State named Diia. How the Ministry of Digital Transformation develops Ukraine's digital governance

The Ministry of Digital Transformation is one of the youngest among government institutions. Established in 2019, it is responsible for the development and implementation of state policy in the field of digitalisation, transformation of administrative services, and development of the IT industry. Since its inception, the ministry has been headed by Mykhailo Fedorov, who retained his position after the resignation of Oleksii Honcharuk's government in 2020.

In this article, Svidomi analyses the ministry's formation, projects, and activities.

The Ministry of Digital Transformation emerged in 2019 following the reorganisation of the State Agency for E-Governance. The Agency was subordinated to the Cabinet of Ministers and dealt with e-governance issues, the development of digital administration of public services, and the functioning of the National Register of Electronic Information Resources. The Agency was limited in its powers and could only implement the government's state strategy in digital administration. 

The new ministry received more autonomy — it could choose how and where to move digitalisation in the public service administration. The Ministry was also empowered to shape and implement state policy in e-commerce and business, electronic and administrative services, trust services and electronic identification. 

The creation of the ministry is the result of one of Volodymyr Zelenskyy's election campaign promises. The concept was called "State in a Smartphone". Services were to become accessible and understandable, and digitalisation was to unburden administrative centres. The idea was also to merge several service delivery departments into one institution. 

Volodymyr Zelenskyy communicated the concept even after he was elected president. "This progressive initiative aims to change the interaction between the state and people. The state should become a service. After all, this is what we are working for," he explained. 

Since the Ministry of Digital Transformation is a new institution, its team is relatively small. As of May 2021, the Ministry employed 209 people. For comparison, in 2023, the Ministry of Justice appointed 434 new employees to positions in its structure. The management team is also small. The head of the Ministry, Mykhailo Fedorov, has only five deputies, while Education Minister Oksen Lisovyi has nine. 

Liliia Oleksiuk, head of the All-Ukrainian Association of Information Security and Information Technologies, also considers the need for a team in line with the tasks a problem. In her words, 53 tasks are assigned to only 334 employees under the Ministry's regulations. 

"As far as I know, the Ministry of Digital Transformation still does not have one common room for employees — some work in the Government building, some work at the place of registration of the body, but the pandemic made its adjustments, and many worked from home.  In such circumstances, ensuring the normal, uninterrupted implementation of the planned projects is already a huge achievement," Lilia Oleksiuk says in a comment to Svidomi.

However, in early 2020, the team introduced the Diia mobile phone app. At the launch of the app, Fedorov said that Ukraine would be "the second country in the world to launch a digital passport". Former Minister Oleksii Honcharuk also believed that digitalising administrative services would be another tool to fight corruption in this sector.

After Honcharuk's dismissal in March 2020, the Ministry of Digital Transformation remained in Denys Shmyhal's new Cabinet. Parliament reappointed Mykhailo Fedorov as Minister of Digital Transformation. The new head of government also promoted the head of the Ministry of Digital Transformation to the status of deputy prime minister. After the changes, the ministry managed to survive without reforms and mergers with other ministries and continued its work on projects to introduce electronic circulation of documents and disseminate Diia.

In 2021, the ministry began implementing a programme to modernise its Administrative Service Centres. Their creation was envisaged by the law on administrative services back in 2013. According to the ministry, the Сentres for Administrative Services (ASCs ) were supposed to become the network for administrative services, consulting on online services (including the Diia portal), business, utilities, and free legal aid. The ministry describes them as a "one-stop shop" with a range of services for citizens." After the full-scale invasion, the ASCs also began to provide administrative services to people displaced by the war.

As of February 2022, the number of such centres in Ukraine reached about three thousand. This includes 1,027 ASCs, 124 territorial units and 28 mobile centres. 

The Ministry has set new goals by 2024: 100% of all public services for citizens and businesses online; provide 95% of transport infrastructure, settlements and their social facilities with access to high-speed Internet; provide digital skills training for 6 million Ukrainians; and increase the share of IT in the country's GDP to 10%. In 2022, during Russia's full-scale invasion of Ukraine, the share of IT in Ukraine's service exports was over 12% but began to fall in April 2023. Researchers believe the reason is the global decline in the IT services market and the war in Ukraine. 

Liliia Oleksiuk has been more optimistic about the ministry's work since its foundation. She believes that the ministry's team has made fundamental changes in the digitalisation of public services, despite Mykhailo Fedorov's team not always ready for civil service and bureaucracy. 

During its work, the Ministry has launched many transformation projects, both independently and with other ministries. These include the New Ukrainian School with the Ministry of Education and Science, Oberih for the Ministry of Defence and Covid certificates for the Ministry of Health.

However, the most essential development Mykhailo Fedorov's team is working on is Diia. It is a comprehensive project that aims to transform the delivery of public services. 

Diia started as an app for mobile devices, containing digital equivalents of documents such as driving licences and car registration certificates. In the spring of 2020, the app added digital versions of biometric documents such as ID cards and international passports. Older documents were not digitised.

In October 2020, during the presentation of the Diia summit, the Ministry of Digital Transformation showed a new update of Diia, expanding not only the digital versions of documents but also the services offered through the web portal. The application now has an identification number (Registration number of the taxpayer's account card). The web portal added eMaliatko (eBaby), a set of services for parents provided at the birth of a child (obtaining a birth certificate, assigning a tax identification number to a child, applying for financial support from the state, etc.). In December 2023, Prime Minister Denis Shmygal announced that there were 70 administrative services available on the "Diia" portal.

The Ministry also introduced an option to register a limited liability company online. At the same time, it simplified submitting documents to the tax authorities and signing documents with an electronic signature like a QES (Qualified Electronic Signature). Electronic business registration, albeit of the LLC type, allowed the start of digitisation of services for legal entities. For example, registering a sole proprietorship was automatically available on the web portal in May 2021.

At the all-Ukrainian Forum, Ukraine 30. Digitalisation in 2021, Diia.Signature was presented. It is a modified form of a qualified electronic signature available in the Diia app, which allows you to e-sign documents. The idea behind Diia.Signature is that the owner does not need a file with a signature key; just activate the function in the app and pass face verification. The Ministry of Digital Transformation reports that the QES key is stored in two parts for greater security: one part remains in the user's smartphone after activation, and the other is stored in a particular module of the Diia portal.  

However, Ukrainian cyber experts and researchers have questions about the security of the Diia app, as Diia collects, stores and processes personal data. 

Mykhailo Fedorov said in an interview with Dom TV channel in 2021 that "'Diia' is designed in such a way that it does not collect information about you. When you install it, the app only displays information already in the registers for a long time." 

In 2024, the Ministry released the code for the Diia app to the public. The Ministry claims that 'Ukrainians' data is safe because the code cannot access registries'. Ukrainian cybersecurity experts have been calling for the code to be made public since the app's release and for an independent audit of the app's security, which has not yet been made public. The Ministry has also failed to publish the app's technical documentation.

During the existence of Diia, especially the app version, there have been problems with attempts to hack the database and technical failures in the app. For example, in 2021, the provider DeNovo, which hosts the Diia portal and app, failed. The Ministry of Digital Transformation immediately reported this and the resumption of work publicly. 

In January 2022, the Diia app and portal stopped working due to a hacker attack. Later, the personal data of two million Ukrainians, allegedly stored by the Diia service, was offered for sale for $15,000 on forums linked to hackers. The ministry said the data was "compiled from many sources merged before 2019". The Cyber Police also denied hacking the Diia database.  

IT specialist and blogger Volodymyr Rozhkov investigated the data leak for the DOU platform and concluded that the leaked data was genuine, and "theoretically, every hundredth user of Diia will find their ID number (individual device number, located in the 'Menu' item in the app - ed.) in the database". 

Attacks on Diia continued after the full-scale invasion. Minister Mykhailo Fedorov reported that after the full-scale invasion on February 24 and until the end of 2022, the ministry recorded over two thousand attacks on Diia. 

Despite this, Diia is the ministry's most successful project. As of November 2023, almost 20 million Ukrainians have downloaded the Diia app to their devices.    

Another important project of the Ministry of Digital Transformation is Diia.City. The ministry describes it as a space combining several tools for developing and scaling IT companies. 

"Diia.City is a special legal regime for IT companies that have registered with the programme. They receive the status of residents. The mode was introduced to "stimulate the development of the digital economy in Ukraine by creating conditions for innovative business, building digital infrastructure and attracting investment". 

To obtain the status of resident under the Diia.City regime, a company must meet the following requirements: specialists' salaries of at least €1,200, 9 or more IT specialists, and 90% of income from IT activities. Residents receive tax benefits and 22% of the unified social tax. The main principle is the gig contract (a civil law contract for providing services to a Diia.City resident — ed.). The acquisition and loss of status is both voluntary and compulsory — for violations and non-compliance. The problem is the cancellation of the status on appeal, as the loss of status occurs when the first instance court decides and is not renewed during the appeal. However, this rule was suspended after the full-scale invasion began, and companies no longer lose their resident status even if they do not meet the requirements. 

This legal regime was introduced to reduce labour relations between IT companies such as LLCs and individual entrepreneurs in the Ukrainian IT market. After all, only an individual can be hired for a gig contract. Of course, the law allows citizens to work under an employment contract and have a sole proprietorship at the same time. 

According to the DOU platform, only four of Ukraine's top 50 IT companies were ready to apply for residency in Diia.City in 2021. But after the launch in early 2022, 44 companies applied at once. As of the end of 2023, 751 companies were the Diia.City residents. The registry is open for applications, and the government has expanded the types of activities subject to Diia.City requirements. These include data centres and manufacturers of components and boards, computers and peripherals, and communications equipment.  

It is not yet possible to assess the effectiveness of the Diia.City regulatory regime, as it was launched before the full-scale invasion. Many companies registered for the scheme after February 24, 2022. 

According to the decision of the Cabinet of Ministers of January 27, 2023, Diia.City residents are defined as "critical for the functioning of the economy and ensuring the livelihood of the population during a special period" and have the right to reserve their employees from mobilisation. This is the main reason why companies have become residents of Diia.City.

Diia.City's legal regime is also suitable for companies preparing to sell their business or for start-ups in active fundraising. It is easier to increase headcount or staff with employees than with service providers such as sole traders.  

E-residency is a service that allows foreigners to register and conduct business in the jurisdiction of Ukraine without being physically present in the country. This programme is similar in its parameters and benefits to the one in Estonia, launched in 2014. 

An e-resident in Estonia can register a business in the country, open accounts in Estonian banks for their business, and connect to specific payment systems not available in other countries (such as PayPal or Payoneer). However, the main benefits of e-residency are access to the EU market, where the e-resident operates as a European legal entity and the low taxes that Estonia offers its residents. 

The programme has been quite successful, with over one hundred thousand people registered as e-residents in Estonia by early 2023. The Estonian government reported that the programme generated more than €51 million in direct revenues for the state budget in 2022. In 2021, Lithuania and Portugal also announced plans to launch similar e-residency programmes in their countries. 

In 2023, the parliament amended the tax code to introduce e-residency provisions in Ukraine. The programme is similar to the Estonian one: foreigners can register in Ukraine as e-residents, open their own businesses and bank accounts here, and receive a Qualified Electronic Signature (QES) to conduct financial and tax transactions in Ukraine. E-residents will receive a 5% income tax reduction. 

The Ukrainian programme differs from the Estonian one in two ways: the e-resident status is granted indefinitely (in Estonia for five years), and the registration procedure is free (in Estonia, it costs EUR 100). 

As of the end of 2023, the programme is in closed beta testing. First Deputy Head of the Ministry of Digital Transformation Oleksandr Borniakov told Forbes that the ministry expects "the readiness of other project participants to perform their functions under the project." In his words, Ukrainian banks must still adapt their technical solutions to the e-residency programme. The launch of the programme has been postponed to 2024.

Digitalisation is an inevitable process linked to global trends in the services market. The state, the monopolist in Ukraine, had to adapt to the needs of the market and citizens. The presidential candidate Volodymyr Zelenskyy's team understood this, and now the Ministry of Digital Transformation understands it, too. 

As the Ministry's products become public, concerns arise about their quality, particularly regarding the potential release of incomplete versions due to the emphasis on rapid development. This is confirmed by the vulnerabilities found in the Diia product. It is important to note that this problem directly impacts public interests, privacy and personal data protection.

Cybersecurity experts led by Kostiantyn Korsun, CEO and co-founder of Berezha Security LLC, identify the following main problems with Diia: personal data and the inability to track the storage of sensitive data such as individual document numbers and, in general, full user names. Clarification is needed on data encryption, account deletion options, and the absence of information about external security audits for Diia, especially post-infrastructure attacks

It has also emerged that Estonia has abandoned the architecture of the Diia app to develop the Estonian e-government app mRiik. Greta Preast, Head of the Estonian Information System Authority, told ERR public media that Estonia is developing a "new architectural language" for its app, utterly different from the pilot project created in partnership with the Ministry of Digital Transformation. 

The Ministry of Digital Transformation is growing, and the budget for its projects in 2024 will be four times higher than in 2023, namely about UAH 2.5 billion (in 2023, more than UAH 600 million was allocated to the ministry — ed.). 

In November 2023, former Deputy Defence Minister Vitalii Deineha accused the former head of the State Service for Special Communication and Information Protection, Yurii Shchyhol, and the Ministry of Digital Transformation of embezzling funds from the Army of Drones project to supply unmanned aerial vehicles to the military. He said that with the start of the full-scale invasion, the State Special Communications Service increased its influence and became the "wallet and hands of the Ministry of Digital Transformation" in many matters, including the revenues for the Army of Drones. 

Deineha called for an audit of the project, and there is currently no information about an open audit of the Army of Drones. 

Minister Mykhailo Fedorov did not comment on Vitalii Deineha's words. The National Anti-Corruption Bureau sent a notice of suspicion to the State Special Communications Service management in November 2023.  Yurii Shchyhol was also released on UAH 25 million bail in November.

Lilia Oleksiuk, head of the All-Ukrainian Association of Information Security and Information Technology, believes that Fedorov's team still has work to do — "comprehensive work on the development of the digital economy". 

Data protection and the balance of open data should also be a priority. "We need to speed up the implementation of EU laws that define data protection requirements (GDPR and NIS2). This is not only an issue for the Ministry of Digital Transformation, but this is the main issue — no other executive body is responsible for the protection of personal data, so even in this difficult time, we have to create this body, which will still work closely with the Ministry of Digital Transformation given its tasks," says Liliia Oleksiuk.

The Ministry of Digital Transformation should also continue to work on e-democracy, says Oleksiuk. She explains that "we still need to move towards e-voting (not e-election!). And this is a fundamental difference and sometimes manipulation) and solve this problem". We must remember the secrecy of the vote and work to ensure it is in this form.

"They have generally fulfilled their work plan for 2023," Liliia Oleksiuk sums up the work of the Ministry of Digital Transformation.