Estonia has introduced a new identity verification feature for its digital government application, despite its history of security and privacy issues.
An Estonian digital app, [1] often called the Eesti.ee app has been introduced by the Estonian government and connects users to over 50 government services. This platform [2] enables individuals to access their personal information, view data related to their children, manage prescriptions, receive official notifications, oversee their vehicles, and report maintenance concerns to local authorities. Liisa Pakosta who [3] is the minister of justice and digital affairs said, “A large part of everyday life has moved onto the phone, much like banking, people expect public services to be fast, mobile and secure. This app is a solution we can present proudly on the international stage as a leading digital nation, we must continue to set the pace.” On July 7, the app rolled out one of its features: identity verification through a digital version of the user’s ID card or passport. This new functionality enables users to display their official identity in a digital format by generating a temporary QR code within the app, a development that has garnered acclaim for its security and convenience. Taavi Ploompuu who [4] is the deputy director-general of the Estonian Information System Authority said, “This is a solution people have clearly been waiting for, modern life happens on mobile, and now identification can, too. Though service providers will need time to adopt it, this is a highly practical tool, and we expect it will find widespread use.”
In a notable advancement in identity verification, the country granted approval earlier this year for the private [5] Smart-ID app to be utilized for voter verification. In an upcoming move for its local elections, Estonia is set to enable voters to authenticate their identities using the private digital identity application, Smart-ID. Developed by SK ID Solution, Smart-ID is one of several options available to Estonians for identity verification, alongside the Mobile ID app and physical ID cards. The implementation of this additional identity verification tool is expected to enhance the convenience of e-voting in the forthcoming elections scheduled for October, [6] as reported by The Baltic Times. Arne Koitmäe who [7] is head of the State Electoral Office said, “The technical readiness to introduce Smart-ID is in place and the necessary law amendment has also entered into force.”
The Parliament of Estonia approved a legislation aimed at enhancing the nation’s electronic voting system in 2024. This update permits voters to authenticate their identities through the Smart-ID app when casting their ballots. Additionally, the legislation enables the use of smartphones and tablets for voting, [8] as reported by the national broadcaster ERR. Madis Timpson who [9] is the Minister of Justice, “Right now, electronic votes are counted based on rules laid down by the National Electoral Committee, while several aspects are regulated by documents approved by the Electoral Service. These decisions will be made by the State Electoral Service before each election if it finds that relevant risks have been managed and the core principles of free elections are ensured.”
Estonia's digital ID system, celebrated for its innovative approach, has encountered privacy issues, particularly concerning possible security weaknesses in its smart card chips and the threat of identity theft. In 2017, [10] a vulnerability was identified in the Infineon smart card chips utilized in Estonian ID cards, putting more than 750,000 cards at risk. In a blog post on Medium, Kaspar Korjus [11] who was the managing director of e-Residency, would later [12] apologize for any inconvenience. “There are still no known incidents of an Estonian digital ID card being misused, but the threat has been elevated so previous certificates containing the vulnerability will be suspended tonight at 24:00 on Friday 3 November. Smart ID can provide uninterrupted access to e-services such as banking, but must be activated now while certificates are active,” said Korjus.