Galleries more

Videos more

Dictionary more

I.D. Card Findings: Biometric Photograph Remains Elephant in Room

25.07.2021

The findings in the complaint sent to the UN International Committee on Civil and Political Rights by Dr. Rajah Madhewoo will give the Mauritian State pause for thought before it just goes ahead with any new ID Card “state-of-the-art” technology. Government has already said it is about to issue new cards, as the old “new cards” reach expiry, so before that, the legal framework will need to be reviewed to respect the Findings against the Mauritian State for arbitrary intrusion into people’s privacy. This is important.


The Findings have also given the rather meagre protection of privacy in the Mauritian Constitution a bit more “body”. This, too, is important. 


But, there is an elephant in the room. 


In times of mass surveillance and what with all the new Safe City cameras all over the country, the dangers of the biometric photograph not only on our ID Card but also still stored in the system’s Central Data Base are exposed as the main problem with the ID Card system. Dr. Madhewoo’s complaint seems not to have canvassed this, the most dangerous aspect left in the existing ID Card system. What he objects to is the taking of fingerprints and storing them on the ID Card, itself. It is on this point that he has, however, made an important victory.


Remember that, after a long protest movement mainly spear-headed by LALIT and CTSP, and taken up later by the then-Opposition MSM, the fingerprint data in the Central Database was destroyed after the Jugnauth MSM came to power in 2014. Ironically, destroying the fingerprint data in the Central Data Base is what has led to the Madhewoo victory in these Findings.


However, the Jugnauth MSM Government, while destroying the fingerprinting data, did not destroy the biometric photos’ data, which we must not forget is not just on the card but is also stored in the Central Database, itself. That is the elephant in the room.


This makes an important victory have a hollow ring to it. LALIT, at the time, again and again pointed to the real danger remaining being in the photos’ biometric data being stored centrally. The hollow ring comes from the main danger having been missed. The main danger lies not in the fingerprint minutiae stored on the Card you keep on your person, the basis of Dr. Madhewoo’s case, but in the facial recognition biometric photographs both on our ID Cards and also still stored, more importantly, inside the Central Database, and now, taken together with the subsequent Jugnauth Government Safe Citydata with facial recognition technology. This biometric data being stored centrally is surely more dangerous than minutiae from fingerprints on a Card in one’s possession. This biometric photograph and its centralized data base is the real intrusion into privacy. This will allow the real breach of the assumption of innocence in Criminal Court proceedings. That is the real Big Brother “scary” element to the ID Card System, specially when added to the Safe City intrusion.


Dr. Madhewoo won his case on a point that makes the Mauritian Government look foolish. The Government’s main argument was as follows: It admitted that the fingerprinting was indeed an intrusion into privacy, but said it was a necessary intrusion in order to prevent, in the public interest, identity fraud, and thus legal under the Constitution. However, once the Central Data Base of fingerprints was destroyed, it was no longer possible to prevent identity fraud with the fingerprint minutiae because the only place they existed was on your own card. As the Committee put it, “this change [destroying the central data base fingerprints] renders the objective of making comparisons with previously submitted biometric data ineffective and thus affects the ability of the State party’s authorities to prevent identity fraud.” In fact, the Committee accepts that it makes data theft easier if the data is stored on the ID Card, which can be lost or stolen. So, the Government’s logic broke down. So, the fingerprint minutiae on the card were found to be in violation of Article 17 of the International Convention. The Article reads as follows:


“17. 1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.


“2. Everyone has the right to the protection of the law against such interference or attacks.”


Thus, the interference in citizens’ privacy, which the Mauritian State admitted fingerprinting to be, becomes “arbitrary” when it is no longer in the public interest as a means of preventing identity fraud. The findings also refer to the storage on one’s own ID Card of the fingerprint minutiae not being a safe way to store the data. But, we might add, this is at least in one’s own possession, unlike the facial recognition data in the biometric photo which is stored centrally by the State as well.


In LALIT, we have always been critical of the Mauritian State’s arguments based on the supposed dangers of “identity theft”. Inter alia, we draw attention to the real-life fact that the Government has never produced evidence of this being a widespread problem at all, let alone specifically in relation to the ID Card needing to contain biometric data.


Anyway, taken as a whole, the Findings are rather peremptory and somewhat threadbare, as a way for the Committee to make public its very first Findings on this internationally vital subject i.e. on this immense, new type of intrusion into human privacy that the whole of the new biometric data part of State surveillance implies. This point gave rise to a “dissenting” judgment.


“Given the complexity of the matter,” as one of the dissenting views to the ICCPR Findings points out, “it would have been prudent for the Committee to ask for third party submissions, to elucidate the key issues put before it. Article 17 [of the Convention] was drafted at a time when advanced biometrics technology was not available...” The kind of input that the Dissenter is suggesting might have helped produce more thorough Findings. 


The Findings, as they stand, imply that, had the Mauritian State not destroyed the Central Data Base copies of fingerprinting minutiae, its system would not be in violation of Article 17 and would be just fine. In fact, this somewhat unsatisfying technical or bureaucratic form of argumentation, diverging from the philosophical issues in the legislation, was what made previous Findings of the same Committee on the Best Loser System issue so unsatisfying: they found, inter alia, that the Mauritian State can use the BLS if it just proceeds to conduct a new communalist census of the whole population. This is the exact opposite of the remedy being sought by the Rezistans ek Alternativ case before the ICCPR. Again, those Findings, too, represent a technical or bureaucratic approach to a philosophical legal issue. What is so unsatisfactory is that the issues at stake are so vital, and the real effects of the Findings could be so counter-productive: in the Madhewoo case, it is implied that all would have been hunky-dory if the central data base for fingerprints had not been destroyed; in the Rezistans case that all will be hunky-dory if a new communal census is embarked upon.  Both would be serious, even mortally dangerous, results for not just the people putting in the Complaints to the ICCPR, but to the whole of society – worldwide as well as in Mauritius in the privacy case, and for Mauritius in the Best Loser case. These types of technical judgment tend to make mobilization more difficult. They tend to create more confusion than they dissipate.


Another dissenting view in the Madhewoo case questions the locus standi of the person putting in the complaint for not being an actual victim (yet) because he had not yet taken out his “new” ID Card and had thus not actually suffered the intrusion into his privacy of having to give his fingerprints. The Optional Protocol to the Convention requires that people need to be actual victims. In the Introductory paragraph it specified that the Committee is empowered “to receive and consider ... communications from individuals claiming to be victims of violations of any of the rights set forth in the Covenant.”


Anyway, the Findings are important in that they force the Mauritian State to take note on the importance of peoples’ privacy. 


In addition, the Mauritian State is a signatory to the Optional Protocol to the ICCPR. This means that it accepts as binding the Convention. This means that the Findings will make the Mauritian State more careful about interference into privacy, via the new ID Cards due soon, and in general. So, the Mauritian Government will need to address the vital issue before us: the collection of data on facial recognition via the combination of ID Cards and Safe City Cameras. We note that Minister of ICT on 16 June in the National Assembly said that “the Mauritius National Identity Card Scheme, MNIC introduced in Mauritius in 2013, has now reached its end-of-life as it has been in operation for almost 10 years. It is now high time to revamp the whole system.” He also said, “... it is proposed to replace the current MNIC by a state-of-the-art technology with enhanced security features and which could be used to provide a wider spectrum of customized e-Services ... and as indicated it will be implemented by 2023.” So, the Government has a whole new set of constraints on its dreams, or nightmares, of new technology and its “wider spectrum” of supposed “services”.


And this brings us to a couple of more general points. 


The degree to which Mauritius, or any other State that signs up to the Optional Protocol, respects its “binding” obligation depends on the degree of mobilization of its people, in particular its working classes. And this, in turn, brings us to an important paradox of human rights Conventions: The more mobilized a State’s people, the fewer binding Conventions it will sign; the less mobilized a State’s people, the greater number of binding Conventions it will sign. 


And in general, human rights Conventions and Charters are always minimalist: They are agreed to by a State or an international body in order to calm down the previous rebellion of the broad masses. They thus represent the very minimum that the State accepts to concede to the broad masses of the people to put an end to the previous mass mobilization they participated in. As the Universal Declaration of Human Rights, itself, admits, “Whereas it is essential, if man [humanity] is not to be compelled to have recourse, as a last resort, to rebellion against tyranny and oppression, that human rights should be protected by the rule of law”.   


And as for preventing criminality, we need other ways of keeping our cities safe than a surveillance state. We mean there is no short cut. We have to struggle for full employment in meaningful work, for food sovereignty and for housing for all. We should not allow the introduction of dangers even more difficult to deal with than individual criminality, like a repressive state. A repressive state leads essentially to “criminality” by a powerful body: the State. That is more difficult to reverse.


Either way, we need to mobilize politically, and around a common program. This way we will, when we are, to quote the Universal Declaration on Human Rights “compelled to have recourse, as a last resort, to rebellion against tyranny and oppression”, it will be on the basis of a common understanding of what kinds of new rights we intend to fight for, for all of us.