Salvation requires good logistics. The refugee camp that functions well is one built with security, sanitation and a good supply of food and drinking water in mind from the very start. Before that can happen, however, there needs to be a precise understanding of how many people need to be supported. Only then can refugee agencies, border officials and charity workers begin to reckon with the immense challenges posed by feeding and housing thousands of traumatised individuals and families displaced by flood and famine, war and pestilence. Increasingly for humanitarian aid agencies, the best method of ascertaining this number lies in data collection through biometrics.
By scanning unique biometric identifiers like fingerprints, faces or irises, officials can begin to build a numerical picture of the transit camp that avoids unnecessary duplication and create a new, official identity for individuals untethered to the government documents of the nations they have fled.
Over time, this can also allow migrants to begin accessing services within the host country while protecting them from fraud. Such has been the case in Cameroon, which hosts some 6,000 refugees from the civil war in the neighbouring Central African Republic. “In the far north, north-west and south-west regions, resources are spent on addressing insecurity, which leaves less money for basic social services,” explains Kathleen Ndongmo, a member of the Africa Digital Rights Network based in Cameroon. A campaign in August to enrol thousands of refugees into a biometric ID card system, says Ndongmo, was a straightforward way for the government and UNHCR, the UN refugee agency, to allow refugees to move “freely without fear of arrest, go to school, access health and financial services, and obtain a mobile phone subscription.”
Even so, it’s a safety net with large gaps. While refugees have the power to withhold consent to having their biometric data collected, Ndongmo has heard of reports that migrants have not been empowered to understand Cameroon’s data protection regulations. It’s all the more concerning, she adds, given the security risks inherent in retaining biometric data. “Despite the fact that advances in technologies can help humanitarian agencies scale up and deliver aid more efficiently and effectively, mass-scale collection and use of refugees’ sensitive biometric data for identification and authentication is concerning,” says Ndongmo.
That leaves it, in large part, up to the collecting agency to decide what data protection regime is best to keep refugees’ biometrics safe. It’s a position that can be abused. In 2021, news emerged that the biometric data of thousands of Rohingya refugees collected by the UNHCR was shared, inexplicably, with the government of Myanmar – the very institution they fled in the first place. For Dr Petra Molnar, a research fellow at Harvard’s Berkman Klein Centre for Internet & Society, the scenario is indicative of vast power imbalances between refugee agencies and those they are meant to care for that, in time, may lead to migrants becoming unwilling test subjects for a whole range of biometric enrolment technologies.
“I don’t know if I would go as far as to say that biometrics can never be positive,” says Molnar. “But… we’re dealing with a reality that is extremely weighted against the people who are moving.”
Informed consent in biometric data collection
Agencies like the UNHCR have collected biometric data for decades in the form of fingerprints, explains Kerrie Holloway, a senior research officer at the ODI, formerly known as the Overseas Development Institute. For years, these prints formed the ideal biometric record – “unless,” she says, “you cut your fingers off, you’re kind of stuck with it” – but recently this identifier has gradually given way to more exotic variants like voice samples (used to authenticate mobile money transfers in Somaliland), gait recognition (tested on disabled Rohingya migrants in Bangladesh), and facial recognition (used to help refugees find loved ones lost in the aid system.)
Iris scanning has proven especially popular. Such data collected from the almost 40,000 refugees housed at the UNHCR’s camp at Azraq in northern Jordan is used not only to collate the number of individuals at the facility, but also to facilitate cardless payments at ATMs outside the facility using the agency’s EyePay service. “The system,” writes UNHCR, “helps to enhance the efficiency and accountability of food assistance, while also making shopping easier and more secure for refugees”.
With each iris scan stored on a form of the Ethereum blockchain, EyePay is also designed to eliminate millions of dollars in transaction fees associated with conventional money transfer services – “money,” MIT Tech Review reported in 2018, “that could have gone to millions of meals”. In time, hoped World Food Program (WFP) executive Houman Haddad, the scheme would allow refugees to open bank accounts and build new lives for themselves without recourse to the government documents of their country of origin.
How popular the system is among refugees themselves is another question. A report co-authored by Holloway found that only ten out of the 45 Syrian refugees interviewed preferred to receive cash payments through iris scanning. Another account from Dr Margie Cheesman, a digital anthropologist who visited Azraq before the pandemic, describes older refugees regularly frustrated at EyePay’s inability to recognise the irises of older individuals with eye problems like cataracts and fearful that the scans would ruin their health. “It’s all the time for the salary and the food and every time we want to buy bread too,” one woman told Cheesman. “My eyes burn after I scan them, it’s too much.”
Low levels of informed consent for iris scanning among migrants at Azraq is also alarming, says Dima Samaro, human rights researcher and an expert in the intersection of technology, human rights and migration. According to claims by Samaro, most of the refugees at Azraq submitting to iris scans do so under the assumption that refusing will prevent them from receiving basic aid, findings echoed by Molnar and Holloway in their own investigations. Effectively, says Samaro, “it’s forcing them to provide the consent in exchange for food and other basic services”.
In response, a spokesperson from UNHCR told Tech Monitor that “the collection and storage of data, including biometric data, comes with a huge responsibility and one we take seriously,” adding that the agency provides individual counselling and other resources to refugees on how to enrol their fingerprint and iris data, while keeping their biometrics safe through a constantly updated data protection and privacy policy. What’s more, they said, the UNHCR’s Jordanian cash programme “offers options to receive cash without the use of biometrics”.
Elsewhere, a memo published by UNHCR in April states that refugees in Jordan have their rights explained to them and that they can object to biometric data collection. While this objection ‘does not impact [their] status with UNHCR,’ its legitimacy is assessed by senior registration staff on a ‘case by case basis.’ While the classifiers collected are not shared with third parties so as to keep individual biometrics safe from misuse, ‘basic biodata’ like names and dates of registration are accessible to other humanitarian actors (such is the case with EyePay, said the UNHCR spokesperson.) However, Die Zeit reported in 2017 that the WFP was analysing purchase data from EyePay to check if refugees had a balanced diet. As such, says Samaro, “refugees find themselves in a position where they cannot defend themselves against the surveillance of their consumption habits”.
UNHCR is also obliged to share the biometric data it gathers in Jordan with the country’s government. That would be less controversial if national data protection regulations were not so weak. “There was a draft law that circulated last year, but it’s still a draft law, so it hasn’t been approved yet,” says Samaro. Even then, she adds, it failed to define biometric data under the law, let alone delineate when, if and how it should be collected.
The situation is markedly different in Europe and North America, where concerns revolve less around the lack of secure frameworks designed to keep biometrics safe than an escalation in the use of advanced technology to fortify borders against illegal immigrants. In the US, it was reported that ICE was using facial biometrics derived from selfies to monitor migrants inside its borders. Meanwhile, a pilot funded by the EU’s Horizon research and development fund named iBorderCtrl tested its own facial analysis system at airports in Latvia, Hungary and Greece from 2016-2019. Built to aid border officials in working out if travellers were lying about their identity or their ultimate destination. A similar system, named AVATAR, has also been tested at the US-Mexico border.
“This is such a clear example of playing around with really, really high-risk, experimental tools in these extremely high-risk areas that really don’t take into account the vast impacts that these [systems] have on people’s human rights, their dignity, and on their ability to present their story in a meaningful way,” says Molnar.
Critics would later argue that such systems ‘could be used to refuse entry or detain travellers based on race or ethnicity’ (emotion recognition technology, meanwhile, has since been criticised for its accuracy.) Molnar herself has previously campaigned against the increased securitisation of European borders as it relates to refugees and migrants, which has seen laws passed empowering police to seize and search their phones, snoop on social media accounts, and launch drones to monitor their movements from above. Earlier this year, the Belgian parliament also approved the creation of a biometric migrant database in the country, accessible to all EU member states.
“We really are dealing with a world that has become very sharp against people on the move,” she says. “It’s really become anti-migrant. All these different jurisdictions are criminalising movement, and they’re also, increasingly, doing it through these really problematic tools.”
Keeping biometrics safe and secure
Even so, the collection of biometric data is becoming increasingly normalised for all kinds of travellers: tourists entering the US, for example, know that their fingerprints are taken by border officials at the airport, while international adoption of biometric passports increases every year. Holloway, a US citizen, was subject to similar requirements when applying for her British visa.
“I willingly agreed to give [that data] because I wanted to move to the UK,” she says. “You could possibly say the same about people who are being displaced. [But] I wasn’t being pushed out of Alabama.”
It’s a crucial difference, say human rights activists. Driven out of their countries of origin, migrants should, in theory, be subject to the same duty of care reserved for similarly vulnerable populations. But while the biometric identifiers collected from legal travellers are often ring-fenced by reams of data protection laws – the security of which is inviolably linked to the reputation of the nation gathering that data – the frameworks governing such data collection among refugees beg to be tightened, argues Holloway.
What’s needed, says the researcher, are clear limits on what kinds of identifying data are collected from refugees in order to keep their biometrics safe from breaches or misuse. “If you're doing food distribution and you want to collect fingerprints so that you know that the person who registered originally is the one receiving the food, okay,” she says. “But do you need to link that fingerprint with gender? Do you need to link it with sexual identity? Do you need to link it with ethnicity or religion? All of these things, people can be persecuted for. The more that we can minimise collection of that kind of data, I think you minimise the overall risk of people then using that database to persecute based on that.”
This is not an unlikely scenario. Governments change all the time through elections, invasions and coups d’état, the data gathered by the previous regime suborned by the next. Such was the case in Afghanistan last year, when biometric records collected by ISAF since 2002 fell into the hands of the Taliban. A border incursion here, a data breach there, and data protection regimes designed to keep biometrics safe and secure can collapse overnight. “It doesn’t take that much effort to imagine how bad that situation could get for those people, just because they’ve had to give up that kind of information when they crossed the border,” says Holloway.
There has been an improvement in data protection standards among refugee agencies. Both the International Committee of the Red Cross and Oxfam have recently published their own guidelines on how they keep biometrics safe and secure, while the UNHCR has had its own policies in place for over a decade, notwithstanding its controversies around the informed consent of collection subjects. Even so, while those in the chain of command at refugee agencies and charities are aware of data protection frameworks, says Holloway, “the person who’s collecting the fingerprint on the ground is often not aware of the rest of the machinery”.
Critics might say that, for a system seemingly so full of risks, there have been comparatively few cases where the biometric data of refugees has been breached or used as a means to oppress minorities en masse. Molnar considers this thinking wrongheaded. While biometric data collection has its place in border control and the provision of key services to migrants, the stakes are simply too high for refugee agencies and governments to continue waiting for a serious incident to occur before tightening standards.
“At the end of the day,” says Molnar, “data collection cannot come at the expense of people’s human rights”.
Read more: Could undersea cables be the next casualty of hybrid warfare?
