For digital government, trust is essential, says Estonia official

Speaker A: Hello and welcome to statescoop's Priorities podcast. I'm Colin Wood, statescoop's editor in chief. This week, statescoop reporter Keely Quinlan interviewed Lisa Lee Pacosta, the Minister of justice and digital affairs for Estonia. We'll get to that in a moment. First, here are the top stories in state local government it this week. California Governor Gavin Newsom on Monday announced that the state has negotiated a contract with Anthropic to provide agencies access to Claude, the company's AI assistant, at half cost. Newsom said the aim is to aid the work of state workers, not replace them. The Federal Communications Commission voted last week to approve a broad review of the federal E rate broadband subsidy program. Advocacy groups said the review, which could lead to limiting or even eliminating the program, is an attack on schools and libraries. In a commentary for StateScoop, two experienced election administrators wrote that last minute changes to the nation's election systems that are being imposed by the Trump administration could come at a high cost. Changes, especially those on tight timelines, they wrote, increase the risk of operational errors, technical failures and voter confusion. When Estonia escaped Soviet occupation and regained its independence in 1991, it took a propitious turn to the Internet. In seeking to establish a new democratic government, the northern European nation began building digital services, setting a foundation that would lead it eventually to become one of the world's most thoroughly connected governments. Lisa Lee Pacosta said going digital was a natural choice.

Speaker B: Estonia regained its independence 1991, and after the occupation from Russia, the country was extremely poor. We had to build up our uh, new government, a democratic state. So we definitely wanted to do everything differently from Russia. So the principles were that we want a, uh, transparent, we want a corruption free, we want a democratic state where people have the feeling that they control the government, not vice versa. And um, these times Internet was already around, so it was actually quite natural to choose the cheapest, most effective way to go with the digital services from the government. So it built layer after layer. We learned very much from private sector, especially from banks and also we trusted very much private sector. So the companies had the innovative ideas and that the same uh, model we have uh, ever since. The innovation is born in the private sector. The government has risk assessment tools and uh, then we take the best what is out there and implement it as government services. The most important lesson learned though was that you can't build a uh, digital state without trust. And trust is the most essential thing though. Not only speaking about cybersecurity, Estonia is written into the world history of cybersecurity because 2007 we were the first state ever to be attacked by another state. It was Russia then. And um, uh, since that we have cyber hygiene, like super important. It was very, very important, uh, also beforehand because we knew the threats, the time. But now we start everything, absolutely everything with cyber security, data protection and uh, also what are the tools, how to ensure that people still have this feeling that they control the government, not the government is controlling them.

Speaker C: Yeah, absolutely. Wow, that is so fascinating. I guess I'm curious about how uh, you all then are thinking about AI, like where this is situated within the role that government plays. Especially noting that piece you said about the private sector. And many governments in the US are rushing to adopt AI. What in your opinion distinguishes this responsible AI governance from simply just regulating it?

Speaker B: Of course regulations are needed, so uh, you need a, uh, certain type, a certain level of regulation, uh, to allow the private sector to build appropriate products, appropriate services on that. So we actually need a kind of uh, legislation for the private sector to understand what are the limits, where to build, uh, the innovation on. So we support regulated AI and we actually have a Ministry of justice and Digital affairs from 2024. And that is exactly because of the AI. We are also like rushing to use the AI, not only in governance, but also we have AI leap at schools. So um, it means that uh, now when everything, absolutely everything is technologically possible, we need to keep our values, we need to keep our liberties, we need to keep the human rights, we need to keep the human centric governance. And that means that we have to be innovative at the legal side as well. So Estonia is doing innovation both on the legal side. And uh, that allows us to go on with the innovative part, also with the AI. Definitely we are oriented into use AI to be the AI, uh, state. And that is also one of the reasons why we not only work with AI at the governance part, but we also have AI leap at schools. It means that uh, already all our teachers have free access to AI and also teachers to, together with the academia, together with the researchers, are building the new educational models on how the education should look like at the era of AI, so that our kids would not only be the best users of AI, but also the best creators, the best critical thinkers, uh, the best learners at the era of AI. So we see it all as a huge possibility to go on with. But again, with all the risk assessments in place, with all the cybersecurity data protection, uh, everything that is related to trust should be absolutely prioritized.

Speaker C: Yeah, totally. Let's dig into those risk assessments though, like, where are you all drawing the line on government use of AI? Like, are there certain decisions that you all have determined that should never be delegated to algorithms, even though they are becoming, you know, so advanced?

Speaker B: We adopted a new, uh, digital agenda just recently. And uh, you rightly said we have our red lines, but a little bit differently than you asked. So first, the most important, uh, thing that we are not going to do from the government side is we are not going to use AI for surveillance. So it is very, very important for the trust of people that they know that all these technological possibilities that are out there will not be used by the government to make the people better people as they already are. So we have drawn a line that we will use AI only for the situations what people would otherwise do anyway. But AI helps the same procedure or the same goal to be achieved in a much more quicker way. So let me give you a simple example. For example, when there is a traffic crossing, there is a policeman standing at the traffic crossing and controlling the things. Then for this AI can be used, uh, so for the same procedures that a human being is already doing anyway. But we are not going to put a drone with an AI analytics across the crossing to add extra information that maybe somebody violates the traffic rules. So this is, um, a red line that assures that we are not going to use the technological possibilities to diminish our liberties, to make people better, to make them behave better than they are already doing. Estonia has a very low criminal rate and more than half of our, uh, prison places are empty actually at the moment. And uh, we definitely believe this is also what the research shows, that when you trust people, when you are not building your state on surveillance, uh, you actually get lower criminal rates. So this is very, very important, uh, uh, for all the technological possibilities not to be used to make people, uh, to behave better or to surveil them, uh, in the way that was not possible before. The second very, uh, very important point is data protection. Let me explain. Estonia has a fully digitalized governance. It means that all the public services are, ah, digital, all the data is digital and nothing is, um, duplicated to paper. And that means that we have more than 3,000 different, uh, state databases that are all interconnectable with an X road system that is an extremely secure architecture for interoperability and actually very, very well designed for the AI era because basically it has computing capacities in. That means that, uh, again, we would have absolutely perfect possibility to use all the data, uh, to Analyze all the data of everybody, because all the data is also connected to the personal code of every physical person and to the company code, of course. So again, we are not going to use it only because the technology would allow it. For every interconnection of the data, for every usage of the data, our, uh, Parliament has to give a, uh, very limited and clear permission. That means that even if you want to use data from different databases, whatever the process is, whatever the decision is, you should have a, uh, permission from the Parliament written in the law. It means that the people themselves give their admission. The control is fully at the parliament hands and no official can combine the data. We also have a data tracker already. That means that you can open the state application and you can, as a citizen you can check every single time when somebody from the public sector, but also including the private sector, has taken a look at your data in the state databases. And that gives full control into the hands of people. If they have any questions, whether these people had a legal ground, for example, of course you can pose this question and you get the answer. And by the way, we have also found out some of the cyber breaches because of, of this control in the hands of people. And that is also relevant for the AI era, especially when the mistake could be huge. So the data protection is now given much higher importance than it ever had, although it was very important already beforehand. And for sensitive data, we are acquiring only the possibilities where the full control is in the hands of the state and in the hands of people with a data tracker. So it means that uh, the design of the AI or algorithmic or whatever solutions there are should be designed in the way that is appropriate from the very beginning. We have also, uh, the laws on how the automaticized decision making should be made and how the control is still in the hands of people even if there is an automaticized, uh, decision making, whether it's by algorithms, whether it's by AI or uh, whether it uh, also has some waiting value, um, based decisions within that. And to end up, uh, although I could talk much longer about that, to end up. So for example, one of the decisions is that yes, we use AI at the courts, but the final decision, the final decision at the courts will always be made by a human judge. So the AI has a possibility to help the judge, uh, to prepare the decision, also to use the data, uh, to prepare the decision, but the very final decision at the court will be made by a human judge.

Speaker C: Wow, that's so fascinating. Like that level of transparency is so cool to hear about like in, in action. But I want to go back to something you mentioned with respect to having fully digital services, no like duplicative services in that sense. You know, here in the US a lot of states have kicked off these widespread modernization efforts. And while there have been great successes, I think in a lot, in a lot of ways there have also been, you know, a handful of processes that you know, folks are finding at least here that uh, it can't be wholly digital. Right. We still have Internet access issues, device access issues. Some folks like, you know, don't necessarily have the resources to access the learning to learn how to use you know, some of these technologies as you've mentioned. So what are some of like the biggest mistakes I guess that governments can make when trying to like transform themselves digitally?

Speaker B: One of the principles that is very important is that nobody should left behind. And uh, that has been the principle also. In Estonia people have a right to be full members of digital society even if they don't have a single gadget. Maybe they don't have resources, maybe they don't just want to, maybe they want to opt out, but they have to have a possibility to get all these digital services even if they don't have a single gadget. And actually we have in Estonia quite many people who don't have Internet or uh, who don't have computers. But we have library system, a public library system. There is a public library in absolutely every village. And public libraries and schools were in 1990s already the first places to get uh, high speed Internet access. And we do not train librarians already from 1990s we train information specialists. And that is because the public library is the hub where everybody can go and get all the digital services needed. The librarians are helping the people. You also get a cup of coffee, you can lend some books if you want. You have a nice uh, social setting there. And uh, the librarians help you throughout all these processes needed, uh, so that you get your uh, services uh, within the digital state without having anything or any knowledge about it yourself. You can do the banking there. You can access all the digital services. Uh, and there is one, uh, service we have um, two ways to do it and that is uh, voting. Estonia just celebrated 20 years of E voting. And um, there you have a possibility both for vote via Internet but also to vote with paper ballots at the voting stations. And if you are for example disabled, I think you are at home and you can vote or you get uh, all the services needed so nobody is left behind. I think this is the very, very important principle, trust is the most important one. And as important as this is that nobody is left behind.

Speaker C: Yeah, that bit that you mentioned about trust is actually such a perfect segue into my, into my next question for you, which is, you know, in terms of like, embracing this digital government at all, all levels, like, few countries have achieved what y' all have with creating this level of trust via transparency. And like, how can governments earn that from their publics rather than simply demand it? Right. Like, I feel like there's so many examples where it's like, it's like we're transparent, see, like, this is what we're doing. But like, in terms of actually giving that power, you know, as you mentioned earlier, with like, visibility into how data is being used, giving that power to the citizens, I think is, is really what y' all are doing differently. Can you talk a little bit more about that?

Speaker B: As I mentioned beforehand, we actually trust very highly the private sector, and we work together with companies. We have learned quite a lot from banks and banking systems. So when people trust their money, uh, and money transfers to Internet banking, to digital banking, then, uh, what are the things that the banks do that, uh, we can copy as a government, if you look at your bank account, you have a full control. You see what transactions, um, there have been. You have the feeling that you have yourself the control over your money. And that is the same model we actually use in Estonia for government, the state app, but you can also access via Internet. We have had this data tracking system and that is now actually, uh, broadened also up to the secret police. Of course, not during the investigation itself, but after the investigation is over, you get a notification that your data was looked at and, uh, you were like, investigated. What also is important that, uh, you never know when somebody has looked at your sensitive data on the paper files. So, um, if you have like a psychiatric disease or something with very, very sensitive information, you never know who has looked at your. When your data is on paper files, but with a data tracker, you know the name of the doctor, you know the name of the nurse, and you know the millisecond when the person has looked at your data. And you can ask whether this or that person had a legal ground to look at this. Actually, also in hospitals, people have lost their job while taking a look. Um, maybe just with curiosity, somebody had a rare disease, but people do not have a right to look at your data without a legal ground. So this combination that there is a very secure legal background, legal norms, how the things are done, but Also the full control within the hands of people with all the rights to ask whether this or that person had a legal ground with a person, a clear visible overview who has looked at your data. And uh, also we have a very high satisfaction level actually with the services. We monitor it all the time. That makes digital state uh, trustable. I have to say that uh, our government is not trusted as much as our digital services. So with all the political combinations we have had in our government, no political party goes to the next elections offering that. We are going to offer you more slow, more costly public services, um, that you have to wait for a long time and then you don't have your control yourself. This is what all the governments have been supporting because the services itself are ah, very convenient, very quick, more and more often also proactive based on your life events. Uh, and this is something that people without that I think most of the Estonians wouldn't consider, consider the government uh, trustful at all. And I recently talked to some of the AI students uh, in Zurich, uh, from Estonia and I asked uh, what has been the most complicated thing for them. They were doing their doctoral thesis there and they answered that uh, to fill in an application on paper they had never done.

Speaker C: Wow, I can't, yeah, I can't imagine that. You know it's so interesting kind of hearing you talk about the trust in government being different from the trust in digital services. And I think for us state governments that are kind of attempting to get to this place, right, like where maybe it's not that they have holistic trust but they have trust in at least that they're all provisioned services that are reliable, fast and easy to access. I think a main challenge to that is that we've got such fragmented agencies, right? There's legacy systems that like in some cases maybe still use those paper based like applications, you know. And then of course you've got the triple whammy with limited budgets. So what would be like I guess your recommendation to states that are wanting to move towards building a trusted modern digital state as y' all have in Estonia?

Speaker B: Every country is different, has different culture, different law systems. So my advice would be that uh, everybody interested in is most warmly welcome to Estonia to study how it was organized. What are our next challenges where we can co create further on because especially at the AI era, the investment level is higher and we are looking really for a uh, lot of co creation of new types of services or new ways to offer services in a more effective way. We very much um, believe that uh, all the countries in the world have at least some kind of governance, some kind of medicine, some kind of education and some kind of defense. Uh, we are very good NATO allies with us. So there is definitely room for a lot of co creation of new type of services, not only learning from each other, but also to actually co create new types. And uh, of course Estonia has the same issues, has had the same issues that the public sector is always fragmented, always. So the shortest answer would be that I have, like from my own experience as a mother of five kids, that when you can't achieve your goal, like make up your bird every morning with just a free will, you have to make a rule. You don't get like pocket money when you don't fulfill this or that, uh, rule. So this is actually the way we have organized it. Also in Estonia, uh, for example, the IT investments are centralized and uh, if you want to use the money, you have to use it in a most effective way. You have to reuse the existing architecture that is already out there. You have to fulfill of course, all the uh, data protection and cybersecurity very, very high require. But with a type of centralized budget, the money has a very good decisive power, uh, for everybody who wants to raise their level of services or their level of innovation. So that has turned out uh, a um, very effective way. I just recently read that also your uh, decision makers are discussing about, uh, unifying a little bit more like the cybersecurity part. This is what we have been doing also in Estonia. So also from this angle there is a lot to learn from each other.

Speaker C: Yeah, no, certainly there have been so many conversations at every level about establishing like a unified national standard for things like cybersecurity, AI governance and data privacy. Right. But we also have the states that want to retain their ability to govern themselves. So there's been a bit of friction there, uh, over the last several years trying to, trying to either get everybody on the same page or bring, you know, more, more voices to the table, so. Totally. Well, I've got, you know, one more question for you. Even though I feel like I could just keep picking your brain forever. Looking ahead, yeah, looking ahead to like you know, the next five, ten years, uh, thinking about how fast technology has transformed what will distinguish governments that successfully like harness AI and all of these digital technologies from those that maybe you say fall behind. Like what would you say are things that would make a country successful in this journey?

Speaker B: I have to repeat for the success factors, uh, the cybersecurity trust, transibility, but also uh, that people have really the feeling that the control is in their hands. Uh, that is essential for any democracy or any democratic state. But also I think we have a global issue here also. So to see that uh, really globally people are not divided, uh, very harshly because that would certainly create tensions. So it's a lot of um, multilateralism we have to turn attention to because this is really important. And also as we have seen from every technological, um, development there are good guys who use it, but there are also bad guys who use it from uh, their angle. And like minded countries fighting for good should unite more than ever before because all these digital issues are global issues. But at the same time, uh, to define uh, what um, good governance would look like, what we are looking for is that people wouldn't notice, uh, government at all or the public governance at all. So you were asking beforehand about the trust to the government and I answered that uh, it is very different from the trust to the digital services. So we would like to exemplify it even further on so that um, people get all the services needed from the public sector without even noticing that there is a public sector around. So that there will be like zero bureaucracy for everybody. And that the help that we as a society want to offer to our people is really so easily accessible that uh, people don't have to bother to ask for uh, help or to wait for, for the services. That is uh, what we are looking for.

Speaker A: Thank you to Lisa Lee Pacosta for being a guest on the Priorities Podcast and for sharing her insights with our audience. That's it for this episode. If you enjoyed listening, please tell a friend or colleague about the podcast, leave us a nice review or comment on social media. We always appreciate hearing from you. The Priorities Podcast this is a production of Scoop News Group in Washington dc. Production work is done by Carlin Fisher. I'm Colin Wood. Thanks for listening.