviet Union, less than half the country had a telephone line. Its infrastructure dated back to the 1930s. Finland, Estonia’s neighbor, gave Estonia an idea of just how far behind the country was in terms of technology and development. The Finnish government, who was then moving to a digital telephone network, offered Estonia its old 1970s analog telephone exchange.

But the government, led by Prime Minister Mart Laar, declined. It decided that its comparative advantage could be found in embarking on rapid technological advancement. That period in the 1990s marked the beginning of the internet revolution. Nineteen ninety-three was the year Mosiac, one of the earlier web browsers, came out. According to former Ambassador and President Toomas Hendrik Ilves, this put Estonia on a “level playing field.”

Ilves’ other inspiration for Estonia’s technological revolution was Jeremy Rifkin’s End of Work, premised on the devastation that automation in a steel mill in Kentucky would bring to employment. With automation, the mill that had employed 12,000 people would only need 100 workers. For a small country like Estonia, this was instead a boon. With automation, Estonia would only need 100 people to create the same economic output as 12,000 people.

By 1997, 97 percent of Estonia’s schools were digitized, with cabinet meetings following suit in 2000. Every law, even draft laws, is published online. In 2000, the government also declared access to the internet a human right. In 2007, the government created online voting, making Estonia the first country with e-voting in a general election.

Estonia is now E-stonia, in Ilves’ words, and one of the most technologically advanced countries in the world.

Today, almost everything is done digitally, from filing taxes to paying for parking. In school, child’s attendance, homework and grades are all available online. Residents can pay for parking through their mobile phones, or reserve time slots for passing border checkpoints. Ninety-five percent of citizens file their taxes online through the E-Tax electronic tax filing system, which only takes an average of three to five minutes to complete. Health records are digitized, while residents can also sign legally binding contracts online, or register a business. Business owners can also check their property and legal records online. You can even apply for e-residency digitally.

All this is facilitated by Estonia’s digital signature system, where electronic signatures have the same legal status as paper signatures, and the electronic ID. The digital identity, or Digi-ID is a card available to any e-resident above the age of 15, is a personal access key card with a SIM chip. The card allows residents to access tax records, register a company, share encrypted documents, file taxes, and more. Estonia also has one of the fastest connection speeds in the world, the result of fiber-optic cabling established throughout the country by 2012. Wi-Fi is available free of charge throughout the country.

The spread of personal data in web databases, along with digital identification, might raise fears of abuse of information by the government or other actors. This is tempered through a policy of transparency. Estonia has a Public Key Infrastructure (PKI), a binary key code that has a public and private key. The PKI ties a person’s public key with their identity, so that the digital identity of a person can be verified. That means that any misuse of information can be immediately identified. In addition, citizens or e-residents can view a log of who has their information, and who has actually accessed their information. Through a Data Protection Inspectorate, e-residents can file a complaint if they believe their information is being misused.

The Wizard of Oz: X-Road

In the 1990s, Estonia could not afford the costs of a central server. But it still needed to find some way to coordinate its databases. E-Estonia is a decentralized system, made out of numerous databases (see Figure 1). It is this decentralization that has provided flexibility, allowing for more innovation and the development of new databases. The decentralized model also means that each government agency can create a system that best suits its needs. In 2001, the government introduced X-Road, the server that drives the whole of E-Estonia. Developed by Cybernetica, an Estonian technology company that has also developed other Estonian e-government databases, X-Road is the system that allows these databases to talk to each other. (For a diagram explaining the components of X-Road, please visit the E-Estonia website.)

X-Road is cheap. The whole system, including maintenance costs, salaries, and investments, only costs 50–60 million euros a year (the government’s entire budget is around $8 billion). Compare this to Russia’s e-government system, which cost $90 million in one year, or Kazakhstan’s $150 million program, neither of which compare to Estonia’s e-government platform.

As Ilves explains, X-Road is a distributed data exchange layer, an enterprise service bus (see Figure 1). It directs queries between separate computer systems. Since each system was formed using different technologies, each system requires an “adaptor,” akin to a translator that sends and receives information in the X-Road format.

While initially created as a way of directing queries to different databases, X-Road has now evolved such that it can write to multiple databases, and even transmit datasets and search for information across databases.

Figure 1: X-Road

Redefining the nation-state

The big question mark over Estonia’s digitization is security. Inherently, the decentralized nature of E-Estonia and X-Road makes it more secure than having a single centralized system. Within X-Road, each system or database has its own secure server to ensure that the information sent across X-Road is not compromised (see Figure 2).

Yet as with all movements towards greater digitization, security concerns remain a real concern. In April 2007, Estonia faced more than 120 service attacks over three weeks in a suspected Russian-directed cyberattack. Many of its web services, including those used for government and business services, were brought down. The fear of a cyberattack remains. As the former president of the parliament, Ene Ergma, remarked, “Like nuclear radiation, cyberwar doesn't make you bleed, but it can destroy everything.”

Since so many public and private activities take place through these databases, cyberattacks have the potential of halting daily transactions. This threat is amplified by the dependence and centrality of the digital ID system. For instance, about 40 percent of those who use e-banking do so through the digital ID. Cyberattacks are particularly concerning given the sensitive and personal information stored in these databases

Estonia has responded by creating data embassies — offshore backup storage sites. It is currently in negotiations with the UK to store all its data, including individual birth and voter records, government laws and bills, etc. Estonia is negotiating for the agreement to fall under the Vienna Convention, which would ensure that the host country could not access the data embassy without Estonia’s authorization. Should a cyberattack wipe out Estonia’s information system, that information could simply be restored. Indeed, Taavi Kotka, the government’s chief information officer, has indicated plans for six data embassies worldwide, including in Luxembourg. “Cut one head off,” a video about the data embassies says, “and like Hydra, three more will grow back.”

In addition, Estonia is looking towards privately owned networks like Amazon Web Services and Microsoft Azure as clouds to store their software. Thus far, only non-sensitive data that is already publicly available are placed on these privately owned clouds. Publicly available data makes up about 85 percent of the data. The remaining 15 percent, such as patient health records, are in blockchain or secure private servers.

Estonia’s e-government thus has a number of safety valves. In so doing, Estonia is redefining what it means to be a state. The state, in effect, has been “deterritorialized.

A new model

Estonia’s digitization began with the rejection of Finland’s old analog telephone exchange. Now, the roles have been reversed. In 2015, Finland introduced a partial version of X-Road with the aim of moving towards a more digitized society, with support from Estonia. The Estonian and Finnish governments are also embarking on cross-border data exchange.

Any country today can set up their own X-Road system. The X-Road technology is now open-sourced and readily available for any country to employ. Central components of its source codes were published openly under an MIT license on October 3, 2016. In fact, Azerbaijan and Namibia are considering deploying their own digital systems. Azerbaijan, for instance, has enlisted the help of the company that developed X-Road to create an “updated version of Estonia’s X-Road.” Namibia is similarly deploying the same technology, with help of Estonian companies like Cybernetica and e-Governance Academy.

Estonia today is a model of digitization. It points to the road forward, and with its open-source technology, it has now paved the road for those who want to follow.

The views expressed in the Government Innovators Network blog are those of the individual author(s) and do not necessarily reflect those of the Ash Center for Democratic Governance and Innovation, the John F. Kennedy School of Government, or of Harvard University.

Related Topics

Related Topics