Estonia: The Little Country That Cloud

Follow the leader is a title, theme, task
Now you know, you don’t have to ask

– Rakim, “Follow the Leader“

Being someone reasonably well-known in technology, I have been getting a lot of questions lately about Healthcare.gov. People want to know why it cost between 2 and 4 times as much money to create a broken website than to build the original iPhone. This is an excellent question. However, in my experience, understanding why a project went wrong tends to be far less valuable than understanding why a project went right. So, rather than explaining why paying anywhere between $300M and $600M to build the first iteration of healthcare.gov was a bad idea, I would like to focus attention on a model for software-enabled government that works. In doing so, perhaps this will be a step toward a better understanding of how technology might make the US government better and not worse.

Early in my career as a venture capitalist, we invested in a company called Skype and I went on the board. One of the many interesting aspects of Skype was that it was based in Estonia, a small country with a difficult history . Over the centuries, Estonia had been invaded and taken over many times by many countries including Denmark, Sweden, Germany, and most recently the Soviet Union. Now independent, but well aware of their history, the Estonian people were humble, pragmatic, proud of their freedom, but dubious of overly optimistic forecasts. In some ways, they had the ideal culture for technology adoption: hopeful, yet appropriately skeptical.

Supported by this culture, Estonia built the technology platform to serve its citizens that everyone wishes we had here. Estonia developed an infrastructure that enabled its government to serve its people so well that Estonians would like to see more, not fewer, government technology projects. To explain how they did it, I’ve asked one of our Entrepreneurs in Residence and Estonian, Sten Tamkivi to tell the story.

 At a casual glance, Estonia might not show up on the US radar too often. It is a tiny country in North Eastern Europe, just next to Finland. It has the territory of the Netherlands, but 10x less people. 1.3 million inhabitants is comparable to Hawaii. Estonia belongs to the European Union, Eurozone and NATO. In other words, as a friend from India recently quipped: “what is there to govern?”

What makes this tiny country interesting as a governance benchmark is not just that the people can elect their parliament online or get their taxes back in two days. It is rather that this level of service for citizens does not start from their government building a few web sites. Instead, Estonians started by redesigning their entire information infrastructure from the ground up with openness, privacy, security and future proofing in mind.

As the first building block of e-government, you need to be able to tell your citizens apart. Sounds blatantly obvious, but sometimes referring to a person by their social security number, then by a taxpayer number and at other times by something else doesn’t cut it. Estonia uses a very simple, unique ID methodology across all systems, from your paper passport to bank records to any government office or hospital. A citizen with personal ID code 37501011234 is a male born in the 20th century (3), on January 1st of year ’75, as baby #123 of that day. The number ends with a computational checksum to easily detect typos.

For these identified citizens to transact with each other, Estonia passed the Digital Signatures Act back in 2000. The state standardized on national Public-key Infrastructure (PKI), which binds citizen identities to their cryptographic keys,  and now doesn’t care if any Tiit and Toivo (to use some common Estonian names) sign any contract between them in electronic form with certificates, or plain ink on paper. A signature is a signature in front of all laws.

As a quirky side-effect, that foundational law also forced all decentralized government systems to become digital “by market demand”. Namely, no part of Estonian government can turn down a citizen’s digitally signed request to ask for a paper copy. As citizens opt for convenience, bureaucrats see a higher inflow of digital forms and are self-motivated to invest in systems that will help them manage the process. Yet a social worker in a small village can still provide the same service with no big investment by handling the small number of digitally signed email attachments the office receives.

For future-proofing, the law did not lock in the technical nuances of digital signatures. In fact, the implementation has already been changing over time. Initially, Estonia equipped all traditional ID cards issued to every citizen for identification and domestic travel inside EU with a microchip. The chip carries two certificates: for full legal signatures and for authenticating to any trusting web site or service (used widely from government services to Internet banks). As every person over 15 is required to have one, there are now over 1.2M cards active, a close to 100% penetration of population.

As mobile adoption in Estonia rapidly approached the current 144% (#3 in Europe), the digital signatures adapted too. Instead of carrying a smartcard reader with their computer, users can now get a Mobile ID enabled SIM card from their telecom operator. Without installing any additional hardware or software, they can access systems and give signatures by just typing PIN codes on their mobile phone.

As of this writing, between ID cards and mobile phones, 1.3M Estonians have authenticated 230M times and given 140M legally binding signatures. Besides the now daily usage for commercial contracts and bank transactions, the most high profile use case has been the elections: since being the first country in the world to allow voting for local elections in 2005, the system has been used for both Estonian and European Parliament Elections and in 2011 counted for already 24% of all votes. (Interestingly, the citizens voted from 105 countries in total, where they just happened to be physically at the time – like my own vote submitted from California).

To further speed this sort of innovation, the state tendered building and securing the digital signature certificate systems to private parties, namely a consortium led by local banks and telcos. And that’s not where the public-private partnerships end: the way the data interchange in the country works is that both public & private players can access the same data exchange bus (dubbed X-Road), enabling truly integrated e-services.

A prime example is the income tax declarations Estonians “fill”. Quote marks are appropriate, because when an average Estonian opens the form for submission once a year, it usually looks more like a review wizard: “next -> next -> next -> submit”. This is because data has been already moving throughout the year: when employers report employment taxes every month, all the data entries are already linked into a particular person’s tax records too. Non-profit reported charitable donations are recorded back as deductions for the giver the same way. Tax deductions on mortgages come directly from data interchange with commercial banks. And so forth. Not only is the income tax rate in the country a flat 21%, after submitting this pre-populated form the citizens actually get any overpayment back on their bank account (digitally transferred, of course) on the second day!

This liquid movement of data between systems relies on a fundamental principle to protect the privacy of the citizens: without any question, it is always the citizen who owns their data. People have the right to control access to their data. For example, in case of fully digital health records and prescriptions, people can granularly assign access rights to the general practitioners and specialized doctors of their choosing. And in scenarios where the rule of law can’t allow them to block the state from seeing their information, like with the Estonian e-policemen using their real time terminals in police cars or offices, they at least get a record of who accessed their data and when. If an honest citizen finds any official checking on their stuff without valid reason, they can file an inquiry and get them fired.

Having everything online does generate security risks on not just personal, but systematic and national level. Estonia was the target of The Cyberwar of 2007 when well coordinated botnet attacks following some political street riots targeted government, media and finance sites and effectively cut the country from the internet abroad for several hours. But as a result, Estonia has since become the home for NATO Cyber Defence Centerand EstonianPresident Toomas Hendrik Ilves has risen internationally to be one of the most vocal advocates for cybersecurity topics among the world’s heads of states.

Even more interestingly, there is a flip-side to the fully digitized nature of Republic of Estonia: taken to the max, having the bureaucratic machine of a country humming in the cloud increases the cost of any potential physical assault to the state. Imagine if physical invasion of this piece of Nordic land by anyone would not stop the government operating, but booted up a backup replica of the digital state hosted in some other friendly European territory. Democratic government would be quickly re-elected, important decisions made, documents issued, business & property records maintained, births and deaths registered and even taxes flowed by those citizens still with access to the internet. May sound futuristic, but this is exactly the kind of world Estonia’s energetic CIO Taavi Kotka can not just dream up but actually implement, on the e-foundations the country already has today.

Yes, the circumstances of the Estonian story are special by many means. The country emerged to re-independence from 50 unfortunate years of Soviet occupation in 1991, having skipped a lot of technological legacy the Western world had built up during ’60-’80s, such as checkbooks and mainframe computers and jumped right into the mid-nineties bandwagon of TCP-IP enabled web apps. During this social reset, Estonians also decided to throw their former communist leaders overboard and elected new leadership – with ministers in their late twenties from whom one can expect disruptive thinking.

But then again, all this was 20 years ago. Estonia has by many macroeconomic and political notions become more of “a boring European state,” stable and predictable, if just somewhat faster growing to close the gap with Old Europe from the time they were behind the Iron Curtain. 20 years, but you can still think of Estonia as a startup country, not just by life stage, but by mindset.

And this is what United States, along with many other countries struggling to get the internet and their increasingly more mobile citizens on it, could learn from Estonia: the mindset. Willingness to question the foundations and get the key infrastructure right, and to continuously re-invent on them. States can either build healthcare insurance brokerage sites for innovation, or really look at what key components need to exist for any service to be built: signatures, transactions, legal frameworks and such.

Ultimately, the states that create pleasant environments will be where the mobile citizens will flock to live their lives. And by many means, tiny Estonia in 2014 is no worse positioned to be the destination than New England was in 1814.

Further reading

• http://e-estonia.com/
• Sten’s speech at Stanford last year (transcript + video) on this topic