The Future of Biometrics and Digital ID in Lebanon: Assessing Proposed Systems for Elections and Social Assistance
Total Page:16
File Type:pdf, Size:1020Kb
The Future of Biometrics and Digital ID in Lebanon: Assessing Proposed Systems for Elections and Social Assistance January 2021 ACKNOWLEDGEMENTS Sacha Robehmed, an independent research consultant, was the researcher and author of this report. The report was edited by Grant Baker, who served as a contributing author, and Nerissa Naidoo, who also drafted the initial literature review. Additionally, Marianne Rahme provided legal analysis related to data protection and privacy and Nourhane Kazak provided copyediting support. Salam Shokor designed the cover and the report layout. The research was generously funded by Privacy International. All errors and omissions are the responsibility of SMEX. SMEX is a Lebanese NGO that since 2008 has worked to defend digital rights, promote open culture and local con- tent, and encourage critical, self-regulated engagement with digital technologies, media, and networks across the Middle East and North Africa (MENA). www.smex.org A January 2021 Publication of SMEX Kmeir Building, 4th Floor, Badaro, Beirut, Lebanon © Social Media Exchange Association, 2021 This work is licensed under a Creative Commons Attribution- ShareAlike 4.0 International License. Table of Contents Executive Summary 4 Methodology 6 What are Digital ID and Biometrics? 7 What is the Existing State of Digital and Biometric ID in Lebanon? 9 Biometric ID for Refugees 10 Role of International Actors 10 Role of Private Sector Biometrics Companies 11 Biometric ID in Lebanese Elections 13 Examining Arguments and Concerns for Digital and Biometric ID 15 Voter Identity Authentication 15 Voter Registration 16 Voting Location and Increasing Participation Credibility and Trust in Election Results 17 Infrastructure 19 Reliability 19 Legal Identity 20 Exclusion 20 Costs 21 Function Creep 22 Centralization and Efficiency 23 Privacy 23 Data Sharing Data Leaks & Management Issues Cybersecurity Breaches Concerns for Digital and Biometric ID Legal Frameworks 27 Data Protection 27 Discrimination 30 Conclusion & Recommendations 31 Recommendations to the Lebanese Government 31 Recommendations to International Donors 32 Executive Summary In Lebanon, passports, driver’s licenses, work permits, basic rights like the right to privacy; enabling increased residency permits and humanitarian aid all use systems surveillance; and potentially being used in harmful ways by that require biometric data — unique fingerprints and/or malicious actors. There is evidence that digital ID systems iris scans — of citizens, residents, and refugees, which are are exclusionary — often affecting the most vulnerable captured, collected, and stored. In 2017, the newly passed people’s ability to access government services. Additionally, electoral law stated that voters would use “magnetic voting national digital and biometric ID systems are costly, and cards”1 in the upcoming parliamentary elections. (Magnetic often need substantial and reliable infrastructures like cards boast a magnetic stripe, which corresponds to per- internet connectivity and electricity to function. sonal information, and they are commonly used as credit cards or for building access cards.)2 Later in the year, the Given these grave risks and concerns, digital and biometric Cabinet passed a measure to adopt biometric IDs instead ID systems should be carefully evaluated to understand if of the magnetic voting cards. The new biometric ID would their implementation is the best way forward. Would they still enable citizens to vote, but it also “serves as an ID, lasts solve the problems they are intended for? Are there any forever and can be used to complete all administrative less risky alternatives? And if moving ahead with imple- transactions, whether for social security, at the financial mentation, how can risks be mitigated? ministry... or anything related to personal civil status.”3 In this report, we aim to both assess the impact of intro- Given the reality of the political and ducing biometric ID on Lebanon’s electoral process and “bureaucratic landscape in Lebanon, it’s un- highlight concerns about the possibility of developing a digital ID that is attached to the provision of social likely that benefits of digital ID for citizens, services, especially given the insufficient safeguards such as efficient service delivery, would be currently in place. achieved. Yet the risks to individuals’ right to privacy are heightened, with insufficient For elections, magnetic voting cards, or biometric ID, would not impact Lebanese electoral fraud, as the challenges are legal frameworks and a history of govern- not in creating an accurate electoral roll or in verifying voter ment data privacy violations. identity. Rather, violations have been documented during ” voting (such as compromised secrecy of the ballot); or in The plan for these biometric IDs was not carried out ahead of the run up to the election when a party might confiscate the parliamentary elections in 2018. However, the Cabinet’s an ID card and then return it on election day in exchange amendment hinted at the government’s desire to build a for goods or favors.4 Biometric ID does not combat these national ID system that ties a biometric ID to the provision kinds of fraud. Another justification given was that magnetic of services. Given the current economic crisis in Lebanon, voting cards, or biometric ID, would allow people to vote the introduction of a biometric voting system seems less in their place of residence. International and local election likely to come into fruition, but the rollout of the digital ID observers nonetheless recommend other measures, such program for verification and authentication, particularly as developing an electoral roll registering voters in their to support social safety net programs, seems more viable. places of residence. Digital and biometric ID is considered by its proponents to Beyond the elections, other possible benefits of biomet- offer more efficient service delivery, enhance security, and ric and digital ID systems, including efficient delivery prevent fraud. The concerns are that digital ID systems may of government services, are unlikely to be realized in pose privacy and security risks by impinging on individuals’ Lebanon. There is also concern that a digital ID introduced 1 Lebanon, Law No. 44: Election of the Members of the Parliament, Issued on 17 June 2017, (Official Gazette No.27, June 17, 2017), http://aceproject.org/ero-en/regions/mideast/LB/lebanon-law-no.44-parliamentary-elections-2017 2 “Magnetic Stripe Card,” Science Direct, https://www.sciencedirect.com/topics/computer-science/magnetic-stripe-card 3 Nicole Hajal, “Report: How does the biometric ID facilitate the voting process?” Lebanese Broadcasting Corporation International, September 18, 2017. https://www.lbcgroup.tv/news/d/breaking-news/335830/report-how-does-the-biometric-id-facilitate-the-vo/en 4 Interview with Aly Sleem, Lebanese Association for Democratic Elections (LADE), July 6, 2020. 4 to facilitate a social safety net could grow into a broader, and organizations working in Lebanon, regarding digital national scheme, which could facilitate surveillance and and biometric ID. Secondly, we aim to inform civil society increase civic exclusion. Lebanon’s ministries and security and individuals in Lebanon interested in understanding agencies also have a history of data leaks, data security and learning more about digital and biometric ID specific breaches, and question marks over data sharing, sug- to our context. gesting weak technical infrastructure and that privacy has not been a priority. Our recommendations, which we expand on at the end of this report, are as follows: Moreover, current legal frameworks in Lebanon are insuffi- cient to protect individuals’ rights when digital ID systems To the Lebanese government: are implemented. The law related to data privacy in Lebanon, the E-Transactions and Personal Data Law, is outdated 1. Fight electoral fraud through electoral reform, not and does not align with gold standard legal frameworks biometric ID for data protection, such as the European Union’s General Data Protection Regulation (GDPR). While technically it 2. Strengthen legal frameworks offers some protections, in practice this is not the case. There is no independent data protection authority. This 3. Ensure sufficient infrastructure is in place role is instead filled by the Ministry of Economy which has the ability to give third parties access to personal data, or 4. Increase transparency around biometric and digital transfer it to foreign states. The E-Transactions Law also ID procurement and implementation makes massive exemptions for government ministries and security agencies and the law has not been enforced. To international donors: Given the reality of the political and bureaucratic landscape 5. Do not support biometric ID for the purpose of fighting in Lebanon, it’s unlikely that benefits of digital ID for citizens, electoral fraud such as efficient service delivery, would be achieved. Yet the risks to individuals’ right to privacy are heightened, with 6. Consult all stakeholders around biometric and digital ID insufficient legal frameworks and a history of government data privacy violations. 7. Refrain from excessive centralization of databases Our first goal with this report is to inform future actions of 8. Do not mandate digital ID system for provision of social the Lebanese government, international donor governments safety benefits 5 Methodology The research for this report was desk research and Given the