Why a ruling on digital ID by Kenya's High Court has global implications for online privacy

For the estimated 1 billion people worldwide without a legal ID, digital identity programmes provide a unique opportunity for increased inclusivity, better financial participation, and wider access to government resources and initiatives.

However, for the countries implementing these programmes, the associated benefits come with a host of thorny tradeoffs surrounding privacy, security and logistics.

Following a landmark ruling by the High Court of Kenya in 2021, which concluded that the rollout of a country-wide biometric ID scheme was illegal, many countries continue to grapple with the legal, regulatory, and ethical boundaries of national identification systems.

Nationally, many countries lack clear legal precedents to govern processes and infrastructure in the digital identity space, and international consensus is just as, if not more, jumbled.

The Kenyan case echoes challenges faced by the EU, the US, and other governing bodies when it comes to digitization of national ID programmes, and the subsequent expectations of privacy for individuals and groups.

Kenya’s digital ID programme, called the National Integrated Identity Management System (NIIMS), was ruled illegal by the High Court because there was no clear documentation of the data privacy risks, nor was there a clear strategy for measuring, mitigating and dealing with those risks.

Related concerns about data privacy and security have arisen in other digital ID platforms as well. For example, India’s Aadhaar is the world’s largest biometric digital ID system.

Registration is linked to biometrics and demographics, and can connect to services including SIM cards, bank accounts, and government aid programmes, making financial systems more inclusive.

Despite these advantages, Aadhaar has seen pushback regarding feasibility and privacy. For example, there are concerns that the Aadhaar database can be used to profile ethnic minorities or violate the privacy of residents.

The Kenyan NIIMS ruling and experiences from other global digital ID platforms highlight three major recurring issues that characterize many national systems:

At their core, these concerns stem from the centralization of data, which increases the likelihood and potential damage of external cyberattacks. It also increases the viability of insider threats and lowers barriers to systematic discrimination from within government.

These threats become even more pronounced to the extent that digital ID platforms are linked to different services and use cases within a nation. As digital ID systems become more prevalent, there are compelling reasons to reduce the degree of centralization inherent to their architecture and operation.

However, managing and mitigating the degree of centralization in digital ID systems is highly nontrivial; the design space is vast, with subtle tradeoffs. Nation states should consider both technical and nontechnical approaches to manage centralization of ID databases.

First and foremost, to navigate this complex landscape, a multi-stakeholder approach should be taken to consider a variety of voices before rolling out new digital ID programmes. For example, many digital ID schemes (such as Estonia's, Aadhar and MOSIP) were developed through public-private collaboration.

Many governments simply do not have the in-house capacity to roll out and maintain a new digital ID system. At the same time, care must be taken when outsourcing development and maintenance.

ID systems are critical infrastructure, and once governments are locked into a vendor, it can be difficult to back out or make changes, due to technical debt and interoperability requirements with downstream users.

From a technical standpoint, one technique for reducing the implications of data centralization involves partitioning databases and enacting appropriate access controls. This enables a database of digital IDs to be split according to attributes, such as the region where the identifier was first registered.

Operators can be given access to only a subset of the data. Such access controls reduce the damage that any single malicious agent can exact, at the expense of greater system complexity and fragmentation.

However, access controls alone are not enough to mitigate the risks associated with storing sensitive ID information, such as biometrics.

A major risk surrounding biometrics in particular is that if, and when, an attacker obtains these credentials for a victim, they may be able to impersonate the victim indefinitely, since a user’s biometrics do not change.

These risks can be mitigated using emerging technologies like computation over encrypted data with rotating keys. For example, homomorphic encryption could be used to store only encrypted iris scans and conduct authentication over encrypted data – thereby significantly reducing the information that is available to the ID database operator, as well as to potential hackers.

At the other extreme, a significant problem with existing ID solutions today is their lack of interoperability, both across nations and services. For example, registration systems for nationalized healthcare do not necessarily communicate with systems for government aid.

The fragmented state of digital ID systems inherently limits data centralization, but it can also hamper their potential benefits. Possible solutions to this problem include standardization of digital ID.

For example, MOSIP is intended to be an open-source digital ID platform for multiple nations and use cases. Others have proposed decentralized, interoperable architectures for storing digital identifiers.

These architectures would enable existing ID issuers to issue their own identifiers while maintaining ID databases in a decentralized manner – for example, on a blockchain maintained by different stakeholders.

Such technologies are relatively untested compared to more classical databases, and could introduce new challenges surrounding governance and database maintenance.

Notice that decentralized architectures do not inherently help with the problem of centralized data aggregation; many blockchain-based data storage architectures are designed mainly to provide transparency, not confidentiality.

Privacy considerations, and well as the potential for exploitation, are incredibly important when it comes to building inclusive and valuable national digital ID systems.

This infrastructure has the potential to generate value and usher in a new era of legal, digital and financial inclusion.

However, there must be a solid foundation of data protection, decentralization, and an environment of digital trust for these programmes to succeed.

The Kenyan courts have simply done the work for the rest of their peers by flagging these issues at the outset.