Reform Index focus: Electronic documents in Diia: How does that work in practice?

“It’s not about people but the system. You may think I’m a naïve dreamer, but we want to have the state in a smartphone, the government in a smartphone. It’s time to do it,” Ukrainian President Volodymyr Zelensky said in May 2019.

In late September of the same year, the Ministry of Digital Transformation presented the “state in a smartphone” project brand – a web portal and the Diia app. The first “documents in a smartphone” were driver’s licenses and car registration certificates.

Ukraine became the fourth country in Europe to make these documents available in digital format. However, the Ministry of Digital Transformation bragged they used no money from Ukrainian taxpayers to develop the test version, with the project’s funding coming from international donors.

The government’s ambitious plan is to digitize all public services by 2024. In November this year, a law will come into force prohibiting government agencies from asking citizens to provide paper certificates. Ukraine must embrace the so-called “paperless office” mode.

Digitizing documents and public services offers many undeniable advantages. This includes streamlining interactions between citizens and the state, expanding access to quality public services, and reducing corruption risks and officials’ influence on issuing the necessary certificates and permits.

That said, Diia still raises a lot of questions. These primarily concern the security and protection of personal data.

So what is “the state in a smartphone”? How soon will we be able to get rid of paperwork? Is the personal data of every Ukrainian securely protected?

What does the “state in a smartphone” comprise?

Today, the digital public brand Diia has six components:

• the mobile app enables every Ukrainian to receive up to nine digital documents and twelve public services;
• the public services portal offers about 70 government services: registering a business, receiving social help, certificates, permits, etc.;
• the Digital Education platform offers online courses in the form of educational video series. Every Ukrainian can use it to improve their digital skills for free, take a test at the end of the course, and receive a certificate;
• the Business platform to support Ukrainian entrepreneurs. You can use it to find a business idea, get advice on your own business, watch educational videos for entrepreneurs, etc. The Ministry of Digital Transformation also plans on adding features to help find business partners and enter international markets;
• the Diia.Centers are new-format administrative service centers (ASCs). Citizens can use them to receive all the public services they need in one visit. In 2021, the Ministry of Digital Transformation selected 188 amalgamated communities to receive a state subvention for transforming ordinary ASCs into new Diia.Centers. Such assistance is provided based on co-funding. To receive assistance, municipalities must ensure that the ASC premises meet the Ministry of Digital Transformation requirements regarding colors, signs, information zones, etc. However, there is no guarantee of receiving a subvention;
• the Diia.City is a special legal framework for IT companies. Residents will have a special taxation model, flexible employment terms, and separate procedures for interacting with state regulatory authorities.

The Ministry of Digital Transformation has recently launched two more platforms based on Diia. These are the national e-democracy platform “InterDiia” and the regional digitization platform “Digital Community.”

So, the next time you hear about Diia, make sure you clarify which of its components is meant.

What Diia’s digital documents are already available to Ukrainians?

Today, citizens can use nine digital documents and two types of COVID-19 vaccination certificates.

A passport of a citizen of Ukraine and a biometric passport. Ukraine became the first country in the world to equate digital passports in smartphones to their physical counterparts. Digital passports are accepted by ASCs in four oblasts of Ukraine, the Ministry of Internal Affairs service centers, Ukrposhta, and Nova Poshta, and by more than twenty banks, and ten airports.

However, regular paper passports are not displayed in Diia. You will also need to have a paper registration certificate in some situations, keeping in mind that the app does not work without a stable Internet connection.

– Nataliia Rybalko, public figure

In addition, a digital passport will not have legal force in any country outside of Ukraine.

An individual taxpayer ID card allows you not to carry a piece of paper with your unique taxpayer number. However, it only works with document sharing in place. Currently, not too many institutions use such a service, with most of them requiring a paper certificate.

Documents for car owners: driver’s license, registration certificate, and vehicle insurance policy. Ideally, all of these documents should replace paper ones, but there are some caveats.

One problem with using a digital driver’s license is the long and not always straightforward document verification process.

There have been cases of getting fined for driving without a license because of failure to complete photo verification, with scan copies of documents being displayed in the app.

It has also happened that the police stopped cars and could not find the driver’s license using the QR-code and instead searched using the document’s details. Similar issues arose in most cases with respect to vehicle registration certificates.

NGO Youth Foundation of European Initiatives has repeatedly complained that certificates of insurance often fail to upload.    

A child’s birth certificate. The document replaces the paper counterpart for parents, enabling them to receive public services using the eBaby service.

The number of institutions to verify documents using QR codes is limited so far. The certificate also does not work if the institution does not offer document-sharing services.

– Natalia Rybalko, public figure

An Internally Displaced Person (IDP) certificate enables IDPs to get public services without paper documents.

A Student ID on a smartphone allows students to do the same as its plastic counterpart, namely get a 50 percent discount on rail travel in couchette cars, discounts in museums, and other government agencies of the cultural sphere. In addition, some universities let students use this e-document as a library pass.

Domestic and international COVID vaccination certificates. There are three types of COVID-19 vaccination certificates available to Ukrainians: two domestic (one- and two-dose vaccination) certificates and an international one.

The international COVID certificates in Diia are officially recognized in the EU, and Ukrainians can travel freely to at least 43 countries. The list of these countries keeps expanding. 

Theft of personal data: is it an actual threat?

To understand whether there is a risk of identity theft from the Diia app, you need to have an idea of how it works. The app does not store personal data. It only displays information from the registers in response to a request from fully identified users.

The Ministry of Digital Transformation constantly emphasizes that the app is entirely secure and difficult to break. To prove this, the agency even ran a competition for ethical hackers to find vulnerabilities in the app, with a prize fund of $35 thousand. It resulted in no one being able to win the prize. Although the participants did find two technical bugs, they did not detect vulnerabilities affecting the app’s security.

In July, the Ministry of Digital Transformation ran a similar competition. The prize pool is up to $4,500 for identifying the highest level of vulnerabilities. The competition’s results will be announced in January 2022.

However, there have been cases where fraudsters got access to digital documents. In July 2021, perpetrators used Diia to issue a loan to a woman at a microfinance organization (MFI). First, they stole her phone number to gain access to her bank account and then used this information to access her digital documents.

In August, the cyber police arrested a woman who had stolen Ukrainians’ personal data and used digital documents to get loans from MFIs. Her actions affected 40 people, with the total damage reaching UAH 300,000.

To avoid such schemes in the future, the Ministry of Digital Transformation excluded all MFIs from Diia. In September, Mykhailo Fedorov announced the launch of a new service: each user will receive a notification about banks conducting credit history checks and their purpose. This will help identify early attempts to get an illegal loan.

Other challenges

For now, the biggest obstacle to using digital documents is the lack of reliable Internet coverage.

Since the app cannot generate a QR code without Internet access, it might not verify any digital documents in cases of force majeure.

For instance, these cases can occur at a train station, bank, or other institution, where customers cannot use mobile Internet or Wi-Fi.

The Ministry of Digital Transformation promises to eventually resolve the Internet connection issue in Ukraine. A memorandum signed with mobile providers includes plans to provide all strategic directions with Internet coverage by the end of 2021 and provide 95% of Ukraine’s population with 4G access by mid-2022.

Other countries’ experience

Many countries around the globe are working to introduce electronic documents. In particular, Belgium is the first EU country to introduce nationwide electronic identity cards (eIDs). The project started in 2000 and ended in 2009. Interestingly, an eID is a legal identity card in Belgium and the EU.

Austria is introducing the “Citizen Card” in the form of a chip requiring the use of an electronic signature on a smartphone.

A well-known example of comprehensive digitization is Estonia. The government has transferred nearly all public services online, except for marriage, divorce, and selling real estate. Since 2000, ID-passports have been in use, containing detailed information about their holders: from medical data to academic performance.

Personal data protection is an Estonian government priority. Every citizen can see in their personal account which government agencies viewed information about them. If they think that the inquiry was not practical or legal, they can apply to a special agency, the Data Protection Inspectorate. If their suspicion is confirmed, the officials will be subject to punishment.

Conclusions

The Ukrainian government’s desire to digitize public services is understandable and positive. This will reduce the country’s corruption levels, make public services fast and accessible to citizens, and relieve ASCs from the constant queues.

However, developing a “digital state” is impossible without improving the quality of the Internet and without covering the entire territory of Ukraine.

In addition, protecting the personal data of users of digital documents and preventing fraud requires continual improvement. To this end, the state should promote the digital literacy of Ukrainians and bring order to public registers to prevent public servants and government officials from falsifying data.