The Taliban have openly talked about using US-made digital identity technology to hunt down Afghans who have worked with the international coalition – posing a huge threat to everyone recorded in the system. In addition, the extremists now also have access to – and control over – the digital identification systems and technologies built through international aid support.
These include the e-Tazkira, a biometric identity card used by Afghanistan’s National Statistics and Information Authority, which includes fingerprints, iris scans and a photograph, as well as voter registration databases. It also includes the Afghan personnel and pay system, used by the interior and defence ministries to pay the army and police.
For Afghans, and for the wider community working on digital identification for development, this means that the Taliban have sensitive personal information that they have said will be used to target those they consider enemies or threats. While some Afghans are frantically trying to erase any trace of digital activity, on official databases, user deletion is not an option.
This is yet another wake-up call illustrating the risks that new digital technologies can pose when they end up in the wrong hands, and for the development community. It reminds those working on digital identity and digital public infrastructure for development, that the benefits of ID systems – enshrined in the sustainable development goal 16.9, right to legal identity – should never be at the expense of individual safety.
Until now, the international development community’s efforts have focused on adoption and inclusion – the fastest and cheapest ways to make people visible to the state in order to manage access to rights and entitlements. The benefits of inclusion in digital ID are extensive – whether that allows access to healthcare and social services, to enrol a child in school, to open a bank account or obtain a mobile phone, to get a job, vote or register a business.
But protection needs to be a bigger priority. Like all technologies, digital identity systems are neither good nor bad, but never neutral, and they amplify the power of those that control them. No technology is going to change actors such as the Taliban’s efforts to target those they wish to find. But the deployment of digital identity systems needs to be smarter about understanding the political interests and risks that shape the contexts in which those systems are used.
Even if this is addressed, identification systems are still going to be rolled out in places where political risks are obvious – just like they have been in Afghanistan. We need to focus on emerging approaches to data management, and mitigating the misuse of these technologies.
For example, we must embrace the “data minimisation principle” – the idea that only necessary personal data should be collected and retained. We also need an approach that minimises centralised data collection, and gives more control to individuals. Countries such as Germany, Spain and the Netherlands are developing digital wallet-based ID systems – that decentralise data storage and control – while the EU’s Covid vaccine passport uses a similar model.
While there are isolated examples of efforts to develop enhanced approaches to these systems and deliver innovation to better protect us, there is no established, independent body of knowledge. There is a wealth of expertise in various governments, companies and associations around the world, in niche newsletter groups, and online publications that could contribute to thinking on this and to developing policy positions. But a gap exists – a need for independent, critical research and advisory services on this important topic. And particularly so for development donors, to support decision-making and investment that can help advance the benefits of digital identification while ensuring that the risks are mitigated.
Emrys Schoemaker is a researcher and strategist at Caribou Digital, where his work focuses on the interaction between digital technologies and social, political and economic change.