India's actually existing DPIs as architectures of hegemony

Mila T. Samdub. Originally published on irl.works

Governance, Openness and Security of Digital Public Infrastructure in India by the internet Research Lab (hereafter, the “GOSDPI paper”) provides new evidence into the organization and functioning of state promoted digital platforms in India. With its comparative approach, it allows us to identify patterns, divergences and blindspots that make up what we might call “actually existing DPI” (as distinct from widely circulating inflated and ungrounded claims about DPI). This essay responds in the form of an architectural critique rooted in political economy. It draws on the findings of the GOSDPI paper to theorize the architecture of DPI systems as flexible, distributed platforms that encode the structure of hegemony in Digital India. This architecture splits governance, ownership, deployment and profit to forge links between powerful interests (software, finance, state elites and sectoral interests, such as in construction). Seen thus, DPIs emerge as instruments that build and sustain elite coalitions, enabling the continuance and intensification of domination.

Actually Existing DPIs

A large and expanding body of gray literature prescribes the principles, architectures, and functions of something called “Digital Public Infrastructure”. Much of this literature is mobilized towards rapid policy diffusion, exporting certain idealized models as “best practices” whose supposed successes can be replicated around the world. As a result, mainstream DPI discourse often pays more attention to finessing how to promote “DPI” than to understanding what the systems given this name actually do.

What does it mean to look at “actually existing DPIs”? This means looking not at technical diagrams that assume end-users who are rational, literate, and empowered, nor unattributed factoids about the cost savings these systems will supposedly deliver, nor the smiling photographs of fictional user personas – farmers and street vendors are in vogue – that adorn dozens of report covers, nor even the elegant principles that promise openness, interoperability, and trust. Rather, actually existing DPIs refer to the opaque, imperfect, compromised, and negotiated systems that are actively reorganizing societies. Looking at actually existing DPIs also means being specific about how these systems work in different contexts; this article focuses on the Indian cases studied by the GOSDPI paper, while recognizing that systems elsewhere are similar and different.

DPI are worth studying in empirical detail because they form the operating system of contemporary life in many places. Small nuances in the structures of these systems have massive ripple effects affecting hundreds of millions of people. Since they are composed of several interlocking structures – legal, technical, economic, cultural – it is precisely the interplay of these various forces that this analysis unpacks.

The GOSDPI paper is primarily framed as an exercise in gathering evidence and evaluating whether six actually existing DPI live up to the claims made on their behalf. This is critically important for advocacy, as the answer on most counts is “no”. In the course of this exercise, the paper’s authors also begin to theorize actually existing DPI. The paper refers, for example, to DPI’s “highly networked public-private architecture”, its “distributed architecture”, its “selective openness”, “complex incentive structures across multiple actors” and “fragmented model of responsibility”. They write that in DPI, “regulatory authority is concentrated in central state bodies, while operational governance is delegated through layered frameworks of rules, guidelines, and bilateral agreements.” And: “when faced with security vulnerabilities and data breaches, DPIs defined their security perimeter narrowly. The security boundary was set to be at the core infrastructure, while responsibility for breaches occurring through third-party integrators and components was denied.” This essay picks up some of these threads to build a more systematic theorization of actually existing DPI.

The DPI Assemblage: From Imaginary to Platform to Extension

To understand DPIs’ broader social and economic effects they should be treated as assemblages: DPIs encompass not only core software platforms, but also ecosystems of private and public sector complementors, the hardware and infrastructural dependencies on which they run, the regulations that govern them, the imaginaries that shape them and the human intermediaries and social structures that provide last-mile interfaces. Across these dimensions, DPIs in India are characterized by a hyper-proliferation of roles and actors. They are structured in ways that “increase the surface area of a problem”, multiplying the sites in which different entities can enter the system and the functions they serve. These functions are operational, economic and regulatory, often at the same time. Importantly, as the GOSDPI paper reveals, though DPI are often described as “open”, in practice they are tightly permissioned, and the entities that occupy roles in the ecosystem often do so because they have significant economic and political power.

Here we draw on and extend the example of the FASTag highway toll collection DPI, which is explicated at length in the GOSDPI paper.

Common imaginaries of marketized development

It is clear from the GOSDPI paper that DPI is not simply a one-size-fits-all approach. There is significant room for variation between different DPIs. Yet at the same time, a shared “sociotechnical imaginary” motivates DPI more broadly. The notion of a broad-based move from “pipes to platforms” in the architecture of government services, for example, has been promoted by a relatively small set of actors over a decade. The Nilekani-led TAGUP report is a consistent touchstone in the distributed governance of DPI. An imperative to scale at all costs, likewise, accompanies all DPI rollouts.

The DPI imaginary frames not only the architecture of the DPI platform but also proposes a theory of change, claims about the kind of social and economic change these systems will bring about in the world. This theory of change – for which there exists little concrete evidence – links DPI deployment to increased government efficiency, private sector innovation and poverty alleviation. It is built on pre-existing imaginaries of marketized development, including CK Prahalad’s business school promise of the “fortune at the bottom of the pyramid” and a “financial inclusion assemblage” that claims that, once granted access to credit, the poor can entrepreneur their way out of poverty.

Entities that have promoted the DPI imaginary include, among others, the tech czar Nandan Nilekani, the industry body Indian Software Product Industry Roundtable (iSPIRT), and global funding agencies like Omidyar and the Gates Foundation. Broadly, these correspond to domestic software capital and US transnational capital. Their stakes are not only economic but also symbolic. With the proliferation of DPI, domestic software capital has today arguably become the hegemonic class fragment in India, playing an outsize role in shaping common-sense assumptions about what the future of the nation should look like.

Complex ownership structures

The agencies that own the core platforms of DPI are often composed of complex configurations of actors. In some DPI, ownership rests entirely with a technocratic state agency. This is especially the case for so-called “foundational DPI” like Aadhaar and Digilocker. But in domains with powerful incumbent sectoral interests, like finance or highways, ownership models tend to be more complex.

As the GOSDPI paper describes, FASTag is owned by the Indian Highways Management Company Limited (IHMCL), a special purpose vehicle, of which the public enterprise National Highways Corporation of India owns 41.38%, toll concessionaires (which include some of the largest infrastructure and construction companies in the country) hold 33.81% and financial institutions hold 24.81%. This fragmented ownership structure includes both finance and construction, with “L&T Finance, GMR Highways, Shapoorji Pallonji Roads, and Essel Infraprojects, each holding between 3–8% of total share capital”.

The National Payments Corporation of India (NPCI), which owns the Unified Payments Interface system, is one of the most prominent entities in the operation of DPI. It is structured as a non-profit company composed of a mix of public banks, private banks and fintechs. Over 51% of shares are held by public sector banks.

Such ownership structures mix public sector enterprises with commercial interests across various sectors. They should be understood as ways of carving up the pie that secure the consent of powerful fractions of capital to build and deploy large-scale projects.

Platform-ecosystems in operation

At the level of operation, each DPI is a platform-ecosystem composed of a two or three-layer stack: the core platform, occasionally a hidden routing layer, and an interface layer.

The core platform is usually operated by the entity that owns the DPI (NPCI operates UPI, UIDAI operates Aadhaar). Occasionally, the operating entity is distinct from the owning entity. The National Electronic Toll Collection (NETC) transactions that are at the center of FASTag toll collection, for example, are operated by NPCI (which is involved in many DPIs that process financial transactions).

The routing layer, where it exists, is composed of incumbent sectoral interests, often but not always in finance, whose buy-in is necessary to operate the DPI. In the case of FASTag, these actors are the issuing and acquiring banks that facilitate the movement of data and money through the system. Access to this layer is controlled by licenses that often mandate technical specifications and/or turnover requirements, restricting them to large enterprises. These entities often earn guaranteed rents from occupying these privileged nodes in the ecosystem.

The interface layer is usually composed of user-facing apps or services. Organized to attain scale, this level is often characterized by entities that already have significant market access or have the resources to take on elevated risk to acquire customers. In FASTag, the interface layer is split between acquiring banks and fintech startups. Acquiring banks are responsible for registering new users into the FASTag system and providing them with a physical FASTag RFID to affix to their car. Fintech apps form the extended ecosystem, which are often used to top up one’s FASTag funds. In other DPI, such as UPI or Aadhaar, this layer is often occupied by fintech companies with speculative business models backed by venture capital.

Putting these three layers together: When a car passes through a toll plaza, data is transmitted to a toll plaza operator, whose infrastructure is configured by a system integrator, to an acquirer bank, to NPCI’s NETC mapper, to an issuing bank, from whose account money is deducted, and then back. A complex incentive structure follows: “Each toll transaction triggers a fixed percentage-based payout to the involved entities. The acquirer bank, issuer bank, NPCI, and IHMCL receive 0.13%, 1%, 0.15% and 0.25% of the transaction value respectively as programme management fee.”

Multiple dependencies

All DPIs depend on complex infrastructural stacks, which are usually excluded from most definitions of DPI. To continue with the FASTag example: “When users pass through a toll plaza, multiple devices generate and collect data: RFID readers capture the Tag ID, TID (transponder ID), and user memory; Automatic Vehicle Classification (AVC) systems determine the vehicle class; Weight-in-Motion (WIM) sensors record vehicle weight; and image capture systems photograph the vehicle.” A proliferation of hardware components, then, is what keeps DPI like FASTag running.

DPIs share infrastructural dependencies with cloud-based contemporary digital systems: data centers, undersea cables, mobile towers and more. These are largely supplied by Chinese hardware manufacturing and US hyperscalers. Yet DPI also have particular infrastructural dependencies that are unique to their uses and the situation of India. Smartphones and internet access, for example, are major dependencies of DPI in India, and India’s telcos – operated by conglomerate capital – entrench their importance with every use of DPI. Since biometrics have been foundational to Aadhaar, biometrics suppliers – which are often US and European contractors – have played a prominent role as well.

People are important dependencies in the functioning of DPI. Despite the nationwide rollout of FASTag, most toll plazas in India remain labor intensive, with human intermediaries helping users navigate systems that often don’t work as designed. A simple example familiar to most people who have traveled on an Indian highway: a user’s FASTag fails to scan when the car pulls up at the boom barrier; in response, a toll plaza operator pulls out an RFID reader affixed to a long stick and waves it closer to the tag in order to scan it. Without such improvisations, DPI would simply not work.

Fragmented regulation

DPI function within a regulatory regime that is organized towards maximizing the circulation of data. Thus, the structure of regulation in DPI often fragments authority. The ultimate regulatory authority often rests within central government ministries or central regulators, such as the Reserve Bank of India, but is enforced by a range of actors. In FASTag, the Ministry of Road Transport and Highways is the apex policy authority, while operational guidelines – fee structures, rules of participation and compliance – are managed by IHMCL.

Extension and interconnection

Because DPIs are structured as platform-ecosystems, they can often be extended. New actors can enter the ecosystem as complementors, usually via bilateral agreements and APIs. Thus, FASTag data is also accessed by government agencies for tax compliance and national security. Commercial entities offer a different kind of extension, integrating DPI with each other or with other services. In a commercial fintech app, the Bharat Connect DPI may be used to top up a FASTag account using UPI for payment. As they are extended and interconnected, DPIs become more entrenched.

Architectures of Hegemony

According to a classic paper on postcolonial politics, a ruling coalition “is always based on an explicit or implicit protocol, a network of policies, rights, immunities derived from both constitutional and ordinary law which sets out over a long period, the terms of this coalition and its manner of distribution of advantages”. With DPI, this article has shown, this protocol is not only legal and social but also technical and economic.

The DPI assemblage apportions specific roles to powerful entities suited to their particular interests. In most DPI, this creates a coalition between the state, the software capitalists that build and extend these systems, the financial capital that runs much of the financial plumbing, the conglomerate capital that operates the network infrastructure and sectoral capitals that vary with each DPI (construction in the case of FASTag), as well as important international actors upon which the entire structure is dependent: US hyperscalers and Chinese hardware manufacturers.

Entities with an economic stake in DPI may extract guaranteed rents from occupying a position in the routing layer. Or they may take more risky interface-level business models, often funded by venture capital. The stakes may also be symbolic – building prestige and the image of nation-building. They may be political, offering gains in national security or surveillance. Some entities are content with the status quo; others want to bend the architecture of the system further towards their interests.

DPIs should be understood not only, then, as technologies of service delivery but also as architectures of hegemony. The protocols of DPI encode the distribution of advantages between the divergent entities that compose the ruling bloc of the nation-state today.

Mila T. Samdub is a writer, designer, and curator who works on the aesthetics and political economy of digital infrastructures in India and the Global Majority world.

ICANN's new domain applications are now public

Yesterday was ICANN's Reveal Day, and the full list of applications for new top-level domains is now searchable (Wired has a good primer). ICANN published 1,615 applications from 481 applicants, and our fiscal host, Exchange Point, is among them applying for .tiny and backup .point.

The most popular applications are AI related. Thirteen applicants want .agent and seven want .agi with OpenAI and Google both applying. Alongside them are lots of brand domains like .facebook and .bankofamerica.

A tip if you go digging to see who applied for what, you need to know what you're searching for. Google files through its registry company, Charleston Road Registry. A search for "Google" returns no results. "Open AI" returns nothing, while "OpenAI" returns 15 results.

Applicants have until October 21 to switch to backup strings, the final list will be public November 17, and public comment runs until mid-March.

Want to appear here? Sponsor a newsletter.

This Week's Links

Open Social Web

• Watch four projects from DWeb Camp, a gathering on decentralized web technology, including software that syncs data without cloud services, an open source soil testing kit, and a serverless app for the Secure Scuttlebutt social network. https://archive.org/details/dweb-virtual-meetup-sep-2026-camp-jomo-fomo/DWebMeetup-Sep2026_video.mp4 

Internet Governance

• Brazil's digital public infrastructure, state-run systems like the Pix payment network, gives citizens little say. Social movements such as the Homeless Workers Movement should help govern it, argues Alexandre Costa Barbosa. https://irl.works/dpi/essays/brazil 
• ETSI, Europe's telecom standards body, published the first standard for measuring a smartphone's environmental impact across its whole life cycle, from raw materials to disposal, so models can be compared consistently. https://www.etsi.org/newsroom/press-releases/etsi-launches-first-of-its-kind-standard-to-measure-environmental-impact-of-smartphones 
• Russia installs state-controlled filtering equipment, known as TSPU, inside private telecom networks to inspect, block, and slow traffic. This report explains how the system works and how it squeezes circumvention tools, by Dmitry Kuznetsov at critical infrastructure lab. https://zenodo.org/records/22794150 
• Competing proposals for how AI fits into the 6G core network, largely split between Western and Chinese companies, could splinter the global mobile standard set by 3GPP, the industry's standards body, argues Ruth Brown. https://www.lightreading.com/6g/the-6g-core-divide 
• John Ousterhout, a retired Stanford professor, is pushing Homa, a protocol he says beats TCP, which carries most internet traffic, for AI workloads in datacenters. He is drafting a standard for the Internet Engineering Task Force. https://www.theregister.com/networks/2026/10/01/stanford-prof-is-beating-the-drum-for-a-new-protocol-to-replace-tcp/5300629 
• Vint Cerf, who co-designed the internet's core protocols, says AI agents need registration, audit trails, and shared standards, and calls digital sovereignty, the push to confine data within national borders, "dead wrong." https://cacm.acm.org/opinion/leveraging-lessons-learned-developing-internet-protocols 
• Brazil's platform rules, including age verification mandates, should treat Wikipedia and other nonprofit projects differently from commercial social media, argue João Alexandre Peschanski, Amalia Toledo, and Elise Silva. https://www.techpolicy.press/wikipedia-isnt-big-tech-and-brazils-platform-rules-should-say-so 

Digital Rights

• More than 80 civil society groups and experts signed an open letter urging governments, companies, and the UN to ground AI rules in international human rights law and address current harms like surveillance and biased outputs, not only future risks. https://globalnetworkinitiative.org/map-ai-open-letter-centering-human-rights-in-ai-governance 
• Canada, Lithuania, and the EU's diplomatic service pulled their sponsorship of Europe's main disinformation research conference, reportedly under US pressure, as panels asked whether the US itself manipulates information in Europe. https://www.techpolicy.press/disinformation-conference-in-europe-roiled-by-transatlantic-politics 

Technology for Society

• The AI industry hates the term "stochastic parrots," which casts chatbots as remixing training data rather than thinking, because it undercuts the case for trillions in investment, Brian Merchant argues in a video with Emily M. Bender. https://www.youtube.com/watch?v=7Z7oA9ndmdY 

Privacy and Security

• Attackers used a small company's legal access to Denmark's national population register to pull names, addresses, and personal ID numbers for about 8.8 million people, living and dead, Denmark's digitalization ministry said. https://thehackernews.com/2026/10/denmark-says-attackers-accessed-cpr.html 
• Cloudflare plans to become a certificate authority, issuing the digital certificates websites need to encrypt traffic, including new ones designed to resist future quantum computers. It says another issuer will reduce reliance on a few dominant providers. https://cloudflare.net/news/news-details/2026/Cloudflare-Announces-Public-Certificate-Authority-for-the-Post-Quantum-Web/default.aspx 
• AI agents aren't going rogue: they're doing what they're told and exposing how poorly secured the internet is, while personal agents like Meta's Muse put users' private data at risk, argues Lucy Purdon. https://courageeverywhere.substack.com/p/if-ai-is-so-dangerous-why-let-it 

Upcoming Events

• Chayn's online safety workshop for survivors of gender-based violence, those who support them, and anyone else, marking World Encryption Day. October 8, Online. https://luma.com/dkvtvuc0 
• Relating Systems Thinking and Design (RSD15) paper talks, where systemic design researchers present peer-reviewed work in curated sessions. October 8–9, Online. https://rsdsymposium.org/rsd15-paper-talks 
• Stronger together: civil society and the private sector as partners in cybersecurity awareness/ October 13. Online. https://www.accessnow.org/event/digital-security-webinars 
• The third meeting of the International Telecommunication Union's (ITU) focus group on embodied AI, meaning AI built into robots and other physical machines, which is developing technical standards for these systems. Open to all.  October 13-16. Hangzhou, CN. https://www.itu.int/en/ITU-T/focusgroups/eai/Pages/default.aspx 
• eco, the Association of the Internet Industry, hosts a roundtable for Global Encryption Day on how the move to post-quantum cryptography, encryption designed to resist future quantum computers, affects connected vehicles and end-to-end encryption. October 14. Brussels, BE and Online. https://www.eco.de/event/eco-x-global-encryption-day-2026-post-quantum-ready 
• Bread&Net, SMEX's gathering of digital rights advocates, technologists, and journalists from West Asia and North Africa, on the theme "Realities Reimagined." October 14–16, Beirut, LB and Online. https://events.ringcentral.com/events/bread-net-2026/registration 
• Prosocial Design Network workshop with Will Schulz on how decentralized platforms like Mastodon and Bluesky open new ways to research healthier social media design. October 21, Online. https://luma.com/pquas90x  
• Responsible Tech Summit, a gathering on accountability in the AI era hosted by All Tech Is Human. October 29, New York, NY or Online. https://alltechishuman.org/all-tech-is-human-blog/responsible-tech-summit-embedding-accountability-in-the-ai-era-to-take-place-on-october-29th-at-the-new-york-times-center-in-manhattan 
• Smart City Expo World Congress is the world’s biggest and most influential event for cities and urban innovation. November 3-5. Barcelona, Spain. https://www.smartcityexpo.com 
• The 8th Privacy Symposium Africa. November 25-26. Accra, Ghana. https://privacysymposiumafrica.com/psa-2026
• Montreal Anarchist Tech Convergence, a gathering on anarchism and technology with sessions on self-hosting, Signal's security gaps, Tor, and mesh networks. October 17–18, Montreal, CA. https://mtl-atc.org 
• SplinterCon Nordic, on how AI is changing internet censorship, surveillance, and the "splinternet," the breakup of the global internet into national networks. December 3-5. Stockholm, SE. https://splintercon.net/nordic 
• 5th Africa International Human Rights Film Festival, themed "Stories of Resistance." Dec 8–10. Lagos, NG. https://filmfreeway.com/AfricaInternationalHumanRightsFilmFestival

Careers and Funding Opportunities

• Freedom of the Press Foundation: Senior Digital Security Trainer. Brooklyn, NY (hybrid) or remote US. https://freedomofthepress.na.teamtailor.com/jobs/708479-sr-digital-security-trainer
• Ada Lovelace Institute: Researcher (Public Participation). London, UK (hybrid). https://www.adalovelaceinstitute.org/job/researcher-ppr-oct-26 
• The Open Technology Fund's Surge and Sustain Fund pays server costs, per monthly user, for large-scale, open source anti-censorship tools like VPNs serving people in China, Cuba, Iran, Myanmar, and Russia. Concept notes are due October 15. https://www.opentech.fund/funds/surge-and-sustain-fund 
• The Social Web Foundation is offering grants of up to $20,000 for developer and creator teams to launch audio, video, or image publications on the Fediverse, the network of linked social platforms like Mastodon. Applications are due November 4. https://socialwebfoundation.org/2026/10/07/call-for-proposals-fediverse-multimedia-grants 

Opportunities to Get Involved

• SplinterCon Nordic, a December conference on internet fragmentation, seeks talks, research, workshops, and demos on how AI affects censorship, network control, and access to information. Submissions are due October 30. https://splintercon.net/nordic/cfp 

What did we miss? Please send us a reply or write to editor@exchangepoint.tech.