A national identity scheme goes global.
THE founders of the internet were academics who took users' identities on trust. When only research co-operation was at stake, this was reasonable. But the lack of secure identification is now hampering the development of e-commerce and the provision of public services online.
In day-to-day life, from banking to dating, if you don't know who you are dealing with, you are vulnerable to fraud or deceit, or will have to submit to cumbersome procedures such as scanning and uploading documents to prove who you are.
Much work has gone into making systems that can recognise and verify digital IDs. A standard called OpenID Connect, organised by an international non-profit foundation, was launched this year. Mobile-phone operators have started a complementary service, Mobile Connect, which allows identities of all kinds to be authenticated from smartphones.
But providing a digital ID that will be widely used and trusted is far harder. Businesses can check their employees rigorously, and issue credentials for gaining access to buildings, computers and the like.
But what about outside the workplace? Facebook, Google and Twitter are all trying to make their accounts a form of ID. But these are issued without verification, so pseudonyms are rife and impersonation easy.
Private providers are offering their own schemes; miiCard, for example, uses bank accounts as a way of issuing a verified online identity. But these fall short of the reliability of a state-backed identity, issued by a government official, checked against other databases, using biometric data (such as fingerprints and retinal scans) and backed by law--in effect an electronic passport.
There is one place where this cyberdream is already reality. Secure, authenticated identity is the birthright of every Estonian: before a newborn even arrives home, the hospital will have issued a digital birth certificate and his health insurance will have been started automatically.
All residents of the small Baltic state aged 15 or over have electronic ID cards, which are used in health care, electronic banking and shopping, to sign contracts and encrypt e-mail, as tram tickets, and much more besides--even to vote.
Estonia's approach makes life efficient: taxes take less than an hour to file, and refunds are paid within 48 hours. By law, the state may not ask for any piece of information more than once, people have the right to know what data are held on them and all government databases must be compatible, a system known as the X-road. In all, the Estonian state offers 600 e-services to its citizens and 2,400 to businesses.
Estonia's system uses suitably hefty encryption. Only a minimum of private data are kept on the ID card itself. Lost cards can simply be cancelled. And in over a decade, no security breaches have been reported.
Also issued are two PIN codes, one for authentication (proving who the holder is) and one for authorisation (signing documents or making payments). Asked to authenticate a user, the service concerned queries a central database to check that the card and relevant code match. It also asks for only the minimum information needed: to check a customer's age, for example, it does not ask, "How old is this person?" but merely, "Is this person over 18?"
Other governments have tried to issue electronic identity cards. But costs have been high and public resistance strong. Some have proved careless custodians of their citizens' data.
There are fears of snooping. Britain had spent £257m ($370m) of a planned £4.5 billion on a much-criticised ID card scheme by the time the current coalition government scrapped it after coming to office in 2010.
That has left a gap in the global market--one that Estonia hopes to fill. Starting later this year, it will issue ID cards to non-resident "satellite Estonians", thereby creating a global, government-standard digital identity.
Applicants will pay a small fee, probably around EUR30-50 ($41-68), and provide the same biometric data and documents as Estonian residents. If all is in order, a card will be issued, or its virtual equivalent on a smartphone (held on a special secure module in the SIM card).
Some good ideas never take off because too few people embrace them. And with just 1.3m residents, Estonia is a tiddler--even with the 10m satellite Estonians the government hopes to add over the next decade.
What may provide the necessary scale is a European Union rule soon to come into force that will require member states to accept each others' digital IDs. That means non-resident holders of Estonian IDs, wherever they are, will be able not only to send each other encrypted e-mail and to prove their identity to web-service providers who accept governmentissued identities, but also to do business with governments anywhere in the EU.
Estonia is being "very clever", says Stéphanie de Labriolle of the Secure Identity Alliance, an international working group. Marie Austenaa of the GSMA, a global association of mobile-phone firms, praises it too. Allan Foster of ForgeRock, a firm that is working on government ID schemes in Belgium, New Zealand and elsewhere, thinks that the new satellite Estonians will help change attitudes to secure digital identities in their own countries, too.
The scheme's advantages for Estonia are multiple. It will help it shed the detested "ex-Soviet" tag and promote itself as a paragon of good government and innovation. It will attract investment: once you have an Estonian ID, setting up a company there takes only a few minutes.
And it will create an electronic diaspora all over the world with a stake in the country's survival--no small matter at a time when the threat from Russia is keenly felt. (Estonia is also planning to back up all its national data to secure "digital embassies" in friendly foreign countries.)
Struck by the X-road's scalability and security, and the fact that it has already worked well for over a decade, Finland and other countries are adopting the Estonian system in whole or in part. But for foreign individuals, perhaps its greatest appeal is that it is optional.
Those who like the system's convenience, security and flexibility can apply (though Estonia's chief information officer, Taavi Kotka, who is taking time away from his real-life job running an IT company, stresses that the ID is a privilege, not a right). Those who feel queasy about a foreign state having access to their personal data can steer clear.
Mr Kotka says that Estonia aims to do for identity what American Express cards did for international travel in the 1960s: to simplify life. But the bigger point is that government-verified identity has been divorced from location.
If Estonia's scheme takes off some other countries may well decide to follow its lead. Some may aim at volume; others, to target the top end, as with the market in non-resident investors' passports. Soon, multiple satellite citizenship may even become the norm.
Click here to subscribe to The Economist.
