X-Road: Estonia's digital backbone

In Estonia, practically every contact with the state is digital, from voting to tax returns to buying parking tickets. Behind these services is X-Road, the infrastructure for digital communication between public authorities, citizens and companies. Together with standards and laws, the software forms Estonia’s digital backbone.

The digital state: What can we learn from Estonia?

Estonia is considered a digital showcase state. The small Baltic country is known for its startup density, enables virtually all administrative procedures online and also offers these services to its global e-residents. Our author Helen Bielawa currently lives in Estonia and researches innovations in the public sector. In this series of articles, she shows what lies behind Estonia’s image and what Germany can learn from it.

In 1991, Estonia declared its independence from the Soviet Union after 51 years – the beginning of a radical system change. The inventors of X-Road laid the foundation for Estonia’s development into a showcase for the digital state in the late 1990s. One of them is Uuno Vallner. From 1993 to 2001, he worked as a consultant for the Information Systems Department at the Ministry of Economy.

“Data is king”

“We built our administrative system from scratch,” Vallner recalls. In the process, a key problem crystallized: sharing data between government agencies was expensive. In addition to this, the  Data protection authority requirements made processes complicated.

We built our management system from scratch.

A secure and, above all, inexpensive solution was needed. “We had no money for cable networks,” Vallner says. “So we decided that data was king. You wouldn’t build a road for a king on the move; you’d give him a protection team. We wanted to send data over the Internet and protect it with software.”

Secure, simple and open source were what the new infrastructure needed to be. These characteristics drove the design.

Transparency and efficiency go hand in hand

The core of X-Road is individual keys. Every government agency, every citizen, every company has a digital twin, a unique ID. Two of these parties can exchange data within X-Road via two security servers without having to use the server of a third party.

There are no duplicate records in X-Road’s system; that is prohibited by law. Those who use X-Road compile the data set they want via requests to the respective authorities.

“That way, each agency knows only part of the data. The health department knows the health data, the population registry knows the residents, the traffic authority knows the traffic data,” Vallner explains. Previously, the same data sets were held by different authorities – not efficiently.

Citizens can see who uses their data for what. With their ID card, they can log into an online portal and view their data. Errors are thus more likely to be noticed and can be reported. Transparency and efficiency go hand in hand.

Open source: a matter of course or a risk?

“I wrote into the requirements that this solution must be open source so that anyone can check it,” says Uuno Valler. But this was not only met with approval. “We had some discussions with security officials.”  So the situation arose that X-Road was legally open source from the beginning, but practically not. Experts got the code on request. It was published on GitHub only in 2016 under the MIT open source license.

Entry of banks gave the breakthrough

The infrastructure is also open to private companies. For example, one of the first major partners for X-Road was banks. Until 2002, only 3 percent of citizens had used online services to communicate with government agencies. Then the two main banks in Estonia switched from pin codes to digital identification.

Within eight years, the usage share rose to almost 40 percent. Today, 99 percent of all government contacts in Estonia are done online.

X-Road is now used worldwide

Finland and Estonia have been jointly developing the software since 2013. Four years later, the two countries founded the Nordic Institute for Interoperability Solutions. Since then, the organization has been taking care of further development and organizing the work of the X-Road community, which is now active worldwide.

Authorities around the world have now recognized the potential of X-Road.

The community’s world map shows that X-Road is now used internationally. In 2016, the Faroe Islands and El Salvador became the first countries outside of Estonia and Finland to implement X-Road. Today, Azerbaijan, Australia, Scotland, Chile, and South Africa are among the countries that have joined, and the WHO plans to use X-Road for digital immunization certificates.

Germany is also testing the Estonian infrastructure

Germany also has a marker on the X-Road map: the Association of Statutory Health Insurance Physicians in Hesse launched a pilot project for video consultation hours and digital prescriptions in April 2020. One of the IT service providers involved is the Estonian company Nortal.

In Estonia, Nortal has developed several state e-services. Since 2018, the software developer has also been active in Germany. In an interview with t3n.de, CEO Ole Behrens-Carlsson and Head of Digital Healthcare Taavi Einaste emphasize how valuable experience from other countries and also from the private sector can be for digitization in Germany.

Island solution or national infrastructure?

In Estonia, X-Road connects public authorities, citizens and companies – in Hesse, patients, doctors and pharmacies. Does the infrastructure also work as an isolated solution in the healthcare sector, without the nationwide context? Yes, say Einaste and Behrens-Carlsson.

You can think of federal Germany as many small Estonias.

“You can imagine federal Germany like many small Estlands. Theoretically, hundreds of X-Roads could work together,” Behrens-Carlsson explains. But the system is also compatible with other infrastructures, such as the telematics infrastructure, he adds.

“X-Road has a very German characteristic”.

According to Einaste, X-Road offers exactly the elements an infrastructure needs when exchanging data as sensitive as healthcare data: It enables data to be exchanged easily, with integrity and security, and it addresses the key issue of who has access to what data.

In addition, X-Road offers a “very German feature, in a way,” Einaste adds. Each data request automatically generates a digital certificate that is valid in court. German authorities need that for legally secure communication.

Einaste recalls conversations with stakeholders in Germany who prefer to use the fax for exactly that reason to have a legally binding document. Because X-Road automates this process, the system is so compatible with the German context.

Digitization is not a magic solution

So the infrastructure is well suited to transfer existing processes to digital. But in the case of digital recipes, more was needed. The exact pipeline through which data is sent and the role of hospitals, pharmacies and patients in it had to be defined. Instead of digitizing the state of affairs, a new process emerged.

“Digitization is not about turning a paper into a PDF. By doing that, the opportunity for real transformation is lost,” says Taavi Einaste. But his German colleague Ole Behrens-Carlsson encounters this mindset again and again in his work with government agencies.

Digitization doesn’t mean turning a paper into a PDF.

“Politicians think X-Road could solve their problems. But X-Road doesn’t magically connect two authorities; it takes development work,” Einaste says. Who has what rights, which actors exchange what data? Only when the answers to these questions are in place can X-Road come into play. That’s why a new mindset must be at the beginning of a technical change.