In Novem­ber 2020, the Indi­an gov­ern­ment proud­ly announced that 1.2 bil­lion cit­i­zens had been pro­filed by the nation’s dig­i­tal iden­ti­fi­ca­tion scheme. While this was an impres­sive return for the Aad­haar sys­tem – described by the World Bank’s for­mer chief econ­o­mist, Paul Romer, as “the most sophis­ti­cat­ed ID pro­gramme in the world” – the scheme had still left behind mil­lions of peo­ple, many of whom were the most vul­ner­a­ble mem­bers of soci­ety.

Acti­vat­ed in 2010, Aad­haar com­bines a 12-dig­it ID num­ber with bio­met­ric iris scans and fin­ger­print data. But, giv­en that lep­rosy remains a prob­lem in rur­al India, many peo­ple can­not sup­ply fin­ger­prints. For instance, Har­sha­bati Kheti, a 68-year-old woman liv­ing in the east­ern state of Odisha, was unable to authen­ti­cate her­self for ration dis­tri­b­u­tion as she had no fin­gers, mean­ing that she was denied food and oth­er wel­fare ser­vices for near­ly a year, despite hav­ing a dis­abil­i­ty cer­tifi­cate.

The Mar­gin­al­ized Aad­haar report, writ­ten by doc­u­men­tary film­mak­er and human-rights cam­paign­er Sub­hashish Pan­i­grahi, revealed that the sys­tem was also of lim­it­ed use to the 800,000 Soras Indi­ans liv­ing in Gajap­ati, a rur­al dis­trict of Odisha, who speak only a region­al dialect and rely on a local her­ald to deliv­er them the news each day.

In the north­ern state of Uttar Pradesh, Aad­haar declared near­ly 6% of the pop­u­la­tion – 1.9 mil­lion peo­ple, most­ly Mus­lims – ille­gal overnight. It was also where 200,000 tonnes of state-sup­plied food­stuffs were pil­fered using fraud­u­lent ID num­bers, divert­ing rations away from the needy and on to the open mar­ket.

While India should still be laud­ed for bound­ing so far ahead with its dig­i­tal ID scheme, oth­er nations can be for­giv­en for pro­ceed­ing with rel­a­tive cau­tion as they seek to avoid the types of prob­lems encoun­tered dur­ing Aadhaar’s roll-out. 

Dr Ana Beduschi, an asso­ciate pro­fes­sor of law at the Uni­ver­si­ty of Exeter, is lead­ing research into the legal­i­ties of Covid pass­port schemes (see below, “How close is the UK to vac­ci­na­tion pass­ports?”). She observes that dig­i­tal ID tech­nolo­gies are not inher­ent­ly neu­tral and can aggra­vate exist­ing inequal­i­ties, work­ing against the very peo­ple whose rights they’re designed to pro­tect. 

“Research demon­strates that, although most cit­i­zens have found India’s pro­gramme easy to use, a size­able minor­i­ty have encoun­tered prob­lems with bio­met­ric authen­ti­ca­tion,” she says.

The most obvi­ous way to engen­der mis­trust is to get involved in a data breach that could have been pre­vent­ed with a lit­tle knowl­edge and effort

The UK gov­ern­ment pub­lished plans for a com­pre­hen­sive dig­i­tal ID pro­gramme in 2020 and has since sought bids for a £4.8m con­tract to pro­duce an app. This fol­lows advanced ID schemes in Esto­nia and oth­er embry­on­ic pro­grammes in Aus­tralia, Cana­da and New Zealand.

In the­o­ry, a secure dig­i­tal ID sys­tem would enable British cit­i­zens to sim­pli­fy inter­ac­tions between them­selves, busi­ness­es and pub­lic author­i­ties. So says Christo­pher Ansara, founder and CEO of Alt/Ave, a spe­cial­ist in secure dig­i­tal doc­u­ment dis­tri­b­u­tion. 

“Hav­ing a dig­i­tal ID is key for mod­ernising pub­lic health ser­vices through remote online authen­ti­ca­tion,” he says. “It will also be incred­i­bly use­ful with­in finan­cial ser­vices, col­lect­ing con­fi­den­tial cus­tomer data and improv­ing admin­is­tra­tive effi­cien­cy by reduc­ing paper­work and human error.”

But one of the crit­i­cisms lev­elled at Australia’s planned dig­i­tal ID pro­gramme is that the gov­ern­ment wants the scheme to link no few­er than 80 diverse ser­vices.

Bruce Espos­i­to is a strate­gist in iden­ti­ty and access man­age­ment at US soft­ware firm One Iden­ti­ty. He believes that cre­at­ing a mono­lith­ic sys­tem that unwit­ting­ly over-iden­ti­fies the pub­lic should be avoid­ed. This is what hap­pened in the US with the mar­riage of social secu­ri­ty num­bers and the cred­it sys­tem, a sit­u­a­tion in which too much infor­ma­tion became far too easy to obtain. Pages of data were trans­ferred – regard­less of need – in each trans­ac­tion. 

The UK should apply what’s known as con­tex­tu­al integri­ty in its dig­i­tal ID scheme, stor­ing as lit­tle infor­ma­tion as pos­si­ble and trans­fer­ring only what’s need­ed for each par­ty, he argues. “A health­care provider may need to know a person’s sex and weight, for exam­ple, but a retail provider would not. Con­verse­ly, a retail­er may need to know a person’s income, as report­ed on tax forms, in order to extend cred­it, but the health­care provider may not need to know this.” 

Smart­phones are enabling this lev­el of func­tion­al­i­ty already, becom­ing a de fac­to dig­i­tal ID for their own­ers, Espos­i­to adds, although con­cerns remain about how much per­son­al data they allow to be shared with third par­ties with­out users’ knowl­edge, let alone con­sent.

In a peri­od when West­min­ster spent £37bn on the round­ly crit­i­cised NHS Test and Trace sys­tem, does the UK have the where­with­al to cre­ate an effec­tive and trust­wor­thy ID sys­tem? Over the past year, the gov­ern­ment has faced data-breach scan­dals rang­ing from the prime minister’s leaked text con­ver­sa­tions with Sir James Dyson to the Min­istry of Defence’s fail­ure to pro­tect the iden­ti­ties of 250 local inter­preters who’d helped the British Army in Afghanistan.

Many large enter­pris­es sim­ply aren’t care­ful enough in pro­tect­ing the data at their dis­pos­al, argues Trevor Mor­gan, prod­uct and mar­ket­ing man­ag­er at Com­forte, a spe­cial­ist in cyber­se­cu­ri­ty. 

“Most of these organ­i­sa­tions aren’t nec­es­sar­i­ly experts in data secu­ri­ty prac­tice,” he says. “The most obvi­ous way for them to engen­der mis­trust is to get involved in a data breach that could have been pre­vent­ed with a lit­tle knowl­edge and effort.”

Even com­pa­nies with exper­tise in secure data han­dling can fall foul of the rules. In 2017, for instance, the UK Infor­ma­tion Commissioner’s Office deemed a part­ner­ship between Google’s Deep­Mind divi­sion and the NHS ille­gal for its “over­ly broad shar­ing of data”.

The best way to pro­tect sen­si­tive infor­ma­tion against ever-more sophis­ti­cat­ed attacks from cyber­crim­i­nals isn’t to squir­rel it away behind guard­ed perime­ters but to impart pro­tec­tions into the data itself, accord­ing to Mor­gan. 

“Data-cen­tric tech­niques such as encryp­tion are well known, but these can come with a lot of oper­a­tional over­heads,” he says. “Pro­tec­tion meth­ods such as tokeni­sa­tion are much bet­ter. This replaces sen­si­tive ele­ments with innocu­ous rep­re­sen­ta­tion­al tokens while pre­serv­ing the orig­i­nal data for­mat, which makes it much eas­i­er and cheap­er for busi­ness appli­ca­tions to use.”

To address pri­va­cy con­cerns, the UK needs to empow­er cit­i­zens with a “self-sov­er­eign iden­ti­ty” that enables them to retain con­trol of how their data is used, argues Espos­i­to. 

“A per­son should be able to own and con­trol all aspects of their iden­ti­ty – which infor­ma­tion is shared, where it is held and – most cru­cial­ly – when it is for­got­ten,” he says. “Indi­vid­u­als shouldn’t be asked to cede con­trol over their iden­ti­ty to any one organ­i­sa­tion.”

The government’s abil­i­ty to posi­tion itself as the con­sci­en­tious guardian, rather than the secre­tive user, of the people’s data will ulti­mate­ly decide the UK’s dig­i­tal ID future.

---

How close is the UK to vaccination passports?

Where we are now 

As the world edges towards the adop­tion of Covid pass­ports, the UK is divid­ed on the need for them. In Novem­ber, Wales joined Scot­land in requir­ing peo­ple to give proof of vac­ci­na­tion to be grant­ed entry to venues includ­ing the­atres and restau­rants. While Eng­land has resist­ed such mea­sures, West­min­ster has indi­cat­ed that peo­ple would need a third jab to be deemed “ful­ly vac­ci­nat­ed”, even though boost­er dos­es are avail­able only to over-40s at the time of writ­ing.

What might hap­pen next 

Pass­ports could still be intro­duced under the government’s so-called plan B this win­ter if there is a sharp increase in the rate of infec­tion. Res­i­dents across the UK can already prove their sta­tus using the NHS App, which gen­er­ates a Covid pass that shows the user’s vac­ci­na­tion details and/or test results.

Fac­tors mil­i­tat­ing against pass­ports

Pub­lic mis­trust in how the state uses its tech­nol­o­gy could be a big bar­ri­er. Last year, North Dakota’s con­tact-trac­ing app, Care-19, was found to be covert­ly send­ing users’ data to third par­ties, for instance, while the munic­i­pal gov­ern­ment of Suzhou, Chi­na, used CCTV and facial-recog­ni­tion soft­ware to iden­ti­fy and shame peo­ple engag­ing in the “uncivilised behav­iour” of going out in their pyja­mas. 

“This exam­ple is benign when con­sid­er­ing the more obvi­ous rea­sons why an author­i­ta­tive gov­ern­ment would have an inter­est in imple­ment­ing a uni­fied iden­ti­ty to track its cit­i­zens,” says Bruce Espos­i­to.

West­min­ster will need to demon­strate to the pub­lic that data pri­va­cy con­sid­er­a­tions are no mere after­thought, accord­ing to Ana Beduschi. 

“Pol­i­cy-mak­ers should also ensure that account­abil­i­ty and the adju­di­ca­tion of griev­ances are avail­able and effec­tive, rein­forc­ing gov­er­nance mech­a­nisms with­in dig­i­tal iden­ti­ty frame­works,” she says.

---