Tuesday, March 9, 2021

Outsourcing e-IDs to Estonia?

 There is usually a trade-off between efficiency and security.

For example, the military is an wasteful and unproductive institution.

However, there seems to be a widespread sense in every society that the existence of a military is a necessary.

The military is a form of insurance, and insurance is expensive.

Likewise, it might be cheaper to import all of a society’s food and technology, but that flies in the face of security issues.

That can become an issue among conservatives.

For instance, it was asserted in the 1980s by the Reagan administration that trade should be completely unrestricted.

Unrestricted trade would reveal efficiencies in terms of price.

Consequently, markets alone would decide what the economy produced and sold.

The saying within the Reagan administration was that “it does not matter if the country is making potato chips or computer chips”.

This libertarian policy toward unrestricted trade would obviously rankle national security conservatives.

Amid the coronavirus crisis, all sorts of supplies ceased to be available because supply chains in general were breaking down during the crisis.

In particular, it became clear very early that the USA was completely reliant on China for personal protection equipment.

The widely recognized trade-off between security and efficiency raises an interesting question.

Are there any examples of when there is not a trade-off between security and efficiency?

One example of a policy that improves both government efficiency and national security is Estonia’s e-government.

Almost all of Estonia’s governmental functions involving interaction with the public have been put on the internet.

https://en.wikipedia.org/wiki/E-Estonia

e-Estonia refers to a movement by the government of Estonia to facilitate citizen interactions with the state through the use of electronic solutions. E-services created under this initiative include:

  • i-Voting,
  • e-Tax Board,
  • e-Business,
  • e-Banking,
  • e-Ticket,
  • e-School,
  • University via internet,
  • the e-Governance Academy , as well as
  • the release of several mobile applications.

In terms of efficiency, this saves the state 2% of its GDP.

https://www.newyorker.com/magazine/2017/12/18/estonia-the-digital-republic

Estonia is a Baltic country of 1.3 million people and four million hectares, half of which is forest. Its government presents this digitization as a cost-saving efficiency and an equalizing force. Digitizing processes reportedly saves the state two per cent of its G.D.P. a year in salaries and expenses. Since that’s the same amount it pays to meet the NATO threshold for protection (Estonia—which has a notably vexed relationship with Russia—has a comparatively small military), its former President Toomas Hendrik Ilves liked to joke that the country got its national security for free.

There is the issue of privacy.

Estonia’s e-government allows personal information to be much more readily accessed because it is stored online rather than on paper.

However, records are kept of who has accessed someone’s personal information.

This record keeping of access serves as a deterrent to illegitimate intrusiveness.

This is an improvement over earlier times when institutional insiders could secretly snoop around in file cabinets full of personal paperwork.

https://qz.com/1535549/living-on-the-blockchain-is-a-game-changer-for-estonian-citizens/

Of course, there is no such thing as absolute security. But it is easy to demonstrate that digital technologies offer more security that paper analogs. The digital format provides much more control over personal data than the paper format, provided that the legal space prescribes clear rules on data gathering, storage, and use. The Estonian people know that meddling in public databases cannot go unnoticed because it would be recorded and secured by blockchain-based timestamping, and officials know that it is a criminal offense to nose around. This creates additional trust between citizens, state, and e-services.

But what is even more important is that your personal data does not belong to the Estonian state. Just because it’s in the database doesn’t mean that Estonia owns it—it belongs to you. At any second you have the right to know and control what happens to this data.

This makes the digital world much more transparent then the analog world. Do you have a complete record of everyone who has ever looked through your medical files, for instance? Digital is only as safe as we make it, but its potential is far greater than analog.

The security of Estonian personal information has been enhanced by e-government, and so has national security.

In 2007, Russians engaged in a wave of sophisticated cyber attacks on Estonian websites.

Estonia responded to this attack by upgrading the security of their e-government.

In 2007, Estonia fell prey to a series of cyber attacks, originating largely from Russian IP addresses. In a way this was a wake-up call, because it led us to creating a cybersecurity strategy and facilitated the creation of a permanent NATO unit focused on enhancing cybersecurity.

We decided to increase our security even further. In the summer of 2017, we announced the opening of the world’s first data embassy in Luxembourg to secure government information in the event of a military or cyber attack.  These server racks are in the sovereign territory of Estonia in Luxembourg (as in a case of any embassy), and both the data and the servers belong to Estonia. We chose Luxembourg as the first data-embassy site because of their readiness and flexibility to work on a new concept.

Germany seems on the path to emulating Estonia’s e-government.

The Germans have rolled out an e-ID, which was the first step the Estonians took in the 1990s.

https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-eID/eIDAS-notification/eIDAS_notification_node.html

There are at least three foundational projects that the Germans need to get right to follow in the footsteps of Estonia’s e-government.

https://www.techrepublic.com/article/how-estonia-became-an-e-government-powerhouse/

  • Digitize registers held by public bodies to provide the necessary information to support e-services;
  • build the X-Road platform that connects the wealth of different systems used in the public and private sector and allows them to share information; and
  • give citizens the means to securely access online services by providing digital ID cards and make digital signatures equivalent to handwritten signatures.

Estonia also offers e-residency to foreigners who can prove their identity and who pay a fee.

E-residency is not related to citizenship and does not give the right to physically enter or reside in Estonia.

While the further goal of the project would be to gain millions of e-residents, its purpose was to increase the number of active enterprises in Estonia.

https://en.wikipedia.org/wiki/E-Residency_of_Estonia

e-Residency of Estonia (also called virtual residency or E-residency) is a program launched by Estonia on 1 December 2014. The program allows non-Estonians access to Estonian services such as company formation, banking, payment processing, and taxation. The program gives the e-resident a smart card which they can use to sign documents. The program is aimed towards location-independent entrepreneurs such as software developers and writers.

An application for e-residency can be made online by filling in a form, supplying a scan of a national passport and a photograph, and giving the reason for applying (which does not strongly affect the outcome of the application).

Successful applicants would be invited to an interview in Tallinn or an Estonian embassy about three months after applying, and would then, if successful, be issued with their card.[5] The certificates of the document are valid for five years, up from three years when the program was first announced.[6] After that period, if a person wishes to continue using e-services, they have to apply for a new document. The application process will be the same as when they first applied. A state fee needs to be paid again when they submit a new application.

Estonia’s enterprising e-residency program raises an intriguing prospect:

Could Estonia or Germany offer an e-identity card to other societies in general?

https://en.wikipedia.org/wiki/Estonian_identity_card

The Estonian identity card (Estonian: ID-kaart) is a mandatory identity document for citizens of Estonia. In addition to regular identification of a person, an ID-card can also be used for establishing one’s identity in electronic environment and for giving one’s digital signature.

The e-ID card is a platform for the delivery of other services.

The Estonian ID cards are used in health care, electronic banking, signing contracts, public transit, encrypting email and voting. Estonia offers over 600 e-services to citizens and 2400 to businesses.[4] The card’s chip stores digitized data about the authorized user, most importantly: the user’s full name, gender, national identification number, and cryptographic keys and public key certificates.

An e-ID for non-Estonians could be the first step toward Estonian (or German) e-residency.

Recruiting such e-residents has been a longstanding objective of Estonia, and it is thus in the interest of Estonia to advance such a project.

The e-identity card would be offered to local governments around the world.

Information pertaining to the ID would be kept on Estonia’s computer systems.

As the services related to the card began to expand, localities would develop their own e-ID card system.

Getting an e-ID card should as convenient as possible.

For example, it should be free.

Also, there would be the option of having one’s identity confirmed by a notary public prior to getting the e-ID card for those who do not yet have a passport or other form of ID.

That is, first-time applicants could bypass much of the state ID-card bureaucracy by getting a certificate of identification from a notary public.

IIRC, in American history, the federal system allows governmental innovation to happen first at the local and state levels, and percolate upwards later.

A state e-ID card outsourced to Estonia could be one such innovation.