Siim Kumpas.

Q178 The Chair: Welcome. As you know, this session is open to the public. A webcast of this session goes out live and is subsequently accessible via the parliamentary website. A verbatim transcript will be taken of your evidence and put on the parliamentary website. You will have the opportunity to make minor corrections for the purposes of clarification or accuracy. Would you be good enough to introduce yourself formally? Then we will proceed to the first question.

Siim Kumpas: It is good to be here. I come from the Government Office of Estonia. I am a civil servant there. I work on strategic communications.

Q179 Lord Harris of Haringey: Thank you very much for joining us today. We are interested in the issue of foreign interference in political systems. We have been told by our Government that they have no evidence of a successful attempt to alter election results in this country, but success is not necessarily the issue.

To what extent is foreign interference in Estonia’s political system a concern for your government? Do you feel that Estonia’s reliance on digital technology makes it more or less vulnerable to foreign interference?

Siim Kumpas: The Estonian government think about foreign interference in our internal matters. Our geopolitical background makes it pretty clear. Since we regained our independence back in 1991, we have been facing some of the challenges that several other countries started thinking about out loud maybe five or six years ago. As such, foreign interference is definitely nothing new to us.

At the same time, it is important to note that, while we are on the physical forefront in the digital sphere, we are definitely not the number one, two or three target for our biggest eastern neighbour. Although it may seem so, looking from the West, possibly for several reasons, we are still a relatively small country and, looking at what is going on in the world, politically there are many bigger possibilities for hostile actors, be it Russia or anyone else, to take into account. When you look at all the biggest information attacks dating back to, say, 2014, they have happened elsewhere, be it Ukraine, the US in 2016, 2018 and now 2020, the Brexit referendum or the downing of MH17. There are also a number of other cases. That is important to note when it comes to Estonia. That said, of course the threat of foreign interference is very high up on our agenda, so we definitely focus on it in our policies and politics.

The second part of your question is a very good question. Yes, we are a highly digitalised society. To some extent that makes us more vulnerable, but to some extent it makes us more ready for certain threats. We are more vulnerable because, in terms of someone targeting some of our crucial digital services that other crucial services rely on, be it electricity, healthcare or something else, the threshold in Estonia for foreign cyberattacks is definitely lower. We need to take even more minor cyber threats more seriously than some other countries. At the same time, the fact that we are pretty advanced in digital matters gives us a certain competitive edge as well. It is a two-way street.

Lord Harris of Haringey: Do you feel that the higher levels of digital literacy, which I know the Estonian Government have worked very hard on, increase the resilience of your society and your people against foreign interference in these processes?

Siim Kumpas: They definitely do. First, it may be good to clarify what we mean by “digital literacy”. In Estonia, we tend to use the term “digital competences”, a small but relevant difference.

We see it comprising mainly of five pillars. The first is information: the ability to find and access information and then assess the relevance and trustworthiness of that information, as well as being able to tell a fact from an opinion. That skill also came up highly in the last PISA test results. The second is communication: using digital means to communicate. That is pretty self-explanatory. The third is content creation: being able not just to consume but to create content, which is highly relevant these days, because we are all more or less journalists nowadays. The fourth is safety, which comprises everything from basic digital hygiene to netiquette. Last but not least is problem-solving skills: being able to solve basic IT problems, be it software or hardware, by ourselves.

If you add all those skills up, yes, that makes our people more resilient not only to hostile interference in the digital domain but to noise, rudeness, bad journalism and everything else.

Lord Harris of Haringey: We have seen the Estonian Foreign Intelligence Service’s annual report, published last month, which warned that Russian cyber threats against the West have gone unpunished and will continue in 2020. It states, “Russia’s cyber operations have been successful and, to date, have not been sanctioned enough by the West to force Russia to abandon them”. What do you think the West should be doing?

Siim Kumpas: That is a very good question. This is a highly political question and I am a civil servant, so I will try to give you my views.

Of course, the prerequisite to doing anything is understanding that the same rules apply to actions in the cybersphere. Whatever you do there, you should, if necessary, be warned or punished for your deeds. That is the first thing. Cyber deterrence is something that we have not tried and tested that much. Especially when it comes to informational interference or cyber, those threats are very asymmetrical, so one can definitely question whether it would make sense, for example, when someone interferes in another country’s internal matters via different informational means, be it disinformation, using bots or something else, to consider responding with cyber means just to show what we are capable of.

I am not a cyber security expert per se but, as I understand it, one of the main drawbacks to the idea of deterrence in the cybersphere is that we can only use our cyber deterrence once, if at all. With physical, kinetic weapons you can host parades, go on the street and show what you have up your sleeve as much as you want. With cyber tools, it is more or less impossible to know what each and every country is capable of. That is definitely one of the drawbacks to cyber deterrence.

Q180 Baroness Morris of Yardley: The level of digital literacy of your public is clearly very impressive. I can see that, given how digitised the public services are, that is necessary. We have talked about the fears that your government might have about cyberattacks. How much do the public understand that bit of the digital world? One of the things I worry about is if a government know there are attacks but the public do not, so they are not necessarily on the lookout for that kind of attack on democracy. What is the level of awareness of the threat to democracy amongst the general public?

Siim Kumpas: That is an excellent question. When we go about building Estonia’s resilience to information attacks and cyberattacks, the first thing we see, as a prerequisite to all that work, is public threat level awareness. Without that, we could not do what we are doing. If people do not understand that there is a threat, what the threat is, where it is coming from, what it looks like and what can be done about it, it is very hard to respond to that. That applies not just to the general audience and general public but definitely to our decision-makers, because if they were not sufficiently aware about threats posed by either cyber or informational means, to be blunt we would have to waste our energy on convincing them that this is something that we have to deal with. We are in a good position in that we have the luxury of not having to do that convincing.

This resilience also comes through our work. Our Internal Security Service, for example, has given out public annual threat assessments for two decades now. Our Foreign Intelligence Service has been doing so for five years. Our cyber intelligence agency started doing it two or three years ago. This has become a norm in our security and defence community. That is just one example. I have talked with my colleagues in several other countries, and it is definitely not the norm that security agencies are this open and give out annual public threat assessments.

Coming back to your question, yes, threat level awareness, among both the public and decision-makers, is absolutely necessary.

Q181 Lord Mitchell: First of all, Mr Kumpas, I would like to congratulate you, or more particularly your country. Whenever we sit around and talk about those who are at the forefront and the vanguard of digital and information technology, you are right there at the top. From where you came from in 1991, that is some achievement.

We have talked about Estonia’s focus on digital and media literacy. What is the definition of digital literacy, and what does this focus looks like in practice, in particular across different ages and different socioeconomic groups?

Siim Kumpas: First of all, thank you for the kind words. Secondly, I briefly went over the definition at the beginning with the five pillars I mentioned: information, communication, content creation, safety, and problem-solving. These are the five pillars of digital literacy, or digital competences as we tend to call it.

A term that overlaps, but not entirely, is “media literacy”, which we also use. By that, we mainly mean the ability to gather, assess and create content. There is heavy overlap, but digital literacy, as the name implies, looks only at the digital sphere. At the same time, especially when it comes to threats in the information sphere, it is very important, especially in Estonia, to understand that digital is not everything. People still watch TV. They still consume other types of media, be it radio or newspapers, especially the Russian-language population of Estonia, which is roughly 30 per cent of our population; they still consume TV quite heavily. The top three channels are produced in Russia and are linked directly or indirectly to the Kremlin. So it is very important to connect those two terms, “digital literacy” and “media literacy”.

When it comes to the practical steps, it all starts in kindergarten with basic education. For example, we start teaching our children basic coding skills and ICT skills using different toys. We have those little bees that they can touch and play with, and when they turn certain knobs the bee does this or that. This might not sound very interesting or relevant, but at the same time this is nothing else but pure coding. They are the lines of code that Facebook or any other modern application make; they are just a lot longer.

Introducing those small gadgets to them very early on is one thing, but that is mainly about coding skills. When it comes to media literacy, for example, or understanding and making sense of the information around us, in the lower grades it is mainly ingrained in other subjects; we do not have a separate course for, say, 10 year-olds called “media literacy” or “digital literacy”. That is the way to go about it. In maths you can talk about how you use statistics, which, again, is something that we are all quite easily fooled by. In art, you can analyse pictures and see how certain methods make us understand or read an image differently, et cetera.

When we get to the high school level, yes, we have a separate course called “media and manipulation”. It is a 35-hour compulsory course that gives all high school students a basic understanding of what media and journalism are and how they work. It includes social media and all other modern solutions. What is a fact and what is an opinion? What are the threats? Who are trolls? Who are bots? How do we make sense of them and protect ourselves from them?

I see this as a beginning. There is still very much to do in this field. At the moment, for example, this course unfortunately is compulsory only in Estonian schools. In Russian schools, there are optional courses but not compulsory ones. We are working on making it compulsory to all schools. We also want to lower the age levels, because at 16 our youngsters are already casting votes at local municipal elections. This means that they need elementary digital skills by that time, because most young people in Estonia cast their votes online electronically. This is all connected.

Lord Mitchell: Can I just ask a quick follow-up question that I cannot resist? It is slightly off-question. I believe that in Estonia you have the facility to vote using a mobile phone. Is that correct?

Siim Kumpas: This is something we are working on. You can vote online. We use internet voting, but mobile voting is a work in progress.

Lord Mitchell: It becomes a key question for us. If we were to go down that route, we would of course be absolutely at risk of all sorts of interference in the process. I just wonder what your experience has been.

Siim Kumpas: Another very good question. The level of trust which the Estonian people put in i-Voting almost does not make sense from a sociological point of view. The curve is almost too high, even given the few small hiccups we have had with our ID card, which is the underlying layer of all our digital services. Ever since we introduced i‑Voting, the rate has gone up steadily. If I am not mistaken, last year, during the European Parliament elections, the number of people who cast their vote via the internet was just below 50 per cent; it was 46 per cent or so.

At times, people tend to trust i-Voting even more than paper voting. There is a weird notion that i-Voting has to be more impenetrable to different threats. I am not sure; it is a bit different. With i-Voting, people either trust the system or not; there is no in between. With paper voting, there are so many things that can go wrong at each and every polling station—the numbers do not add up, a balloon pops in front of a camera, et cetera.

At least in our case, people trust i-Voting very highly, but that again points to the fact that we have basically built all our services on a digital platform. If I am not mistaken, today the number of our e-services available online is around 99 per cent, basically everything, which means that people are so accustomed to digital and the convenience they get out of it, and the track record has been so good, that they have no reasons to doubt the system so far. Of course, trust is difficult to win and easy to lose, which is why we are very keen to keep our systems as secure as possible.

The Chair: This possibly tells you more about my cultural taste than you need to know, but there is a brilliant Netflix series called “Narcos: Mexico”. Episode 6 shows how the 1988 Mexican election was totally stolen as a result of the manipulation of electronic voting by the narcotics industry. The amount of detail which the episode goes into is quite extraordinary. It is really quite alarming. It is also enjoyable.

Siim Kumpas: Thank you for the recommendation. I will have a look.

Q182 Lord Lucas: In Estonia’s experience, what have been the main barriers to promoting good digital media and political literacy? What have been the problems and how did you overcome them? What lessons should we learn from that?

Siim Kumpas: When it comes to digital literacy more narrowly there have been two main obstacles. The first is the opposition from some parents and some special schools, such as Waldorf schools. Some people are afraid that introducing digital solutions, both software and hardware, too early on, and making them too visible in the education system, raises the risk of youngsters becoming addicted to digital technology. The science behind this tells us otherwise. If anything, it is a symptom of something else that started somewhere else. The school system in Estonia does not make young people addicted to digital technology in that sense.

The only cure for that is raising awareness, explaining and communicating. One thing that definitely helped us was when psychologists and other experts started pitching in and publicly started sharing their views on this. We were able to have this rational and grown-up discussion about the threats and availabilities of digital technologies in our school system.

Secondly, I would bring up the awareness of school management and their understanding of what is expected of them, as well as their means of implementing certain courses or other ways of learning, and their availability. We can talk a lot about digital, but it is not very helpful if your school does not have an internet connection. This is something where the state has to lend a helping hand and provide a necessary layer of means, so that schools are both willing and able to commit to digital solutions.

Lord Lucas: How do you help older people, when we are faced with systems that change every few years and where the rules that we had become used to are completely different? Even with something like Word, facilities are suddenly put somewhere else. I will not begin to describe the new House of Lords telephone system. How are older people meant to keep up with this constant change? They are being asked to do the same thing, but the way of doing it keeps changing without their permission.

Siim Kumpas: It is a challenge. Let us be honest. I do not consider myself to be very old, but even I do not have a TikTok account, for example, which I understand is the biggest thing on the internet these days. You start losing the tempo quite early on, so it is definitely a tricky feat. We have several training programmes. We organise free training offered by, for example, our unemployment insurance fund. They focus not only on unemployed people but on people who might become unemployed because of rapid changes in technology. They already try to look ahead of the curve in that sense, even though it is not always easy.

It is about preparing for tomorrow. Even though we might not know exactly what tomorrow brings, we know that it will bring even faster changes. This is a mindset that we can definitely promote amongst people.

Q183 Baroness Morris of Yardley: You have said quite a lot about digital literacy in schools, so I might just add a bit to that question. You have just talked about the Government helping out with internet connections, but how much can you instruct schools as to what to do? How much freedom do they have? Can you say a little bit about training the teachers? Who has been responsible for that? Have the Government led that training? Are you pretty confident that the teachers have the skills to do what the nation needs in this area?

Siim Kumpas: First of all, our curriculum is unified. It is a national central curriculum, which means that it applies to all schools. It is unified in both Estonian and Russian-language schools. There are some limited exceptions to that, but most of what happens in Estonian and Russian-language schools is more or less the same. The curriculum gives our schools certain aims, goals and study outcomes which they have to reach. The way our schools reach those is up to them. In that sense, they have a clear direction as to where to go, but the way to get there is up to them. They are pretty free in their choices when it comes to choosing between different study materials, methods, et cetera. It is a mix.

When it comes to our teachers, especially with the digital literacy part, both our universities that train teachers are obliged, by contract with the Government, to insert elements of digital competences in all their training programmes, be it biology, the Estonian language or maths. That is in there.

Something else that we use, although not yet in all schools, is what we call educational technologists. They are people in the schools—it can be a full-time position or a teacher doing this part-time—who support not the pupils but other teachers and school staff in digital matters. Ideally, we would see all schools having educational technologists within their schools, but of course that is up to the schools. Again, both the universities that train teachers in Estonia offer an MA-level course on this subject. Systematically, we try to do as much as we can to make it as easy as possible for schools to at least have people to choose from who could then support and see what solutions are best for their own schools.

Baroness Morris of Yardley: Would the technologists be able to teach older teachers who have not been through these new courses, or are they just fixing the equipment and making sure that it works?

Siim Kumpas: Again, it varies from school to school. They are not classical IT guys in that sense. They do not go around fixing printers and computers. They focus on the educational part of technology, so they are absolutely there to support the teachers and the staff.

Again, when it comes to media literacy, for example, which again is somewhat similar but somewhat different, we definitely have a lot to do. As I described briefly, the compulsory course for high school students is a good start, and we have some really good study materials for that, but when we have a teacher who has never had a single course on the same subject, how do we expect them to explain what the Internet Research Agency is and what it has to do with life in Estonia? We definitely have some plans for the future when it comes to training teachers more specifically on media and information literacy. We have focused purely on digital so heavily that some of the other fields have perhaps not received the attention they deserve.

Baroness Morris of Yardley: How do you know that you are successful? Presumably, like all schools, children will take exams and tests. Do you assess digital literacy separately or as part of the subject, in the same way as you described teachers being taught how to teach the subject?

Siim Kumpas: That is a good question. We assess digital competences separately as well. I will not go over all the technical details of what it comprises, but we started doing that five or six years ago. The numbers are now around 83 per cent or 84 per cent, just to give you an overall understanding of what we are aiming for. We assess it, but again to a large extent it is self-assessment.

Our practice has shown that the schools that are savvier in digital matters grade themselves with lower grades. The ones that might not be that savvy tend not to understand what they do not know and give themselves higher scores. How you get the numbers right so that they are actually comparable is always a matter of methodology.

Q184 Lord German: You talked earlier about how the public need to understand that digital can have positives and negatives, and how people need to understand the threat.

I wonder if we could take the question slightly wider. How do you develop the understanding, beyond education itself, to civil society, businesses, trade unions, workers and people who are in the third sector? Do the government of Estonia take the lead in bringing all these people together, or is there a grass-roots movement somewhere that takes it on, promotes it and takes it forward?

Siim Kumpas: Again, I will separate digital literacy and media literacy. When it comes to digital literacy, most of the work has been done by the Government, starting from a vision and going all the way down to implementation and assessing the results. We have private sector companies, mainly from banking or telecommunications, that have run several programmes, but those are mainly for adults and are mainly meant to train their future clients to be wiser clients.

When it comes to media literacy, there has been a mix. There are some elements in place in the formal school system. There are some NGOs that work on this. Our universities work on this through teacher training as well as through their journalism curricula and their law institutes, et cetera; businesses maybe not so much.

I will step back a few steps and briefly describe how we see our biggest challenge in this. As the strategic communications team of the Government Office, one of our main goals is to build the resilience of our society to foreign information attacks. We are not talking about foreign investments or any other classical threats but information attacks. By doing that, the first pillar that we already went over is public threat level awareness. That is the key.

Moving on from there, it is about media literacy but it is also about supporting free and independent media, seeing them not just as someone to amplify our messages but actually as a crucial element of democratic society. It is not very easy for a government to support independent media; there is a conflict in the very idea.

At the same time, it is doable and necessary. I am not talking for example about the content that they put out but more about the environment that they operate in. When we look at big social media platforms and the amount of ad money that they take out of our journalism houses and editorials, it is pretty serious. In Estonia, to be very frank, we do not even know the exact number. Minimally, it is somewhere between €10 million and €20 million per year. When we look at the revenues of our journalism houses, they have similar minuses in their budgets. How do we fix that? How do we make the playing field level again? There are very many aspects to raising the resilience; media and digital literacy is just one part of it. Supporting independent media is another.

One of our team’s roles is to see this problem as a whole. By “this problem” I mean the information disorder, which is not a very good and popular term. This covers everything from fake news, which I do not like as a term, to what is happening with our journalism and with social media platforms, and how this is changing the way we act as citizens. We do not fully understand it; no one does. We do not even understand whether foreign interference in one’s elections has an effect or not, although I do not think that is relevant; when you interfere in someone else’s elections, you have already crossed a red line.

It is important to have a central body in a Government that at least tries to see this as a whole and to see the educational, security, technological and legal elements of it. One of the biggest challenges is not undermining the complexity of this phenomenon or conundrum.

Lord German: You have basically given three pillars of the work that you do and which the government body that you are associated with does.

On public awareness and media literacy, it would appear from what you have been saying that you have put all your effort into young people, training and work in schools, knowing that, as time goes by and older people pass away, you will gradually get towards the level of understanding that you wish. Have you decided whether you can intervene more generally in society to get those three pillars in place? The key one is public awareness. How can you do that with people who are less digitally literate because they are older? Are you just waiting for the old people to pass away?

Siim Kumpas: No, not at all. When it comes to media literacy and digital literacy, the focus has indeed been heavily on the youth. Our resources are limited, as are everybody’s, and we just need to prioritise. This has been our top priority. This does not mean that we forget about people the day they leave the school system. As I already mentioned, there are several training programmes for adults who are unemployed and who wish to do something else in their lives or to become more digitally literate. That is just one pillar.

The overall awareness-raising work that we do is not at all directed only at young people. There is the work that our journalists do and our co‑operation with them. One of the luxuries Estonia has is that our journalists are of very high quality. We rank highly in different press freedom indexes and other rankings. This means among other things, and coming back to Russian interference and information operations, that very rarely do its hostile narratives and twisted facts and stories make it from its closed and toxic information environment to ours. This is something that, again, gives us this extra layer of trust.

Whenever something happens in the information sphere, be it an attempt to interfere or the discovery of a bunch of fake accounts online that are associated with Russia, it is quite heavily discussed in public; this is no longer a niche topic in Estonia. The work of building awareness definitely covers the whole of society, not just young people.

Lord Black of Brentwood: You mentioned the importance of the independent news media in the media literacy mix. Of course, the problem that all independent news media right across Europe are facing is the dominance of the platforms of Google and Facebook, and their impact on the advertising market. I just wondered whether there is anything the Government of Estonia have done to try to tackle that in a way that supported the quality journalism that you are talking about and which Estonia is rightly well known for.

Siim Kumpas: Again, that is a very good question. I very much agree that what is happening around us is that the relationship between social media platforms and journalists is becoming worse, for two reasons: first, they are taking away the ad money; secondly, they are taking away eyeballs, which means that the newspapers need to compete with the platforms not just for the money but for attention. They need to make their content more like social media and more viral, and that is something that can undermine the notion of high‑quality media and can lead to biased media.

Have the Estonian Government done anything to remedy this? Yes and no. We have different funding grants for journalists, for journalist students, et cetera, but this is a drop in the ocean. It needs to be looked at from a much wider point of view, and this is an area where we are just too small as a country to do anything about alone. Let us be honest: Facebook has over 2 billion users and we have 1.3 million people, a difference of 1,500 times, more or less.

We do not have the leverage to make them do anything they do not want to do; this is a fact we have to accept. We need good partners and other countries that understand that what is happening is doing democracy as a whole no good. We have not figured this out yet. I understand that the OECD is working on this. The European Union has its own ideas when it comes to digital services and regulating them, but this is an area that definitely requires co-operation between a lot of countries in the world.

Q185 The Chair: Mr Kumpas, you talked about the issue of scale, and I will come on to that in a second. Would you agree that, because Estonia has seen this as an existential threat since 1991, or shortly afterwards, you have a significant advantage over us in that we have not convinced our populace that this is an existential threat? It tends to be treated more as a “nice to have”. It seems that the position with your public is that they absolutely understand that it is no small thing. This is about the survival of Estonia. Is that an overstatement or is that fair?

Siim Kumpas: It is fair, especially when it comes to what our neighbour is doing. I cannot imagine any serious politician or thought leader in Estonia questioning some of the things we have done in this field to protect ourselves. That is basically unimaginable.

Of course, when it comes to our own political activists or third countries that are also hostile, our awareness is not as high. We have this very specific awareness when it comes to threats posed by Russia. I am not sure we are very ready for other authoritative Governments who have recently been appearing on the radar more and more. This is something that we definitely need to work on and where we need to get both public buy-in and policymaker and politician buy-in.

Q186 The Chair: Speaking for myself, and probably the Committee, this session has been a tour de force. I have one final question. What is the most effective thing the Estonian Government have done to create active digital citizens? Given the disparity of scale, what can the UK learn from that?

Siim Kumpas: That is a good question. Honestly, the only way to do it is to go fully digital. It is very hard to make people appreciate competences if they have no need for them. If the society we are talking about is very lowly digitalised, it is very hard to get it to where we have. The easiest way to do it, honestly, is just to invest heavily in digitalising the society. This starts off like a good snowball that starts building on its own speed and strength. It starts off with little things, and in the end it is about convenience, security in the cyber domain and awareness, and all that adds up. My number one recommendation would be to go as digital as fast as possible.

The Chair: Can I just add one small question? From what I know, you started off with a big advantage in having a leader in the 1990s who understood this world and had no doubts about it. What interests me is that, despite the political swings and roundabouts you have been through, you have managed to maintain this focus. No one has dropped the ball ever since that early leadership. Is that fair to say?

Siim Kumpas: Yes, to a large extent. Of course, when you start off very low, it is easy to make huge gains very quickly. When you come to a certain point, progress becomes more and more difficult. We are seeing this in Estonia as well. It is not as easy as it used to be to make the huge leaps that we made 15 or 20 years ago. We are becoming riper as a society, both physically and digitally.

We need new ideas on how to build something new. We already have the digital infrastructure and so many things in place, but what will tomorrow look like? How do we take on questions relating to AI and robots, et cetera, and the way in which they will change our workforce and our industries? There is definitely room for improvement in Estonia when it comes to digital matters, because tomorrow is super-exciting and we do not know what it will look like.

The Chair: On behalf of the whole Committee, thank you very much indeed.