‘A cautionary tale’: Uganda’s surveillance state built on biometric ID program

The Ugandan government is using its national biometric ID program to crack down on its political opponents, a report revealed this week.

Program introduced ‘to identify criminals’

Uganda first established its National Identification and Registration Authority (NIRA) in 2014. The governmental body began issuing ID cards to citizens that tie their national identities to their fingerprints and digital footprints. Citizens are now required to use these IDs to vote, receive medical care, complete bank transactions, and even purchase mobile SIM cards.

Approximately 60% of Ugandans are enrolled in NIRA’s ID program, which was originally promoted by Ugandan President Yoweri Museveni as a way “to identify criminals accurately and promptly.”

NIRA-issued IDs are linked to personal data such as facial scans, fingerprints, license plate details, and mobile phone user data. Officials who have access to government databases can use a citizen’s ID to track his or her movements, social media accounts, and relatives’ places of residence.

‘No due process’

Nick Opiyo, a human rights lawyer in Uganda who has been persecuted for opposing the government, says there is “absolutely no due process” requirement that limits government access to citizens’ private data. Officials at various levels track citizens at will by accessing their biometric data.

“There is almost no confidentiality in my work anymore,” Opiyo told Bloomberg. “There’s pervasive fear and self-censorship.”

But it is not only officials who can access citizens’ biometric data. Sixty-seven private companies and government organizations can access the NIRA databases.

AI surveillance cameras help locate private citizens

Agather Atuhaire, a journalist and mother of two, published a report in 2022 on the government’s mismanagement of taxpayer funds. The government began tracking her phone records, social media accounts, and movements. Her landlord evicted her.

Ugandan authorities are open about the government’s surveillance capabilities. The country signed a $126 million contract with Chinese megacorp Huawei for an AI-based surveillance camera system. The CCTV cameras capture license plates and driver’s faces from passing cars.

Those cameras come in useful if officials want to track a private citizen who has never committed a crime and is not in the police database. Authorities can pull the taxpayer’s photo from NIRA and then enter it into the Huawei CCTV system, which will send an alert when its facial recognition cameras locate the individual. 

The Ugandan government is planning to roll out a new ID card which will capture even more biometric data, such as iris scans.

Bloomberg says Uganda serves as a “cautionary tale” for countries who are using biometric identity systems “without rigorous checks and balances.”

The UN’s vision

Biometric identity programs are increasing in Western countries, at least partially at the urging of the United Nations.

According to the UN, it is a human right for every individual to be issued a legal ID. The UN’s vision is that each individual’s digital identity will be tied to other aspects of his or her life, creating a kind of digital web. At the center of this web would be the ID, which would be accessible to government authorities. 

Frontline News learned last year, for example, that GAVI, a UN-sponsored vaccination body, began pilot testing a program in Ghana that immediately registers the biometric data of every newborn. At birth, infants’ fingerprints are scanned, as are the voices of their parents or caregivers. These data are used to create digital identities that track each baby’s vaccinations and allow him or her to receive government benefits.

The UN hopes that governments around the world will use biometric ID programs to track citizens “for climate change” and to “inspire behavior change.”

Biometric ID systems already used in airports

Several Western countries are already advancing systems like Uganda’s.

According to a report on airport travel trends, travel documents like passports and boarding passes by 2030 will have been fully replaced by AI-powered biometric technology that scans facial features and matches them to a digital identity. This information will be shared between governments to make air travel more “seamless” for passengers.

“Standardization of immigration and customs processes will be needed, including the sharing of facial recognition and passport data across international authorities. This will enable the integration of biometrics and AI technologies,” said the report.

Even now, in international airports like those in Dubai, Tel Aviv, and Los Angeles, biometric scanners use facial recognition technology to analyze travelers’ facial features, which are then matched against a database of faces linked to passports. 

Surveillance in the US

Last year, the Transportation Security Administration (TSA) began rolling out facial recognition systems in airports across the country to identify travelers. Passengers can insert their driver's license into a slot or passport onto a scanner and look into a camera about the size of a tablet. The camera uses an algorithm to analyze the passenger’s face and match it against their identification card.

But surveillance in the US is mostly carried out by private corporations who then may or may not share the data with state and federal governments.

In 2022, for example, a lawsuit revealed that Google has been using sophisticated technology to capture and store faces and voiceprints of Google users and non-users, including both adults and children. 

One of the ways Google captures this information is through FaceNet, a face-mapping technology which allows Google to identify and group faces together on Google Photos. FaceNet scans and maps the faces of both users and non-users on the app, which has been downloaded over 6 billion times, and stores them “for an unreasonable amount of time.” 

Another lawsuit revealed that during the pandemic, the Massachusetts Department of Health (DPH) worked with Google to tap into over one million Android smartphones for contact tracing.

The complaint alleged that a tracking app was secretly auto-installed on the phones, though it was not visible alongside other apps. The app, named MassNotify, could only be found by the user when opening Settings and using the View All Apps feature. If a user found the app and deleted it, the DPH simply had it re-installed. 

Surveillance in Israel

Israel’s Hawk Eye program uses license plate recognition (LPR) cameras to track vehicles “just in case their vehicle is involved in a crime in the future.” Police reportedly maintain a massive database containing data on the movements of vehicles belonging to taxpayers across Israel. Officials have said that the program is necessary for “detecting serious criminal offenses.”

In Tel Aviv’s Ben Gurion Airport, the Israel Police employ a secret artificial intelligence algorithm to profile and detain passengers at the airport who have no criminal history and provide no cause for suspicion. It gathers private information about citizens from government ministries, including databases from the Ministry of Interior, Ministry of Welfare, the Tax Authority and others. The algorithm then compiles the data, which may include socioeconomic status, marital status, relatives, etc., and matches them against a predetermined criminal profile. It is unclear what significance the algorithm assigns to various data. 

If there is a match, even if there is no criminal history, the passenger is detained at the airport by police before passing through border control. The reason for the detention is known only to police officers, who then conduct a search of the passenger’s luggage and may also conduct an invasive body search. 

Surveillance in Australia

Last year, Australia’s Finance and Public Service Minister Katy Gallagher announced plans to expand the government’s digital ID program. Each ID contains digital versions of government-issued documents such as birth certificates, driver's licenses, and passports, as well as the taxpayer’s unique biometric data. Over 10 million Australians currently use MyGovID to access any one of the government's 130 services. 

But Gallagher seeks to expand MyGovID to the private sector, where third-party institutions can access taxpayers’ digital IDs before providing their services.

In September, the Australian government also announced plans for a “national skills passport” which will serve as digital identification for employment. The passport will consolidate individual taxpayers’ skills, qualifications and education and will be accessible to employers. Treasurer Jim Chalmers, Education Minister Jason Clare, and Skills and Training Minister Brendan O’Connor say the passport’s purpose is “to help workers promote their qualifications and businesses find more skilled workers.”

But it is not only government institutions that are enforcing biometric ID programs.

Australian banks have joined forces to require biometric checks from customers, along with other restrictions designed to “combat fraud.”

The Scam-Safe Accord, as the initiative is called, is intended to “protect Australian consumers” by implementing “anti-scam measures.” All customers opening new accounts must provide at least one biometric data point such as a facial recognition check or fingerprint. Another possibility is a behavioral check, which will monitor customers’ behavior when interacting with the banks’ online systems. For example, users who copy and paste data into online forms when the customers whose account is being accessed usually key in the data might not be authenticated.

Surveillance in the UK

The United Kingdom is rolling out robust new traffic cameras across the country which will not only be used to catch drivers violating the speed limit but also those holding phones in their hands or not wearing seatbelts.

These “ultra cameras" are stealthy. There is no flash to alert drivers they have been photographed. The devices also use infrared technology and Automatic Number Plate Recognition (ANPR) to help identify drivers. The VECTOR-SR cameras, made by German manufacturer Jenoptik Traffic Solutions, run 24 hours a day, seven days a week, 365 days a year. 

Last year, British Policing Minister Chris Philp penned a letter to police forces nationwide urging them to increase their use of facial recognition searches. UK law enforcement has come under fire, though, for its practices regarding its databases and watchlists. Police have yet to delete over three million images of people who were never charged with a crime despite being ordered to do so by a court in 2012.