 And this now, the following talk, is a really just-in-time service, because Malawika Jaram was in Hong Kong yesterday, or something, and was flown in from Hong Kong just now. And there was a special ferry going on to take her over to here. So everything was made possible by the great team of the angels we have here. And I believe this really, really is worth a special kind of applause. But also Malawika did a lot to come here. So I think she also deserves the same kind of applause just for being here. But I believe also the topic she is speaking about is very important. The talk is biometric ID cards by the billion. I don't think that I should say too much, but it's about how they introduce volunteer-based ID cards with biometric features in India. Malawika Jaram! Okay, I wish all conferences were this easy. Just showing up gets you applause. But I think in the field we're in, just showing up is half the battle solved. Not enough people show up for the right reasons. So I'm just going to, first of all, want to thank everyone who helped to bring me here. As she said, I was in Hong Kong yesterday, and here I am. Thank you, Air Travel. And the few countries that don't impose borders on you. But soon they will. So I'm actually going to talk about the Indian ID project, but I'm actually going to kick off with something a little different but related. So I'm going to throw out a quote, and I want you to tell me, guess where it's from, to allow the trustworthy to roam everywhere under heaven while making it hard for the discredited to take a single step. What do you think this refers to? Anyone? Sorry? Confusion? Very close, actually. Sorry? If you have questions, can you please use the microphones? Anyone else? What do you think this refers to? Do you want me to repeat that? Allow the trustworthy to roam everywhere under heaven while making it hard for the discredited to take a single step. Nothing? Some people usually guess Black Mirror, but it's not. So it actually refers to something from China. It's the new social credit system, which some of you may have heard about. That is in the official document. This is how governments write documents in certain countries. And to me, it was a really creepy document to read because it talks about how one of the aims of the project, the hubris of the project is amazing because it's not just about the social. It's not just about credit rating, but it takes both of them and adds a few steroids and amps it up with no laws, which is super creepy. But they actually say in their policy documents things like, we really want to establish a sincerity culture. I hear sincerity culture and I think Borat, you know, makes a sincere country of Kazakhstan or whatever, but it's a really creepy project. And I think the reason I find it so fascinating is the lack of resistance to it is very similar to the lack of resistance we have to the identity project in India. And it's also a very top-down method of surveillance while pretending not to be about surveillance at all. And it has a very patronizing, very neoliberal twist to it about, oh, it's going to make life better for everyone. And you know, we've heard that before. We haven't drunk that Kool-Aid, so I don't see why we need to start now. But the Indian ID project is really fascinating. How many people know anything about the Indian project? You people? Okay. So when I used to be a practicing lawyer for my sins, not anymore. And when I went back to India, I think one of the reasons I got so interested in privacy was within seconds of getting a SIM card, I started getting junk. My parents didn't know what my phone number was, but apparently insurance companies knew I existed. And a few days later when I started getting a lot of super creepy ads for health-related things like disproportionately, you know, until then it was a mix of get married, here's your astrology sign, you know, here's your horoscope. This is why you aren't married, because your horoscope is in the wrong ascendant, blah, blah, blah. And suddenly I'm getting this spate of health stuff. And I said, is it a coincidence or did a new person just get my number or what's going on? And I was driving by a clinic where I just done blood tests. And I was waiting in traffic, in a traffic jam, and I noticed that literally across the street from the clinic was a data broker. And I said, are you serious? Is it that simple? A guy goes to have a smoke with his friend and picks up the customer list from that day, and like starts spamming all of us with advertising about insurance schemes. Like, is it really that simple that that kind of data sharing happens? And I thought, oh, I'm going to complain. You know, I'm a lawyer. I have an overdeveloped sense of justice. I don't know which came first. But I thought, OK, I need to complain. And I thought, oh, wait, I'm not in England anymore, or Kansas. We don't have an information commissioner. We don't have a data protection authority. We don't even have data protection laws. Who am I going to complain to and on what basis? And that's sort of what actually made me switch from being a practicing lawyer to actually investigating privacy, because I would talk to people. And this is when the ID card was just being rolled out. And I would talk to people and say, don't you find this super creepy that you have to have your biometrics collected? And it's two finger prints. I mean, it's both your irises. It's all 10 fingerprints. It's facial recognition and a set of fields of data. And I said, why are people not on the streets protesting and burning stuff down? And everyone told me, and this is a very flattened response. But the sum total was, you've just been away too long. India doesn't care about privacy. We're not private as a culture. Asians, we're not about the individual. That's a very Western enlightenment construct. It doesn't apply to us. We're all about family. We're all about society at a larger collective level. We don't really give a shit about the individual. So you've just been away too long. You have Western ideas of what privacy means. And I thought, OK, I could tell them about the ICCPR, which we're a signatory to. I could tell them about human rights jurisprudence. But I would actually turn around and say, do your parents know you're gay? And they're like, oh my god, I'll lose my inheritance. Shut the fuck up. Or I'm like, do they know you're dating a Muslim woman? Oh god, no. Do they know you eat steaks when you're not at home pretending to be vegetarian? Do they know you smoke? Do they know you smoke weed? All of the answers to that were like, ah. And I'm like, OK, so you have an interest in privacy. So you may call it something else. You may not have it under the umbrella of privacy, but you do care. We all have secrets. And if you don't, please leave the house and get a life. So this was what got me unpacking this whole idea of, is the idea of privacy so alien to us that we don't feel the need to protest when something is egregiously invasive? And the reason this is big, I'm just going to fast forward a little to now and why it's so important. I'll explain the scheme a little. But right now, our Supreme Court has just concluded seven days of hearings on whether we even have a constitutionally protected right to privacy. And this came about because there was so much litigation against the Biometric Identity Project that have been percolating up through the courts, which have cynically or for good reason not looked at them so far. And they finally took this whole batch of petitions together to actually unpack this question of whether we even have a right, because our government very cynically decided that a very good argument to make was, well, if we don't have a right to privacy, where's the question of this program invading it? Which is masterful on one level, but also deeply disrespectful of every piece of jurisprudence we've built up till now. So the project was intended to be a welfare measure, as so many of these things are. It's for the poor. The poor are going to get screwed more than anyone else disproportionately, but that doesn't seem to matter. And a few years ago when I'd given talks about this, I'd compared it to all kinds of other efforts, all kinds of other ID cards that have failed. Why we need one more? Is this one ID to rule them all? And if you're not actually making all of those other identity programs invalid, why do you need a single identifier that's actually going to aggregate all of that information? So if I have a passport, I have a driver's license, I have a tax identification number, which to some extent are secure because they all function in silos, they don't talk to each other. And suddenly you're talking about this one number that's going to have your biometrics attached, so everybody wants those attached. Because to me, this is seen as an assault on the poor and it's an assault on people who don't fit the norm. So the idea is that people don't fit within the mean and they assume everyone is fraudulent, everyone is a criminal, people are out to file taxes incorrectly, people are not on the tax bracket at all, or people have actually committed some kind of fraud to get welfare twice. So instead of solving the problem of why welfare delivery fails, why don't we just solve it with an identity project which actually doesn't tackle the welfare problem, but it tackles a completely different one. And by pretending that it's an open source project, you can make a whole population keep quiet about the risks because they're like, yeah, I kind of think it's creepy, but oh my God, biggest open source project in the entire world ever. I think I'll work on it, right? So a lot of people started moving back to India. We had this reverse brain drain where people said, this is a really huge progressive project that's going to give people entitlements. We want to work on it. And I think a lot of people believed in it for the best possible reasons. They genuinely thought they were doing good. They actually thought that for a country where you don't have a good system or recording births and deaths, you don't have a good way of knowing where people live. You don't have demographic information that can help a government decide where do I need to put a new school? Who do I need to send money to? It can be super useful. Whether you need to do it this way without any safeguards is a different question. But I think a lot of people felt that this could be enabling. This could empower a lot of people. And they got involved in it for all kinds of reasons. And at the time, I kind of worried that in seeking to include everyone, was it actually excluding the digitally illiterate? Was it excluding the marginalized? Was it excluding certain types of people? And I found that actually that was really true. And I think it came home to me very clearly, very early on in the project when I was invited to speak at probably one of the most interesting conferences. It was organized by the local LGBT community in Bangalore. And it actually brought people from a whole bunch of villages. So they weren't sophisticated users. They'd never touched technology in any meaningful way. They probably didn't even speak English, a lot of them. Some of them had dumb phones, not smartphones. But they had heard that this project was seemingly empowering because you could identify, for gender, you could say M, F, or T. For a country like India that can be so socially conservative, T is huge. So everyone thought, wow, this is amazing. This is so forward-thinking of the government. Except people who've been screwed over and over again, they don't think that way, right? So they're sitting there going, wait, am I going to be on a list somewhere? Do they now know where I live and they have my address and they have my data and they can use my data in fraudulent ways to actually incriminate me? Like, do I really want to sign up for this? Or is it yet another reason to stay underground and under the radar? And I was the only lawyer in the room, so everyone turned to me with legal questions that completely messed with my head because they were things that nobody has thought of in the project. You know, a couple of people said, well, I'm a manual laborer. I don't have what the authority thinks of as good quality fingerprints. I keep trying to register and the system keeps rejecting me because my fingers, you know, the walls have been eroded away by very hard labor, so I don't register. So what happens? Or I register, but the false acceptance and the false positives and false rejects are so high that I'm always having to find 16 other forms of ID to prove who I am. So what's the point of this project? And then there were people who said, well, I'm going through a sex change. I'm taking hormone replacement therapy right now. Are my fingerprints gonna change as my hands get more muscular and bigger? Will that keep pinging the system and be rejected? I was like, I don't know. And certainly the government didn't know. But I think the other thing that actually really stuck with me was someone said, well, I've actually inherited three pieces of land being the oldest son in a Hindu Brahmin upper caste family on the assumption that I'm the oldest man. If I now go and self, I've never had to self-identify. I've preferred to believe it's, I'm gender fluid. Now if you tell me to fix myself in a system as being one or other, and if I choose to be either female or transgender, does that mean I lose my property? Are they gonna come and take my land away from me because I'm no longer male? Do the rights under which I succeeded to inherit this property, do those fall away? And what's the grandfathering clause that actually allows me to hold onto my land? Well, of course there was nothing and the government hasn't thought about these outliers at all. They barely thought about the fact that most people can't even register. And then when I talked to people at the authority, they said, oh no, you don't have to worry about that because the error rates are very small. They're only about a few percent. I thought a few percent for a population of over a billion is a lot of people. And then it turned out that because of errors that are specific to India with the manual labor problem of the bad quality fingerprints and the fact that a lot of people due to malnutrition have really bad cataracts. So their iris scans are also defective. If they register at all, they can be easily spoofed. So for these reasons, the error rates for biometrics in India are closer to 15%, which is like way off the charts for any kind of safe project. And 15% of 1.2 billion people is hundreds and millions of people who are going to be left out of a project that is supposed to include them, but also that has become the single way that you can interface with your government, the single way that you can access benefits services welfare. And if you're poor, if you're marginalized, if you're entitled to certain benefits and subsidies because you live below the poverty line, which is a lot of people in India, and the whole project that is supposed to help you get those benefits keeps rejecting you and keeps saying your body is found wanting apart from all the physical and the legal issues like the emotional affective reasons a system keeps telling you you're just not fucking good enough, right? Those were really, really big issues that people were grappling with, but every time we tried to actually use civil society to advocate for some of these, I'm just giving you a very broad set of arguments that we kept getting back. One was we don't have a right to privacy. The second was something's better than nothing. We've seen from net neutrality and free basics in India, it's the same kind of thing. Well yeah, poor people don't have internet access, something is better than nothing. It's only Facebook, it's a walled garden, but that doesn't matter, it's something, right? And it's the same thing that keeps coming up here as well. And this idea that, oh, as a culture we're not private, or this idea which actually we're even seeing now in the West that privacy is a luxury, right? Only some people can afford it, or this even more cynical thing of, well, you're on Facebook, so why are you protesting against this project, right? And I could actually say with moral superiority that I'm not on Facebook and never have been, but most people are, but for a government to turn around and say, well, you're on Facebook, so it's okay for me to collect this information, is a stupid kind of parallax error. Or this idea that the internet, mobile systems, ID cards, whatever sort of techno utopian wet dream you're thinking of is going to be what the third world wants and it's good enough, or it's a trade-off, on balance it's better, or it's free. I mean, these were the tropes that kept coming up. And I actually went back to look at a lot of our texts. I don't know if some of you might know Professor Anita Allen at UPenn, who wrote this great book called Unpopular Privacy and she talks in that about how there are certain things as a society we just don't allow. Even if there is a perfect market for something, there's a willing buyer, there's a willing seller, there's a price that they agree, that is negotiated fairly, there are some things we don't condone and for that she uses the example of organ sales and she says, in a particular kind of context, somebody might think I need to marry off my daughter who's poor, I'll just sell a kidney because I'm never going to make that kind of money being a farmyard laborer, I'll just sell a kidney, I've got the other one, I'll be fine. But as a society we don't think people should be selling parts of their body in order to finance certain things, so we don't allow it, we make it illegal. So in the same way we were sort of saying are there certain things that you just shouldn't allow biometrics to be used for, especially when the technology is so nascent, but what I've found was this idea that we'll just beta test this on a whole country with this very, very large population, we'll perfect it as we go along and they would use a lot of Silicon Valley terminology saying oh we'll fail faster, blah, blah, and sort of say oh we'll just tweak it as we go along, and you know, things like well we have such a big population, people are being born as we speak and people are dying as we speak, so if we wait for it ever to get perfect, we're never going to change anything, so we just start, we do something and you know we'll figure it out as we go along. Yeah, in figuring it out as you go along you're rejecting entire like millions of people from the project, so you know it was deeply, deeply problematic, and where are we now? I think one of the reasons it's so hard to argue against this project is because you're competing with the idea of transparency, except it's a very venal idea of transparency where it makes people vulnerable and visible to their government, but it doesn't change anything about how opaque the government is to its citizens, that doesn't change at all. And I think I've never needed to quote Julian Assange before, but it's something that he said, which Sunni Abraham at the Center for Internet and Society tweaked a little bit and he said, privacy is for those without power and transparency is for those in power. I kind of disagree with that because I think privacy is for everyone, whether you are or aren't in power, but I think when you're dealing with a country that has so much corruption, it's very seductive to say that any kind of project that might eliminate ghosts in the machine, that might eliminate duplicates, which people might have double registered to vote or to get benefits, the idea that you can somehow clean up and cleanse this database of all these people who shouldn't be there or who are already there and they shouldn't be counted twice, that's a very seductive logic. And when you couple that with the finances and say, oh, it's gonna save the exchequer so many millions in rupees, it's very hard to argue that for some little, when a warm and fuzzy fundamental rights, which actually we don't even have, that we're gonna stop progress. So it's been a really, really challenging fight and I think the other trope we keep coming up against is people are seen as corruptible. You can pay anyone a bribe and get whatever you want and actually that's somehow the only way you negotiate things in a country where the whole system is against you and while I'm not condoning corruption or bribery as a normal way of living, when the system is really screwed up, you do what you have to do to survive. But this idea that the system is somehow going to clean up everything and make it transparent is bolstered by the fact that people see computers and machines as neutral. So all of the discussions we're having in the West about how technology is not neutral, it embeds biases, it amplifies and replicates our own implicit or explicit biases, that whole argument has not touched India. And I think for me the thing that it's part of a whole sort of sweeter projects, nationalistic, state-driven projects which are all seemingly fascist but they're also about this idea of marginalizing exceptions and deviance, deviance of different kinds. You're gay, you should be out of this system. You don't have money, you don't count. We don't need to solve the last mile problem because you're not gonna make us a profit. So I think it's part of that kind of neoliberal project where we think this is progress and to argue against it is to be a Luddite and to hold back a country that's otherwise trying to leapfrog. And I'm gonna give you a couple of examples of how the system when you're actually implementing it on real embodied lives has really super creepy outcomes. And this is from a wonderful article written by Ursula Rao and Graham Greenleaf in Surveillance and Society, which is called Subverting ID from Above and Below, the Uncertain Shaping of India's New Instrument of E-Governance. And it says, as homeless citizens began enrolling, they found their fingers to be wanting. The first effort at encoding a perfect set of 10 fingerprints usually failed. The machines couldn't identify the unique contours of fingers damaged during a harsh life on the streets. Enrollers began a struggle against the dust that had settled into the skin of manual labourers. And anyone who studies biometrics will know dust is a real no-no when it comes to scanning people and we're a country full of dust. A wet towel was passed from person to person. Rub your hands strongly, technicians would repeat. At times performing the procedure up to five times to produce a sufficiently detailed reading, it improved the success rate, but it couldn't help those who had lost fingers in industrial accidents or fingertips. They were told to wait for especially authorized enrolers to arrive who could certify their disabled status. In a very waiting for Godot kind of wait, the person never arrived. That's all those bearing the marks of a high-risk construction industry in the form of deep scars, severed fingers, or mutilated hands. Or those whose biometric data couldn't otherwise be captured or registered remained excluded. And so they talk about how humiliating it is actually going on trying to do it and they're like trying to put dust eradicating wipes and vaseline and all kinds of things. And then there was another problem where they say gender posed a second and very different challenge. Women had little issue with fingerprints, but their predicament was less physical and more habitual. Many women couldn't get the photograph and their iris scanned right, trained to lower their gazes or to veil their faces in an act of modesty. They were uncomfortable when staring straight into the light of a camera. Their bodies resisted the humiliating intrusion by blinking and producing streams of tears. A box of tissues and the authoritarian hands of enrolers which arrested heads and pulled the tissues below and above the eyes to discipline nervous eyelids, helped the process roll on. Sometimes the younger unmarried sister-in-law was brought in and called to cover up for a freshly married shy woman who couldn't be entrusted to the crude hands of a male who was not related to her. So these are the kinds of bodily humiliations that were being visited on people with the view to grasp them metaphorically and physically in different ways into a system. And I think the other trope that is very much a part of is this idea that's very beloved of the humanitarian aid community, which is if you can't be counted, you don't count. And that's something we're trying to resist and our legal system isn't quite letting us get there. So let me just tell you about the court case and the challenge that we're dealing with right now. And it's amazing that it's come to this, that in 2017 we're even discussing whether we have a fundamental right to privacy. And it's actually, there's a bunch of really interesting people who have filed these pieces of litigation and one of them who's the most colorful character in this scene is a retired colonel from the Indian Army who's decided that if it's the last thing he does, he's gonna bring this project to its knees. If he dies fighting this case, he's going to do it. And he's amazing. He wrote this at a time when it sounded really insane to be saying that we want to kill this project. He was doing it. He didn't care what anyone thought. And he wrote what I can only call a tract. It was this really scurrilous tract which had instead of a very sort of don't panic, large friendly letters, hitchhiker's kind of book on the back of it, this bright yellow neon, terribly produced book. On the back of it, it says something which was fascinating. It says, you're not an Indian until an American says so. And people were like, what? And he was trying to get at the fact that he had filed lots of right to information requests which are kind of like FOIA requests in the US, wanting to know who are the vendors involved? What access to data do they have? Are they sending it back to the mothership in whatever country they're from? Why is the data of Indian citizens being shared with foreign people? This would never happen in any other country. Data couldn't travel outside. And if it did, it would have to be protected by certain safeguards and safe harbors just like your little Jetty and the privacy shield. But why is this happening? And it actually turns out that a lot of the vendors are from this whole, the same old suspects. It's the military industrial complex of all the biometrics vendors that we've seen everywhere. It's the morphos and the L1 identity systems and Accenture and KPMG and all of these people who are all over this project, huge money making project. It's sort of, you sell a solution and then invent the problem afterwards, kind of actors. And so he was trying to get information and the government very cynically turns around and says, well, we don't actually need to reveal that information because we have confidentiality clauses in all of our agreements. The whole point of right to information statutes that serve the public interest is to get around these stupid bullshit confidentiality clauses. As a lawyer, I know they're not what the paper they're written on, right? But somehow the government has been trying to get away with these. And so where are we now? We actually had a stream of cases right from the 1940s and 50s which actually talked about surveillance and the right to privacy. Some of them came out of the bodily privacy world are domiciliary visits if you're a prisoner or if you've been indicted of a crime. Can they come and check up on you and make sure you're sticking to the terms of your parole? Is that kind, coming in the middle of the night and ringing your doorbell, is that allowed? And a lot of the case law was stuck in that sort of physical invasion of privacy space and they'd slowly sort of moved to think of terms of informational privacy. And we've used a lot of American jurisprudence in this but now what's happening is some of the older cases held that there is no fundamental right to privacy and then there were later cases that said of course there is either that there is a fundamental right or that you can read it into the right to life and liberty and the freedom to live with dignity. What American law would call a penumbrial right. It's on the penumbra and without that you can't exercise rights of freedom of speech, rights of assembly, rights of religious freedom. So even if they're not explicitly called right to privacy that you would read them into other fundamental rights and even the US doesn't have an enumerated right to privacy as such but it's been read in. So we followed a lot of that jurisprudence but the later cases that actually said yes we do have a right to privacy were decided by smaller benches. So they were three and five member benches opposed to the older one which said you don't have a right to privacy which was a bigger bench. And so it's raised this whole sort of constitutional crisis of do you go with the later judgments or do you go with the earlier one because it's more judges at a very fundamental level. So that's where we are. And I've sort of been this awful Cassandra when I used to talk about this and I started working in this field about 10 years ago. I made a lot of predictions saying they're going to drag this out to the courts to a point where they're gonna present it as a feta complete to the government and say but now we've got 1.09 billion people covered. What you want us to now kill this project? What about all the data we've collected? What about all the benefits? What about the money we've spent? And basically by putting off making a decision about the right to privacy, you reach a point where by stealth you've not only expanded the scope of the project you've put it into all kinds of fields where you don't need to. So right now we live in a country where one of the most enabling projects the previous government did was giving kids midday meals at school. Sometimes it was the only reason kids would go to school because they'd get one square meal a day. They also got educated in the process, kicking and screaming, but they went there for the meal. And it's one of the few projects that's actually worked from a welfare perspective. And now you can't get your midday meal unless you have an Aadhar number which is this biometric identifier. So do we really need to be checking kids biometrics to make sure they get milk in a sandwich or a piece of bread? Like it's deeply problematic. And you can't now register a death without this number which already the Twitters are ablaze with jokes about, oh good, Aadhar is great because now you never need to die. It's fantastic, right? You can't get a marriage license. People have been denied scholarships. There are all kinds and none of these are mandatory. The whole cynical thing about the project is all of this time when people were fighting for fundamental rights saying this project is deeply problematic. The government kept saying, but it's voluntary. It's kind of like an app ecosystem. You can just plug and play. If you like it, you can use it. And if you don't, you don't have to sign up. It's not a mandatory national ID program. It's just an enabling little thing. If you find it useful, use it. Except now it's been used in conjunction with so many projects that this idea of it being voluntary is a complete nonsense, which of course it was always gonna be. And 10 years ago I said this and people said, oh, you're so paranoid. No, it turns out paranoid is the right way to be. So that's exactly where we are. So we don't know what the Supreme Court is gonna do. I have a feeling that interested with such a big task, they're gonna take it extremely seriously and come out with a really comprehensive judgment, which is probably gonna be 400 pages. But as one of my colleagues, Gautam Bhatia, wrote recently, we actually don't need a 400-page judgment. We need a three-paragraph judgment because the questions that have been posed to the Supreme Court are very narrow and very specific. Does the older judgment still stand? Do the newer rights that talk about a right to privacy hold good? Is there anything standing in the way of the newer jurisprudence? And 40 years of consistent jurisprudence that has held with the newer principle that there is a right to privacy, that's all they need to pronounce on. They can do that in three paragraphs. They can answer the two questions and come up with the conclusion. That's all we need. We don't need to revisit things that are settled law. But I have a feeling that presented with such a grand occasion in such a great stage with which to do it, a Supreme Court might feel the need to actually extrapolate from many other things and actually make a very big judgment out of this, which I'm okay with if they reach the right conclusion, but if they reach the wrong conclusion and give us 75 reasons why we don't have a right to privacy, everything we've achieved in 40 years of jurisprudence is gonna go straight back to the writing board. And one of the very problematic things is as a result of where these pieces of litigation challenges have come from, we're now equating the right to privacy, and we're conflating it with the right to privacy as a general right that applies in other things with this one particular biometric identity project because it's come on the back of litigation challenging it. So they've become so inextricable now that it's really hard to understand how the court is gonna be seized of this when they think, well, actually, if I pronounce there is a right to privacy, what is it gonna do to this big monster database that's been created? I don't see a problem with that. The UK struck down its ID database. It said it couldn't guarantee it was secure. Theresa May said this back when she was good, that she couldn't guarantee it was secure. She, that it didn't actually do what it said on the tin and that they couldn't actually guarantee that it would actually solve the problems it was meant to. And they not only canceled the biometric identity project, they very publicly destroyed the database. I want to be at these ceremonies where they burn databases. I think it would make me very happy. But they could do it. Australia has had an allergy to anything that's called an Australia card for years. Other countries have collected data and then decided it didn't serve their purposes as a just democratic society. And if they decided to move on, but we sort of, but we spent the money when we need to have it, like let's use it. It doesn't fit me anymore, but I'll just get the genes altered, it's fine. So it's a real problem. And the reason why I was so keen to come and talk to you here is a lot of people see this as, well, it's an Indian project, who cares? What does this have to do with me? It has everything to do with you because my government is going to be selling it to your government tomorrow. They already are. They've sold consultancy services on the back of this and they're selling the actual technology behind it as a tried and tested one on the backs of all of these poor people who don't have the agency or the knowledge to actually protest. So it is a beta testing ground, usually wrapped up in some kind of nice neoliberal spin or this idea of leapfrogging development. We didn't have to do 2G. We can go straight to 4G. You know, yeah, you can go straight to this biometric project. And I think the other problem is we have bigger social problems to solve, but we don't read enough science fiction. So we're not as scared. We should be, but we're not. So I think you need to be really careful about what you do in your countries because we will copy the best of what you do without any of your safeguards because we can. I think that's a theme of a lot of this event because we can. So how am I doing for time? Do I? Half an hour. Oh my God, okay. Okay, so I am just gonna go back to something. I thought I had less time. So I think one of the other issues that we're dealing with is reimagining the idea of consent. We've seen from a lot of papers that, you know, we went from a time when people said, oh, we can collect all the data. It's no problem because nobody owns data. It's on the internet. It's free. It belongs to us. It's taken a lot of activism to get to a point where we say, you need to actually get consent. And now people think, oh yeah, I'll have meaningless consent. I'll make you click through in the worst possible way when you desperately want to play that game before you lose your scores and, you know, we'll accept anything by way of consent. You know, yeah, we'll sell our unborn children or we'll sell our lives for 50 cents off a Big Mac. And now we're saying, well actually that whole consent model, that's broken too. And if you look at Daniel Solove's great piece where he talks about this, consent is upfront, consent is a one-off, consent is for something, you think you've made a trade-off at that point in time and you think there's utility and value in making that trade-off, but it doesn't necessarily apply as the project keeps changing. And I think that's something we've seen here as well, that this idea of, yeah, well, we've consented, you've given your biometrics, but you had no idea it was gonna be coupled with all of these different projects. And I'll give you another example of a really weird side effect that had we done pilots about these things and done cost-benefit analyses and actually looked at what these things were like in the field. We may have learned a few lessons and improved the project, if not killed it. And one example is we have something called a Rural Guarantee Scheme where, if people want to work, they can be given a certain number of hours of work a week to be farmers. And there's this wonderful organization in Rajasthan called MKSS, run by Aruna Roy and Nikhil Day. And they actually did field studies and they said, okay, in the old days, when someone used to go and get this Rural Employment Guarantee and they were allowed certain amounts of money, they would waste a lot of time actually going to put their money in the bank account, which was in the next village, and they would lose half a day of wages that they could earn by having to go to a bank and physically go and deposit money. And they said, how about we give you a no-frills bank account? And we give you a no-frills bank account using this biometric identifier to fulfill KYC requirements. So if it's a very simple bank account, you don't need to, you're not gonna be doing derivatives trading, although they don't seem to use a lot of safeguards there either, you could get this very easily with this identifier. And then they found something super counterintuitive and weird that after they linked people's bank accounts to this Rural Guarantee scheme, which is called NREGA, National Rural Employment Guarantee Scheme, they found that productivity went down. And they said, okay, wait, this is weird because they're not wasting time going to deposit money. Why is it that it's going down and not up? People should be super productive and working more hours and earning more money. What's going on here? And then these guys observed what was happening in the old way that the scheme was implemented on a Friday evening at the end of your work week, the landlord would stand around and pay all the farmers based on how many hours of work they had done in front of each other. They'd all stand around in a circle, they'd get paid and they'd drink it on their way home. What they found was once this became invisible and you didn't have the social ostracism of being that slacker who didn't work as many hours as your neighbor, nobody had any incentive to work hard. They didn't care about pride, they didn't care about what they look like in front of their peers. The whole thing had become inscrutable and invisible in a black box. So two things happened. One, they worked less. And two, the women didn't get access to the money because the men predominantly handled the bank accounts and handled the technology and would be like, money hasn't shown up, checks in the mail, don't have it. Whereas in the old days, the women would have cost them on their way home and say, give me half the money for groceries and school fees before you go and drink the rest away. So they were having huge effects on income, on women, on kids, on schooling, on food, on malnutrition, which if they'd actually tested this for a few weeks, they could have found this out. But no, they just decided they were going to irreparably link it to this project. And now you have this really weird consequence. And MKSS, as an organization, is one of the NGOs that's been at the forefront of arguing about how terribly discriminatory this project is going to be and in the way that it's visited on many people. And one of the things, one of the biggest lessons that I had was many years ago, the ID authority actually invited a bunch of civil society actors to consult. It had to go through the motions of saying, yeah, we've taken opinions of civil society and of course we help rubber stamp these things by showing up, but it's worse than not showing up and not being difficult, so I'm always happy to be difficult. So I go to one of these meetings in Delhi and the chairman of the ID project was in there and he was listening to all these opinions, from blind people, from the Free Software Association, from all kinds of people saying, have you taken account of our needs? Our needs are special. There are all these populations that we represent. What are you doing to make sure that the project doesn't discriminate and that it actually includes them? And the chairman was very nice for a while and then he started getting really irritable and you could see he was thinking, I actually have a real job to do. This is a big project. I don't want to be sitting here listening to you people whine about things. And he started giving really cranky answers. And the moderator of that session was one of the founders of the MKSS organization who is this really old school activist, old hippie, long hair sitting there, stroking his beard, listening to all these arguments, seen it all before. And he turns around in this very avuncular way, taps the chairman on his shoulder and he says, can I just give you a little bit of a lesson? He said back in the day when people used to protest about dams and the impact of hydroelectric projects that would displace entire villages by flooding them, he said I would go and protest about these dams and say you can't set up this dam until you've made arrangements to relocate people. And people thought I was insane. And along came Medha. Medha is a very well known environmental activist in India. And he said along comes Medha one day and says no dams. I don't care what the terms are, no dam. And he said I found that overnight I had become a moderate without changing my position. Just because someone crazier than me came along, I suddenly shifted to the center while she was the outlier and the crazy person. Suddenly the government wanted to talk to me because I was sensible and reasonable compared to her. You know the crazy bitch who'd just come along. So he's like, you never know. All of the people that you're listening to today are tomorrow's moderates. And you're gonna be negotiating the terms of these arrangements and you know renegotiating the social contract with these people are in the room right now. So right now you're looking at them like they're all woo. But they're the ones you're gonna actually count on to be your champions of the project once something creepier comes along. And I've never forgotten that lesson of the fact that your own position can change along a spectrum without you having changed your views or your ideology just because something else shifts the terms of the debate. And I think that's kind of where I wanted to end that with a project like this the tendency is to be responsive. You are responding on the terms of somebody else's debate. They're setting the agenda. They're setting the terms and you're constantly fighting back saying, oh, I don't agree with this right to privacy because this is what I think. You're constantly in a state of churn. You're thrashing, trying to actually meet these responses when actually we should just be turning around and saying, I don't care how many benefits there are. This is the terms of the debate that we actually want to have. And I think that's emerging now. And it's emerging in ways that are interesting. The younger generation has taken this on as their challenge. Even though everyone says young people don't care about privacy, I'm like, really, then why do we have Snapchat? Come on, you know, if not to safeguard dick pics, we do care about privacy. And the younger generation is actually using humor. We're having our own set of John Oliver moments and it's sort of galvanized protests. People have cartoons about this. And I think people are actually suddenly realizing even the ones who initially said, I don't care, I have nothing to hide. And you know, if I could have a dollar for every time someone has told me I have nothing to hide, I have nothing to fear, I wouldn't be standing here, I'd be owning an island in the Bahamas. But I think that's what's changing in India now where people think I didn't care, I thought I had nothing to hide. But wait, I can't actually function without this number. I can't do anything. And now I'm beginning to get creeped out by just how much of an insane interconnected matrix it is, which governs everything from the cradle to the grave. They're saying you can't comment on websites without this. You can't enroll for certain things without it. So it isn't just impacting our bodies and our lives and our experiences. It's not just surveillance of our financial transactions. It's everywhere we go, it's everything we do. It's every way that we could express ourselves. It's sort of a fight against all of the values that we hold sacred as a society. And part of this is also part of this nationalistic agenda that's emerging in a lot of countries where not the only one, these kinds of populist agendas are very popular. And I think India is part of that same global trajectory of saying, well, why wouldn't you want your government knowing what you're doing? Are you crazy? Oh my god, do you use Tor? So it's part of that whole thing. Why do you use encryption? Why are you an activist? Why don't you want to be followed? And I think Daniel Solove actually, he got so annoyed listening to this Nothing to Hide argument that he actually asked people, he crowdsourced good responses to the I Have Nothing to Hide argument and people sent him everything from why do we have curtains? Can I have your credit card details? If you have Nothing to Hide, you have no life. Please get out more. All kinds of fantastic arguments. But I think in the Indian Supreme Court, a lot of that is not gonna hold sway. I have hopes that our judges will do the right thing. A couple of judges on that bench really uphold civil liberties, but there are a few who think that providing a project that the government has spent money on that is allegedly empowering and that will save money. I think those arguments are gonna be very compelling. So I'm really hoping that they fulfill the sovereign socialist democratic republic ideas that we had in the constitution and uphold the constitution and see that it's a living breathing document. There is a lot of techno utopianism in the government and a lot of people said, well, maybe this will trigger the need for a privacy law. Yeah, but the draft data protection law that's being proposed is being written by people who wrote the Adhar Act. If that isn't a conflict of interest, I don't know what is. And if you write a data protection or a privacy piece of legislation to meet the needs of one particular biometric identity project, you're not having a law that's broad, that's fit for purpose and that covers all kinds of different situations. You're writing something that's enabling and facilitating a particular frame for this project. So I'm not hopeful about the law that will come up. So we'll see what happens. I'm holding, I'm not holding my breath, but my parents had a cat called Thoreau and they had a little sign called Walden outside the house. This is in deepest darkest India. Like I grew up with parents who read Thoreau in Emerson. And so I don't know, maybe this is, you know, be careful what your parents named their cats because one day you'll be fighting for civil disobedience and unjust taxes somewhere in a galaxy far, far away. And I think for me, the biometric identity project is a form of unfair tax. It's a tax on our bodies, it's a tax on our freedom, it's a tax on expression and it has to be resisted in every possible way. Thank you, I'm happy to take questions. We have 10 minutes about 15 minutes. It looks as if they have questions, so we start with the microphone in the front. Okay, sorry for that, it's all my fault. Thank you so much for this talk because all I knew about Adare was from the BBC and the Economist. My head is going like, bam. And they're the more reasonable ends of the reporting, so. So I live in the US where you can't buy a beer without having a social security number. So this is just India catching up with the Western world in many aspects. But I've also read that Adare is actually quite helpful in preventing corruption in welfare payments, et cetera, et cetera. Don't you see anything good about it? Is it a plan that could work if it wasn't so badly implemented or is it in your view something fundamentally wrong with the whole idea? With my lawyer hat on, I would say that the project could be made to work if it had the right safeguards. And in terms of the welfare implementation part, there is a lot of ghosts in the machine. There are duplicates that could be weeded out. But actually when you look at a lot of the social sciences research and the economic data around this, the reason why you have a lot of pilfering and siphoning of money from the welfare system or why goods and welfare don't reach their intended recipients is not because of the lack of identification. It's because the goods don't reach destinations. It's because food grain sits rotting in a cellar. It's because at the point of contact, somebody is bribed. It's all kinds of factors for why intended benefits don't reach recipients, which actually are not problems arising out of identification. So I think there are ways that you could meet welfare needs without having it to be purely around identification, but it's easier to fix the identity piece than all of those other, there are transport issues, there are all kinds of other last mile linkage problems. And I think if you could actually streamline those, you could actually help. And I think you could also have a project that was voluntary and you could have the benefits of it for people who don't have any form of ID at all. But when you actually look at the process to get identification, the data shows that most of the people who have enrolled are people who already have multiple forms of valid government ID. And if you look at the number of people who have not enrolled, disproportionately it's people who don't have identity, which means it's a project that's helping those who have identity because it requires you to give 16 other forms of ID to enroll. So those who genuinely are undocumented and could really benefit from being included, they're the ones that are not being included for various reasons. So I think if we could fix that, it could help. And I think doing this in a legal vacuum without data protection laws or safeguards is absolutely madness. So I think there are ways you could fix it to work, but I don't know if there is political will to fix it to make it to work when the surveillance motive is so huge and where the public-private partnership works in ways that extracting data is one of the most valuable benefits of the project rather than stopping corruption. Thank you. And question from the other microphone. Yes, thank you for the talk as well. Very depressing. And I'll be quoting the crap out of it. Thank you. One small and one larger question. The small question is, when is the judgment expected to be finalized? We don't know. Not even a rough... No, they said they're gonna take that time and give a considered decision. So it could be a few months. Okay. And the actual question is, from what you are saying, there is now a precedent that it is okay to pretty much exclude a part of society that is more or less half of Germany in terms of size, right? How concerned should people be around here with your Cassandra hat on in places like Germany, like the UK, where Theresa May used to be good? How concerned should it be that people will go and look, oh, you know, those outliers and stuff, we can actually just ignore it and it will be fine. Yeah, that's a good question. I think the reason they can get away with the project like this is because it's visited on a predominantly poor population or a middle-class population that doesn't see the problem with it. And the elites will always be above the law anyway. So I think it's only possible in a few countries where you can do it without legal repercussions. I don't know if you could ever implement it in a Germany or a UK without people saying, oh my God, this is ridiculous. And it's what happened with No2ID, which Phil Booth and a lot of people worked on. So I think we have precedents here for it not being the case, but I don't know now with sharing passenger data, which fortunately is now being rolled back a little, and other ways that governments are now sharing it to be cyber, to be secures. I had to say cyber is a Freudian slip. Yeah, I don't know. Can you please turn on the microphone in the front? Okay. Hi. Not a question, but something to contemplate. I've lived in Spain for six years, and I came from Holland. Can you please come to your question because we have so many people and not much time. Thank you. So I went to the shop and I bought something with just my bank card, and they required me to identify with an official document. So this is the kind of thing, even if now you're talking about institutionalized stuff, it can even spread beyond that. Only to contemplate. I was asked for ID when I wanted to buy tampons in Buenos Aires, and I thought, when did tampons ever blow up an airport? You know, the kind of terrorist activity that we're accused of. Then the question from the other microphone. Okay. I took it that you think that probably the project will survive some way because it's too big to fail. Yeah. Do you know the surveillance framework to handle privacy issues in a symmetry context, where the idea is, if you can't keep the information private for some reason, the main problem is a symmetry where the government knows everything about the people and the people know nothing about the government. If the project goes on, do you think there is a way to mitigate this by giving the people some sort of first copyright on their information, private property rights, the right to know when and why that information is shared? I think there is, and I think what's happened, it's unfortunate, and it's what we always thought when you create a honeypot of saying this is the single identifier that links everything, of course it's a hacking target, or less sinister than hacking was data is leaking, because it's such a federated identity system that if you want to enroll population sizes of above a billion, you outsource it to a whole bunch of actors down the chain who are all doing enrollments. You know, you don't have one single authority doing it. So without it even hitting the system and it being hacked at the sort of central data repository, the people who've done the enrollment have been leaking the data and selling the data and there's a huge gray market. And I think knowledge of that is actually making people say, well, actually if it's not even that secure, do I need to trust it? So I think the government is going to have to respond. So far they've been saying, of course it's secure, of course it's secure, like going on and on about it, but I think they're gonna have to come, I don't know, maybe differential privacy will help, maybe other kinds of techniques will help to keep the data anonymous where possible. But I'm really hoping that if, I don't see the system not surviving, as you say, we're now gonna have to focus our attention. So far the attention has been on a right to privacy. If it means that even without a right to privacy or a limited right to privacy, I think we're gonna have to focus on functional ways to protect data and protect people and think about rights of ownership. Thank you, I believe we are running out of time. Maybe one very, very, very short question, very short. Can you give us any good examples of either existing legal frameworks or theoretical legal frameworks that can be implemented for schemes like this? Do they even exist? I don't think they do, to be perfectly honest. I think a voluntary scheme would get around a lot of these problems, but I think one of the objections that the government has been making is unless you actually capture the entire population, it's not going to be accurate in terms of duplicates. You're not gonna be able to ping the system to eliminate fraud. But I think in terms of legal frameworks, other than rights of, you know, surveillance, rights against surveillance, I'm not sure that there are any perfect systems that work. Okay, thank you. This was by Mithuk Adhikath by the billion from Malavika Jharyaram.