Part 1: Governance Rules for Public-Sector Platforms Can’t Wait (2019)

Advocates of Digital Identity Platforms Need to Address Questions about Power and Authority Now

By David Eaves and Ben McGuire

In March of 2017, the World Bank announced a $100 million grant to the government of Morocco for the Identity and Targeting for Social Protection Project, which would “expand coverage of a Unique Identifying Number (UIN) for the Moroccan population and foreign residents, and to improve targeting of Social Safety Nets (SSNs)… [which] will particularly benefit women by facilitating their access to social and financial services.”

Like myself and many others, the World Bank is enthusiastic about the potential benefits of identity-platform investments, which promise to increase sustainable development, boost savings and revenue, benefit healthcare, end child marriage, and empower women and girls. Less clearly addressed — and increasingly worrying to those working at the forefront of technology and government — are the potential risks embedded in these tools and how we as a society will mobilize to address those risks. This is a challenge the public is awakening to: One need look only at the mass protests across India in late 2019 around fears that digital government tools would help facilitate rendering some citizens stateless.

Governments and international agencies investing in these tools must ensure that rules establishing governance, authority, and accountability are at their core. This doesn’t just mean some clearly defined policies stored in a library. We need institutions that are empowered to manage complex new tools and strong digital-rights frameworks — possibly like the EU’s 2016 General Data Protection Regulation, or GDPR — that protect individuals. And these institutions and rights need to be enforced at every layer of the platform “stack,” from databases to applications to the services delivered to citizens.

A decade ago, Tim O’Reilly threw down a gauntlet to policymakers: Governments in the digital age should think of themselves as operating systems and adopt a platform mindset. In this new world, learning from the example of private-sector leaders like Amazon, governments would become providers of a technical infrastructure of common database and application layers that could be used by agencies, subnational governments, and civil society to radically improve and streamline services. Since then, nations like Estonia and India have led the charge in building digital platforms for government, generating exciting headlines and hopeful advocates.

The World Bank’s investment in identification for Morocco followed a series of reports on the state of identity ecosystems across Africa. This was part of a much larger World Bank project supporting foundational national identities platforms for emerging markets. Better identity infrastructure may empower governments to be more efficient in the distribution of public services like education, healthcare, and insurance. But the inverse can be true as well.

Western news outlets recently recoiled at reports that Absher, a since-deprecated government-sponsored application in Saudi Arabia, allowed the government and male citizens to track and control women. Absher sits on top of a database of passports and is not a true identity platform. But the underlying questions about the use of this tool are similar, and indeed, are more important in the world of digital platforms, which can help to organize and make accessible the vast amounts of data governments collect about their citizens. How can we help ensure that the tools we are building will be used for empowerment and transformation rather than to permanently reify existing power arrangements?

It’s urgent to address these questions now because the decisions made today will impact society for decades. Right now, dozens of emerging markets are looking at government platforms as a way to fundamentally reimagine how states deliver public services more cheaply and efficiently. Over the coming decade a new, 21st century core government infrastructure will be built. Will it be designed to serve citizens, or their governments?

The choice is not clear and the path of least resistance will not necessarily create the benefits we expect. In the worst-case scenario, big investments in platforms will allow powerful sectors of society to increase their locus of control, adding sophistication and precision to existing efforts aimed at surveillance and distribution of public benefits to favored groups. As the UN has argued, data-enabled government demands new kinds of social protection. One reason to have confidence in the long-term potential of platforms in countries like India is that technocratic faith in platform efficiencies has been matched against a civil society and populace that can mobilize to push back against perceived government overreach. Jamaica’s courts recently struck down a new national digital identity program based on privacy concerns. But not every national government is counterbalanced by the same kind of robust civil society; we should be careful about unilaterally empowering one sector in a way that can disempower others. This is not a technical problem to solve or a call to end platform investments. We need to define the governance of these platforms: who will build them, who will control them, and how they will fit into society.

The power of these tools demands a clear explanation of how platforms will be governed and controlled to ensure equity and accountability. It is critical for not only governments, but also the international development agencies funding these platforms, to tackle the following questions:

• Which agencies will own the construction and maintenance of the platforms? What agencies will devise policy for them, and who will enforce these rules? The agencies that build the platforms might not be the most appropriate home for them in the long run. Good governance suggests that responsibility for drafting policies, operations, and enforcement is best controlled by different entities. What models exist for this?
• Who will control access and what will be shared across agencies? Platform owners will assume enormous power in a more integrated public sector; how can governance models and ministerial oversight ensure fairness? Government service rules are already opaque to most citizens; what rules should exist to ensure not only transparency, but also accountability for decisions that are made far from the point of service delivery?
• What data will these platforms create, and what should we do with it? Citizens want their governments to be more adaptive and responsive. They are also concerned about what their government knows about them. Today, willingness to share data with various government agencies is based on the presumption that it can’t or won’t be shared. What happens when that informal understanding falls apart?

When national governments invest in platforms, they must think critically about where the platforms will live, what kinds of internal mandate authority their owners will have, and how those structures will impact the exercise of national power. They need to clarify precisely how the data that lives within and flows through the platform will be stored, protected, and controlled. They need to explain how citizen users will have robust input in design phases, as well as accessible accountability tools for maintenance and evaluation. Most important, we all must grapple with the capabilities of the state brought to scale and speed by the power of platforms. Nothing about the technical back-end of these tools inherently helps us answer these questions, and the recent history of platforms has been generally positive. But if — or when — national power flows to actors who are uninterested in preserving equity and accountability, the rules may matter very much.

To be clear, we aren’t launching a salvo at national governments that are exploring platform tools, nor castigating the international development agencies and others that are supporting these investments. Platforms truly do have enormous potential to radically improve public services and the lives of human beings around the world. To date, the development of these tools for digital transformation has been inspiring to watch and document. But while we have seen plenty of excitement about upsides, we have yet to see adequate attention paid to the potential risks and dangers of the new powers these tools create. Scholars like Shoshana Zuboff are sounding the alarm about the ability of tech giants to conduct mass surveillance for ad sales and product research. But the consequences of this monitoring would pale in comparison to what similar tools could accomplish in the hands of a motivated state.

Platforms, particularly identity platforms, could generate a radical shift in a national government’s power over and proximity to citizens, and in the power dynamics between various parts of government. We need to ensure that the scale and efficiency gains for government are met by a set of governance rules that protect privacy, preserve safety, and promote accountability. Governments and international institutions that are investing in these tools today need to act to define the new rules of governance and the control they will embed in platforms. Money has been spent, projects are underway, and platforms are coming, whether we are prepared to deal with their consequences or not. There is no time to wait.