Digital Rights in DPIs — Limitations and Lessons for Equitable Futures

Transcript

[music] Uh I hope I'm audible. Great. I would just request if people can come forward. I can't really see anybody but uh Oh, thank you. Um cool. So I'm just going to do a brief introduction of uh my work and myself and contextualize this in the in the topics that we've discussed today. Um I am an ex-engineer but I am not an engineer at the moment. So my objective here is not to tell you what to build. Uh my objective here is going to tell you what the principles are on which some of the innovation that we seeing in DPIs and I'll get to the topic in a bit.

What should be the principles around this this innovation around which this building of technologies need to be centered around. Um and I by profession am a researcher of politics and economics of technologies and that's really going to be the the standing on which I'm going to talk about the topic today. Just to start off digital rights in DPIs the the DPI here does not stand for deep packet inspection as I was asked earlier today by a computer science guy. Um it stands for digital public infrastructures and I think specifically for people in India DPIs have been in the mainstream discourse for some time. We've heard them now sort of gain worldwide popularity in a lot of contexts as well. Um we know that Ethereum Foundation itself has been working with the government of Bhutan to

create a blockchain based digital identity infrastructure. Um what I'm going to do today is sort of drill it down to first principles. I'm going to talk a little about what is the history of digital public infrastructures. Um not just technological history of it but the the political and the economic history of these infrastructures. I'm going to secondly talk about the issues of digital rights violations in in digital public infrastructures. um specifically what causes these rights violations and specifically what are the technological and economic forces inside digital public infrastructures that cause these violations and then lastly I'm going to briefly sort of close off by talking a little about broad principles that you know builders developers technologists all of you um can sort of take back from this session

and reflect on as future principles to think about when you work with digital public infrastructures and digital public goods. Um moving on uh a brief and political history of DPIs. I just want to start by sort of busting a very quick myth here. Um digital public infrastructures are at their core digitally accessible and or mediated public infrastructures. By definition they are public infrastructures that are mediated through digital mechanisms. They are not just technological artifacts. They are not an application that you create. They are not just um um you know a protocol that you build. They are an infrastructure itself. And I would really urge all of you to think about physical infrastructures whenever I say digital infrastructures because the the thinking the policy thinking the

technological thinking around digital infrastructures does not stray very far away from physical infrastructure. So they are technosocial and technolal ecosystems. They have technological and legal components attached to them. They have technological and sociological components attached to them. And the point of DPIs is that they make it necessary for they make it possible for citizens and enterprises to access public infrastructures via digital means for a variety of reasons. All of us know about the Aadhaar ecosystem in the country. The purpose of the Aadhaar ecosystem is to validate somebody's identity. But there are a bunch of other DPIs which I'll get into in a bit. The second point here is that a DPI the three terms here the digital, the public and the infrastructure all of them are really politically loaded terms. You

know we can't think about digitization i.e the tech being used without thinking about who owns this tech. What really did it take to create this tech in the first place? Are the people who using this tech actually aware of what the tech is doing to them? Second the public the the people here the communities that are being affected. Um is the tech designed for the communities that you are engaging with or is it an abstract idea that has been converted into a prototype and then scaled? And lastly infrastructure. Um again like I'm saying I've been reiterating this since the beginning of this talk. Infrastructures are very different from basic applications. They they serve a social purpose which is not necessarily captured through quantitative metrics like prices. They are not always captured through what does the market

forces reveal. It is not always captured through is it leading to substantial quantitative gains in the lives of people who use this infrastructure. Maybe in the short term but over the long term that kind of trend sort of starts to become visible. So infrastructures by themselves have a lot of network effects. The creation of an infrastructure does not only benefit the users of that infrastructure but also people who rely on those who use that infrastructure. So this kind of amplifying quality of a DPI needs to be kept in mind because this is what differentiates them from a lot of basic applications, basic you know e-commerce marketplaces, many apps that all of us use. At the same time DPIs of today rely heavily on private actors and this is the second point I'm getting to. Despite public infrastructures, despite being

politically loaded infrastructures, they rely heavily on private actors for a lot of purposes. I'm very happy to toss some examples out there. But even in the Indian context, we see the the private sector, the technology developers, specifically big tech entities being heavily involved in how DPIs are created today. And this is not merely from the point of view of technology deployment. It al all starts from the point of view of deciding what should be the architecture of that technology in the first place. It is even beforehand deciding what is the social problem that this infrastructure will solve. The question that Aadhaar solves the identity problem. Why are we solving the identity problem in the first place?

These are again political questions that are often sort of offloaded to the private sector to the market to sort of address and work their way through. Uh and the second problem here that we see is that DPIs by nature are scalable. They can grow really quickly. The entire point of a public infrastructure specifically in the Indian context is that the state very often backs these DPIs which means the scaling of a particular infrastructural solution from a pilot to a countrywide ecosystem is something we have experienced and unfortunately in a lot of global south countries this experience is not consensual. We can talk all day about consent notices. We can talk all day about whether a user is consenting to share their data or not.

when you are mandated to use an infrastructure by the state who is providing you the services consent is merely a word. So what's important to think about here is that this is a state approved rails to transfer personal data and often highly sensitive data and these data sets pertain to citizens social and economic needs. If you go to a doctor, if you visit a clinician, you will be asked to give your health records and there is a whole DPI that captures health related information of of Indians and of Indian citizens in general. Um and that's the second point. They are politically loaded infrastructures. They rely heavily on private actors. These are some of the DPIs that I think a lot of us are or may be aware of. We have the unified payments interface. All of you who are in the room right now have most

definitely used UPI. UPI is the payments DPI for India. There's also Pix there. Pix is uh the Brazilian alternative for UPI. And I'm just sort of putting these examples here. uh the the icon that you see here at the bottom at the left is India's health digital public infrastructure. On the top you see an agricultural infrastructure that has been created. ULI is a lending related infrastructure which also then ties to UPI. EXDS is a European health data space infrastructure completely different from the Indian example. CAR CAR is a Brazilianbased uh DPI which is specifically about land record allocation. We had Carla I think a couple of sessions ago who talked about

how land records are managed in a lot of countries. Car's example in Brazil is a very interesting example um that you know I can talk a little about. And lastly there's XT. XT is I think an Estonia based digital public infrastructure. It's a data exchange platform essentially. Um and like I'm saying here the tension at the heart of DPI is how to design and govern public infrastructures that essentially make data accessible to private actors. There's there's a very clear sort of you know tension of incentives of contradictions here and I just want to leave this as the starting point here to establish the fact that these are not apolitical neutral technological artifacts. These are very socially relevant economically relevant infrastructures.

Now the second question that we have on our plates is how do we understand digital rights on on DPIs right and what does it really mean to have a right in an infrastructure specifically in an infrastructure that is digital. It's not an infrastructure you can touch. It's an infrastructure that you mediate on your phone. What I want to start off here and the way I'm going to talk about digital rights here is not through a sociological framework, not through a political framework. What I want to talk to you about is that there are three key features that make a digital public infrastructure a digital public infrastructure. First is the presence of digital technologies. The entire premise of digital public infrastructure is that it reduces costs and allows fund auditability to occur. In the Indian context, a larger uh rationale for

pushing for DPIs is that the money that the government spends on providing subsidies to people is not adequately allocated. There's a lot of scams. There's a lot of fund leakages. Digital technologies is the solution that is proposed to take care of that problem. But it also accelerates the possibility for exclusion and discrimination. Everybody in the India does not have a phone. 50% of this country's rural population does not have access to internet. um phone is supposed to be the most prominent mode through which Indians access internet not laptops but almost all of them use Android phones which immediately creates a a larger market monopoly issue which I'll get to in my point three. Um the second point is building data profiles. DPIs by nature rely on data flows. They allow

the state and the private actors who are present on this infrastructure to dictate and control the data that the citizen allows the state to access. If you are a a a health tech startup, if I go back a couple of slides, if you're a health tech startup and you join India's digital health ecosystem, you can essentially ask citizens to share their health data with you. If you are a hospital, you can do the same thing. The same is true for Agri stack. The same is true for UPI. The entire point of a DPI is to allow for data flows and using these data flows to create data profiles that can provide personalized services that can provide citizens access to a larger problem. But also they engender risk of surveillance and cyber security.

I'm I'm happy to talk about examples here but it's being recorded so maybe we'll talk about it later. But there have been plenty instances on the Indian context and outside where the creation of DPIs has led to certain centralized architectures of data being stored and it's a single point you know of failure sort of waiting to break down which in the previous years we've seen happen with many existing DPIs. Lastly there's the partnership with private actors. Um DPIs as we know them today have emerged in a context of post-liberalization. We live in a world where specifically India. We live in a country where state capacity is really hollow. Uh there are not enough funds that the state holds.

Stateun enterprises do not have the right kind of capital that they need. So access to private actors is often pitched as a way to get access to a larger capital base that the state does not hold. However, it also exposes a public infrastructure to the profit motive that comes with involving private actors in the first place. The idea for doing this is not to really say, you know, that we shouldn't build data profiles or we shouldn't use digital technologies. They have their pros. But the argument here is that all these decisions come with trade-offs. And you all as developers, as builders of technologies have to keep in mind that the trade-offs that come up come with making any of these choices. And what I really want to point out is that all these DPIs make these choices very

differently. It is there is no homogeneous model to how to create a digital public infrastructure. It depends on the sensitivity of the data set. It depends on what is the digital maturity of the population you're working with. It depends with it depends on what are the rules you have in place, what are the laws you have in place. So the idea really here is to keep these contradictions and tensions in mind. Let's start with the first one. um using digital technologies. The presumption here is that widespread access to and deployment of digital tools and technologies are integral for government authorities to reach all those people who need public services. Um the idea is that if everybody cannot visit the government office or if there are not enough hospitals in the country, creation of digital technologies will allow people to access doctors, they will allow them to access the

government. The outcome for this is that from Android applications to information systems that are used by entities, you essentially have digitization as a key pillar of the modern DPI paradigm. Some uh examples that I've listed in the bracket here. Asha workers. This is a very interesting um case that I can probably spend a couple of times on couple of minutes on um DPIs like any other infrastructure have a workforce attached to them. The health the health DPI that I talked to you about a couple of slides ago, Aayushman Bharat digital mission. This one the way this mission works is that there is a very vast contractual workforce that is attached to this ecosystem and the point of that contractual workforce is to go in rural

areas to meet women who are let's say underfunded underresourced clearly not do not have access to adequate healthare the point of workers is to meet these women get them onboarded onto the DPI and this is a completely contractual work they are not provided any kind of wage security they are not provided any kind of social security. This is a labor population that is doing a lot of the chunk of digital public technologies, but they essentially are bypassed and are sort of sidelined in the larger premise of the technology being created. The risk that I want to point out here is one, there's an exclusion from accessing the service. Like I said, internet access in this country is really poor. People do not have a lot of phones. A lot of them essentially used the dumb phones that we used to have,

you know, the Nokia and all. The the second point here is privacy violations. You know when you create a digital technology you automatically create an avenue for data to flow somewhere and that creates a risk for privacy violations. And lastly there's information asymmetry. Even if you were to provide everybody with the phone, even if you were to provide them with the right kind of knowledge on how to access DPI, their interaction with a device that is a black box is is an opaque experience. They don't have the kind of knowledge that is required let's say by developers and by others to break into that system. Um so using digital technologies comes with a presumption.

There's an outcome that flows from that presumption and these are some violations that we've seen and in our work sort of emerge from this action. Second building data profiles uh the collection of data especially personally attributable information like fingerprints in in the Indian context we have um fingerprints iris scans as part of existing digital public infrastructures. This is the kind of extensive data profiling that um you know countries not just India but outside are also looking to build. The outcome here of course is that the technical and legal choices made in the process of designing, developing and scaling DPS adhere to a philosophy of data maximalism. By essence, a lot of these countries are trying to build data profiles. And one thing you wouldn't want to build extensive data profiles is

data minimalism. So they automatically and inherently tend to rely on data maximalism as an approach. Let's capture everything that the user is doing on the public infrastructure starting from the time they've logged in, the IP location, the geo tagging and and you know all of that that comes with it. The problems here are pretty obvious. Privacy violations are very evident here not just in the form of state surveillance but also unauthorized connections specifically when private actors are present in the infrastructure. How is the data storage occurring between the state facility that is supposedly backing the infrastructure and the private actors who are just merely service providers on the on the infrastructure? How is the third party sharing done is often not made clear in the context of DPIs and of course unauthorized connections with other

players outside. And lastly, this is an interesting point. This is about data as a fee for entry. If you are somebody who's a poor person in this country who's trying to access the state provided meals that you have to access, you really don't have an option about providing data. You go to your local facility, they asked you to give them your iris scan, your fingerprint scan. You really don't have the luxury to say no, I don't really want to give my data because the the access of ration itself is tied to you providing data. In this case, data is no longer a shared, you know, personal feature that you are telling somebody about. It becomes a fee. You really can't run away from it.

And this essentially nullifies everything we talk about consent and notice in this country u and outside data as a fee is a big problem in in Brazil and Europe as well. And lastly, there's the partnership with private actors. The assumption again like I've articulated previously is that given the capacity gap it is assumed that if you bring in the the private sector it is critical for the it is critical for the development the deployment and in some cases even the governance and this is like a major red flag which I just want to sort of you know let let it sink in because there are DPIs even in the Indian context where everything from the development the deployment and the governance is done through private structures. These private structures may be for-profit entities or they may be

not for-profit entities but they are private structures. The problem with that is these private organizations are not beholden to problems of right to information. The the first the top most uh DPI that you see here unified payments interface is essentially governed by a body that is a section 8 nonprofit in this country. by that nature that that entity is not um you know it does not fall under the law of right to information. I can't file a request with that entity to give me information on okay what are the kind of codebased changes you have made over the years can I review the codebase of this interface a lot of these systems are not open source pix is probably an a very interesting aberration here because pix

has sort of run away with its openness agenda really popularly and happy to talk about that in detail but overall this is a setup where private sector's prevalence is extremely common and the outcome of this of course is that application servers servers and databases. Again, the the important part to keep in mind here is that the Aadhaar app that all of you use or the UPI app that all of you use is only one layer of the DPI stack. It's only the userfacing layer which is the application. But you have the protocols below it. You have the cloud systems below it. You have the servers and the data databases all of that sort of below that and most of it is not provided by the state. Google as the provider of a lot of cloud services.

AWS, Microsoft, these are the firms that are very present in public procurement contracts. They have very close relationships with public governments as well. And that means they are essentially private providers for a lot of these infrastructures. Now once you do that, there are many other questions to consider because again they are not beholden to right to information requests. You can't summon them as easily as you can let's say demand accountability from a public actor like the state. The problem this leads to of course is one there is lack of access to proprietary code bases and design schema. We've seen this with UPI. We've seen this with Aadhar. How is the DPI structured? What are the architectures at play here? What are the protocols?

How were these protocols decided? Were the communities taken into account when these protocols were decided? Was there an evaluation of these protocols done based on principles not just of technological feasibility or economic scalability but also on factors of relevance for the user? Because these are public infrastructures. I'm just sort of bringing that point back. The second point is entrenchment of systemic lockins and disc dependencies. That's really the reason why I brought up the cloud providers here. Cloud providers today the world over are renowned for setting up certain vendor lockin mechanisms that prevent them from being replaced by other cloud providers. These are lockin mechanisms in the face of aggress but also lockin mechanisms in the form of you know technological fragmentation, exposure to extractive

practices like dark patterns and lastly privacy violations. Sorry, I'm quickly running out of time, so I'm going to rush a little. Um, happy to sort of talk about some of these points. The idea here is that yes, data sharing is important, but it says nothing about who should be coordinating this information. Yes, digital tools make it less expensive, but neither the emerging savings nor the externalized costs are shared by all. And lastly, the public private capacity gap is real, but partnerships and investments must lead to actual transfer of technology to the people and not really away from the state, which is the the paradigm we seem to be finding ourselves in. This is just going to be here. The argument that I really want to leave you all with and this is the conclusion here is that the shift needs to occur in multiple areas of the paradigm all the

way from conceptualizing a use case to implementing it in a rights respecting manner. Adopt a technolal model of secure data minimalism. Fund and govern DPIs through publicly accountable bodies and not through bodies that are not open to right to information to freedom of information requests. And lastly, the technical capacities of state enterprises have to build hand in hand. Otherwise, we are heading for a stage where it's really the private actors that provide a lot of these services in the first place. Thank you. This is my signal account. Happy to have a chat later. >> Yeah. Thank you. Thank you. Thank you.

And yeah, let's move to the questions. We have actually not much time. Please scan QR if actually you have questions. Yes. So move let's move to the first one. Yes. And actually we see that with the risk of pHQ tech shouldn't we actually move to minimalism uh in in actually DPI solutions? Yeah. In actual architecture what do you think about this? >> Yeah with risk of PQA tech should we shouldn't we focus on data minis? We should I mean I think I'm a very strong advocate for data minimalism here. I think sorry I hope I'm understanding that question correctly but we really should think about moving to a data minimalist model and more importantly a model that encourages decentralization and I don't mean decentralization in the

sense of storing data sets separately but still having a central control and command mechanism. I mean actually relegating control off to the people who own them. The health DPI that I was talking to you to you about earlier in the Indian context is often pitched as a decentralized DPI and that's because if you go to a hospital and you give your data there your data stays in the hospital it doesn't go to a central repository like other DPIs but the central repository still stays control of what's the protocol on which these data will flow is this an encrypted flow of data are these stored on servers that are you know protected in some way what are the standards on which they are protected all of this is out of the ambit of decentralization in the health context It's important to think about data minimalism and decentralization

sort of hand in hand here. >> Okay. Thank you. Let's move for another question. Should actually India build its own stable coin over actually year Ruby. Yeah. What do you think? >> I think I'm going to skip that question one because I'm not a uh an expert in CBDs at all. Um I have my personal take on it which I don't think is suitable for this stage probably but uh happy to have that chat maybe off the stage. Sorry. >> Thanks for answering. Yeah, actually next question. You actually mentioned that DPI even more vulnerable. Yes, that private um platforms. So, who actually should hold them in this case?

>> That's a that's a great question and I think it really depends on which DPI you are talking about because if it's the health DPI, then you need to have a delegated you know sort of accountability structure where the hospitals that you're giving your data to or the health tech startups you are giving your data to of course have a certain set of accountability thresholds they should bind by. then you really need to have a regulator here. I mean, I know we're in a space where trust on state entities is withering and rightfully so, but a problem of data leaks or data breaches as we've seen in this country where levels of digital literacy and more importantly access to digital technologies is bad. There has to be a a setup to put in defaults in place. We can't rely on consent notices and consent mechanisms by individual

users to decide what data is you know shared by them because a lot of them don't really care. They they what they want is the service that is being given to them in exchange of the data that they'll hand over. So there has to be an apparatus in place specifically with parliamentary bodies. I don't mean to hand over the power here to an unaccountable executive in any way. There are parliamentary examples in the in the Brazilian case for instance where the the land DPI that I had talked about actually has a very interesting decentralized governance structure. There are community bodies that manage the lands commons for those areas and these community bodies essentially have the first line of control and because that that DPI is open source by design those communities can work with

technological workers that they are aware of to audit these architectures outside of the ambit of the state. So there is certain responsibility here that needs to be put on first mile actors who collect this data in the first place. But we also need a more centralized approach for regulation and for auditing these systems that make sure that the traits of these systems are put out in public and they're not really opaque infrastructures that people are dealing with. >> Thanks. Thanks. Yeah. And thanks everyone for the questions. [music]