Arising out of its request for assistance from the United Arab Emirates (UAE) in 2021, the Government of Guyana yesterday inked a US$34 million contract with German-headquartered company, Veridos, for the production and rollout of an electronic citizenship card that consolidates the data of the holder, providing for easier access to public and private sector services.
But while Guyana hopes to boost easier access across platforms with the swipe of the card and privacy aspects being “second to none”, technology experts have expressed concern about this country neither having ample or robust legislation to guard against cyber threats nor a comprehensive Data Privacy Policy. Questions are also being raised as to whether this contract should have been subject to public procurement as opposed to direct discussions with the UAE.
“Given the Government of Guyana’s commitment to promote e-governance in order to improve the productivity of businesses and delivery of government services through e-health, e-education, e-security, e-agriculture, electronic permits, and licence processing, et cetera, there is an immediate need to implement a robust national identity management system, one that focusses on the integration of identification services across government agencies, security ease of use and acquisition of IDs,” President Irfaan Ali yesterday remarked at the virtual signing.
“By so doing, This ID system will improve access to all citizen-centric government services and benefits the citizens, private sector, and government alike. This will bring us in line with solutions used by the most developed economies and position Guyana to be a competitive sphere, in a world that is moving [and] advancing drastically along a technological landscape,” he added.
Representing Guyana at the virtual signing ceremony were the President, Prime Minister Mark Phillips, Minister of Finance Dr. Ashni Singh, and Minister within the Ministry of Public Works Deodat Indar. The other signing party included UAE’s Sheikh Ahmed Dalmook Juma al Maktoum, a representative of Veridos, and other foreign representatives. Whether the UAE and al Maktoum are benefiting from this deal has not been clarified. Al Maktoum had also been connected to the sale of Sputnik COVID vaccines to Guyana in 2021.
The electronic identity card (e-ID) is distinct from Guyana’s National Identification Card which is catered for under this country’s National Registration Act and which is constituted to be implemented by the Guyana Elections Commission (GECOM). There has been no public discussion of this new card and its
implications for privacy and in relation to cyber security. It has also not been ventilated in Parliament.
The President said that from speaking with al Maktoum from 2021 to the signing yesterday, a process evolved where this country was invited by the UAE sheik to view a demonstration from two companies. After evaluating both presentations, it was determined that the Veridos system was best suited for Guyana.
“This process took some amount of time. The Government of Guyana sought the assistance of the UAE in October of 2021. On an invitation of His Highness Sheik Amah al Maktoum, two internationally recognized industry leaders [a Swiss company] and Veridos presented their national ID system solutions. These solutions were evaluated by a technical team comprising members of the National Data Management Authority and the office of the National ICT Advisor. The evaluation criteria factored technology use, other government clients, as well as biometric security subsystems and Veridos was the company in the estimation of the evaluators that presented the best solutions for Guyana.”
While Ali mentioned that security systems would be in place, he did not give specifics, as he underscored the benefits. “e-ID systems promote the idea of one citizen, one identity, by assigning a unique national registration number to each citizen, for use by all government agencies [and] private sector. For example, in the banking sector now, we know the difficulties there. Through this card, the banking sector now can have fingerprint verification and validation of the person who is before them. So the need for proof of address and all the other documentation is eliminated. So, the cost of doing business, the effectiveness, the competitiveness, the efficiency, all improved as a result of this technology,” he emphasised.
Globally certified
He noted that the card was globally certified to ISO 18013-5, which makes it acceptable for international travel and highlighted its integrity.
“The ID cards that we are going to implement for Guyana are going to position Guyana among a set of nations that has one of the most technologically advanced electronic identification systems. The ID cards are compliant with 18013-5 of the ISO Standard. What this means is that this card is also accepted by the International Civil Aviation Organization for international travel. So, that is the level and integrity of the card. Not only does it come with the highest level of ISO compliance, but it is also accepted by the International Civil Aviation Organization for international travel. As a result of that compliance, it brings with it technical and international standards that are met….”
The president added that the card also provides for solving the backlog of immigration issues. “… as you know, we have the new requirement for work permits; managing work permits, managing our immigration process, the resident card. All of these will be major issues that we will have to deal with. This card will allow us to deal with this electronically. Because through this card we will now be able to address the issue of work permit, [and] resident cards will be added onto the electronic ID system, and will be used to better document the immigrants working in Guyana,” he said.
“There isn’t an ISO 27001 certified data centre in Guyana to house this data. While the e-Governance unit subscribes to the NIST [National Institute of Standards and Technology], they do not follow NIST 800-53 guidance for security,” a United States cyber-security expert who requested anonymity told Stabroek News, in an invited comment.
“Has this company and the solution been assessed, potential risks identified and mitigated?” the IT technician questioned while pointing out that Guyana has to carefully monitor to assess and remedy gaps.
One observer pointed out that while the US is among the countries that have implemented digital ID systems, to ensure the safety of citizens’ data, that country has enacted stringent laws.
“These laws include The Gramm-Leach-Bliley Act (GLBA), which mandates financial institutions to explain their information-sharing practices and safeguard sensitive data, The Health Insurance Portability and Accountability Act (HIPAA), which sets national standards for the protection of medical records and personal health information, The Children’s Online Privacy Protection Act (COPPA), which regulates the collection of personal information from children under 13, and The California Consumer Privacy Act (CCPA), which grants California residents the right to know what personal information is being collected and opt-out of its sale,” the observer explained.
“Unlike the US, Guyanese citizens lack comparable legislative safeguards against the misuse and breach of their centralized and easily accessible data,” the sources added.
Noted too was that “concerns about privacy and the potential for unauthorized access to the data collected by the system remain. The implementation of a national ID card system is also expensive, and the cost may be passed on to taxpayers. Some citizens who do not have the necessary documentation to obtain an ID card, such as refugees or stateless persons, may be excluded. Technical issues such as system failures, glitches, and errors can also cause inconvenience and frustration for citizens.”
Global advocacy organisation, EDRi 2, which “works tirelessly to defend fundamental rights in the digital age, to advocate for appropriate laws and policies, and to raise awareness of the key issues impacting digital rights,” has also listed a number of gaps e-ID systems bring and suggests that governments should implement strict security measures before these are rolled out.
“In the case of public-private partnerships, that is, access by private companies, use cases must be controlled strictly. Otherwise, identity theft and other identity-related crime and mischief cannot be avoided…,” it stated as it focussed on Austria’s plan to implement the system.
To implement the project from the technical side, there will be a central ID processing system, pre-enrollment and fixed enrollment stations, mobile stations and delivery stations. Features of the card include laser engraving and an Automated Fingerprint Identification System (AFIS) to access all of a user’s biometric information on a polycarbonate document with a chip. All of the features, according to Ali are tailored for this country. “The system allows the capture of biographical information, based on international standards and stores it to provide identity based services to individuals and other government offices.”
The president said that the contract with the company covers an in-country help desk and that they will train administrators and operations staff, after which there will be a one-year implementation period. The company also will provide an additional 60 months of support services.
