Chinese Mass Surveillance and the Estonian Conscription Register (KVKR)—Like Two Peas in a Pod

Estonia has received international attention as a successful e-nation, where processes are made more efficient through digital data collection and processing. Mass data collection also raises significant concerns, such as the risk of privacy violations and potential abuse. The Estonian Conscription Register (KVKR) is an example of an Estonian national database created to meet an administrative need. Still, its architecture and scope indicate worrying similarities to the mechanisms of China’s mass surveillance.

About China’s Mass Surveillance

China’s Social Credit System (SCS) is a massive database that uses massive data collection and algorithms to evaluate citizens. It can determine who is trustworthy and who is not based on various criteria, including financial capacity, criminality, and social behavior.

Important features:

• Scope of data collected: SCS compiles information about citizens’ personal, financial, and social lives.
• Automated decision-making: Algorithms determine who can access certain services and who cannot.
• Integration of monitoring tools: SCS is connected to various information systems that work together.
• Risk of abuse: SCS has the potential to restrict civil liberties and create coercive conformity.

KVKR – Estonian Version of China’s Mass Surveillance?

The Estonian Conscription Register (KVKR) was created to manage data on those subject to military service and those wishing to enlist. However, its scope and the techniques used in the system architecture are strikingly similar to the Chinese surveillance system.

Massive Data Collection

KVKR collects and stores the following data:

• Personal data: personal identification number, contact information, place of residence, citizenship.
• Education and health data: educational level, health examination results, diagnoses.
• Behavioral data: information about volunteer activities and skills, criminal record and criminal proceedings.
• Military information: history of military service, mobilization orders.

The “person_info_v1” service retrieves extensive information about individuals at once, including:

• Number of children, level of education, place of employment, driver’s license, contact information and address known to the state.
• Health compliance, ranks, wartime positions.
• Religious affiliation, identity documents.
• Test results and service records, date of oath.

The KVKR refers to “projects” as structural units that manage various service-related processes, including call-ups for training, health checks and other operations necessary during military service. Through projects, large amounts of personal data are collected and managed and processed automatically using background processes. This approach is reminiscent of commercial information systems, where “products” are replaced with “call-ups” and are managed according to established criteria. For example, automatic data query processes are performed daily to check whether individuals’ health declarations and diagnoses are up-to-date, eliminating the need for manual checks.

X-Road Interface and Automation

Like the Chinese SCS, the KVKR is also linked to various databases, including the population register, criminal record, and health information system. Data exchange via the X-road platform enables automated and/or mass decision-making, for example when determining military service obligations or assessing suitability.

Privacy and Tracking Scope

Although the KVKR has limited access, data on male citizens as young as 17 is automatically collected from the population register, even though conscription may still be years away. This is similar to China’s “pre-screening” mechanism, where citizens are monitored and assessed even before they are in immediate need.

Anyone interested can learn more about the KVKR data fields in the table below. It is thought-provoking that there are at least 300 fields with the prefix “subject” alone, i.e., data on subjects.

Concerns

Data collection can become a separate goal. Mass data collection creates a precedent where the state’s ability to collect data becomes more important than the use of the collected data to achieve specific and proportionate goals. Bureaucrats find it very convenient to scroll through their warm offices and manage individuals in the same way that e-shops manage their inventory. The Defence Resources Board has paid KVKS developer OÜ Inversion Software 328,560 euros in a little over three years.

There is reason to question whether the amount of data collected by the KVKR is proportional to its purpose. Couldn’t we do with less? Estonia’s digital success story should focus on how to use technology fairly and responsibly, not on how to create a data collection and decision-making machine similar to the practices of China’s mass surveillance.

Sources:

1. K. Drinhausen, V. Brussee. China’s social credit system in 2021 from fragmentation towards integration
2. State Gazette. Statutes of The Estonian Conscription Register
3. Inversion Software. The Estonian Conscription Register v3 (KVKR3): System architecture
4. Inversion Software. The Estonian Conscription Register v3 (KVKR3): X-road server
5. Inversion Software. The Estonian Conscription Register v3 (KVKR3): Interface documentation
6. State Information Systems Authority. KVKR data composition