Estonia’s digital ID cards are famous around the world, but most Estonians actually now use their mobile phones for regular digital signing instead. This is now also available to e-residents as an app called Smart-ID.
E-residents are signing up for Smart-ID because it’s faster, more convenient, and works even if your digital ID card is lost or expires.
What is Smart-ID?
Smart-ID is a mobile app that enables you to authenticate your identity online and digitally sign documents using a set of PIN codes. It works just like an Estonian digital-ID card used by citizens, residents and e-residents of Estonia, except you never need to worry about plugging your card into a computer because you can complete the same functions instantly through your smart phone or tablet instead, regardless of whether the e-service you are using is on your computer or the same smart device that you are using with Smart-ID.
Smart ID knows who you are because you have to use your Estonian digital ID card, such as an e-Residency card, in order to set it up before you can use it. After that though, you don’t need to carry your card and card reader anymore. You can leave it at home and continue to enjoy the benefits of digital ID through Smart-ID on your phone or tablet (although we know a lot of e-residents love to carry around and show off their e-Residency cards anyway).
How Smart-ID was born
Estonia began issuing ID cards to its citizens and residents in January 2002. At the time, there was nothing particularly special about issuing cards as national IDs, especially in Europe.
However, Estonia was a young country building its entire national infrastructure almost from scratch and so able to implement the newest technology and processes without any legacy systems to hold it back. Alongside rapid reforms to improve ease of doing business, Estonia’s early experiments in digital governance were proving remarkably effective and an ambitious programme called Tiigrihüpe (Tiger Leap) had just successfully brought all classrooms online.
The digital ID card
As part of that digital revolution, Estonia decided it would start issuing all its ID cards in 2002 as digital ID cards by integrating a secure chip. When plugged into a computer, they would provide cards holders with online authentication and digital signing through a unique set of PIN codes to be entered on screen.
This system was developed by the state with various partners, principally a private company called SK ID Solutions (which later also developed Smart-ID). You might notice their name in the service prompts when digitally signing documents on your computer.
The truly revolutionary part of this new digital ID system was that it was open to anyone who wanted to verify an identity or receive a digital signature, not just government. With that system in place and dispersed across the Estonian population, the private sector as well as the public sector were incentivised to build their own services around it. This not only enabled them to improve their services, but also entirely rethink how to offer services that are designed from a digital-first perspective.
The important point to remember is that the chip card itself was never a key part of this system. The cornerstone is actually the ‘isikukood’, a unique national identification code for each person. Estonians now receive an isikukood immediately as they are born and parents can then log in and choose a name for their baby in their own time.
In case you are wondering, the 11 digit isikukood that you can see on your e-Residency card breaks down like this:
That isikukood above belongs to me, by the way.
So the card was simply the most secure technology available at the time to verify that someone online is who they say they are, using the isikukood as the basis for their unique identification because obviously two people could have the same name – even in a country like Estonia with just 1.3 million people. Your card can be lost, expire or be made obsolete, but you will still keep the same national identification code for life. And with that, the same digital identity.
Mobile-ID
In 2011, SK ID Solutions and its partners then unveiled a new digital identity tool without the need for a card: Mobile-ID. It works in the same way as a digital ID card, except the certificates within the card’s chip are instead embedded into a mobile phone SIM. Although a digital ID card is still a mandatory form of identification in Estonia, the popularity of Mobile-ID has risen rapidly, especially among the most active users of online services, such as internet banking on your phone. It has also now been rolled out in Lithuania and there are now more than 400,000 users across both countries.
Mobile-ID has one significant drawback for e-residents though. It can only be issued through an Estonian mobile provider (with a very small monthly cost) and they do not issue Mobile-ID subscriptions to non-residents. As a side note, we at Unicount have been lobbying to change that requirement so that e-residents can also get Mobile-ID. Well, that may not be necessary any longer.
Smart-ID
In 2017, SK ID Solutions unveiled an even more advanced digital ID tool that retained the convenience of using a mobile phone but detached it from the hassle of tying it into a mobile phone contract. It’s an app-based solution called Smart-ID that works on Apple and Android mobile phones and tablets. You still need to use your digital ID card to authenticate yourself when setting it up, as well as to re-authenticate yourself after three years of use when your Smart-ID expires, but between then you never have to touch your card to use most e-services in Estonia. That eliminates one of the most significant issues encountered with e-Residency at present, which is that you lose access to e-services if you lose your card, until you can get a new one issued at an Embassy. This is now even more difficult than ever to coronavirus travel restrictions.
A number of private companies in Estonia, such as banks, quickly began integrating Smart-ID into their service and so it’s popularity took off among Estonians. It’s also worth noting that the costs of using Smart-ID are paid entirely by the services providers (like us here at Unicount), not the users.
Later that year, many e-residents discovered Smart-ID for an unexpected reason. International researchers discovered a theoretical flaw that could enable someone with immense computing resources to compromise a digital ID card. Estonia took no chances and decided to switch off digital ID card certificates for the vulnerable batch of cards temporarily to eliminate the threat while the fixed certificates were rolled out. In the meantime, e-residents were advised that the only way to use their digital ID continuously to access e-services during that brief period was to set up Smart-ID before they were temporarily switched off. At the time, I was working at the e-Residency programme and was urging e-residents to sign up for Smart-ID. This was the catalyst for a temporary change that became permanent even after their digital ID cards were ready to use again because so many of these e-residents realised how convenient Smart-ID is.
Since then, Smart-ID has continued to grow rapidly among citizens, residents, and e-residents of Estonia. It has also been rolled out in Latvia and Lithuania. In total, there are now 2.7 million Smart-ID users making more than 50 million transactions per month with it.
Funnily enough, as I write this article here in Estonia, my partner has just become the latest person to sign up for Smart-ID – and out of pure necessity. She just ordered a new phone with a new SIM, but will be unable to set up Mobile-ID on it because that would require a trip to the shops, which are closed due to the coronavirus emergency measures. Her only solution was to set up Smart-ID on her tablet through her current Mobile-ID just before it was switched off. So far, she says she likes Smart-ID more.
In 2019, Smart-ID was then granted permission to be used with Estonian state services for the first time. Unicount, the simplest way to start a paperless EU company, has now also integrated Smart-ID into its online company formation process. This is something even the Estonian state business register has not yet enabled.
This technology has even more exciting potential in future too.
Smart-ID is now developing Biometric Identification, for example, which enables users to authenticate their identity through the app instead of first doing it offline, such as when they pick up their e-Residency card. So you can already set up Smart-ID without any digital ID card in limited cases, but the only reason why you can’t enjoy the benefits of e-Residency through this process yet is because you’d also need your isikukood, which is only issued either to Estonian citizens and residents at birth or to e-residents when they receive their first digital ID card.
If you look at business registers in other countries then it can be very difficult to understand who owns companies when different people have the same name, even when that country is trying to be open about the data they have. In contrast, the Estonian Business Register displays the isikukood of owners and directors so there can be no confusion. This, in turn, helps us all benefit from a more trusted and transparent business environment in Estonia.
However, it’s entirely possible that the e-Residency digital ID card will soon become obsolete because of this biometric identification once further development is completed (both in terms of technology and legal processes). By that point, you would just need to be issued with your Estonian ID code online and you are ready to establish and manage a paperless EU company using a biometric Smart-ID.
What do e-residents think about Smart-ID?
We polled e-residents today in the Estonian e-residents Facebook group to find out how they use Smart-ID. We were expecting a relatively even split among e-residents who have signed up for Smart-ID and those who haven’t heard of it yet.
A total of 64 e-residents responded and the results surprised us.
The majority of e-residents that responded are using Smart-ID more than their digital ID card.
Just 15% of that use both said they used their digital ID card more often. A small minority said they either hadn’t heard about Smart-ID or hadn’t tried it. Surprisingly, a significant minority said they couldn’t set it up because their Mac doesn’t have a USB port. However, another e-resident pointed out that USB-C readers are available for Macs. It also further highlights the importance of setting up Smart-ID before you lose the ability to use the ID card.
We also hear anecdotally from e-residents about how much they love Smart-ID once they start using it. When Unicount integrated Smart-ID into the platform, we invited a friend who we knew was already planning to start a company to use Unicount and be the first person to start a company using Smart-ID, which we could then announce. Funnily enough, within hours of adding Smart-ID as an option for company creation on Unicount (and without any announcement that this was now possible), an Estonian user of the platform went ahead and made history by doing it themselves. This was later followed by the first e-resident to start a company through Smart-ID.
So our big announcement didn’t quite go to plan, but we realised that there is genuinely widespread demand for integrating services with Smart-ID – which is even better.
How to sign up for Smart-ID as an e-resident
Smart-ID is available as an app for iOS devices through the Apple app store and Android devices through the Google Play store. It doesn’t take up much space or much data to use – and it’s completely free because services providers like Unicount cover the cost.
Top tip: Your Smart-ID will be valid for three years after you create it or re-validate it so make sure you do this just before your current digital ID card expires if you want to save yourself some time before your next trip to an Estonian digital ID pick up location.
Once you’ve downloaded the app, open it up and click ‘Register’ then follow the on-screen instructions to authenticate yourself and sign up for Smart-ID as an e-resident. You can repeat this process and set up Smart-ID on as many devices as you like, such as your mobile phone and a tablet.
As with your e-Residency card, you will have two PIN codes to use Smart-ID, although these won’t be the same as the codes issued with your e-Residency card. One is for authenticating your identity (when you log into a service) and the other is for digitally signing (when you want to sign a transaction or agreement). You can choose these PIN codes yourself.
There’s one other part of the process that will be new to digital ID card users. Every time you use a PIN code, you’ll see a confirmation code appear on inside both the e-service you are using and inside your Smart-ID app (even if the e-service you are using is also on the same device). You always confirm that these numbers match up before entering your PIN codes.
Based on the experience of other users (both in Estonia and among the e-resident community), once you start using Smart-ID you’ll start wondering how you ever managed without it.
Thanks for reading
This article was written by Adam Rang, Communications Director at Unicount.
Whether you are using Smart-ID, Mobile-ID or still an Estonian digital ID card, Unicount is the simplest way to start a paperless EU company in 5 minutes. It’s used by a growing number of citizens, residents and e-residents and we’ve now launched a virtual office only service for existing Estonian company owners. Learn more at Unicount.eu.
