An identity digitized

When Waseem Soufi and Rasha Haj Ali began applying to become privately-sponsored refugees in January 2016, they had no idea it would take nearly half a year to complete the paperwork alone. It would be almost another year and a half before their applications were accepted and Soufi and Haj Ali were cleared to come to Canada. On November 15, 2017, the couple finally landed in Ottawa.

Contributing to the delay was a host of geographic, cultural and bureaucratic barriers that made filling out paperwork and obtaining the required documentation challenging. Because Soufi was living in Saudi Arabia to escape conscription in the Syrian army, he could not return home to get the civil records he needed. Cultural differences in language and writing addresses meant Soufi needed to redo his forms, and the high level of detail required in the applications was not always easily recalled.  During the process, Soufi also needed to obtain and keep track of documents like his passport, driver’s licence, marriage contract and proof of his university education.

The UN High Commissioner for Refugees estimates 1 billion people live without proper identifying documents, something the agency says bars a significant portion of the world’s population from opportunities like getting a job, accessing housing, opening a bank account or owning a mobile phone. This number includes refugees, who along with other displaced people, could benefit from an alternative form of identification: a digital one.

Digital identity is an electronic representation of the characteristics that make up a person’s identity. It’s a digitized version of a person that logs information like age, citizenship, employment and education and proves these attributes actually belong to you. In an online world, it’s a way to easily identify someone and provide access to services outside a paper or plastic-based system. Today, governments worldwide – including Canada – are transitioning into the digital space. Others are already there, like Estonia, which started becoming a digital government as far back as 1997.

e-Estonia

In Estonia, citizens only enter their personal details into the country’s national system once. Data is filtered and encrypted so it cannot be accessed by unauthorized persons. Citizens own their data and every time it is externally accessed, the interaction is logged. Estonians use a chip-based digital ID card to access services.  This digital ID system means:

• Estonians no longer need to fill out forms or prove their identity
• Citizens can vote online and complete their taxes in minutes
• Healthcare professionals can access their patients’ comprehensive digital health records from anywhere
• Non-Estonians can apply for “virtual” residency and access services like online banking from outside the country 

Today, digital ID is poised to enter the refugee sphere with Canada at the helm. For many Syrians like Soufi, it could mean a much smoother path to freedom. According to a 2017 report from the Norwegian Refugee Council and the UNHCR, Syria’s war has resulted in the destruction of many civil registry offices. Only seven per cent of respondents from a household survey indicated they had access to new government-issued ID, more than half of those surveyed were not in possession of their marriage certificates and more than 25 per cent of children under five had no civil or legal record of their existence. Such documentation is critical for survival within the country, but also necessary for receiving humanitarian aid. And for those fleeing as Soufi and Haj Ali did, they are key for entry into Canada.

A global strategy

In 2019, the UNHCR will launch its first global strategy on digital ID in partnership with Immigration, Refugees and Citizenship Canada. Both Canada and the UNHCR already collect biometrics – data like fingerprints or iris and facial scanning – from refugees as they pass through their systems. This data, and more, is slated to be part of what the aid agency calls a “refugee identity ecosystem”.

According to Michael Casasola, a senior resettlement officer with UNHCR Canada, IRCC and the refugee agency first began discussing an identity management strategy in late 2017.

“Globally there has been an increased attention to this theme of refugee identity,” Casasola said.

“UNHCR has a lot of data about refugees in its registration system. It follows them throughout their process. Particular vulnerabilities, why they are a refugee, what programs they are accessing. But in many ways [refugees] don’t have access to that information, they don’t control it.”

The $100,000 strategy is taking the form of a series of virtual summits to explore the idea of a global identity system, while also protecting data and privacy. In June 2019, Ottawa will host the strategy’s final event, bringing together displaced people, technologists and community members. By the end of 2019, the agency hopes to have the entire refugee population for which it currently collects data contained in its population registry. The hope is to put this data back in the hands of the displaced, so they can use it to identify themselves along their journey.

Waseem Soufi neatly stores all of his documentation inside a three-inch thick binder. As he flips through the plastic sleeves, the story behind each page usually follows. [Photo © Raisa Patel]

A digital Canada

The strategy comes at a time when Canada is launching its own nationwide effort to become a digital government. Along with Estonia, Canada is part of the Digital 9, a group of the most digitally-advanced nations in the world. The two countries are joined by seven other member states: Israel, Mexico, New Zealand, Portugal, South Korea, the United Kingdom and Uruguay.  It’s partly why Ottawa expanded the Treasury Board president’s role in 2018 with an added title: Minister of Digital Government.

Canada’s digital identity strategy has yet to be released publicly in any form, though it is expected to drop this year. According to Treasury Board documents obtained from the department, the strategy aims to give Canadians one online identity account across federal, provincial and territorial levels of government. The goal is to make access to government-related services less time consuming, cut down on the number of accounts Canadians are forced to juggle and reduce how often people are required to prove their identity.

“We have this service that right now lets Canadians log in to 100 different federal services run by 29 different departments and agencies. We’re basically building a successor to that,” explained Ken McMillan, Treasury Board’s director of digital identity. “We’re working with vendors to build the procurement together.”

McMillan says Canadians can expect to fill out an online form, wait several days for an access code and then use that code to verify their identity to the government to access all their future services. [Photo © Raisa Patel]

McMillan said the project will be called Finding Canada, but because department is still working on building the platform, he is unable to share further details. IRCC also confirmed it was part of the strategy, but would only say that it was currently “exploring a number of projects to support” Treasury Board’s digital identity vision.

Digital ID in the refugee sector will create some unique challenges, McMillan said, because it means IRCC will have to handle people who are missing important documentation while ensuring security needs are met.

Privacy, please

Emphasizing privacy and consent is a key part of the equation for Joni Brennan, the president of the Digital Identity and Authentication Council of Canada (DIACC). The DIACC is a non-profit network of public and private sector groups that develops industry standards, research and public outreach for digital identity and economy in Canada.

Last November, Brennan flew to Ottawa to help lead FWD50, a conference focused on bringing technology to government. To kick off a workshop on digital identity, Brennan began with an exercise she likes to facilitate to remind people how personal someone’s identity can be.

Standing in front of nearly one hundred public servants, Brennan first asked her audience to remove their conference badges, which included their full names and federal department. She then instructed participants to pass their badge to the person seated next to them. Almost everyone complied. Next, Brennan asked everyone to pull out their smartphones and hand them over to the same person. After a pause, a handful of participants agreed. Finally, Brennan told participants to take out their wallets and give all the cash inside to their neighbour. The audience balked. Only one man followed through, just to get a laugh from his seatmate.

“Can [refugees] be identified in a way…that doesn’t create a registry that could then be turned around and be used to identify those people?”

– Joni Brennan

The concept of risk also factors in to the refugee experience, but for more sinister reasons.

“Can [refugees] be identified in a way that they can gain access to benefits, but also doing so in a way that doesn’t create a registry that could then be turned around and be used to identify those people?” Brennan mused.

It’s a balance Casasola said the UNHCR is also considering.

“There’s the whole question of privacy and ownership of that information,” he said. “What are the values behind that and how are they respected?”

Unto the breach

For refugees fleeing persecution, a data breach could have dangerous consequences for their privacy and safety. The Canada Revenue Agency, for example, has experienced more than 2,000 breaches in the past three years. The culprits were largely identified as the agency’s own employees. Even Estonia is not immune: in 2017, researchers found a security flaw in the country’s chip cards, potentially opening citizens up to identity theft or having their data exposed. At the time, the system was briefly shut down to address the flaw.

In the wake of other major data breaches like the Facebook and Cambridge Analytica scandal, strengthening privacy law is critical. But back in September, Canada’s Privacy Commissioner Daniel Therrien criticized Ottawa for engaging in consultations rather than bolstering law, calling progress “slow to non-existent”. Therrien called for a “substantial budget increase” for his office in order to uphold privacy rights, including overseeing breaches.

“We don’t have to look far to see all kinds of breaches of government information in the past,” McMillan said.

“We can’t have databases that are being duplicated across, between organizations because that just introduces more points of failure and more vulnerability. A breach happens in one place, and you may not even know.”

The government is building privacy measures into its digital identity strategy, including updating its outdated infrastructure. It’s also putting mechanisms in place that allow service providers to see only the relevant data they are authorized to view for that particular interaction. In some cases, the provider will only be allowed to know whether a detail about a person is true, without revealing the information itself.

Such strategies will need to be unrolled carefully and responsibly, particularly where society’s most vulnerable are concerned.

For his part, McMillan acknowledged that for those applying for refugee status as Soufi did, security and ease of use can go hand-in-hand.