Selver started providing the ID card issuing service in late January, but the Information System Authority (RIA) made an order to cease doing so soon afterwards, once it had become apparent that the necessary permits to do so were not in place. The issue was not one that Selver itself was reportedly responsible for.

The issue affects over 1,700 people, and over 1,100 affected ID cards had already been issued and collected, when the problem became fully apparent on Wednesday.

The issue also affects Estonian residence permits and digital certification, while the PPA has moved to issue replacement cards and documentation from Friday.

Speaking to ERR's radio news Thursday, Ilmar Toom, RIA director said: "The field of trust service is very strictly regulated. There are requirements that must be met in order to be able to provide this service."

"The existing operating license did not cover dispensing from stores. If this operating license is obtained, this activity can be continued," he continued, adding that while the option to pick up ID cards from a store is a nice one, it is not viable right now following the Police and Board Guard Board (PPA) order.

"These documents must be replaced because the e-signature certificate was issued without following the corresponding procedure. The law stipulates that they must be invalidated. Technologically, we have no objections," he went on.

All three organizations analyzing what happened

In the meantime, neither RIA, the PPA, nor SK ID Solutions AS, , the company which certifies new ID cards, have come to consensus on where culpability lies, but are analyzing the situation.

SK ID reportedly told RIA about the violation on February 2, less than a week after Selver outlets had been able to provide the service.

This was not halted until Wednesday, however, while certification of already-issued cards will be declared invalid Friday.

Ilmar Toom added that the three authorities confer regularly, while RIA supports the idea in principle, the proper procedures must be followed.

SK ID Solutions board chair Kalev Pihl could only comment to the extent that the PPA injunction, at the RIA behest, was issued at short notice, but the company would be adhering to it.

"Certainly there are things that have not been done, because otherwise there will be no prescription, but too little time has passed to talk about it in more detail," Pihl said.

SK ID notified RIA in early February

Pihl said while communication with RIA started earlier, ie. when SK ID itself notified the authority, SK ID only discovered Wednesday that it had to revoke certificates issue with the ID cards and had to halt issuing any more.

"The RIA is our supervisory body and we informed them of our actions, that we have experienced procedural shortcomings, and that is why we are at the point we are at as of today," Pihl continued.

He referred to one other step in the narrative, namely that SK ID had read via the media that Selver would be issuing ID cards, residence permits and digital ID, after which the company then approached RIA with its concerns.

"I would leave further commenting on all the major thoughts and conclusions to PPA and RIA, who have pulled things from the opposing ends, as it were," Pihl continued, noting that from Friday, certification of documents issued from Selver must be revoked (in addition to the halt called on issuing new cards, in effect already).

Margit Ratnik, head of PPA's identity and status office, filled in the saga from her authority's side, noting that the PPA started issuing ID cards, and also Estonian passports, via Selver branches, followed by the RIA inquiry and notification that a supervisory procedure had begun against the PPA on that basis, prompting the authority to halt the issuing of cards and digital certification.

Given this meant documents had been issued without a valid license to do so, and given the preparation process had lasted over a year even as the public could only start using the service from late January, the PPA will investigate how this had gone on, involving all three parties.

The PPA, RIA and SK ID all bear responsibility, she added.

"The documents began to be issued on January 27. This date was known to all parties," Ratnik said.

PPA spokesperson: Issues should have been clear 'much earlier'

Nonetheless, the lack of the required permit should have emerged "very forcefully, and much earlier," Ratnik went on.

"In fact, by the conclusion of the contracts, and at the very latest before the start of the establishment of the service (ie. January 27)," she went on.

Those issued with ID or residency permit cards from Selver branches must exchange them at a PPA station on Friday, though this will come at no extra charge, Ratink added, while applicants will also be reimbursed for the service provision fees they paid to Selver, though this will cost the state no small amount, Ratnik went on.

In Tallinn, new ID cards will be issued on Friday to replace the Selver-issued ones at the PPA stations on Pinna street and on Tammsaare street, while those residing outside the capital will be able to receive the document from the PPA station most convenient to them, Ratnik said.

Selver is to continue issuing Estonian passports, a service unaffected by the RIA order.

Once the independent auditor and RIA give the go ahead, Selver will be able to start issuing ID cards again, while all transactions and all digital signatures made so far with the recalled cards will remain valid.

RIA stated that document security was not compromised.

--

Follow ERR News on Facebook and Twitter and never miss an update!