The Digitization of Identity

The trade-off, as is often the case with data, is whether the potential gains in efficiency are worth the losses in privacy and the potential for misuse. JL


Jake Watts reports in the Wall Street Journal:

Digitally nimble states believe digital IDs can solve how to trust whether someone is who they say while cutting the cost of physical paperwork and lowering bureaucracy. Advocates of digital identities say they cut billions off the cost of processing and will change the way people interact with the internet, where identity fraud is rampant and expensive.A study found developing economies could unlock 6% of gross domestic product and 3% in developed economies by adopting digital identities, with over half the value accruing to individuals. And $1.6 trillion could be saved globally every year by reduced payroll fraud. This system may (be) efficient or invasive.
Karoli Hindriks was in a hotel in Tokyo when she cast her vote in Estonia’s national election four years ago. She started her company, cross-border careers portal Jobbatical in 2014, over an omelette and cappuccino from a cafe here in Tallinn. And she filed her 2017 tax return in just a few minutes from an airport lounge in Seoul.

Ms. Hindriks is a citizen of cyberspace, recognized across public- and private-sector services in her home country by her digital identity and not her physical presence. With all her data shared when it’s needed, Ms. Hindriks’s pharmacy knows instantly what her doctor prescribed. Her tax return is automatically generated. And her identity determines access to almost everything, from her 6-year-old daughter’s kindergarten website to her bank account.
“If I log in to anything that is related to being a human here, I use the same identity,” Ms. Hindriks says. “You can’t imagine how spoiled we are with that. When you try to do something in another country, then you start to understand how privileged we are.”
Each one of Estonia’s 1.3 million people has a mandatory digital identity that serves as the primary way citizens access services, whether it be making a utility payment, buying or selling a car, or using loyalty cards in department stores. Children are given a unique identification number and added to the grid from the moment they’re born. Life events, such as deaths and marriages, are entries in a database. The government is testing real-time monitoring of economic output by analyzing tax data that is automatically uploaded by Estonian companies.
 

This system may sound uber-efficient or incredibly invasive, depending on your point of view. But Estonia is among a number of digitally nimble states around the world that believe digital IDs can help solve one of the internet’s thorniest problems—how to trust whether someone is who they say they are—while also cutting back on the costly business of physical paperwork and lowering the barriers of bureaucracy.Advocates of digital identities say they cut billions off the cost of bureaucratic processing and will forever change the way people interact with the internet, where identity fraud is rampant and expensive. Estonia says it saves the equivalent of 2% of its entire economic output and saves the workload of more than 1,400 people annually by automating government services through digital identities.
A study published in April by the McKinsey Global Institute found that developing economies could unlock an average value of 6% of gross domestic product and 3% in developed economies by widely adopting digital identities, with just over half the value accruing to individuals. And $1.6 trillion could be saved globally every year by reduced payroll fraud, the report found.
Supporters also say the technology saves lives: a nationwide medical database in Estonia means hospitals and ambulance crews can pull a person’s medical history en route to an incident. And fraud is much harder in a system that records everything.
The idea is catching on. Finland has imported the Estonian model and in 2017 linked its own digital identity system to Estonia’s, allowing databases in the neighboring countries to communicate with each other. Governments in Canada, Singapore and China, to name a few, are working on their own digital ID systems.
But civil-rights watchdogs and cybersecurity experts urge caution, warning of consequences that could outweigh the cost savings and efficiencies. Digital identity “is not a question of if, it’s a question of how,” says Dakota Gruener, executive director of ID2020, a New York-based nonprofit that coordinates funding and sets technical requirements for ethical digital identities. Ms. Gruener sees digital identities, which are at the most basic level a way of representing yourself, as a fundamental human right.
 

They are being adopted at speed around the world, but “we are very concerned digital identity is not very thoughtfully implemented or designed and carries tremendous risk,” she says. “A poorly designed digital identity system is a tool for mass surveillance. If you want to consider the worst possible scenario, it’s a tool for genocide.”Estonia’s digital ID system has its roots in 1991, when the country regained its independence after the fall of the Soviet Union. The government tried to figure out how a remote and icy nation with a declining birthrate could provide services to people scattered across more than 17,000 square miles, about twice the size of New Jersey. “We figured technology might be a way to punch beyond our weight,” Siim Sikkut, Estonia’s chief information officer, said during a recent interview in a government compound in Tallinn.
Mr. Sikkut said Estonia rebooted itself after the Soviet era and now benefits from a lean government, flat bureaucracy and willingness to experiment. Officials today are fond of saying that the only things you can’t do online in Estonia are buy a house and get married or divorced.
For all this convenience, the rapid advancement of digital identities and the back-end systems that power them has raised concerns among privacy and cyber-security advocates who say they compromise a right to anonymity that is baked into the culture of Western liberal democracies.
“Identity and identification makes us more transparent, more accountable, more legible,” says Gilad Rosner, the Barcelona-based founder of the Internet of Things Privacy Forum. But “people cannot criticize government if they fear retribution, and retribution is much easier if we know who you are and how to find you.”
In any digital system, the risk of cyberattacks is a persistent threat. In 2017, a security flaw in government-issued identity cards threatened Estonia’s digital infrastructure. Estonia revoked the security access of nearly 800,000 affected identity cards, forcing citizens to update their digital security certificates online or in person at government offices.
While there was no known theft of data, the problem could have exposed a person’s entire digital identity and allowed a hacker to access hundreds of government and private-sector services while pretending to be someone else. It was a wake-up call for officials and a demonstration of just how reliant Estonia was on the technology.
Mr. Sikkut says trust in Estonia’s system is underpinned by respect for the rule of law and transparency. “Obviously all these tools can be very grossly misused and really for harm, but at the same time do we really need to stop using them?” Mr. Sikkut asks.
The IT backbone of Estonia’s system, which went live in 2001, has no central database. It connects nearly 700 organizations and public sector institutions that talk directly to each other to share data, rather than via a central point, to avoid creating a single target for attackers. A backup of government data is kept in Luxembourg as a security measure, and the system is capable of holding digital elections remotely even if Estonia is physically occupied by a foreign power.
 

All Estonians can log on to a government portal to see who has accessed their data, when and why, and challenge the reasons in court if they suspect malpractice. The only exception is law enforcement, which is not obliged to log its access during an investigation but is required to inform citizens when an investigation concludes.One example of a digital identity that has privacy activists concerned is China’s “social credit” system, a pilot project in some Chinese cities that aims to monitor the conduct of citizens on civic good deeds like volunteer work and blood donations and record acts of bad behavior such as defaulting on loans or criminal convictions. In some places, ratings of a person’s “trustworthiness” serve as the basis for rewards such as discounts on public services. Such a system is similar to financial credit scores that are widely used globally as a way for banks and other creditors to assess the reliability of potential customers to pay back their loans. China also has an electronic signature that is legally binding for certain documents and gives all citizens over the age of 16 a mandatory identity number that stays with them for life.
China’s size and economic clout will make it a global player in digital identity if it chooses, says Taavi Kotka, an entrepreneur who was formerly Estonia’s government chief information officer. “We were the planners. We showed it was possible,” Mr. Kotka says over coffee and a plate of chocolate in his airy seaside Tallinn office. “I’m waiting for China.”
While in government, Mr. Kotka widened the reach of Estonia’s digital ID system to include foreigners. The country now offers “e-residency” to anyone in the world, allowing them to access the country’s digital ecosystem and granting the status necessary to start a local company. “As the world becomes more global, people identify themselves not through physical location but how they feel in their heart,” says Mr. Kotka.
To access services, e-residents use a similar process to Estonian citizens, entering a personal identification number on their cellphones to prove who they are and a second PIN to digitally sign documents. These signatures are legally binding across the EU, like a handwritten one, but without the need to courier business contracts and rental agreements from one place to another.
When it was launched in 2014, e-residency was sold as a way to bring in as many as 10 million new “connections’’ for Estonia, a country with a declining birth rate and such harsh winters that it has struggled to attract immigrants. Microsoft Inc. co-founder Bill Gates and Pope Francis are among Estonia’s 55,000 e-residents, a total that hasn’t reached anywhere near that early goal, which Mr. Kotka said he inflated as a way to drum up support for the program. New applications do exceed Estonia’s birth rate.
About 6,800 e-residents have started their own businesses in Estonia. They pay local corporation tax—which in Estonia is up to 20% only on profits that are not retained or reinvested. (Personal income taxes of e-residents are the responsibility of each individual, usually payable where they physically reside.)
E-residency does not confer physical residency or citizenship rights. Applicants go through background checks by the Estonian police and border guard—rejections hover at around 2%—and must pick up their identity card and a USB card reader from an Estonian Embassy. The service costs €100.
For Turkish tour guide Arzu Altinay, Estonia’s program provided a lifeline for her business—a booming walking-tour operation in Istanbul’s ancient city that was devastated when a terrorist attack and failed coup three years ago brought the flow of tourists to a halt. “That was the end of my business in Istanbul,” says Ms. Altinay.
With her new e-residency, Ms. Altinay was able to found a business in Estonia and gain access to the European Union’s single market. She opened an Estonian bank account in euros. Now, she manages Walks in Europe, a network of walking tour guides in 16 European cities from Rome to Riga.
Ott Vatter, head of Estonia’s e-residency program, says his dream is a global network of trusted government-issued digital identities, recognizable across borders, that would allow an entrepreneur to use their Estonian identity to set up a company elsewhere in the world without having to go through complex and expensive relocation processes.
“I think the future of work is really about smart immigration and people being free to travel and free to work wherever they want to work,” Mr. Vatter says.