Biometrics use is becoming routine. Can regulation catch up?

Biometric verification of beneficiaries at a displacement site in Nzulo, DRC. Photo by: UN Migration Agency (IOM) / CC BY-NC-ND

UNITED NATIONS — The United Nations Development Programme procured a $13 million set of biometrics kits to support voter registration in Yemen around 2012, following a request from Yemeni authorities. But the country’s civil war came a few years later, and the kits still sit untouched in a warehouse, according to Niall McCann, a policy adviser on legal identity for UNDP’s Bureau for Policy and Programme Support.

“Though, of course, no fault of the Yemeni electoral authorities, it looks really bad when you see this level of IT infrastructure investment sitting unused for over five years," McCann said in a recent interview with Devex.

UNDP is among the U.N. agencies — as well as other major development organizations and finance institutions such as the World Bank — that are increasingly turning to biometrics to execute their work.

“If you don’t or cannot explain how the data is used, it produces distress in the community and it makes NGOs less accountable. That’s the first challenge.”

— James Eaton-Lee, lead information security and data protection officer, Oxfam GB

The advanced technology, which recognizes individuals based on biological data such as fingerprints or iris scans, attracts both criticism related to security risks as well as praise for its potential efficiency, experts say.

But there are also lingering questions about whether the technology is actually effective, and whether it is sustainable in remote or fragile places like Yemen. While a handful of organizations are backing away from biometrics, many others view it as a useful tool — and one that could benefit from greater oversight.

There has been an “acceleration” in the rate of people being enrolled in biometrics programs by development organizations, according to Mirca Madianou, a researcher of biometrics and development work at Goldsmiths, University of London.

“Not only is it normalized, but I think it often becomes a goal, a target that needs to be met. So I think it is pervasive. And my concern is that this occurs even though the evidence about its benefits is unclear,” Madianou said.

‘An area that is under construction’

Reducing the risk of fraud is often cited as a primary benefit of biometrics. It can also help in situations where people lack formal identification, according to Carlos Muñoz, a representative of World Food Programme’s technology division. WFP began using fingerprint recognition in Cox’s Bazar, Bangladesh, in 2014, and has since captured fingerprints of more than 7 million people in 32 countries.

“WFP does not intend per se to expand biometrics, we intend to increase confidence that assistance is reaching the right people. Biometrics is one of many tools we use that can continue to give confidence to beneficiaries and donors that assistance is being used according to plan,” Muñoz said in an email to Devex.

The reliability of the technology is another concern that Madianou and other experts voiced in interviews with Devex. For example, racial and gender bias has been highlighted as an issue with digital identification technology, which could fail to recognize some registered aid beneficiaries.

At the center of this debate, though, is one central challenge: There are no international agreements or guidelines regulating how biometrics should be used, or how individuals’ personal identification data should be stored.

“There is no universal model for how it is to be handled, be it by the private sector, be it by states. It is an area that is under construction for the entire planet, and it is basically assumed that we are really in a no man’s land, in an area that needs regulation,” said Karl Steinacker, an independent consultant on humanitarian and digital identification. “At the European level, there is discussion, but the humanitarian agencies are avoiding the discussion.”

Evaluating a new way forward with biometrics

Oxfam International and the International Committee of the Red Cross are two aid organizations that have recently taken their own stances on biometrics. Oxfam has had a self-imposed moratorium on biometrics since 2015, though it continues to research the technology, according to James Eaton-Lee, lead information security and data protection officer at Oxfam GB.

Security concerns and the lack of international biometrics standards are among the reasons why Oxfam has maintained the moratorium, he said.

Aid beneficiaries have the right to know how their data will be shared or used, but this needs to be an ongoing conversation, he added.

"If you don’t or cannot explain how the data is used, it produces distress in the community and it makes NGOs less accountable. That’s the first challenge,” Eaton-Lee said.

“What becomes challenging is that is not a one-time transaction … It is a very challenging proposition to explain everything that will happen with anyone’s data at one point in time. You can saturate them with information, and then you have another kind of problem where people are stressed because you are throwing paperwork at them,” he continued. “You can usually, at a high level, give them the key elements.”

Carrying a physical identification card could place an aid beneficiary or voter at risk for different threats, which a digital ID could help reduce, experts say. But biometric data collection also presents the risk of individuals’ digital IDs getting hacked, according to Mariana Dahan, founder and CEO of the World Identity Network, which advocates for secure identities.

“Information on each individual is being amplified and multiplied, and the most worrisome part of this is the personal data is being stored in databases, which are poorly managed most of the time,” Dahan said. “That is a big concern.”

In August, the ICRC adopted an official set of biometrics guidelines, which recognize a possible “balance” between maximizing the technology’s efficiency and minimizing security risks. The organization is limiting its use of biometrics to missing persons and forensic work, according to Massimo Marelli, head of data protection at the ICRC.

The ICRC is also procuring a new technical solution that would let individuals retain a copy of their digital ID without storing it in a central ICRC data system.

“Holding a copy often is a risk and a threat for the organization. If you have certain information, malicious stakeholders may want to get it. If you do not, you are in a much better position to say, ‘We do not have it, and we will not be able to provide it,’” Marelli said, adding that there is no legal basis for ICRC to maintain copies of people’s digital information.

Calls for a regulatory international framework are likely to grow as aid and development work further incorporates biometrics. Eaton-Lee, of Oxfam GB, notes a reluctance from some European and international donors to fund multiple digital platforms hosted by individual organizations. This could lead to a centralized digital storage system, which multiple aid and development agencies would be able to access. Accountability should be a key focus of this work, Eaton-Lee said.

"What we need to do is build a stronger community of practice around this technology in order to build and adopt the right standards, risk assessment frameworks, technical and governance tools to make this threshold clearer. And we must improve accountability to each other and the communities we serve to make this demonstrable,” he said.

About the author

  • Amy Lieberman

    Amy Lieberman is the U.N. Correspondent for Devex. She covers the United Nations and reports on global development and politics. Amy previously worked as a freelance reporter, covering the environment, human rights, immigration, and health across the U.S. and in more than 10 countries, including Colombia, Mexico, Nepal, and Cambodia. Her coverage has appeared in the Guardian, the Atlantic, Slate, and the Los Angeles Times. A native New Yorker, Amy received her master’s degree in politics and government from Columbia’s School of Journalism.