Article content
Suppose you have ever applied for Estonian e-Residency. In that case, your story often goes something like this: you found out about the program online or by word of mouth, put in your application, and then had to travel to the nearest embassy to pick up your identity card when it was ready. Sometimes these stories also involve international flights and matching availability for an appointment with different Estonian embassies around the world.
The reason for the visits is so that the Estonian government can capture biometric data, including fingerprints, on new e-residents, who will have access to the country’s ecosystem of digital services. This ensures that the issued cards carry a high level of trust and security. But e-Residency program developers say that they would like to leverage new technology, without compromising security, as part of the process to make accessing e-Residency more user-friendly, and are assessing different ways of capturing biometric data remotely to do so.
“It’s a question of time it takes from making an application to becoming an e-resident, or making an application to renew one’s e-Residency, to the time you get the card and it’s activated,” said Lauri Haav, Managing Director of the e-Residency program. “It has room for new efficient solutions.”
e-residents make the second-largest city in Estonia
Estonia introduced its e-Residency program in 2014, and currently, there are close to 100,000 people enrolled in the program. It allows holders of e-Residency to open and operate an EU business without being an Estonian resident. Holders of e-Residency get a springboard to the EU market, while their companies pay tax to the Estonian state for locally hired staff, and local service providers assist.
Haav took the helm of the program at a time it was embarking on an innovation program called e-Residency 2.0, the aims of which have been to increase its membership as well as to make it more secure and to improve the user experience for e-residents. As part of its goals to improve security around the program, e-Residency has worked extensively with the Estonian Police and Border Guard Board, which has collected more data on program applicants when they apply.
e-Residency remote biometric easing the pain of travelling
The program is now working with the Estonian Police and Border Guard Board on enabling remote capture of biometrics data. If an e-resident could verify their fingerprint data remotely in some way, Haav noted, it would make it less necessary to travel long distances. Not only does Estonia, a country of 1.3 million, have limitations to how many embassies it can operate worldwide, but some countries are also quite large, meaning that for Australians or Americans, for example, travelling across time zones to visit an embassy can be time-consuming.
“Even if you have an embassy in Canberra, it doesn’t help people on the other coast of Australia,” remarked Haav. “So this is what is driving this topic, how to get closer to the customer,” he said. “But everything has to be digital and still maintain the same trust level.”
Ideally, e-residents would be able to securely provide biometric data via a mobile application, reducing the requirement for a physical visit. This, however, is not so easy, as the processes for the issuance of Estonia’s digital ID card for e-residents have to be aligned with the EU’s Regulation on Electronic Identification and Trust Services (eIDAS). While some financial service providers use some biometric applications for facial recognition, the e-Residency program would like to include fingerprint data as well.
Remote and secure
The question, therefore, is how to capture fingerprints from e-residents securely and remotely and if that is even possible. Anna-Liisa Tampuu is a project manager in the Estonian Police and Border Guard Board’s Identity and Status Bureau. She has a background in security in the private sector and also founded SheTravel, a London platform that specialises in female travel security. In May 2022, she returned to Estonia to lead the innovation project connected with e-Residency.
“We are at the beginning phases of looking at remote identification and biometrics capture,” said Tampuu. Currently, Tampuu is looking into the capabilities of remote biometric capture technology, how the data can be collected, the quality of the capture and any challenges in implementing such a solution. She said that the market is evolving and that the pandemic triggered a general trend toward using applications that allow remote biometric data capture, both by governments and in finance.
Tampuu highlighted that it is important to consider and understand the various elements of remote contactless capture, as the wider industry is currently discussing opportunities and concerns involving security, new emerging threats, the quality of the capture, best practices and international standards. The latter is not yet fully developed for remote contactless capture and some of its modalities, she noted.
Tampuu also emphasised that remote contactless capture is “an exciting new opportunity” but said that it needs to be done carefully and right for the use case, considering the appropriate risk mitigation measures. “My role is to understand this dynamic, to get a picture of these fast-moving technologies, and how to leverage these technologies securely so we can utilize capturing biometrics remotely and put it in the program,” she said.
The ideal tool would be able to capture biometric data remotely but at a high level of security that is aligned with eIDAS and Estonian legislation. “It’s a puzzle being put together,” she said.
Remote card renewing
According to Haav, the e-Residency program will likely introduce remote biometric data capture one step at a time. While new e-residents will still need to visit either the Estonian police or an embassy to provide their fingerprints for the first time, those renewing their identity cards after five years might be able to skip the wait and do it remotely using remote biometrics data capture.
“If you are renewing a document, we already have your fingerprints,” said Haav. “All we want to see is if we can get a match again,” he said. “That gives us the safety that you are you.”
The earliest such a solution might become available is after several important steps. Once the Estonian Police and Border Guard Board concludes its assessments of different platforms, the issue will go to public tender, and it could take a year to develop and test an offering before it goes live. As such, the move to remote biometric data capture is not an idea but something that we are actively exploring and planning to test for its suitability for implementation.
“We are hoping to find a solution next year and start testing the pilot in 2024,” Haav confirmed.
