Sign in Subscribe
By Mallory Knodel —

Studying Digital Public Infrastructures

Studying Digital Public Infrastructures
Photo by Tim Promwanna / Unsplash

This week I attended the AWID Forum in Bangkok. It was a truly memorable moment to commune with 4000 feminists as 2024 comes to a close. I was there to support APC's Women's Rights Programme, in particular as a digital security expert. Here are some highlights:

  • Feminist Tech Gardens: Space to meet, discuss and talk. Programming was split across two different areas:
  • Advocates of a #bindingtreaty want corporates to be held directly accountable under existing human rights mechanisms.
  • Debt relief campaign from the Committee for the Abolition of Illegitimate Debt, which aligns with warnings from The World Bank itself (NYTimes gift link).
  • Point of View’s campaign to hold Big Tech accountable resonates with many feminists. Sign up for more info.

Privacy and security in digital public infrastructures

By Divyank Katira, Gurshabad Grover, and Anunay Kulshrestha (internet Research Lab)

The internet Research Lab is hosted at the Exchange Point Institute. The project 'Privacy Risks of Digital Public Infrastructure in India' is supported by the Digital Infrastructure Insights Fund. The authors can be reached at mail@irl.works.

The Indian government has widely deployed a set of technological solutions that citizens are de facto required to use to access essential public and private services. Promoted as “Digital Public Infrastructures” (DPIs), these infrastructures digitally mediate a number of day-to-day interactions that citizens have with governments and businesses, including identification, payments, credential management, e-commerce, welfare distribution, healthcare, and banking.

While DPIs are a global phenomenon, India has spearheaded the deployment of infrastructures and even boasts of foreign policy structured around its promotion. At the G20 in India in 2023, world leaders adopted a framework for “Systems of DPI” while stating that DPIs are “safe, secure, trusted, accountable, and inclusive.” While such assertions make for good sound bites, the underlying substantive claims have not been rigorously tested in the Indian context. 

Contrary to what ‘public’ in ‘digital public infrastructure’ might suggest, many parts of DPIs in India are in reality governed by opaque public-private partnerships or outright for-profit companies. While marketed as facilitating an “open” ecosystem, many DPIs are not free or open source. 

For instance, Digi Yatra – a facial recognition system to enable entry into airports – is, in theory, an initiative launched and led by the Ministry of Civil Aviation in the Government of India. In practice, its operations are governed by a non-profit foundation. When simple questions about the system were directed to the Ministry, it rejected them citing the fact that the non-profit foundation does not come under the purview of governmental transparency legislation. Developed by a separate for-profit tech company that has since been accused of siphoning public funds, none of Digi Yatra’s source code is available to the public.

Including and beyond Digi Yatra, DPIs in India operate on and store private data of nearly all residents with little transparency or oversight.

This dearth of oversight has resulted in numerous data breaches and security vulnerabilities in many DPIs, such as Aadhaar, a biometric identification that is practically required for most citizen interactions with the government – from filing income taxes to availing social welfare.

Imagined by technocrats and developed by private companies, Indian DPIs have rarely taken a privacy-respecting approach, generally storing and processing more private user data than is necessary to provide functionality. With many systems now inter-linked because of government policy, privacy researchers in academia and civil society have sounded the alarm on the potential surveillance enabled by DPIs in India. 

Indians are also being increasingly coerced into using DPIs – sometimes by the government making them mandatory for many basic interactions and access public to services, sometimes by flouting basic principles of privacy. Airport security staff have been found signing up flyers to Digi Yatra without their consent. Many Indians who registered to get their Covid-19 vaccine shot were automatically signed up for a national “Health ID.” Ditto for anyone who availed a government health insurance scheme. As of 2022, at least three quarters of these “voluntary” Health IDs were generated from these two databases alone. With “Aadhaar-linked birth registration” now active in most states in India, enrolment to the identification program in India now begins at age zero.

Worryingly, many other countries are unwittingly – or worse, on purpose – adopting the ‘DPI model’, aping shortcomings of Indian deployments into their own. The Aadhaar program’s design has already informed numerous digital identity systems in Africa. India recently announced the creation of a global repository for DPI and a social impact fund to accelerate development and deployment of DPIs in the Global Majority. India also led the creation of modular platforms for other countries to adapt, including those for digital identity, payments and welfare distribution. Thirteen countries are currently deploying such systems while pilots are underway in at least seven. India has entered into agreements relating to payment infrastructure with at least twelve countries. 

The damage needs to be contained, both in India and outside it.

To inform public, policymakers, researchers and civil society organizations around the world of the risks of DPIs, we will be undertaking a systematic analysis of how “open”, “secure” and “accountable” Indian DPIs really are. Our research project will audit the data collection practices of DPIs to document what entities operate these infrastructures, the data (and metadata) visible to them, and parties the data is shared with. It will also explore how slices of information from disparate applications are already being or can be combined to create a surveillance apparatus. 

📧
Please forward and share this post!

Subscribe to Internet Exchange

Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe