“A Digital Road to Hell”: NYU School of Law Sounds Alarm on World Bank’s Digital Identity Programs

The World Bank and its partners claim that “investing in digital ID systems is paving the road to an equitable digital future.” But instead “they may well be paving a digital road to hell.”

Governments around the world are quickly but quietly designing, assembling and piloting digital identity systems, often with biometric components. They include the European Union, which itself comprises 27 member countries, the UK, Australia, Canada and dozens of countries in Africa, Asia and Latin America. The spread of these systems across the Global South is being spurred by a new development consensus that asserts that digital identification can foster inclusive and sustainable development and is a prerequisite for the realization of human rights.

As the World Bank noted in 2017, over 1.1 billion people in the world are unable to prove their identity and therefore lack access to vital services including healthcare, social protection, education and finance. Most live in Africa and Asia and more than a third of them are children. In an ostensible bid to address this problem, the World Bank launched the Identification for Development (ID4D) program in 2014 with “catalytic contributions” from the Bill & Melinda Gates Foundation as well as the governments of the UK, France, Norway and the Omidyar Network.

A Dangerous New Road

The program provides loans to help countries in the Global South “realize the transformational potential of digital identity,” and has been rolled out in dozens of countries, mainly in Africa but also in Asia and Latin America. The program is wrapped up in cosy buzz words such as “digital development” and “financial inclusion”, but it has led to the promotion of a dangerous new approach to digital identity systems. That’s the damning conclusion of a new 100-page study by the NYU School of Law’s Center for Human Rights and Global Justice (CHRGJ), titled Paving the Digital Road to Hell: A Primer on the Role of the World Bank and Global Networks in Promoting Digital ID:

Through the embrace of digital technologies, the World Bank and a broader global
network of actors has been promoting a new paradigm for ID systems that prioritizes what
we refer to as ‘economic identity.’ These systems focus on fueling digital transactions and
transforming individuals into traceable data. They often ignore the ability of identification
systems to recognize not only that an individual is unique, but that they have a legal status
with associated rights.

Still, proponents have cloaked this new paradigm in the language of human rights and inclusion, arguing that such systems will help to achieve multiple Sustainable Development Goals. Like physical roads, national digital identification systems with biometric components (digital ID systems) are presented as the public infrastructure
of the digital future…

The problem, notes the paper, is that this emerging infrastructure has “been linked to severe and large-scale human rights violations in a range of countries around the world, affecting social, civil, and political rights.” What’s more, the benefits remain “ill-defined and poorly documented”:

Those who stand to benefit the most may not be those “left behind,” but a small group of companies and security-minded governments. The World Bank and the network argue that investing in digital ID systems is paving the road to an equitable digital future. But, despite undoubted good intentions on the part of some, they may well be paving a digital road to hell.

Three Core Functions of Digital ID

The report identifies three core functions of digital identity: identification (“the process of establishing the identity of an individual”); authentication (“the process of asserting an identity previously established during identification”) and lastly, authorization (“the process of determining which actions may be performed or services accessed on the basis of asserted and authenticated identity”).

The report’s authors are well positioned to comment on digital identity programs having participated in global policy discussions around digital ID, including in public consultations and events with the World Bank and its ID4D Initiative as well as with other international organizations, governments, foundations, and private technology vendors. The project team members have jointly organized workshops with civil society organizations (CSOs) to discuss the impact of digital ID systems on human rights across the African continent. They have also taught on the subject in law school courses as well as partnered with national human rights organizations to research specific digital ID systems.

Digital identity programs have the potential to impact a cross-section of basic human rights including the right to food, the right to health, the right to privacy and data protection, the right to equal treatment and protection from discrimination, the right to dignity, the right to free expression and association, the right to education, the right to freedom of movement and the right to housing. Based on their research, the CHRGJ’s project team lists a litany of ways in which digital ID systems can infringe on basic human rights:

One thing is clear about digital ID systems: they can lead to serious human rights
problems and are prone to implementation failure. Even those promoting the identification for development agenda acknowledge these significant risks. However, the gathering of evidence and monitoring of human rights impacts remains sorely lacking. Documenting these impacts has often fallen to activists, journalists, and researchers—including our own project.

In India, the significant impacts of Aadhaar on people living in poverty only became
known through the efforts of scholars, journalists, and civil society organizations. This
patchwork of evidence has shown that digital ID systems can lead to a wide range of urgent human rights issues, including but not limited to: the violation of the right to nationality; limiting access to health care, food, and social security; a multitude of concerns about privacy and data protection, surveillance, and cybersecurity; and fundamental changes to models of democracy, participation, and citizen-state relationships. The human rights consequences can be severe and irreversible. In India, for instance, exclusion from the Aadhaar system has resulted in numerous starvation deaths and countless other examples of deprivation, exclusion, and harm.

Some of these negative impacts are not necessarily linked to the digital aspects of
such systems, but instead are manifestations of underlying dynamics of social exclusion,
economic inequality, and marginalization. Any form of identification system has the
potential to be used in beneficial and harmful ways. Digitalized identification systems may
alter or augment these effects and can also reverse hard-won progress on human rights.
Still other negative impacts appear to result directly from the introduction of new digital
technologies and new forms of ID system design and implementation. This includes the use of digitized biometrics, as well as the concentration or centralization of data to be used in platforms for public and private use. At the most basic level, for instance, the widespread use of biometrics creates new dependencies on Information and Communications Technology (ICT) and electrical infrastructures, which may often be lacking.

Many new or upgraded digital systems are also designed in ways that encourage function creep, as they are intended to be used for multiple purposes that are unforeseen when the system is first designed. This means that harm can quickly spread and intensify, as digital ID systems become insurmountable barriers to a wide range of services and rights.

We saw a perfect example of this in action a couple of weeks ago when local authorities in Central China used the country’s COVID-19 health app to prevent account holders from seeking access to funds that had been frozen by their banks. According to Asia Times, more than 400,000 depositors of six rural banks in Henan Province have been unable to withdraw their money since April. Yet when some of those depositors tried to travel to the banks’ headquarters on Monday 12 to take part in protests, they suddenly found that the health code on their app had turned red, making them ineligible for travel.

As I warn in my book, Scanned: Why Vaccine Passports and Digital Identity Will Mean the End of Privacy and Personal Freedom, once vaccine passport and digital identity systems are established, mission creep is all but guaranteed:

One of the companies involved in the development of the UK’s COVID-19 vaccine passport, the US IT firm Entrust, said that the vaccine passport could also be “redeployed” as a nation ID card. This is despite the fact that a previous digital ID card scheme was scrapped in 2011 following a public outcry against the intrusion and potential for human rights violations it would entail.

In a blog written shortly before Entrust was awarded a £250,000 contract in May 2021 to provide the cloud software for the UK’s vaccine certification, the company’s product marketing manager Jenn Markey noted that:

Vaccine credentials can become part of the infrastructure of the new normal… Why not redeploy this effort into a national citizen ID program that can be used for multiple purposes, including the secure delivery of government services, secure cross-border travel and documentation of vaccination?

Since the publication of Scanned, in mid-March, the UK government has unveiled a plan for a national digital identity scheme, which will include some of the features proposed by Entrust.

The Global ID Network

The World Bank is, of course, just one of many organizations promoting digital identity as a development tool. But it has played a crucial role by “manufacturing consensus in the newly framed field of ‘identification for development” as well as serving as a conduit for financing the projects. As the report points out, it has carved out a niche for itself as a central node in what CHRGI describes as an emerging “network” of global actors promoting a new paradigm for digital ID systems.

The network includes donor governments such as the United Kingdom, the United States, Germany, Australia, Israel and France; global foundations like the Bill & Melinda Gates Foundation (BMGF) and Omidyar Network; governments whose digital ID systems have been promoted as success stories, such as Estonia, India, Peru, and Pakistan; UN agencies; regional development banks, including the Asian Development Bank and the Inter-American Development Bank; private biometrics corporations such as Idemia, Thales, and Gemalto; card companies like MasterCard; new networks such as the Global System for Mobile Communications Association (GSMA) and ID4Africa; and other global organizations.

All of these actors are guided by different interests and hold different perspectives on how best to implement digital ID systems. For example, new digital initiatives have served as “lucrative sites for international firms’ profits, and also, notoriously, for the extraction of rents by local decision-makers.” Local governments on the receiving end of ID4D funds also get to build and reap the benefits of a much more efficient system of population control. The report notes that a key guiding motivation is often national security and counter-terrorism, “as embodied by 2017 UN Security Council Resolution 2396, which called on Member States to collect biometric data to identify terrorists.”

For donor governments in the North such as France, Germany and the UK, foundational digital identity programs in Africa offer the possibility of more effectively curbing and controling inward migration and bolstering security efforts while also opening new markets for corporate constituents, including biometrics companies. Indeed, as the report notes, “national embassies have played a role in helping to secure contracts for biometrics companies.”

An “Economic” or “Transactional” Approach to Identity

The ID4D network insists that digital identity is helping to improve lives in developing and emerging economies, but such claims seem to be based on flimsy evidence. They include a regularly cited assertion that the “Aadhaar unique identification system in India generated over $11 billion dollars in potential savings.” According to “knowledgeable observers” consulted by CHRGJ, serious problems exist not only with the “specific methodologies used by the Bank, but also the persistent lack of investment in quality impact evaluations, particularly for multisectoral work, and the lack of robust cost-benefit analyses.”

An even more serious problem is the World Bank and its partners’ dogged insistence on an “economic” or “transactional” approach to identity. The goal, according to CHRGJ, is to achieve a “collective paradigmatic shift” by pouring investments into new forms of systems at the expense of more traditional approaches such as civil registration and vital statistics (CRVS), which have been the preferred way of providing rights-based legal identity:

“Instead of providing a birth certificate, these new systems will help to create “digital public infrastructure” as part of a “digital stack” to “enable paperless, cashless, remote, and data-empowered transactions”…

These systems seem attractive because the question of who is granted citizenship and accompanying rights is made downstream from the identification system. This differs from birth registration, where according to human rights frameworks, nationality should be determined as close to birth as possible. The Bank, however, has a long and complicated relationship to politics and human rights, and seems more comfortable keeping such concerns at arms length. A model in which the government is perceived as
merely building the “digital public infrastructure” on top of which private enterprise can
flourish, also seems to align with long-held neoliberal preferences at the Bank about the
role of government vis-à-vis the private sector. Therefore, the focus on foundational ID
fits well within existing Bank policies.

Significant evidence has shown that there are many problems with this model. The economic approach to identity may lead to new forms of coercion and exploitation of
poor populations and their data by the public and private sector—as critics of the Aadhaar
system have pointed out…

Meanwhile, governments in the Global South are taking on large debts and spending millions in public funds on contracts with private vendors to build biometric systems that can all too easily become systems of exclusion, surveillance, and repression. The Bank takes great pains to state that biometrics are not required. But by emphasizing their benefits throughout its documentation, the ID4D Initiative has helped to normalize the extensive use of biometrics in digital ID systems.

 

“Paving a Digital Road to Hell” is a document not just intended as a primer on the risks posed by digital ID systems and their promotion by the World Bank and the network. It is meant as a “call to action” to the global human rights ecosystem — including human rights organizations and other civil society organizations, experts, and activists.

Digital ID systems will, in many ways, determine the shape and form of digital governments and societies of the future. These are not marginal issues that should only be discussed and contested by those with technical expertise on biometrics or database design, but fundamental concerns that should be on the agenda of any individual or institution working on human rights and development…

Given the severity of the actual and potential human rights violations arising from this model of digital ID, we are not merely sounding the alarm, but also reflecting on what can be done.

CHRGJ proposes a range of actions for tackling the threats and risks posed by digital ID programs, including slowing down processes so that more care is taken; making discussions around digital ID systems more public; and building a broad coalition of diverse actors who have an interest in a human-rights focused society — “which may mean not having a single national digital ID system at all.”