Estonia is about to become the first truly digital society. This deck, supporting a speech at the TopConf Tallinn 2014 conference, points out reasoning behind the endeavour and technical challenges met to date.

1. E-residency, data
embassy and the Cloud
Andres Kütt
Estonian Information System Authority / Architect
20.11.2014

2. Estonia in perspective
Population1 Labor force PPP gross national
income per capita
Estonia 1 690 391 23.280
Latvia 2 1 046 220 21.820
Russian
Federation 144 76 872 229 22.800
Singapore 5 3 021 715 71.900
United States 314 158 666 072 52.610
1 - In millions, rounded to 1
Estonia is so tiny a quarter of our population can become a rounding error.

3. GNI per capita
80 000
60 000
40 000
20 000
0
Estonia Singapore USA Latvia
Russian Federation
1995 1998 2001 2004 2007 2010
The graph shows that no only is our GNI considerably smaller than that of more advanced countries, it is also growing at the same pace. Ergo, we shall be
relatively cash-strapped for the foreseeable future.

4. The solution? Go paperless. Replace the expensive paper-based services with electronic government services that are easier to scale and do not create
the feedback loop of bureaucracy creating more bureaucracy.

5. 690 391
Our prime-minister-to-citizen ratio is too high.

6. GAAS
Government as a service. We are already building these web services, why not provide them to others?

7. 10 000 000
This is radical. Illustrates the lengths to which this country is willing to go. Because we have very few other options.

8. Digital continuity becomes a problem
! We cannot switch back to paper
! For the reasons we went digital in the first place
! Also because we no longer know how
! Digital is built deep into all aspects of Estonia
! Business processes shaped around requesting data, not
delivering documents
! This does not scale without digital
In the digital world, this is certainly the case. The more digitized one is, the more dangerous digital risks become. Estonia can not go back to paperless
simply because we no longer know how. This has been the case for so long, our business processes have adapted.
For example, a common practice has companies supplying a certificate of tax status as part of public tender processes to make sure they do not owe
taxes to the state. In Estonia one would execute a query against the tax board information system instead asking for the status of a particular company.
Issuing a certificate would also be meaningless as companies can go and change their tax declarations at will altering their financial standing with the
state.

9. One solution to this would be to move all the services to the Cloud by using Microsoft, Amazon, Google or other cloud service providers. I’ll talk a bit
about the challenges and learnings we have had

10. Citizens/Officials/Enterprises
Electronic identity
Delivery channels
Integration
Infrastructure
Agency Agency Agency Agency
Finance and portfolio management
Information security
Information System Registry
Architecture of Estonian information system

11. Citizens/Officials/Enterprises
Electronic identity
Delivery channels
Integration
Infrastructure
Agency Agency Agency Agency
Finance and portfolio management
Information security
Information System Registry

12. Cloud is not simply an
infrastructure problem
It immediately becomes a business problem,
if not sooner then when assessing risks

13. Whom can you trust?
We make a lot of implicit and explicit decisions on trust, cloud
introduces a lot of complexities to these decisions

14. Small players are too small
What is their actual ability to honour the collateral?

15. Big players are too big
Appi

16. What about democratic change?
A nation democratically decides it is OK to look into
files they consider to be under their jurisdiction

17. “Lady, I never walk into a place I
don't know how to walk out of.”

18. In the end, nobody can be trusted
Not with really important things
Cryptography to the rescue!

19. Secure multi-party computation
Ability to share data and computation between untrusted parties
Cryptography to the rescue!

20. X1 X2 AVG(X1,X2)
Original 12 8 10
Node 1 1 3 2
Node 2 4 2 3
Node 3 7 3 5

21. Browser-based cryptography
Since the server cannot be trusted,
the client must encrypt everything

22. Challenges with the browser
! Related to encryption itself
! WebCryptoAPI coming to age but clearly inadequate
! Big players reluctant to cooperate on Browser/OS issues
! Related to handling of encrypted data
! How to execute server-based tasks like search on encrypted
data?
! Key management issues

23. Conclusions
What can we make of it all?
Cryptography to the rescue!

24. Moving to cloud assumes a high level of
maturity from the entire organisation
More so than being either in our out of the cloud

25. Trust decisions need to get explicit
Questions of trust have profound business implications and
must thus be made explicitly

26. Cryptography seems to be a solution
Although it is not entirely clear, how exactly

27. Thank you!
Andres Kütt
andres.kutt@ria.ee