New biometric smart ID cards (2)

Jane Duncan
In South Africa, low levels of public awareness of the dangers allowed biometrics to be introduced to the social security system, and then extended to the national population register. The technology Press have tended to publish fawning articles extolling the virtues of biometrics, while the investigative Press have focussed on corruption and mismanagement in the department.

The fact that the reportage has been confined to a fairly narrow range of issues has left the broader issues around privacy and surveillance largely unaired.

With one or two notable exceptions, the technical part of society has not spoken out.
The department is idealising biometric technology, arguing that not only will the system prevent identity theft but it will also become a gateway to service delivery and a lynchpin of all citizen engagements with government.

In fact, the department has said that, in future, South Africans may use just one card for all their official documentation requirements, including identities, driving licences, national health insurance and social grants.

As several other departments had expressed interest in becoming involved in the project, the department would look into how it could upscale the chip on the cards in order to accommodate them.

The department’s statements suggest that data sharing across departments is envisaged, and that function creep is considered unproblematic.
They are also being vague about the future shape of the system, and have, for instance, floated the possibility of extending the system into electronic purses.

In response to a parliamentary question on this very issue, the department said that the card “. . . will include, amongst others, demographic information which is in the current green bar-coded ID book, a picture, fingerprint biometric security features and other security information which cannot be disclosed for security reasons”.

This reply implies that the number of registrable facts is likely to increase in time, and the mind boggles at what is meant by “security information”.

The department needs to be much clearer about the purposes the ID card and database will be put to. To its credit, though, it has instituted an elaborate audit trail to deter officials from misusing the database to commit fraud, but this is unlikely to deter hackers.

Freedom of expression has been hugely controversy in South Africa, yet the related right to privacy has attracted practically no debate, possibly because the right lacks a dedicated civil society champion.

How much information should the state have about its citizens, who have already been “RICA’d”, “FICA’d”, “e-Natis’d” and “e-tolled”? In the absence of this debate, South Africa is well on its way to becoming a database state.

The one ray of hope is the newly promulgated Protection of Personal Information Act, which promises to stop misuse of personal data.
The Act is lauded widely as a very good law, but it remains untested, especially when it comes to national security matters.

Also, much depends on the robustness of the soon-to-be-created Information Regulator, meant to investigate breaches of the Act.
The Act applies to criminal justice and national security matters only if they do not offer sufficient privacy safeguards.

In cases where these safeguards don’t exist sufficiently, then the Act forbids further processing of information by state bodies, unless i t is necessary to avoid prejudice to the maintenance of the law by any public body: a rather fluffy formulation.

However, the dangers of centralised biometric databases go beyond the Act; they call into question the very wisdom of biometrics itself, given that the solution that it offers to problem of identity fraud may well be worse that the problem itself.

Biometric technology on a large scale is untested and by no means infallible, and when put in the hands of a state that is increasingly at war with its citizens, it can become a dangerous technology too.

In fact, in time, people may come to recognise biometrically-based databases, including those back-ending ID cards, for what they are: a dumb idea.
Ducan is a Professor of Journalism from the University of Johannesburg.