My phone, my ID

A mobile app is all it takes to verify one's identity

By Neo Shi Wei

When it’s time for doctor Äli Roose to vote during the parliamentary elections, she does not need to fish out her identity (ID) card or visit a polling station.

Instead, she keys in two sets of numbers – one for authentication and the other for her digital signature – on her mobile phone to verify her identity, and proceeds to cast her vote on her computer, all under two minutes.

Dr Roose, 53, also files her taxes and transfers money to her daughter using the same two sets of numbers.

“I don’t need the physical ID card anymore. I can’t even remember the last time I used it,” she said.

Dr Roose is among a growing number of Estonians who are turning to their mobile phones as identification due to its convenience and security.

Estonia has long been a frontrunner in embracing technological innovations. In 2002, the former Soviet state became one of the first countries to embed electronic chips into its physical ID cards.

Using a special card reader, Estonians can insert their ID cards into computers to verify their identity for online services.

Moving this technology to phones, Estonians can now use either a special SIM card known as Mobile-ID, or a Smart-ID app — developed last year — on their phones to access public and private services.

When a user accesses an e-service via the Smart-ID app, a verification code is displayed on the web page, and another appears on the app. The Mobile-ID works in a similar manner, but the verification code appears as a text message instead.

If both codes match, the user can enter two sets of unique PIN codes which grant authentication and sign the document digitally.

To date, the number of Smart-ID users in Estonia has swelled to about 290,000, around one-fifth of the population. Meanwhile, some 190,000 people use Mobile-ID, according to statistics provided by SK ID Solutions (SK), the developer of both ID systems.

Convenience is key

The Mobile-ID and Smart-ID apps are now mainstays in Estonian phones. The Smart-ID app, in particular, has taken off in the past few months as it is free, fast and accessible.

Freelance film producer Kalev Smidt, 25, who regularly uses the app for banking purposes, said: “I don’t use the physical card anymore — it’s very troublesome to find a computer and a card reader. But I carry a phone with me all the time.”

Some Estonians prefer the newer Smart-ID app to the Mobile-ID SIM card because the app is faster, and the user is not dependent on a telco and its short messaging service (SMS) service.

“I can use the mobile app everywhere, even when I’m overseas, as long as I have an internet connection,” said entrepreneur Andreas Nõmm, 31, who signs business contracts through the app.

He added that he does not to have to pay for the app, unlike the Mobile-ID that costs one euro per month.

But the Smart-ID app is still awaiting accreditation and is not considered an official government issued document. As such, many public services, such as voting and accessing health records, on the phone are available only through Mobile-ID.

Citizens like Mr Smidt have therefore adapted to using both the Mobile-ID and Smart-ID.

Security measures

Besides bringing convenience to citizens and service providers, the Smart-ID and Mobile-ID systems increase the resilience of the Estonian identity system, said Professor Robert Krimmer, 40, an e-governance expert at Tallinn University of Technology.

He said: “In case of a hardware issue with the ID cards, you can still use the mobile solutions as they work on a different technical system.”

Last November, the Estonian government suspended 760,000 physical ID cards, more than half of the population’s, due to a security flaw in the chip embedded in the card.

While the government was rolling out updates to fix the issue, it advised citizens to sign up for Mobile-ID, citing it as a secure alternative.

Mr Mark Erlich, 43, an advisor at government agency Republic of Estonia Information System Authority, said that the government considers the Mobile-ID to be as secure as the physical ID card, as both are always with the user physically.

Physical ID cards are here to stay

SK’s chief executive officer Kalev Pihl, 42, said that the mobile solutions will never replace the physical ID card completely, as there are a few limits to Mobile-ID and Smart-ID.

It is still not possible for both the Mobile-ID and Smart-ID to match the encryption levels offered by the physical ID cards. Document encryption can only be done with the physical ID cards, he added.

Both Mobile-ID and Smart-ID are also not accepted as photo identification, which is required when crossing borders in the European Union or upon the police’s request.

Despite these, the physical ID card has become a relic in many Estonians’ everyday lives.

Dr Roose said: “It is very normal here, even my mother-in-law has started to use it. It is just much more comfortable with a mobile phone.”