From elections to filing tax returns, Estonia does it all online without compromising on privacy

People around the globe have been watching the build-up to the United States election with disbelief. Particularly confusing to many is the furore over postal ballots, which the US president, Donald Trump is insisting will lead to large-scale voter fraud – despite a complete lack of evidence to back this. And yet this issue has become a central feature of the debate.

Citizens of Estonia, a small nation in Baltic region, will perhaps be particularly perplexed: since 2005, Estonians have been able vote online, from anywhere in the world. Estonians log on with their digital ID card and vote as many times as they want during the pre-voting period, with each vote cancelling the last.

This unique technological solution has safeguarded Estonian voters against fraud, use of force and other manipulations of remote voting that many American voters are apprehensive about in the 2020 US election.

Voting online is just the start. Estonia offers the most comprehensive governmental online services in the world. In the US, it takes an average taxpayer with no business income eight hours to file a tax return. In Estonia, it takes just five minutes.

In the UK, billions of pounds have been spent on IT, yet the NHS still struggles to make patient data accessible across different health boards. In Estonia, despite having multiple private health service providers, doctors can collate and visualise patient records whenever and wherever necessary, with consent from patients – a real boon in the country’s fight against coronavirus.

Branding itself the first “digital republic” in the world, Estonia has digitised 99% of its public services. And, in an era when trust in public services are declining across the globe, Estonia persistently achieves one of the highest ratings of trust in government in the EU. The Estonian government claims that this digitisation of public services saves more than 1,400 years of working time and 2% of its GDP annually.

The tiger leap

The foundation of this digital republic dates back to 1997, a time when only 1.7% of world population had internet access, a start-up called Google had just registered its domain name and British prime minister John Major was celebrating the launch of 10 Downing Street’s official website.

Meanwhile, the government of the newly formed state of Estonia envisaged the creation of a digital society, where all citizens would be technologically literate and governance would be paperless, decentralised, transparent, efficient and equitable. The young post-Soviet government decided to ditch all communist-era legacy technologies and inefficient public service structure.

In a radical move, the government – which had an average age of 35 – also decided not to embrace western technologies. Neighbouring Finland offered an analogue telephone exchange as a gift and the Estonian government declined, envisaging communicating over the internet rather than analogue telephone.

The government of Estonia launched a project called Tiigrihüpe (Tiger Leap) in 1997, investing heavily in development and the expansion of internet networks and computer literacy. Within a year of its inception almost all (97%) of Estonian schools had internet access and by 2000, Estonia was the first country to pass legislation declaring access to the internet a basic human right. Free wi-fi hotspots started being built in 2001, and now cover almost all populated areas of the country.

The government also understood that, in order to create a knowledge-based society, information needs to be shared efficiently while maintaining privacy. This was a radical understanding, even in the context of today, when for most countries, data sharing among different organisations’ databases is still limited. It is predicted that by 2022, 93% of the world’s total data collected or stored will be such “dark” or siloed data.

Two decades ago, in 2001, Estonia created an anti-silo data management system called X-Road through which public and private organisations can share data securely while maintaining data privacy through cryptography. Built in partnership with Finnish government, X-Road came under cyber-attack from Russian IP addresses in 2007. This attack made clear how vulnerable centralised data management systems are, and so Estonia required a distributed technology that is resistant to cyber-attack. Addressing this need, in 2012 Estonia became the first country to use blockchain technology for governance.

Blockchain governance

Distributed ledger technology, commonly known as blockchain, is the underpinning technology of the cryptocurrency Bitcoin. The technology has moved on significantly since its inception in 2009 and is now used for a variety of applications, from supply chains to fighting injustice.

Blockchain is an open-source distributed ledger or database system in which an updated copy of the records is available to all stakeholders at all times. Due to this distributed nature, it is almost impossible for a single person or company to hack everybody’s ledger, ensuring security against cyberattacks.

Deploying blockchain technology not only ensures protection against any future attacks, but also poses many other benefits to Estonians. For example, in most countries, citizens have to fill in many different forms with the same personal information (name, address) when they need to access public services from different government agencies. In Estonia, citizens only need to input their personal information once: the blockchain system enables the relevant data to be immediately accessible to the required department.

This might scare people worried about data privacy. But citizens, not the government, own their personal data in Estonia. Citizens have a digital ID card and approve which part of their information can be reused by which public service. Estonians know that even government officials cannot access their personal data beyond what is approved by them for the required public service.

Any unauthorised attempt to access personal data will be identified as invalid: indeed, it is a criminal offence in Estonia for officials to gain unauthorised access to personal data. This transfer of ownership and control of personal data to individuals is only possible due to blockchain technology.

This should be an inspiration for the rest of the world. It is true that most countries do not have similar circumstances to post-Soviet Estonia when the Tiger Leap was introduced. But the same futuristic mindset is required to address the challenge of declining trust.

Dr Imtiaz Khan is a Reader in Data Science and Ali Shahaab is a PhD Candidate, Distributed Ledgers / Blockchain Technology at the Cardiff Metropolitan University.

This article first appeared on The Conversation.