Estonia, the Digital Republic
Its government is virtual, borderless, blockchained, and secure. Has this tiny post-Soviet nation found the way of the future?
171218_r31150
The Estonian government is so eager to take on big problems that many ambitious techies leave the private sector to join it.
Illustration by Eiko Ojala
Up the Estonian coast, a five-lane highway bends with the path of the sea, then breaks inland, leaving cars to follow a thin road toward the houses at the water’s edge. There is a gated community here, but it is not the usual kind. The gate is low—a picket fence—as if to prevent the dunes from riding up into the street. The entrance is blocked by a railroad-crossing arm, not so much to keep out strangers as to make sure they come with intent. Beyond the gate, there is a schoolhouse, and a few homes line a narrow drive. From Tallinn, Estonia’s capital, you arrive dazed: trees trace the highway, and the cars go fast, as if to get in front of something that no one can see.
Within this gated community lives a man, his family, and one vision of the future. Taavi Kotka, who spent four years as Estonia’s chief information officer, is one of the leading public faces of a project known as e-Estonia: a coördinated governmental effort to transform the country from a state into a digital society.
E-Estonia is the most ambitious project in technological statecraft today, for it includes all members of the government, and alters citizens’ daily lives. The normal services that government is involved with—legislation, voting, education, justice, health care, banking, taxes, policing, and so on—have been digitally linked across one platform, wiring up the nation. A lawn outside Kotka’s large house was being trimmed by a small robot, wheeling itself forward and nibbling the grass.
“Everything here is robots,” Kotka said. “Robots here, robots there.” He sometimes felt that the lawnmower had a soul. “At parties, it gets close to people,” he explained.
A curious wind was sucking in a thick fog from the water, and Kotka led me inside. His study was cluttered, with a long table bearing a chessboard and a bowl of foil-wrapped wafer chocolates (a mark of hospitality at Estonian meetings). A four-masted model ship was perched near the window; in the corner was a pile of robot toys.
“We had to set a goal that resonates, large enough for the society to believe in,” Kotka went on.
He is tall with thin blond hair that, kept shaggy, almost conceals its recession. He has the liberated confidence, tinged with irony, of a cardplayer who has won a lot of hands and can afford to lose some chips.
It was during Kotka’s tenure that the e-Estonian goal reached its fruition. Today, citizens can vote from their laptops and challenge parking tickets from home. They do so through the “once only” policy, which dictates that no single piece of information should be entered twice. Instead of having to “prepare” a loan application, applicants have their data—income, debt, savings—pulled from elsewhere in the system. There’s nothing to fill out in doctors’ waiting rooms, because physicians can access their patients’ medical histories. Estonia’s system is keyed to a chip-I.D. card that reduces typically onerous, integrative processes—such as doing taxes—to quick work. “If a couple in love would like to marry, they still have to visit the government location and express their will,” Andrus Kaarelson, a director at the Estonian Information Systems Authority, says. But, apart from transfers of physical property, such as buying a house, all bureaucratic processes can be done online.
Estonia is a Baltic country of 1.3 million people and four million hectares, half of which is forest. Its government presents this digitization as a cost-saving efficiency and an equalizing force. Digitizing processes reportedly saves the state two per cent of its G.D.P. a year in salaries and expenses. Since that’s the same amount it pays to meet the nato threshold for protection (Estonia—which has a notably vexed relationship with Russia—has a comparatively small military), its former President Toomas Hendrik Ilves liked to joke that the country got its national security for free.
Other benefits have followed. “If everything is digital, and location-independent, you can run a borderless country,” Kotka said. In 2014, the government launched a digital “residency” program, which allows logged-in foreigners to partake of some Estonian services, such as banking, as if they were living in the country. Other measures encourage international startups to put down virtual roots; Estonia has the lowest business-tax rates in the European Union, and has become known for liberal regulations around tech research. It is legal to test Level 3 driverless cars (in which a human driver can take control) on all Estonian roads, and the country is planning ahead for Level 5 (cars that take off on their own). “We believe that innovation happens anyway,” Viljar Lubi, Estonia’s deputy secretary for economic development, says. “If we close ourselves off, the innovation happens somewhere else.”
“It makes it so that, if one country is not performing as well as another country, people are going to the one that is performing better—competitive governance is what I’m calling it,” Tim Draper, a venture capitalist at the Silicon Valley firm Draper Fisher Jurvetson and one of Estonia’s leading tech boosters, says. “We’re about to go into a very interesting time where a lot of governments can become virtual.”
Previously, Estonia’s best-known industry was logging, but Skype was built there using mostly local engineers, and countless other startups have sprung from its soil. “It’s not an offshore paradise, but you can capitalize a lot of money,” Thomas Padovani, a Frenchman who co-founded the digital-ad startup Adcash in Estonia, explains. “And the administration is light, all the way.” A light touch does not mean a restricted one, however, and the guiding influence of government is everywhere.
As an engineer, Kotka said, he found the challenge of helping to construct a digital nation too much to resist. “Imagine that it’s your task to build the Golden Gate Bridge,” he said excitedly. “You have to change the whole way of thinking about society.” So far, Estonia is past halfway there.
One afternoon, I met a woman named Anna Piperal at the e-Estonia Showroom. Piperal is the “e-Estonia ambassador”; the showroom is a permanent exhibit on the glories of digitized Estonia, from Skype to Timbeter, an app designed to count big piles of logs. (Its founder told me that she’d struggled to win over the wary titans of Big Log, who preferred to count the inefficient way.) Piperal has blond hair and an air of brisk, Northern European professionalism. She pulled out her I.D. card; slid it into her laptop, which, like the walls of the room, was faced with blond wood; and typed in her secret code, one of two that went with her I.D. The other code issues her digital signature—a seal that, Estonians point out, is much harder to forge than a scribble.
“This pin code just starts the whole decryption process,” Piperal explained. “I’ll start with my personal data from the population registry.” She gestured toward a box on the screen. “It has my document numbers, my phone number, my e-mail account. Then there’s real estate, the land registry.” Elsewhere, a box included all of her employment information; another contained her traffic records and her car insurance. She pointed at the tax box. “I have no tax debts; otherwise, that would be there. And I’m finishing a master’s at the Tallinn University of Technology, so here”—she pointed to the education box—“I have my student information. If I buy a ticket, the system can verify, automatically, that I’m a student.” She clicked into the education box, and a detailed view came up, listing her previous degrees.
“My cat is in the pet registry,” Piperal said proudly, pointing again. “We are done with the vaccines.”
Data aren’t centrally held, thus reducing the chance of Equifax-level breaches. Instead, the government’s data platform, X-Road, links individual servers through end-to-end encrypted pathways, letting information live locally. Your dentist’s practice holds its own data; so does your high school and your bank. When a user requests a piece of information, it is delivered like a boat crossing a canal via locks.
Although X-Road is a government platform, it has become, owing to its ubiquity, the network that many major private firms build on, too. Finland, Estonia’s neighbor to the north, recently began using X-Road, which means that certain data—for instance, prescriptions that you’re able to pick up at a local pharmacy—can be linked between the nations. It is easy to imagine a novel internationalism taking shape in this form. Toomas Ilves, Estonia’s former President and a longtime driver of its digitization efforts, is currently a distinguished visiting fellow at Stanford, and says he was shocked at how retrograde U.S. bureaucracy seems even in the heart of Silicon Valley. “It’s like the nineteen-fifties—I had to provide an electrical bill to prove I live here!” he exclaimed. “You can get an iPhone X, but, if you have to register your car, forget it.”
X-Road is appealing due to its rigorous filtering: Piperal’s teachers can enter her grades, but they can’t access her financial history, and even a file that’s accessible to medical specialists can be sealed off from other doctors if Piperal doesn’t want it seen.
“I’ll show you a digital health record,” she said, to explain. “A doctor from here”—a file from one clinic—“can see the research that this doctor”—she pointed to another—“does.” She’d locked a third record, from a female-medicine practice, so that no other doctor would be able to see it. A tenet of the Estonian system is that an individual owns all information recorded about him or her. Every time a doctor (or a border guard, a police officer, a banker, or a minister) glances at any of Piperal’s secure data online, that look is recorded and reported. Peeping at another person’s secure data for no reason is a criminal offense. “In Estonia, we don’t have Big Brother; we have Little Brother,” a local told me. “You can tell him what to do and maybe also beat him up.”
Business and land-registry information is considered public, so Piperal used the system to access the profile of an Estonian politician. “Let’s see his land registry,” she said, pulling up a list of properties. “You can see there are three land plots he has, and this one is located”—she clicked, and a satellite photograph of a sprawling beach house appeared—“on the sea.”
The openness is startling. Finding the business interests of the rich and powerful—a hefty field of journalism in the United States—takes a moment’s research, because every business connection or investment captured in any record in Estonia becomes searchable public information. (An online tool even lets citizens map webs of connection, follow-the-money style.) Traffic stops are illegal in the absence of a moving violation, because officers acquire records from a license-plate scan. Polling-place intimidation is a non-issue if people can vote—and then change their votes, up to the deadline—at home, online. And heat is taken off immigration because, in a borderless society, a resident need not even have visited Estonia in order to work and pay taxes under its dominion.
Soon after becoming the C.I.O., in 2013, Taavi Kotka was charged with an unlikely project: expanding Estonia’s population. The motive was predominantly economic. “Countries are like enterprises,” he said. “They want to increase the wealth of their own people.”
Tallinn, a harbor city with a population just over four hundred thousand, does not seem to be on a path toward outsized growth. Not far from the cobbled streets of the hilly Old Town is a business center, where boxy Soviet structures have been supplanted by stylish buildings of a Scandinavian cast. Otherwise, the capital seems pleasantly preserved in time. The coastal daylight is bright and thick, and, when a breeze comes off the Baltic, silver-birch leaves shimmer like chimes. “I came home to a great autumn / to a luminous landscape,” the Estonian poet Jaan Kaplinski wrote decades ago. This much has not changed.
Kotka, however, thought that it was possible to increase the population just by changing how you thought of what a population was. Consider music, he said. Twenty years ago, you bought a CD and played the album through. Now you listen track by track, on demand. “If countries are competing not only on physical talent moving to their country but also on how to get the best virtual talent connected to their country, it becomes a disruption like the one we have seen in the music industry,” he said. “And it’s basically a zero-cost project, because we already have this infrastructure for our own people.”
The program that resulted is called e-residency, and it permits citizens of another country to become residents of Estonia without ever visiting the place. An e-resident has no leg up at the customs desk, but the program allows individuals to tap into Estonia’s digital services from afar.
I applied for Estonian e-residency one recent morning at my apartment, and it took about ten minutes. The application cost a hundred euros, and the hardest part was finding a passport photograph to upload, for my card. After approval, I would pick up my credentials in person, like a passport, at the Estonian Consulate in New York.
This physical task proved to be the main stumbling block, Ott Vatter, the deputy director of e-residency, explained, because consulates were reluctant to expand their workload to include a new document. Mild xenophobia made some Estonians at home wary, too. “Inside Estonia, the mentality is kind of ‘What is the gain, and where is the money?’ ” he said. The physical factor still imposes limitations—only thirty-eight consulates have agreed to issue documents, and they are distributed unevenly. (Estonia has only one embassy in all of Africa.) But the office has made special accommodations for several popular locations. Since there’s no Estonian consulate in San Francisco, the New York consulate flies personnel to California every three months to batch-process Silicon Valley applicants.
“I had a deal that I did with Funderbeam, in Estonia,” Tim Draper, who became Estonia’s second e-resident, told me. “We decided to use a ‘smart contract’—the first ever in a venture deal!” Smart contracts are encoded on a digital ledger and, notably, don’t require an outside administrative authority. It was an appealing prospect, and Draper, with his market investor’s gaze, recognized a new market for élite tech brainpower and capital. “I thought, Wow! Governments are going to have to compete with each other for us,” he said.
So far, twenty-eight thousand people have applied for e-residency, mostly from neighboring countries: Finland and Russia. But Italy and Ukraine follow, and U.K. applications spiked during Brexit. (Many applicants are footloose entrepreneurs or solo venders who want to be based in the E.U.) Because eighty-eight per cent of applicants are men, the United Nations has begun seeking applications for female entrepreneurs in India.
“There are so many companies in the world for whom working across borders is a big hassle and a source of expense,” Siim Sikkut, Estonia’s current C.I.O., says. Today, in Estonia, the weekly e-residency application rate exceeds the birth rate. “We tried to make more babies, but it’s not that easy,” he explained.
With so many businesses abroad, Estonia’s startup-ism hardly leaves an urban trace. I went to visit one of the places it does show: a co-working space, Lift99, in a complex called the Telliskivi Creative City. The Creative City, a former industrial park, is draped with trees and framed by buildings whose peeling exteriors have turned the yellows of a worn-out sponge. There are murals, outdoor sculptures, and bills for coming shows; the space is shaped by communalism and by the spirit of creative unrule. One art work consists of stacked logs labelled with Tallinn startups: Insly, Leapin, Photry, and something called 3D Creationist.
The office manager, Elina Kaarneem, greeted me near the entrance. “Please remove your shoes,” she said. Lift99, which houses thirty-two companies and five freelancers, had industrial windows, with a two-floor open-plan workspace. Both levels also included smaller rooms named for techies who had done business with Estonia. There was a Zennström Room, after Niklas Zennström, the Swedish entrepreneur who co-founded Skype, in Tallinn. There was a Horowitz Room, for the venture capitalist Ben Horowitz, who has invested in Estonian tech. There was also a Tchaikovsky Room, because the composer had a summer house in Estonia and once said something nice about the place.
“This is not the usual co-working space, because we choose every human,” Ragnar Sass, who founded Lift99, exclaimed in the Hemingway Room. Hemingway, too, once said something about Estonia; a version of his pronouncement—“No well-run yacht basin is complete without at least two Estonians”—had been spray-stencilled on the wall, along with his face.
The room was extremely small, with two cushioned benches facing each other. Sass took one; I took the other. “Many times, a miracle can happen if you put talented people in one room,” he said as I tried to keep my knees inside my space. Not far from the Hemingway Room, Barack Obama’s face was also on a wall. Obama Rooms are booths for making cell-phone calls, following something he once said about Estonia. (“I should have called the Estonians when we were setting up our health-care Web site.”) That had been stencilled on the wall as well.
Some of the companies at Lift99 are local startups, but others are international firms seeking an Estonian foothold. In something called the Draper Room, for Tim Draper, I met an Estonian engineer, Margus Maantoa, who was launching the Tallinn branch of the German motion-control company Trinamic. Maantoa shares the room with other companies, and, to avoid disturbing them, we went to the Iceland Room. (Iceland was the first country to recognize Estonian independence.) The seats around the table in the Iceland Room were swings.
I took a swing, and Maantoa took another. He said, “I studied engineering and physics in Sweden, and then, seven years ago, I moved back to Estonia because so much is going on.” He asked whether I wanted to talk with his boss, Michael Randt, at the Trinamic headquarters, in Hamburg, and I said that I did, so he opened his laptop and set up a conference call on Skype. Randt was sitting at a table, peering down at us as if we were a mug of coffee. Tallinn had a great talent pool, he said: “Software companies are absorbing a lot of this labor, but, when it comes to hardware, there are only a few companies around.” He was an e-resident, so opening a Tallinn office was fast.
Maantoa took me upstairs, where he had a laboratory space that looked like a janitor’s closet. Between a water heater and two large air ducts, he had set up a desk with a 3-D printer and a robotic motion-control platform. I walked him back to Draper and looked up another startup, an Estonian company called Ööd, which makes one-room, two-hundred-square-foot huts that you can order prefab. The rooms have floor-to-ceiling windows of one-way glass, climate control, furniture, and lovely wood floors. They come in a truck and are dropped into the countryside.
“Sometimes you want something small, but you don’t want to be in a tent,” Kaspar Kägu, the head of Ööd sales, explained. “You want a shower in the morning and your coffee and a beautiful landscape. Fifty-two per cent of Estonia is covered by forestland, and we’re rather introverted people, so we want to be—uh, not near everybody else.” People of a more sociable disposition could scatter these box homes on their property, he explained, and rent them out on services like Airbnb.
“We like to go to nature—but comfortably,” Andreas Tiik, who founded Ööd with his carpenter brother, Jaak, told me. The company had queued preorders from people in Silicon Valley, who also liked the idea, and was tweaking the design for local markets. “We’re building a sauna in it,” Kägu said.
In the U.S., it is generally assumed that private industry leads innovation. Many ambitious techies I met in Tallinn, though, were leaving industry to go work for the state. “If someone had asked me, three years ago, if I could imagine myself working for the government, I would have said, ‘Fuck no,’ ” Ott Vatter, who had sold his own business, told me. “But I decided that I could go to the U.S. at any point, and work in an average job at a private company. This is so much bigger.”
The bigness is partly inherent in the government’s appetite for large problems. In Tallinn’s courtrooms, judges’ benches are fitted with two monitors, for consulting information during the proceedings, and case files are assembled according to the once-only principle. The police make reports directly into the system; forensic specialists at the scene or in the lab do likewise. Lawyers log on—as do judges, prison wardens, plaintiffs, and defendants, each through his or her portal. The Estonian courts used to be notoriously backlogged, but that is no longer the case.
“No one was able to say whether we should increase the number of courts or increase the number of judges,” Timo Mitt, a manager at Netgroup, which the government hired to build the architecture, told me. Digitizing both streamlined the process and helped identify points of delay. Instead of setting up prisoner transport to trial—fraught with security risks—Estonian courts can teleconference defendants into the courtroom from prison.
For doctors, a remote model has been of even greater use. One afternoon, I stopped at the North Estonia Medical Center, a hospital in the southwest of Tallinn, and met a doctor named Arkadi Popov in an alleyway where ambulances waited in line.
“Welcome to our world,” Popov, who leads emergency medical care, said grandly, gesturing with pride toward the chariots of the sick and maimed. “Intensive care!”
In a garage where unused ambulances were parked, he took an iPad Mini from the pocket of his white coat, and opened an “e-ambulance” app, which Estonian paramedics began using in 2015. “This system had some childhood diseases,” Popov said, tapping his screen. “But now I can say that it works well.”
E-ambulance is keyed onto X-Road, and allows paramedics to access patients’ medical records, meaning that the team that arrives for your chest pains will have access to your latest cardiology report and E.C.G. Since 2011, the hospital has also run a telemedicine system—doctoring at a distance—originally for three islands off its coast. There were few medical experts on the islands, so the E.M.S. accepted volunteer paramedics. “Some of them are hotel administrators, some of them are teachers,” Popov said. At a command center at the hospital in Tallinn, a doctor reads data remotely.
“On the screen, she or he can see all the data regarding the patient—physiological parameters, E.C.G.s,” he said. “Pulse, blood pressure, temperature. In case of C.P.R., our doctor can see how deep the compression of the chest is, and can give feedback.” The e-ambulance software also allows paramedics to pre-register a patient en route to the hospital, so that tests, treatments, and surgeries can be prepared for the patient’s arrival.
To see what that process looks like, I changed into scrubs and a hairnet and visited the hospital’s surgery ward. Rita Beljuskina, a nurse anesthetist, led me through a wide hallway lined with steel doors leading to the eighteen operating theatres. Screens above us showed eighteen columns, each marked out with twenty-four hours. Surgeons book their patients into the queue, Beljuskina explained, along with urgency levels and any machinery or personnel they might need. An on-call anesthesiologist schedules them in order to optimize the theatres and the equipment.
“Let me show you how,” Beljuskina said, and led me into a room filled with medical equipment and a computer in the corner. She logged on with her own I.D. If she were to glance at any patient’s data, she explained, the access would be tagged to her name, and she would get a call inquiring why it was necessary. The system also scans for drug interactions, so if your otolaryngologist prescribes something that clashes with the pills your cardiologist told you to take, the computer will put up a red flag.
The putative grandfather of Estonia’s digital platform is Tarvi Martens, an enigmatic systems architect who today oversees the country’s digital-voting program from a stone building in the center of Tallinn’s Old Town. I went to visit him one morning, and was shown into a stateroom with a long conference table and French windows that looked out on the trees. Martens was standing at one window, with his back to me, commander style. For a few moments, he stayed that way; then he whirled around and addressed a timid greeting to the buttons of my shirt.
Martens was wearing a red flannel button-down, baggy jeans, black socks, and the sort of sandals that are sold at drugstores. He had gray stubble, and his hair was stuck down on his forehead in a manner that was somehow both rumpled and flat. This was the busiest time of the year, he said, with the fall election looming. He appeared to run largely on caffeine and nicotine; when he put down a mug of hot coffee, his fingers shook.
For decades, he pointed out, digital technology has been one of Estonia’s first recourses for public ailments. A state project in 1970 used computerized data matching to help singles find soul mates, “for the good of the people’s economy.” In 1997, the government began looking into newer forms of digital documents as a supplement.
“They were talking about chip-equipped bar codes or something,” Martens told me, breaking into a nerdy snicker-giggle. “Totally ridiculous.” He had been doing work in cybernetics and security as a private-sector contractor, and had an idea. When the cards were released, in 2002, Martens became convinced that they should be both mandatory and cheap.
“Finland started two years earlier with an I.D. card, but it’s still a sad story,” he said. “Nobody uses it, because they put a hefty price tag on the card, and it’s a voluntary document. We sold it for ten euros at first, and what happened? Banks and application providers would say, ‘Why should I support this card? Nobody has it.’ It was a dead end.” In what may have been the seminal insight of twenty-first-century Estonia, Martens realized that whoever offered the most ubiquitous and secure platform would run the country’s digital future—and that it should be an elected leadership, not profit-seeking Big Tech. “The only thing was to push this card to the people, without them knowing what to do with it, and then say, ‘Now people have a card. Let’s start some applications,’ ” he said.
The first “killer application” for the I.D.-card-based system was the one that Martens still works on: i-voting, or casting a secure ballot from your computer. Before the first i-voting period, in 2005, only five thousand people had used their card for anything. More than nine thousand cast an i-vote in that election, however—only two per cent of voters, but proof that online voting was attracting users—and the numbers rose from there. As of 2014, a third of all votes have been cast online.
That year, seven Western researchers published a study of the i-voting system which concluded that it had “serious architectural limitations and procedural gaps.” Using an open-source edition of the voting software, the researchers approximated a version of the i-voting setup in their lab and found that it was possible to introduce malware. They were not convinced that the servers were entirely secure, either.
Martens insisted that the study was “ridiculous.” The researchers, he said, gathered data with “a lot of assumptions,” and misunderstood the safeguards in Estonia’s system. You needed both the passwords and the hardware (the chip in your I.D. card or, in the newer “mobile I.D.” system, the sim card in your phone) to log in, blocking most paths of sabotage. Estonian trust was its own safeguard, too, he told me. Earlier this fall, when a Czech research team found a vulnerability in the physical chips used in many I.D. cards, Siim Sikkut, the Estonian C.I.O., e-mailed me the finding. His office announced the vulnerability, and the cards were locked for a time. When Sikkut held a small press conference, reporters peppered him with questions: What did the government gain from disclosing the vulnerability? How disastrous was it?
Sikkut looked bemused. Many upgrades to phones and computers resolve vulnerabilities that have never even been publicly acknowledged, he said—and think how much data we entrust to those devices. (“There is no government that knows more about you than Google or Facebook,” Taavi Kotka says dryly.) In any case, the transparency seemed to yield a return; a poll conducted after the chip flaw was announced found that trust in the system had fallen by just three per cent.
From time to time, Russian military jets patrolling Estonia’s western border switch off their G.P.S. transponders and drift into the country’s airspace. What follows is as practiced as a pas de deux at the Bolshoi. nato troops on the ground scramble an escort. Estonia calls up the Russian Ambassador to complain; Russia cites an obscure error. The dance lets both parties show that they’re alert, and have not forgotten the history of place.
Since the eleventh century, Estonian land has been conquered by Russia five times. Yet the country has always been an awkward child of empire, partly owing to its proximity to other powers (and their airwaves) and partly because the Estonian language, which belongs to the same distinct Uralic family as Hungarian and Finnish, is incomprehensible to everyone else. Plus, the greatest threat, these days, may not be physical at all. In 2007, a Russian cyberattack on Estonia sent everything from the banks to the media into chaos. Estonians today see it as the defining event of their recent history.
The chief outgrowth of the attack is the natoCoöperative Cyber Defense Center of Excellence, a think tank and training facility. It’s on a military base that once housed the Soviet Army. You enter through a gatehouse with gray walls and a pane of mirrored one-way glass.
“Document, please!” the mirror boomed at me when I arrived one morning. I slid my passport through on a tray. The mirror was silent for two full minutes, and I backed into a plastic chair.
“You have to wait here!” the mirror boomed back.
Some minutes later, a friendly staffer appeared at the inner doorway and escorted me across a quadrangle trimmed with nato-member flags and birch trees just fading to gold. Inside a gray stone building, another mirror instructed me to stow my goods and to don a badge. Upstairs, the center’s director, Merle Maigre, formerly the national-security adviser to the Estonian President, said that the center’s goal was to guide other nato nations toward vigilance.
“This country is located—just where it is,” she said, when I asked about Russia. Since starting, in 2008, the center has done research on digital forensics, cyber-defense strategy, and similar topics. (It publishes the “Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations” and organizes a yearly research conference.) But it is best known for its training simulations: an eight-hundred-person cyber “live-fire” exercise called Locked Shields was run this year alongside cybrid, an exercise for defense ministers of the E.U. “This included aspects such as fake news and social media,” Maigre said.
Not all of Estonia’s digital leadership in the region is as openly rehearsed. Its experts have consulted on Georgia’s efforts to set up its own digital registry. Estonia is also building data partnerships with Finland, and trying to export its methods elsewhere across the E.U. “The vision is that I will go to Greece, to a doctor, and be able to get everything,” Toomas Ilves explains. Sandra Roosna, a member of Estonia’s E-Governance Academy and the author of the book “eGovernance in Practice,” says, “I think we need to give the European Union two years to do cross-border transactions and to recognize each other digitally.” Even now, though, the Estonian platform has been adopted by nations as disparate as Moldova and Panama. “It’s very popular in countries that want—and not all do—transparency against corruption,” Ilves says.
Beyond X-Road, the backbone of Estonia’s digital security is a blockchain technology called K.S.I. A blockchain is like the digital version of a scarf knitted by your grandmother. She uses one ball of yarn, and the result is continuous. Each stitch depends on the one just before it. It’s impossible to remove part of the fabric, or to substitute a swatch, without leaving some trace: a few telling knots, or a change in the knit.
In a blockchain system, too, every line is contingent on what came before it. Any breach of the weave leaves a trace, and trying to cover your tracks leaves a trace, too. “Our No. 1 marketing pitch is Mr. Snowden,” Martin Ruubel, the president of Guardtime, the Estonian company that developed K.S.I., told me. (The company’s biggest customer group is now the U.S. military.) Popular anxiety tends to focus on data security—who can see my information?—but bits of personal information are rarely truly compromising. The larger threat is data integrity: whether what looks secure has been changed. (It doesn’t really matter who knows what your blood type is, but if someone switches it in a confidential record your next trip to the emergency room could be lethal.) The average time until discovery of a data breach is two hundred and five days, which is a huge problem if there’s no stable point of reference. “In the Estonian system, you don’t have paper originals,” Ruubel said. “The question is: Do I know about this problem, and how quickly can I react?”
The blockchain makes every footprint immediately noticeable, regardless of the source. (Ruubel says that there is no possibility of a back door.) To guard secrets, K.S.I. is also able to protect information without “seeing” the information itself. But, to deal with a full-scale cyberattack, other safeguards now exist. Earlier this year, the Estonian government created a server closet in Luxembourg, with a backup of its systems. A “data embassy” like this one is built on the same body of international law as a physical embassy, so that the servers and their data are Estonian “soil.” If Tallinn is compromised, whether digitally or physically, Estonia’s locus of control will shift to such mirror sites abroad.
“If Russia comes—not when—and if our systems shut down, we will have copies,” Piret Hirv, a ministerial adviser, told me. In the event of a sudden invasion, Estonia’s elected leaders might scatter as necessary. Then, from cars leaving the capital, from hotel rooms, from seat 3A at thirty thousand feet, they will open their laptops, log into Luxembourg, and—with digital signatures to execute orders and a suite of tamper-resistant services linking global citizens to their government—continue running their country, with no interruption, from the cloud.
The history of nationhood is a history of boundaries marked on land. When, in the fourteenth century, peace arrived after bloodshed among the peoples of Mexico’s eastern altiplano, the first task of the Tlaxcaltecs was to set the borders of their territory. In 1813, Ernst Moritz Arndt, a German nationalist poet before there was a Germany to be nationalistic about, embraced the idea of a “Vaterland” of shared history: “Which is the German’s fatherland? / So tell me now at last the land!— / As far’s the German’s accent rings / And hymns to God in heaven sings.”
Today, the old fatuities of the nation-state are showing signs of crisis. Formerly imperialist powers have withered into nationalism (as in Brexit) and separatism (Scotland, Catalonia). New powers, such as the Islamic State, have redefined nationhood by ideological acculturation. It is possible to imagine a future in which nationality is determined not so much by where you live as by what you log on to.
Estonia currently holds the presidency of the European Union Council—a bureaucratic role that mostly entails chairing meetings. (The presidency rotates every six months; in January, it will go to Bulgaria.) This meant that the autumn’s E.U. Digital Summit was held in Tallinn, a convergence of audience and expertise not lost on Estonia’s leaders. One September morning, a car pulled up in front of the Tallinn Creative Hub, a former power station, and Kersti Kaljulaid, the President of Estonia, stepped out. She is the country’s first female President, and its youngest. Tall and lanky, with chestnut hair in a pixie cut, she wore an asymmetrical dress of Estonian blue and machine gray. Kaljulaid took office last fall, after Estonia’s Presidential election yielded no majority winner; parliamentary representatives of all parties plucked her out of deep government as a consensus candidate whom they could all support. She had previously been an E.U. auditor.
“I am President to a digital society,” she declared in her address. The leaders of Europe were arrayed in folding chairs, with Angela Merkel, in front, slumped wearily in a red leather jacket. “Simple people suffer in the hands of heavy bureaucracies,” Kaljulaid told them. “We must go for inclusiveness, not high end. And we must go for reliability, not complex.”
Kaljulaid urged the leaders to consider a transient population. Theresa May had told her people, after Brexit, “If you believe you’re a citizen of the world, you’re a citizen of nowhere.” With May in the audience, Kaljulaid staked out the opposite view. “Our citizens will be global soon,” she said. “We have to fly like bees from flower to flower to gather those taxes from citizens working in the morning in France, in the evening in the U.K., living half a year in Estonia and then going to Australia.” Citizens had to remain connected, she said, as the French President, Emmanuel Macron, began nodding vigorously and whispering to an associate. When Kaljulaid finished, Merkel came up to the podium.
“You’re so much further than we are,” she said. Later, the E.U. member states announced an agreement to work toward digital government and, as the Estonian Prime Minister put it in a statement, “rethink our entire labor market.”
Before leaving Tallinn, I booked a meeting with Marten Kaevats, Estonia’s national digital adviser. We arranged to meet at a café near the water, but it was closed for a private event. Kaevats looked unperturbed. “Let’s go somewhere beautiful!” he said. He led me to an enormous terraced concrete platform blotched with graffiti and weeds.
We climbed a staircase to the second level, as if to a Mayan plateau. Kaevats, who is in his thirties, wore black basketball sneakers, navy trousers, a pin-striped jacket from a different suit, and a white shirt, untucked. The fancy dress was for the digital summit. “I have to introduce the President of Estonia,” he said merrily, crabbing a hand through his strawberry-blond hair, which stuck out in several directions. “I don’t know what to say!” He fished a box of Marlboro Reds out of his pocket and tented into himself, twitching a lighter.
It was a cloudless morning. Rounded bits of gravel in the concrete caught a glare. The structure was bare and weather-beaten, and we sat on a ledge above a drop facing the harbor. The Soviets built this “Linnahall,” originally as a multipurpose venue for sailing-related sports of the Moscow Summer Olympics. It has fallen into disrepair, but there are plans for renovation soon.
For the past year, Kaevats’s main pursuit has been self-driving cars. “It basically embeds all the difficult questions of the digital age: privacy, data, safety—everything,” he said. It’s also an idea accessible to the man and woman (literally) in the street, whose involvement in regulatory standards he wants to encourage. “What’s difficult is the ethical and emotional side,” he said. “It’s about values. What do we want? Where are the borders? Where are the red lines? These cannot be decisions made only by specialists.”
To support that future, he has plumbed the past. Estonian folklore includes a creature known as the kratt: an assembly of random objects that the Devil will bring to life for you, in exchange for a drop of blood offered at the conjunction of five roads. The Devil gives the kratt a soul, making it the slave of its creator.
“Each and every Estonian, even children, understands this character,” Kaevats said. His office now speaks of kratt instead of robots and algorithms, and has been using the word to define a new, important nuance in Estonian law. “Basically, a kratt is a robot with representative rights,” he explained. “The idea that an algorithm can buy and sell services on your behalf is a conceptual upgrade.” In the U.S., where we lack such a distinction, it’s a matter of dispute whether, for instance, Facebook is responsible for algorithmic sales to Russian forces of misinformation. #KrattLaw—Estonia’s digital shorthand for a new category of legal entity comprising A.I., algorithms, and robots—will make it possible to hold accountable whoever gave a drop of blood.
“In the U.S. recently, smart toasters and Teddy bears were used to attack Web sites,” Kaevats said. “Toasters should not be making attacks!” He squatted and emptied a pocket onto the ledge: cigarettes, lighter, a phone. “Wherever there’s a smart device, around it there are other smart devices,” he said, arranging the items on the concrete. “This smart street light”—he stood his lighter up—“asks the self-driving car”—he scooted his phone past it—“ ‘Are you O.K.? Is everything O.K. with you?’ ” The Marlboro box became a building whose appliances made checks of their own, scanning one another for physical and blockchain breaches. Such checks, device to device, have a distributed effect. To commandeer a self-driving car on a street, a saboteur would, in theory, also have to hack every street lamp and smart toaster that it passed. This “mesh network” of devices, Kaevats said, will roll out starting in 2018.
Is everything O.K. with you? It’s hard to hear about Estonians’ vision for the robots without thinking of the people they’re blood-sworn to serve. I stayed with Kaevats on the Linnahall for more than an hour. He lit several cigarettes, and talked excitedly of “building a digital society.” It struck me then how long it had been since anyone in America had spoken of society-building of any kind. It was as if, in the nineties, Estonia and the U.S. had approached a fork in the road to a digital future, and the U.S. had taken one path—personalization, anonymity, information privatization, and competitive efficiency—while Estonia had taken the other. Two decades on, these roads have led to distinct places, not just in digital culture but in public life as well.
Kaevats admitted that he didn’t start out as a techie for the state. He used to be a protester, advocating cycling rights. It had been dispiriting work. “I felt as if I was constantly beating my head against a big concrete wall,” he said. After eight years, he began to resent the person he’d become: angry, distrustful, and negative, with few victories to show.
“My friends and I made a conscious decision then to say ‘Yes’ and not ‘No’—to be proactive rather than destructive,” he explained. He started community organizing (“analog, not digital”) and went to school for architecture, with an eye to structural change through urban planning. “I did that for ten years,” Kaevats said. Then he found architecture, too, frustrating and slow. The more he learned of Estonia’s digital endeavors, the more excited he became. And so he did what seemed the only thing to do: he joined his old foe, the government of Estonia.
Kaevats told me it irked him that so many Westerners saw his country as a tech haven. He thought they were missing the point. “This enthusiasm and optimism around technology is like a value of its own,” he complained. “This gadgetry that I’ve been ranting about? This is not important.” He threw up his hands, scattering ash. “It’s about the mind-set. It’s about the culture. It’s about the human relations—what it enables us to do.”
Seagulls riding the surf breeze screeched. I asked Kaevats what he saw when he looked at the U.S. Two things, he said. First, a technical mess. Data architecture was too centralized. Citizens didn’t control their own data; it was sold, instead, by brokers. Basic security was lax. “For example, I can tell you my I.D. number—I don’t fucking care,” he said. “You have a Social Security number, which is, like, a big secret.” He laughed. “This does not work!” The U.S. had backward notions of protection, he said, and the result was a bigger problem: a systemic loss of community and trust. “Snowden things and whatnot have done a lot of damage. But they have also proved that these fears are justified.
“To regain this trust takes quite a lot of time,” he went on. “There also needs to be a vision from the political side. It needs to be there always—a policy, not politics. But the politicians need to live it, because, in today’s world, everything will be public at some point.”
We gazed out across the blinding sea. It was nearly midday, and the morning shadows were shrinking to islands at our feet. Kaevats studied his basketball sneakers for a moment, narrowed his eyes under his crown of spiky hair, and lifted his burning cigarette with a smile. “You need to constantly be who you are,” he said. ♦
No comments:
Post a Comment