Western-backed biometrics programs for the developing world could put data in the wrong hands.
By Kevin P. Donovan and Carly Nyst
Posted Friday, May 17, 2013, at 11:51 AM
An Indian villager looks at an iris scanner for a pilot project of the Unique Identification Authority of India, or UIDAI, in the village of Chellur, northwest of Bangalore, on April 22, 2010.
Photo by Dibyangshu Sarkar/AFP/Getty Images
Move over, mobile phones. There’s a new technological fix for poverty: biometric identification. Speaking at the World Bank on April 24, Nandan Nilekani, director of India’s universal identification scheme, promised that the project will be “transformational.” It “uses the most sophisticated technology … to solve the most basic of development challenges.” The massive ambition, known as Aadhaar, aims to capture fingerprints, photographs, and iris scans of 1.2 billion residents, with the assumption that a national identification program will be a key ingredient to “empower poor and underprivileged residents.” The World Bank’s president, Jim Yong Kim, effusively summed up the promise as “just stunning.”
Although few can match Nilekani’s grand scale, Aadhaar is but one example of the development sector’s growing fascination with technologies for registering, identifying, and monitoring citizens. Systems that would be controversial—if not outright rejected—in the West because of the threat they pose to civil liberties are being implemented in many developing countries, often with the support of Western donors. The twin goals of development and security are being used to justify a bewildering array of initiatives, including British-funded biometric voting technology in Sierra Leone, U.N. surveillance drones in the Democratic Republic of the Congo, and biometric border controls in Ghana supported by the World Bank.
This vigorous adoption of technologies for collecting, processing, tracking, profiling, and managing personal data—in short, surveillance technologies—risks centralizing an increasing amount of power in the hands of government authorities, often in places where democratic safeguards and civil society watchdogs are limited. While these initiatives may be justified in certain cases, rarely are they subject to a rigorous assessment of their effects on civil liberties or political dissent. On the contrary, they often seek to exploit the lack of scrutiny: Nilekani recommended in another recent speech that biometric proponents work “quickly and quietly” before opposition can form. The sensitivity of the information gathered in aid programs is not lost on intelligence agencies: Pulitzer Prize-winning journalist Mark Mazzetti recently revealed that the Pentagon funded a food aid program in Somalia for the express purpose of gathering details on the local population. Even legitimate aid programs now maintain massive databases of personal information, from household names and locations to biometric information.
Humanitarian organizations, development funders, and governments have a responsibility to critically assess these new forms of surveillance, consult widely, and implement safeguards such as data protection, judicial oversight, and the highest levels of security. In much of the world, these sorts of precautions are sorely lacking: For example, despite the success of information technology in Africa, only 10 countries on the continent have some form of data protection law on the books (and even those rarely have the capacity or will to enforce them).
Kenya is a good example of how these programs can go wrong. In the country’s recent election, a costly biometric voting scheme flopped, adding widespread uncertainty to an already fragile situation. The problems were manifold, from biometric scanners that couldn’t recognize thumbprints to batteries that failed and servers that crashed. As journalist Michela Wrong put it, “almost none of it worked.” With limited resources, why support expensive and often ineffective technologies like biometric voting when traditional systems often suffice?
While biometrics could help clean up electoral rolls, they may very well serve to obfuscate the electoral process, as information is passed through proprietary applications and technologies, closed to public scrutiny and audit.
But the worries in Kenya extend beyond technological failure. Like many low-income countries, Kenya has historically lacked a robust program of birth registration, making public health work notoriously difficult. It also stymies the provision of education services and cash transfers to vulnerable populations. To rectify this, the Kenyan state has sought to enroll all adults in a biometric national identification scheme that aims to interoperate with various other databases, including the tax authority, financial institutions, and social security programs. According to the director of this Integrated Population Registration System, George Anyango, the government now has “the 360 degree view of any citizen above the age of 18 years.” The Orwellian language is particularly worrisome given Kenya’s lack of data protection requirements and history of political factionalism, including the ethnic violence in the aftermath of the 2007 election that resulted in the death of more than 1,000 Kenyans.
The Aadhaar project in India—a country with a history of ethnic unrest and social segregation, widespread political and bureaucratic corruption, and with no effective legislative protection of privacy—should raise similar, magnified fears. Furthermore, it’s doubtful the program could help bring about the social equality it promises. Proponents of these state registration schemes argue that a lack of ID is a key reason why the poor remain marginalized, but they risk misdiagnosing the symptom for the cause. The poor are marginalized not simply because they lack an ID, but rather because of a complex history of discriminatory political, economic, and social structures. In some cases a biometric identity scheme may alter those, but only if coupled with broader, more difficult reforms.
One of Aadhaar’s biggest promises is the opportunity to open bank accounts (which require identification). Yet, poor, marginalized Indians, even with an ID, find formal banks to be unfriendly and difficult to join. For example, the anthropologist Ursula Rao found that the homeless in India—even after registering for Aadhaar—were blocked from banking, most frequently for lack of proper addresses, but more fundamentally because, as she notes, biometric identification “cannot establish trust, teach the logic of banking, or provide incentives for investing in the formal economy.” Bank managers remain suspicious and exclusionary, even if an identity project is inclusive. Without broader reforms—including rules for who may or may not access identity details—novel identification infrastructures will become tools of age-old discrimination.
Another, more practical drawback is that biometric technology is particularly ill-suited for individuals who have spent years in manual labor, working in tough conditions where their fingerprints wear down or they may even lose full fingers or limbs. Even with small authentication error rates—say, the 1.7 percent that recent estimates from Aadhaar suggest—the number of failures in a population the size of India’s can be enormous. Aadhaar has already enrolled 240 million people, with plans to reach all residents. You do the math.
The growth of these systems is due in part to the lack of public education and consultation, as well as the paucity of technical expertise to advise on the risks and pitfalls of surveillance technologies. But certainly the international donors and humanitarian organizations that support these initiatives have a responsibility to critically assess and build in safeguards for these technologies. Given the enormity of the challenge facing these organizations, it is perhaps easy not to prioritize issues like privacy and security of personal data, but the same arguments were once made against gender considerations and environmental protections in development. Aid programs that involve databases of personal information—especially of those most vulnerable and marginalized—must adopt stringent policies and practices relating to the collection, use, and sharing of that data. Best practices should include privacy impact assessments and consider the scope for “privacy by design” methodologies.
As the rhetoric around Aadhaar makes clear, the promise of a quick technical solution to intractable social problems is alive and well. However, it is time to recognize that human development involves the protection of civil liberties and individual freedoms, and not blindly rush into the creation of surveillance states in the name of development and poverty alleviation. Donors and aid organizations need to remember that the other 5 billion deserve privacy, too.
