POSSIBLE ONLY IN ESTONIA: THE POVERTY OF DIGITAL SIGNATURE
Estonian e-government (electronic government) has been praised enough, mainly on the official and political level. Even our prime ministers have been abroad to advertise electronic ID cards. Our ex-prime minister Andrus Ansip is Europe’s digital commissioner now.
However, some people have cast a doubt on the credibility of electronic ballots. And several countries, referring to security considerations, have postponed to follow Estonian lead.
Continually, there have been difficulties in electronically (digitally) signing the documents. In fact, the system doesn’t work, one might say.
The technocratic-utopian demagoguery and the taboos, resulting from politicizing the issue, have been the main obstacles to discuss the shortages.
At the same time, there are (or have been) several important things in the electronic world, missing only in Estonia or for Estonian language, about which the advertisers of the e-government had been preferred to hush.
The immediate reason to write the present essay was the following story. More than 6 months ago I received an email, including a contract. I was asked to sign that contract digitally. To be sure, it is not legally compulsory, neither was I under some kind of pressure. Moreover, earlier, sometimes I had succeeded in digitally signing some documents. Unfortunately, because of different obstacles, after 6 months, I had still not succeeded to sign my contract. Finally, I understood that it was not my fault, neither the fault of my computers, despite that various people had instilled it. Then, I printed my contract out, signed it manually, sent it by old-fashioned post, and I received my money by modern electronic bank transfer (not all modern things are malfunctioning).
The idea of the title of the present essay has been taken from the TV serial “Possible only in Russia”. In Estonia – the neighbor of Russia – this serial is very popular.
The present essay is my translation and refinement of my paper “Võimalik ainult Eestis: digiallkirja viletsus”, published in Estonian on the site Nihilist.fm. Some remarks, based on the discussion of that paper, have been included in the footnotes.
The Program is Ambitious and Complicated
However, the state cannot compel people to use the computers and programs of one particular company and not to use the products of other companies. The state cannot even assume it. There are different popular platforms (Windows, UNIX, etc), and the program for digital signing should be usable in all of them. But private companies are competing with each other, and continually one piece doesn’t fit with the other one. In addition, the software and browsers are often updated, etc. The digital signature program should follow all those renewals, but in the case of updates, incompatibility is a common phenomenon.
Perhaps, in order to achieve that the program actually works for 90% of the users, a big team of specialists is required to maintain and complement the system, what is difficult to sustain for a small country.
The digital signature program has to be secure. Therefore, it is sizable. Despite that it has been denied several times, it is a fact that, in the case of the computers with Windows platform, while installing programs bigger than certain threshold typical troubles are occurring.
Because of the complicatedness of the digital signature program, one can forecast that a large amount of the users are unable singly to install, update, tune it, learn to use it, etc. Moreover, acclimatization to the updates takes a lot of time. What was working a month ago, doesn’t work today.
If you are digitally signing rarely, then probably you have not checked the status of your programs, browsers, plugins, security certificates, etc. Now, if you suddenly need to digitally sign a document reasonably quickly, then forget it.
While Estonian politicians are advertising the digital signature and its advantages, it seems that no one has accomplished a consumer survey (objective and state-independent) about who and when is able to use that system. Perhaps the vast majority of the documents are digitally signed at the business hours, in the state offices, where the info-technologists are constantly updating and tuning the computers.
Shortages of the Customer Support
My first difficulties with the digital signature program arose while trying to install it – my computer reported an error code. Then I googled and got into Microsoft homepage. But I did not find there any useful information about how to overcome my obstacle.
Thereafter I turned to the program’s customer support in Estonia. However, they suggested the very same Microsoft homepage where I had been already, with the claim that there has to be something helpful. In my naivety, initially I remained to believe it.
After a lengthier investigation, I started to grasp something. Microsoft itself offers help only concerning general issues. However, it hosts the manuals, which can be uploaded by the producers of the programs. For example, if the company is producing a video program and this program has typical difficulties in the computers with Windows, then the specialists of that company are uploading to the Microsoft homepage the guide about how these difficulties can be managed.
But Estonian team had not uploaded to the Microsoft homepage their guide about how to overcome difficulties with the digital signature program; nevertheless the customer support directed me to that page, insisting that I have to study the guides hosted there.
Of course, most of the habitants of Estonia will remain convinced that they themselves are inadequate concerning the computer staff and that this is the reason why they are unable to study the nonexistent manual.
Later, I found one altogether another Microsoft page and I learnt, what thing is Clean Boot and how to do this. It is not for the beginners. I recommend this. If there are some glitches while installing some program, then Clean Boot will probably help.
The customer support was constantly assuming that I had made some banal mistakes. Most of the time, they tried to explain things I knew already or knew better than they themselves. I insisted to get a specialist, but it took a pretty much time before I got one. Then, however, the specialist had no time for a face-to-face contact. As I was a beginner, the specialist couldn’t teach me over the phone call, how to accomplish the Clean Boot.
Defend your documents
The info-technologist of the digital signature program installed that program on my computer over the internet. I gave my agreement and he took over my computer, using the program TeamViewer.
And this is the first security problem. To install the digital signature program on my computer, I had to trust the info-technologist, who had a possibility, during that process, at least to chart the programs and filenames in my computer. In my computer, however, there might be some confidential materials. Moreover, perhaps I am a dissident in a state of rigid regime, and the authorities would be happy to find something illegal from my computer, at least a trifling thing, to incriminate and politically neutralize me. Anyhow, knowing the present political situation in Estonia, do you believe that to install the digital signature program on his computer, Edgar Savisaar would allow the info-technologist to use the TeamViewer? “And who else belong to your team?” would he ask, smirking.
Can you imagine a society in which, to sign using a pen, you should appeal to the pen engineer (at first, you would be gibed that your pen doesn’t belong to the most modern ones, that the ink doesn’t fit the version of the pen and that you have not mastered, in the university, the construction of the pen), in the course of mounting the pen, however, the pen engineer would survey not only the document you wanted to sign, but he would look at all of your papers?
There are other security issues concerning the documents. For example, in the National Library of Estonia, there are computers the visitor can use to digitally sign one’s documents. Unfortunately, one has to download the document to the local computer. Later, the visitor can delete one’s file, but the visitor has no access to the Recycle Bin and cannot empty it oneself.
Defend your password
If you are not rich enough to buy the most modern computer and the most modern programs, and to hire the info-technologist, then what can you do? In Estonia, the cybercafés are out of fashion. In the bank, there are few computers you can use to log in the internet bank, but you cannot sign your document you have on your memory device. Perhaps a computer with the ID-card program is at your workstation, but perhaps not, moreover, the company or institution may prohibit to deal with business or remote things at the working hours.
Thus, the libraries. However, the state scrimps concerning the libraries. At the summer time, the libraries are closed or opened fugaciously. There are only few computers properly working and the queues are formed. Now a new security problem arises: someone is standing behind you and is looking at the keyboard and the screen. Perhaps he is learning your password by heart.
Never mention that the workers of the library could function as the indirect customer support, teaching the use of the digital signature program – but because of the complexity of the program and its updates, sometimes the visitors have to teach the workers of the library instead.
Defend your identity
Some experts from Sweden are claiming that their system of identifying the persons is safer than the Estonian one but, differently from us, they are not advertising it in the wider world, because it is meant to their own people. The Estonian system, however, is supposed to have a backdoor, through which the administrator can access citizens’ things without their knowledge and permission. I am far from being able to comment such rumours. I would also like to avoid addressing the highly controversial and political issue of the electronic voting in the case of the ballot of Estonian Parliament.
Nevertheless, the main security problem seems to be the following. Today, it is still difficult to falsify someone’s ordinary signature many times. But if one gives one’s ID-card to another person together with the passwords, then one’s electronic signature can be falsified repeatedly.
If you are living in a city like Tallinn and you are tired of traffic jams and of searching for parking places, exhausted from traffic accidents, parking fees and –penalties, then, if possible, you are simply walking, traveling by bus or riding the bicycle. Probably you would be injured, if someone would demagogically declare concerning your lifestyle, that you are old-fashioned and that you want to fall back into the era without electricity and with the horse carts. If someone would say that you do not grasp the progress, that the forward-looking people have already understood the things and are commuting with the automobiles.
However, exactly such a demagoguery is preached, if you say that you are already tired of the computers and messing with the programs, that you already have an experience that, frequently, the shortest and safest way is without the computer.
If you bought a new car, but it is beyond repair most of the time, then no one would claim that it is your own fault that you are unacquainted with the construction of the car. Because the automotive industry is huge and mighty. But if you cannot accomplish a digital signature, then they are starting to preach that you are inept concerning the computers.
The info-technologists are modern plumbers. They are aware of their importance and power.
No one understands what the IT-men are doing. In the philosophy of science, this is known as “the problem of scientific experts”. One expert tells you one truth, the other one another truth. Only they themselves are able to understand and they are aware of it. They can judge you illiterate, while hiding mistakes of their own and referring to the large numbers of people who do not grasp anything about the computers.
They make an idiot of you.
Although the e-government has been promoted by two prime ministers and one president of Estonia, the state itself has admitted that one info-technologist, who committed a crime, got away. I keep in mind that when the president of the United States was visiting Estonia, someone blocked the emails of the interior minister of Estonia. The offender was searched from some reconnaissance institution in Estonia, amongst its info-technologists, but the chargeable was exculpated in the court. Independently of whether the accused person was actually guilty, thereby the state has admitted that it is not secure to play with electronics and that the main witch may elude.
In 1972, Isaac Asimov published his science fiction short story “Take a Match”, reprinted in 1975 in his collection Buy Jupiter and Other Stories. In that story, an interstellar spaceship is in danger, because the eccentric Fusionist defends his reputation. The ship is without sober fuel and power. A schoolteacher saves their souls. From the old books he has found out that anciently people were using the matches to light a fire, to get some light and heat.
Therefore, the title of our essay might as well be “Take a Pen”.
Taboos as the Result of Politicizing
As Estonian government supported private company Estonian Air, which was going to bankrupt, so the Government and President have advertised the e-government too. It is obvious that the issue of the ID-card has been politicized.
Actually, right now, while I am translating the present essay, I can read from the newspaper Postimees that Angela Merkel is visiting Estonia and that Estonian Prime Minister Taavi Rõivas advertises the e-government, suggesting it to Germany. Great issues are at stake.
However, it seems to be a classical Potemkin village and pokazuha (in Russian: показуха). While there are only few sunny days in Estonia, there are even fewer days when digital signing of the documents is successful.
It is a taboo subject. The worker of the library is trembling from fear if I am saying that there is nothing wrong with the library’s computer and that probably some error is contained in the last version of the digital signature program. The worker of the bank whispers into the ear that today all the Republic’s digital signature system is down, and that I should not say to anybody that she said it, because she is afraid of being fired. Because it is like a national secret that the system, advertised abroad, doesn’t function properly.
The number of the ad hoc theories used for self-justification arises so quickly that it seems to be difficult even to classify them.
At the golden age of the Soviet Union someone said that the tram was late and he got an answer that again he was criticizing the soviet power.
The second political reason, why the issue has turned to be a taboo, is the extensive campaign of the opposition leader Edgar Savisaar that the results of electronic voting were falsified in the case of the ballot of Estonian Parliament. Estonian security service KAPO has associated Savisaar with Kremlin.
Thus, in the tribalists’ country, if you say that the tram was behind time, it is not necessarily interpreted solely as a criticism of the government; it could be even seen as a hostile Kremlin’s propaganda.
Watch out not to scratch the image of the successful small country.
On the homepage of Estonian ID-card one can click All News ® Success Story. The English version Success Story and the Estonian version Edulugu are somewhat different. There are much more items in the Estonian version. Moreover, in the Estonian version, the content of some items is more patriotic than the content of the same items in English.
Consider the following two items of the Estonian version of the homepage:
If translated into English, these two captions are as follows:
“200 Million Digital Signatures on Behalf of Better State”
“The Economist Praised Estonian ID-system to the Skies”
The first caption sounds like a typical soviet propaganda. As if the real patriots are signing digitally to promote the construction of the communistic society. The article itself contains some arguments and wordings similar to those from the soviet times.
It seems to be a religious attitude.
Note that this item is missing from the English version of the site.
The second caption is a narcissism. The caption of the same item in English is more modest:
The referred paper of The Economist has the same caption.
Everyone except Estonians Possess It
Optical Character Recognition. For example, if you are scanning a book, then what you get are photos or files in the Portable Document Format (PDF). Now, the OCR reads the text out of a picture, transforming it into the Word text, for example. Finally, you have got a text file. The mistakes have to be recovered manually. Such programs are convenient to reprint old books or to transform them into electronic versions. There are several good free softwares able to do this and such softwares have extensive assortments of various languages. Usually, Finnish, Latvian and Russian languages are included, but not Estonian. Umlauts (polka-dots) are both in Estonian and Finnish languages, therefore, this is not the reason why the OCR in Estonian is not easily accessible.
Of course, I do not assume here that the aim of governmental activity should be to fatten the expensive programs of huge companies.
Below, as an example, a screenshot of the language assortment of the OCR of the program PDF-XChange Viewer is provided.
Estonian Language Pack
for automatic spelling checker. It exists conveniently in the priced Word, but for the freeware LibreOffice one has to search it from the internet separately, which is troublesome. For some free text editors the Estonian pack doesn’t exist at all, while Latvian and Finnish languages are still present.
Estonian Text to Speech Synthesizer
to transform Estonian printed text to speech. For the most important freewares, there are various language packs, but the Estonian one cannot be obtained even for money. It is troublesome or impossible to get it for a cellphone. The speech synthesizer of Tallinn Technical University is properly working but can be used only over the internet. True, it has only one and slightly monotonic voice which cannot be regulated. It was told to me that in the Windows there is one Estonian speech synthesizer now which can be tuned, but I have not checked it as yet.
In the present essay I have not criticized the work done by the info-technologists. In my mind, they have made a very good job. Notice that Estonia is a country of small population. Rather, one might say, I have criticized the myth and cult of the e-government.
Initially, I proposed my essay to the main journal of culture in Estonia. Therefore, in the text, I tried to avoid unnecessary technicalities. My essay was rejected by the journal. Among other things, it was claimed that I am obviously exaggerating concerning the shortcomings of the digital signature program.
I do not think so. Moreover, apparently this is not an exaggeration if, from the national portal, one can find articles with the following captions:
“200 Million Digital Signatures on Behalf of Better State”
“The Economist Praised Estonian ID-system to the Skies”
This is a downright religion already. But criticizing the “praising to the skies” is an exaggeration – roughly like damnation to the hell.
Thus, I hope it to be comprehensible if I interpreted journal’s answer as confirming my germinating feeling that this is a taboo subject we are dealing with. The editor is unable to overcome the taboos, because he has been hired by the state.
Don’t exaggerate here with your rumors that at the time of Soviet Government the tram was late to the station.
In the meanwhile I tried to use a byroad to digitally sign my document – I tried to take into use the Mobile ID. Unfortunately, it turned out that I was unable to make a request on the police homepage. I had to digitally identify myself, using the system I tried to escape from. Everything was right until the last and crucial pressing of the button “OK”. Before that, no error message was appearing. But after I pressed the button “OK”, a message appeared that they did not find (I do not remember, what).
With some minor changes, I sent my essay to the portal Nihilist.fm . Surprisingly, it was published immediately – after few hours.
Some of the critical comments on my essay have been addressed above, in the footnotes. Some critics claimed me to be incompetent, marking that I have not discerned between the program and browser and plugin; that there is a difference between the Internet Explorer and Firefox, etc.
Some of my commentators seemed to be highly competent info-technologists. Their remarks directly supported my claim that the system of digital signature has systematic shortcomings. Among other things, they mentioned that a user-friendly program doesn’t assume that the user knows all this stuff about the programs, browsers, plugins, etc, etc. If you are able to learn and use the programs like Word, but not able to learn and use the digital signature program, then it is not the case that something is wrong with you.
Surprisingly, all of my commentators were anonymous.
While discussing with my critics, a new idea came into my mind. The state could open some available places with the computers, in the case of which it guarantees that the digital signature program is in working order. Otherwise, one can endlessly accuse the customers. However, it is cheaper to deny everything.
 Abstractly speaking, there is no difference between the computer program, plugin for the browser, or app (or applied program) – all of them are some kind of programs or parts of programs.
 Some IT specialists disagree with me. However, the DigiDoc program is the facto government monopoly and maybe the salaries of the programmers are at issue.
 Notions like “complicatedness”, “complexity”, etc, are relative and context-dependent. Here, the complexity from the viewpoint of the user is at issue. To be sure, perhaps some necessary steps towards user-friendliness have not been accomplished.
 Edgar Savisaar is the (de facto) leader of Estonian major opposition political party – Estonian Centre Party. This party has been famously paranoiac concerning the secret police. However, now it is a public fact that their leadership has been under serious hidden scrutiny. The Central Party is influential and it has many members.
 Note that some security issues are arising out of the difficulties in installing or using the digital signature program while using one’s personal computer.
 The last security issue, well known in Estonia, was not mentioned in my original paper, published in Estonian. Perhaps this is the only place where the so-called Mobile ID has been attacked as well.
 Unfortunately, the arguments above received a confirmation from the feedback to the earlier version (published in Estonian) of the present essay. Several critics dogmatically insisted that the system was in working order and that I was simply inept concerning the computers, etc. One info-technologist, who is calling himself as the “IT-rat”, sent me insulting messages. Notably, he compared my claim, that the DigiDoc program is too complicated for the user, with the attitude of those who are unable to take the candy out of its envelope.