Thousands of Afghans relocated to UK under secret scheme after data leak

This is exactly why Bruce Schneier describes data as a toxic asset. Collecting huge databases about people can and has put lives at risk.

THE GUARDIAN: Conservative ministers used an unprecedented superinjunction to suppress a data breach that led the UK government to offer relocation to 15,000 Afghans in a secret scheme with a potential cost of more than £2bn.

The Afghanistan Response Route (ARR) was created in haste after it emerged that personal information about 18,700 Afghans who had applied to come to the UK had been leaked in error by a British defence official in early 2022.

This data-leak happened not just because of security failures, but because a vast amount of data about Afghani citizens was collected in the form of a digital national ID scheme that was partly funded by the US and the EU.

Privacy International warned about this danger back in 2021 and now the chicken have come home to roost.

PRIVACY INTERNATIONAL: […] there are inevitably serious concerns about how the biometric data it contains could be used for malicious identification by entities emerging in power to ascertain their own control. The data stored could reveal very sensitive information, from socio-economic status to gender and ethnicity - easily derived from father and grandfather’s names and mother tongue. This information might be used by entities to identity and target opponents.

Over the years, though, there have been evidence of the risks posed by the development of biometric databases in Afghanistan. They were starkly illustrated when local journalists reported in 2016 and 2017 that Taliban insurgents were stopping busses and using biometric scanners to identify and execute any passengers who were determined to be security force members.

Afghanistan’s digital national ID contains:

Photo
National ID Number
Full name
Father and Grandfather’s name
Physical Description
Place and DOB
Sex
Marital Status
Mother tongue
Profession
Biomatric data

The UK is currently proposing to adopt a digital national ID scheme called BritCard and privacy watchdogs like Big Brother Watch are fighting against it.

One thing I am curious about is if there has ever been a country that had a national ID scheme for years, even generations, and then decided to dismantle it?

Because if people have been used to a mandatory national ID for years, I would imagine it being extremely difficult to make anyone care to dismantle it. I’d say it’s damn right impossible.

Not that I can think of.

Closest thing would be countries that no longer exist due to external factors. It’s a huge transition from having national IDs to not having one after all.

The real question is: What countries do not require a national ID? Is it even possible to avoid one due to soft factors (i.e. applying for social services or travel)

By national ID, I mean ID cards with a unique permanent number that proves your citizenship, and in many countries is mandatory to carry on you at all times once you’re 16 or 18.

I don’t mean passports or driver’s license. Those expire.

Also, I understand that some countries like the US may technically not have a national ID scheme, but you could argue that American social security numbers serve as national IDs as they are unique permanent identifiers assigned to every American citizen.

Wikipedia has a fascinating article about national ID schemes across the world.

It’s divided in 3 sections:

1. Countries with compulsory identity cards (Belgium, Argentina, Greece)
2. Countries with non-compulsory identity cards (France, Germany, USA)
3. Countries with no identity cards (Australia, Canada, UK)

Yeah, I pretty much meant that definition. I just didn’t specify the national scheme part but assumed that was clear. Sorry about that.

What all three categories (compulsory, non-compulsory, none) encounter would be the social issues associated with dismantling an established national ID system or migrating to an alternate one.

In the US, this would be like implementing an formalized ID program and deprecating the role of Social Security Numbers and Driver’s Licenses as primary means of identification, causing some annoyances with paperwork for the next few years but ultimately simplifying the data collected.

On the other hand,a country with a national ID card system that turns it off one day will have to reckon with millions of their own citizens not having a reliable method of identification. I presume that not everyone can drive or have thought about leaving the country to obtain these secondary ID cards.

I’m sure that this problem isn’t AS bad across the world; people are ultimately used to the norms established in their country and have survived without compulsory ID. What is difficult is the short-term consequences of change itself, even in the name of data privacy. Convenience is a huge trap people fall into

Yes, it would be very challenging to successfully dismantle with creating chaos. That being said, in the real word, there are still millions of people, if not a billion in total, who do not have any form of ID, despite many of them living in countries with national IDs. So it’s not like national IDs have completely solved the problem they were aiming to solve.

And with biometric physical and digital ID, you have to provide more data to qualify, like your fingerprints for example, which some people cannot provide. Some people have jobs where they use their hands to the point that they cannot provide fingerprints.

I also know people with regular jobs who have registered their fingerprints to access places, and it doesn’t work for them. The system fails to recognize their fingerprints.

Yes, @em wrote a brilliant article about this very topic. I’m currently trying to deter my neighbors from falling into that trap with smart meters. But I think it’s important to study the cases where legal norms that were widely accepted are being challenged, or even better, successfully dismantled.