THE STATE OF IDENTIFICATION SYSTEMS IN AFRICA A Synthesis of Country Assessments 2 / The State of Identification Systems in Africa © 2017 International Bank for Reconstruction and Development / The World Bank 1818 H Street NW Washington DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Rights and Permissions The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2625; e-mail: pubrights@ worldbank.org. Cover Image: Fingerprint Map of Africa, Matthias-Sönke Witt. CC BY-NC-ND. 3 / The State of Identification Systems in Africa ACKNOWLEDGEMENTS This report was prepared by Julia Clark on behalf of the Identification for Development (ID4D) initiative, the World Bank Group’s cross-departmental effort to support progress towards identification systems using 21st century solutions. The findings in the report are based on detailed assessments of identification systems (IMSAs) in 17 countries—Botswana, Chad, Cameroon, Côte d’Ivoire, the Democratic Republic of Congo (DRC), Ethiopia, Guinea, Kenya, Liberia, Madagascar, Morocco, Namibia, Nigeria, Rwanda, Sierra Leone, Tanzania, and Zambia—that were conducted between 2015 and 2016 as part of the ID4D initiative. As a result, the information presented here represents a snapshot of identification systems in these countries at the time the reports were written, and may not reflect recent developments. This summary report relies heavily on the teams that conducted the individual assessments, as well as the many local officials and professionals whose expertise informed their analysis. Specifically, the report would not have been possible without the work of the authors and contributors to the IMSAs, including Joseph Atick (Chad, Côte d’Ivoire, DRC, Liberia, Morocco, Rwanda, Sierra Leone), Vasumathi Anandan (Kenya), Heriniaina Andrianasy (Madagascar), Diego Angel- Urdinola (Moroc-co), Kenabetsho Bainame (Botswana), Nathalie Tchoumba Bitnga (Cameroon), Motsholathebe Bowe-lo (Botswana), Dorothee Chen (Morocco), Ndoe Dir (Cameroon), Fatima El Kadiri (Morocco), Jean Ferry (Guinea), Alan Gelb (Ethiopia, Kenya, Tanzania), Mia Harbitz (Madagascar, Namibia), Diane Hubbard (Namibia), Linda C. Kasonde (Zambia), Mpho Keetile (Botswana), Anne- Lucie Lefebvre (Madagascar), Neo Corneliah Lepang (Botswana), Marc Lixi (Guinea), Kannan Navaneetham (Botswana), Azedine Ouerghi (Côte d’Ivoire), Robert Palacios (Ethiopia, Côte d’Ivoire, Morocco), Krish-na Pidatala (Namibia, Tanzania, Zambia), Ariel Pino (Morocco), Serai Daniel Rakgoasi (Botswana), Antsanirina Ramanantsoa (Madagascar), Manuel Salazar (Cameroon), Zaid Safdar (Liberia, Nigeria, Sierra Leone), Arleen Cannata Seed (Kenya), Jaap van der Straaten (Cameroon, Zambia), Emily Weedon (Cameroon), and Matthias Witt (Madagascar). Furthermore, this report benefitted greatly from the input of Robert Palacios, Alan Gelb and Jonathan Marskell, under the supervision of Vyjayanti Desai, and from the support and guidance of the ID4D team, including Matthias Witt and Kamya Chandra. 4 / The State of Identification Systems in Africa Glossary 1 Autonomous In the context of government administration, an entity legally entitled to administrative and budgetary self-rule within the executive branch of the government, but outside of the line ministries. Civil register The repository of loose-leaf files, ledger books, electronic files, or any other official files or database set up for the universal, continuous, and permanent recording—in accordance with established procedures—of each type of vital event and its associated data for the population of a defined area (e.g., county, district, municipality, or parish). Credential A mechanism, process, device or document that vouches for the identity of a person through some method of trust and authentication. Examples include birth certificates, national ID cards, digital and mobile certificates, unique ID numbers, etc. Deduplication A specialized data compression technique for eliminating duplicate copies of repeating data. Biometric data—including fingerprints and iris scans—is commonly used to deduplicate identities and establish uniqueness. Digital identity A set of electronically captured and stored attributes and credentials that can uniquely identify a person that individualize a person in a computer- based environment. Electronic identification An credential used to identify and authenticate an individual in a digital environment. Generally, a smartcard that contains a contact- or (eID) contactless chip. Foundational Identification system created for general public administration and identification—including civil registries, national IDs, and national identification system population registers—which may serve as the basis for a wide variety of public and private transactions, services, and derivative identity credentials. Common examples include national IDs, civil registers, and population registers. Functional identification Identification system created in response to a demand for a particular service or transaction, and may issue identity credentials such as voter IDs, system health and insurance records, bank cards, etc. These may be commonly accepted for broader identification purposes, but may not always bestow legal identity. 1 Unless otherwise noted, definitions are based on IMSA Guidelines and additional ID4D publications, including the Principles on Identification for Sustainable Development, the ID4D Strategic Framework, and a joint World Bank Group–GSMA–Secure Identity Alliance Discussion Paper, “Digital Identity: Towards Shared Principles for Public and Private Sector Cooperation”. 5 / The State of Identification Systems in Africa Glossary Identification The determination of identity and recognition of who a person is; the action or process of determining what a thing is; or the recognition of a thing as being what it is. Identification/identity Systems—including databases, credentials, and the processes, procedures, and infrastructure to create and manage them—that register system and identify individuals for a general or specific purpose. Identity A unique set of features and characteristics that individualize a person, including biographical and biometric attributes. Interoperability The ability of information systems and procedures to share or authenticate data and enable the exchange of information and knowledge among them. National population A register of every unique individual that has the right to reside in the country (citizens, adult, children, resident foreigners, diaspora, and register (NPR) refugees). Legal identification Identification systems that provide government-recognized credentials (e.g., identifying numbers, cards, digital certificates, etc.) that can be used system as proof of identity. Legal identification need not be linked with nationality or citizenship, and may encompass both foundational and functional systems. Social register Databases that contain socioeconomic data on the population—at the individual and/or household level—for the purpose of unifying the targeting and distribution of social programs, such as social safety nets and pensions. Unique identity number A number—normally based on biometric identification—that uniquely identifies an individual for their lifetime and can be used to link an identity (UIN) across databases and systems in both the public and private sector. 6 / The State of Identification Systems in Africa Abbreviations ABIS automated biometric identification system AFIS automated fingerprint identification system A.N.GE.IE Agency for Electronic Governance and Information Technology (Guinea) BOT build-own-transfer BUNEC National Civil Status Bureau (Cameroon) CRVS civil registration and vital statistics DAPEC Direction des Affaires Politiques et de l’Etat Civil (Chad) DCNR Department of Civil and National Registration (Botswana) DNEC Direction Nationale de l’Etat Civil (Guinea) DNRPC Department of National Registration, Passport and Citizenship (Zambia) DRC Department of Civil Registration (Namibia) ECOWAS Economic Community of West Africa States ICT information and communications technology ID identity document ID4D Identification for Development (World Bank Group Initiative) IPRS Integrated Population Registration Service (Kenya) INCRS Integrated National Civil Registration System (Sierra Leone) ISMA Identity Management System Analysis (the World Bank’s ID4D assessment tool) MINALOC Ministry of Local Government (Rwanda) MINATD Ministry of Territorial Administration and Decentralization (Cameroon) MSPC Ministry of Security and Civil Protection (Guinea) NASSIT National Social Security Insurance and Trust (Sierra Leone) NFC near-field communication NIA national identity authority (general) NID national identity document NIDA National Identity Agency (Rwanda) or National Identification Authority (Tanzania) NIMC National Identity Management Commission (Nigeria) NIN national identity number (may or may not be unique, i.e., a UIN) NIR National Identification Register (Liberia) NPR national population register (general, see glossary) NPRS National Population Registration System (Namibia) NRS National Registration Secretariat (Sierra Leone) NSSNP National Social Safety Net Program (Nigeria) ONIP Office National D’Identification de la Population (DRC) 7 / The State of Identification Systems in Africa Abbreviations OVCs orphans and other vulnerable children PII personally identifying information PPP public-private partnership TASAF Tanzania Social Action Fund (Tanzania) UIN unique identity number UNDP United National Development Program UNICEF United Nations Children’s Emergency Fund WBG World Bank Group 8 / The State of Identification Systems in Africa List of Tables and Figures Table 1. Institutional Arrangements for Foundational Identity Systems 22 Table 2. Decentralization of Civil Registration and Identification Services 25 Table 3. ICT Access and Infrastructure 28 Table 4. Major ICT Issues Highlighted by Reports 29 Table 5. Registration and Identification Rates 31 Table 6. Database Technology for Legal Identification Systems 38 Table 7. Fingerprint Technology Used for National IDs 40 Table 8. National ID Credentials and Authentication 42 Table 9. Data Protection Laws and Authorities in Africa 53 Figure 1. Snapshot of Relative Identity Ecosystem Development 12 Figure 2. Relative Development of Civil Registration and Identification Ecosystems 17 Figure 3. Advanced Identity Ecosystems: Coverage and Linkages between Foundational Assets 18 Figure 4. Intermediate Identity Ecosystems: Coverage and Linkages between Foundational Assets 19 Figure 5. Early Identity Ecosystems: Coverage and Linkages between Foundational Assets 21 Figure 6. Birth Registration and National ID Coverage, Scaled by Population Size 32 Figure 7. The Urban-Rural Divide in Birth Registration 33 9 / The State of Identification Systems in Africa Table of Contents GLOSSARY 4 ABBREVIATIONS 6 LIST OF TABLES AND FIGURES 8 TABLE OF CONTENTS 9 EXECUTIVE SUMMARY 11 INTRODUCTION 16 KEY FINDINGS 17 Ecosystem Overview 17 Governance: Institutions and Capacity 20 Institutional Frameworks 21 Fiscal Sustainability 26 Administrative Capacity 28 ICT Limitations 29 Inclusivity: Barriers and Constraints to Enrollment 30 High Costs for Users 34 Complex Legal and Administrative Requirements 35 Loss of Paper-Based Records 36 Geographic Constraints 37 Lack of Demand 37 Technology: Use and Management 38 Enrollment 39 Credentials 41 Authentication 43 Data Storage and Security 44 Integration: Interoperability and Interconnectivity 45 10 / The State of Identification Systems in Africa Legal and Regulatory Framework 47 CONCLUSIONS 50 Strengths 50 Strong Commitment to Identity 50 Efforts to Improve Coverage 51 Innovations in Governance 52 Weaknesses 53 Lack of Stakeholder Coordination and Integration 53 Limited Administrative, Fiscal, and Technical Capacity 54 Inaccessibility and Unmet Demand 55 Unrealized Technology Potential 55 Problems with Vendors and Procurement 56 Missing legal and regulatory foundation 56 RECOMMENDATIONS 57 Country Recommendations 57 Harmonize and Modernize Identity Systems 57 Plan for Fiscal Sustainability 58 Extend Coverage in an Inclusive Manner 59 Follow Best Practices for Technology 60 Build Authentication Infrastructure 61 Reform the Legal and Administrative Framework 62 Future Engagement by the World Bank Group 63 Bibliography 65 Appendix 1: IMSA Reports in Africa 66 Appendix 2: Institutional Structure of Foundational Identity Systems 67 11 / The State of Identification Systems in Africa Executive Summary THE ABILITY TO PROVE ONE’S IDENTITY IS A CORNERSTONE OF PARTICIPATION IN MODERN LIFE, YET OVER 1.5 BILLION PEOPLE LACK PROOF OF LEGAL IDENTITY. As a first step in assisting its client countries to close about the current state of identity systems in these this identity gap, the World Bank Group’s ID4D initiative countries. A final section offers recommendations from conducts Identity Management Systems Analyses these IMSAs that may be broadly applicable to other (IMSAs) to evaluate countries’ identity ecosystems developing contexts, as well as recommendations and facilitate collaboration with governments for for future WBG engagement in this area. future work. To date, analyses have been conducted in 17 African countries, including Botswana, Chad, KEY FINDINGS Cameroon, Côte d’Ivoire, the Democratic Republic • Administrative framework and capacity: The of Congo (DRC), Ethiopia, Guinea, Kenya, Liberia, institutional arrangements that govern identity Madagascar, Morocco, Namibia, Nigeria, Rwanda, systems vary substantially by country. In many Sierra Leone, Tanzania, and Zambia. cases, civil registries and national ID registries Overall, these analyses reveal a wide range of identity are housed in different ministries or departments, system types and levels of development. Some and only a few countries have autonomous countries, such as Botswana, Kenya, Morocco, and identification agencies. A handful have or have Rwanda have systems that are relatively advanced in begun to develop national population and/ terms of coverage, robustness, integration, and utility. or social registers to identify individuals and Many others (e.g., Chad, Nigeria, and Tanzania) are in beneficiaries for life. Civil registration is highly intermediate levels of development, while others still decentralized in most countries, while national have non-existent or newly emerging identity systems ID systems tend to be centralized. There are a (e.g., DRC, Guinea, Liberia). In these countries, a variety of fiscal arrangements to fund identity historic lack of strong foundational identity systems systems, although in most cases they are funded has often led to a proliferation of disconnected as line items in the national budget. On the functional registers. Many are currently faced with whole, identity systems are underfunded and the challenge of reverse-engineering civil registers under-resourced. The lack of ICT infrastructure, and national IDs in order to improve efficiency and including internet and power, is a major barrier for meet demand for identification services. Figure 1 the extension and utility of identity ecosystems provides an overview of the relative development in most countries. of identity ecosystems in these countries across key • Accessibility: In most countries, accessibility of dimensions of the IMSA. identity systems and services is low; only a few The first section of this paper synthesizes the findings countries have achieved substantial coverage from these reports according to the five dimensions in both civil registration and identification. A of the IMSA: administration, accessibility, technology, number of persistent barriers have limited integration, and legal frameworks. Based on these accessibility and coverage, including high direct findings, the second offers some general conclusions and (particularly) indirect costs to users, complex 12 / The State of Identification Systems in Africa legal and administrative requirements, paper- handful FIGURE of countries 1. SNAPSHOT are currently OF RELATIVE IDENTITY the process inECOSYSTEM based records systems that are vulnerable DEVELOPMENT to damage, geographic constraints including difficult terrain and sparse populations, and a lack of demand from users. • Technology: The technology used for identity enrollment, credentialing, and authentication varies by country, as do methods of data storage and levels of system security. A majority of countries still have paper-based civil registers, while most civil identity systems are electronic and use biometric technology to de-duplicate individuals. Most have adopted plastic cards and smartcards with advanced security features, although a few maintain paper-based ID cards. And although a few countries allow service providers (including government ministries, banks, etc.) to authenticate credentials against a central database, almost none have developed infrastructure to securely authenticate individuals using biometrics, despite the existence of smartcards that are capable of performing this function. Only a few countries store and manage their data according to international best practices to protect against theft or unintentional data loss. of integrating multiple foundational databases • Integration: The integration and interoperability to create true national population registers and of identity systems is low in most countries. enable records to be updated across the system Identity remains fragmented, with multiple in real-time. agencies in charge of foundational identity • Legal frameworks: A majority of countries lack systems—including civil registration and adequate legal frameworks to support and identification—and a multitude of functional regulate modern identity management systems. identity registers operated in isolation by different Some have adopted laws to effectively govern ministries. In some countries, service providers identity institutions and processes, while others use the national ID as a basis for services or for have legislation with overlapping or unclear issuing a functional IDs, however the verification mandates for identity actors. Nearly all countries of these credentials is often manual. A few lack sufficient regulations to protect personal countries have made progress with integration data and uphold individual rights to privacy and by creating unique identity numbers (UINs) that fair use of data. In addition, many identity-related link civil registration and identification records laws are outdated and do not take into account and provide a unique identifier from birth, and a the digital nature of modern data capture, 13 / The State of Identification Systems in Africa storage, and use. to identity, there is an ongoing lack of coordination and planned integration among CONCLUSIONS identity stakeholders in a number of countries. Identification systems remain highly fragmented Based on the above findings, the IMSA reports offer and duplicative, wasting valuable resources and a number of conclusions about the general strengths capacity. Where efforts have been uncoordinated and weaknesses of identification systems in the or rivalrous, the quality and coverage of legal assessed African countries: identification systems have suffered. Strengths: • Limited administrative, fiscal, and technical • Strong commitment: Overall, there is a growing capacity: There is a persistent lack of commitment to build identification systems in implementation capacity in a number of these countries, evidenced by its inclusion in countries. This problem is particularly evident in national development and e-Governance plans those areas that have faced violent conflict or and efforts to coordinate identity stakeholders economic crises and lack general administrative in a number of countries. Many of the countries capacity and resources, although many other in this study are currently in the process of countries also lack staff with adequate technical developing ambitious plans to roll out new or knowledge and face chronic underfunding. Even improved identity systems. those countries that are well-resourced often face crucial deficits in ICT infrastructure. • Efforts to improve coverage: Many countries have made significant progress in improving the • Inaccessibility and unmet demand: Barriers coverage of their identification systems—birth to enrollment—particularly high indirect costs registration in particular—over the last decade. and administrative hurdles to accessing This has been achieved by outreach campaigns identification—keep the coverage of identification to remote and underserved populations and systems low in many countries. Unmet demand the increasing deployment of technology to for foundational identity documents is evident facilitate inclusion. in the high uptake of many functional programs such as voter registration. • Innovations in governance: A number of countries have also used technology to improve • Unrealized technology potential: Nearly all the delivery of identification services, including countries have moved toward digital identity the use of mobile devices to register births, SMS for national ID systems, many civil registers notifications to help applicants track the status of remain paper-based, and most transactions ID applications, and one-stop-shops to increase using national IDs are manual. In many countries, the efficiency of access to ID and eGovernance registration and identification offices in the services. A few countries have also undergone countryside remain disconnected from central substantial civil service reforms to improve the databases. In addition, most countries, including operation of identification-providing agencies. those with advanced smartcards, lack the ability to authenticate individuals securely against their Weaknesses: identity credentials. • Lack of stakeholder coordination and • Problems with vendors and procurement: A integration: Despite political commitment number of countries have experienced delays 14 / The State of Identification Systems in Africa and failures in their identification projects due to with health and education ministries, inclusive problems with the procurement process, vendor enrollment campaigns, and mobile technology), lock-in and the use of proprietary technology that boosting the demand for identification by raises costs and inhibits growth and adaptation increasing its utility in everyday life, and extending of identification systems. systems by integrating legacy databases and identifying residents at a younger age. • Missing legal and regulatory foundations: A majority of the surveyed countries lack • Follow best practices for technology by using adequate legal frameworks to support and open-source and off-the-shelf (OTS) technology, regulate modern identity management systems. adopting international standards for biometrics, This includes overlapping mandates for encrypting data and transactions, weighing identity providers, inadequate privacy and data the costs and benefits of credentials carefully, protection laws, and out-of-date regulations that collecting the minimum amount of data required, do not sufficiently cover digital identity. and considering technology options to reach remote and unconnected places. RECOMMENDATIONS • Build authentication infrastructure that Although the IMSA tool is designed to provide increases linkages with service providers to country-specific analyses, in aggregate they offer a authenticate credentials, and introduces the number of recommendations common to all or most capacity to authenticate individuals either countries. In addition, the reports indicate several against a card or a central database (via the important areas for continued engagement by the cloud). World Bank. • Reform legal and administrative frameworks by Country Recommendations: implementing international guidelines for privacy and protection of digital data (e.g., ECOWAS • Harmonize and modernize identity systems or OECD frameworks), creating clear lines of by empowering national identity coordinating authority for identification, and updating legal agencies or authorities (NIAs), adopting a unified requirements and administrative procedures to approach to identity management, establishing reduce barriers to access. UINs, modernizing civil registries, and planning for international interoperability. Areas for Further Engagement by the WBG: • Plan for fiscal sustainability by considering • Additional IMSAs and feasibility assessments: various options for financing identification Continued use and development of the IMSA tool systems (including corporate financing and will provide a solid and productive foundation for PPPs), ensuring that cost is not a barrier to future partnerships. In addition, the WBG should identification, and taking into account potential also assist countries in completing feasibility long-term savings from improvements to the studies before finalizing identification programs system (e.g., increased tax collection, rationalized and (especially) before beginning procurement. wage bills, reduced program leakage, etc.). • Technical assistance: There is substantial • Extend coverage in an inclusive manner by demand for more technical assistance following removing cost barriers, increasing points of the IMSAs, particularly for independent experts contact with citizens (e.g., though partnerships 15 / The State of Identification Systems in Africa to consult on technology systems, legal experts to help develop frameworks for data protection and privacy, and experts from identification leaders in developing countries (e.g., Peru, India, Pakistan, Rwanda, Thailand) to share their experiences and expertise. • Programmatic support for identity systems: Many WBG projects involve the creation or use of identification systems for functional programs, including for social protection programs, pension and civil service reforms, and financial inclusion. These projects can be an important instrument to boost demand for identification and—where creating foundational systems is not feasible in the short-term—create functional identity systems that reinforce or lay the groundwork for modern foundational identification systems in the future. • Investment in foundational identity systems. The WBG can continue to play a direct role in supporting the development of robust and inclusive foundational identification systems. This may involve investment in modernizing and integrating data systems, including digitization of records, ICT equipment and infrastructure, staffing and training, setting up enabling agencies such as Data Ombudsman offices, etc. 16 / The State of Identification Systems in Africa Introduction UNIVERSAL, ROBUST IDENTIFICATION SYSTEMS ARE ESSENTIAL FOR NATIONAL DEVELOPMENT AND THE FULFILLMENT OF INDIVIDUAL RIGHTS AND OPPORTUNITIES. However, many low and middle income countries 3. technology use and management, lack effective identification systems with the capacity 4. interoperability and interconnectivity, and to deliver basic identity credentials and services. 5. legal and regulatory frameworks. As a result, an estimated 1.5 billion people across The resulting analysis details identity assets and the world have no form of legal identification.2 This gaps, and gives country-specific recommendations deficit disproportionately affects poor and vulnerable for improving the integrity and utility of identity groups—including women, children, rural-dwellers, ecosystems. minorities, migrants, and refugees—and often prevents them from accessing basic political rights, From 2014 to 20163, IMSAs were conducted in 17 economic opportunities, and social services. countries in Sub-Saharan and North Africa: Botswana, Chad, Cameroon, Côte d’Ivoire, the Democratic In 2014, the World Bank Group (WBG) created the Republic of Congo (DRC), Ethiopia, Guinea, Kenya, Identity for Development (ID4D) initiative to assist Liberia, Madagascar, Morocco, Namibia, Nigeria, client countries in closing this identity gap. A key Rwanda, Sierra Leone, Tanzania, and Zambia4. These pillar of the ID4D Action Framework is country analyses were based on in-country missions to and regional engagement, which begins with an interview key government and private sector identity Identity Management Systems Analysis (IMSA). The stakeholders, as well as desk reviews of primary and IMSA is a tool used to evaluate a country’s identity secondary material, including country development ecosystem, including laws, policies, practices, plans, operations manuals, legal documents, and governance institutions, capacity, and technology. more. This document summarizes the results of these An IMSA facilitates collaboration with governments reports. It begins by presenting key findings and then to improve legal identification systems—including identifies general conclusions regarding the state of civil registration, national IDs (NIDs), and population identity management in these countries. Finally, it registers—and their interoperability with functional summarizes recommendations for the development registers. Specifically, it assesses a country’s of identity systems in Africa and other developing identification system along five dimensions: regions, and for further engagement by the WBG. For 1. administration, including institutional frameworks additional context and resources, this report should and capacity, be read in conjunction with the World Bank’s ID4D 2. accessibility, including barriers and obstacles to Strategic Framework and the Digital Identity Toolkit5. timely and universal registration, 2 Estimates by the World Bank ID4D Dataset, as of February 2016. This dataset is updated annually. 3 As these assessments were carried out over two years, this report does not take into account recent developments in identification systems in these countries. However, the general trends and lessons remain the same. For more detail, consult the individual country reports listed in Appendix 1. 4 Additional IMSAs conducted in Burkina Faso, Lesotho, Niger, São Tomé and Príncipe, and Somalia have not been included in this summary as their reports had not yet been finalized at the date of publication. 5 Available at http://pubdocs.worldbank.org/en/179901454620206363/Jan-2016-ID4D-Strategic-Roadmap.pdf and http:/ /documents. worldbank.org/curated/en/2014/06/20272197/digital-identity-toolkit-guide-stakeholders-africa. 17 / The State of Identification Systems in Africa Key Findings THIS SECTION SYNTHESIZES KEY FINDINGS ABOUT THE IDENTIFICATION SYSTEMS IN 17 AFRICAN COUNTRIES THAT COMPRISE ROUGHLY 50 PERCENT OF THE TOTAL POPULATION OF THE CONTINENT. It focuses on foundational legal identification FIGURE 2. RELATIVE DEVELOPMENT OF CIVIL REGISTRATION systems, including civil registries, national IDs, and AND IDENTIFICATION ECOSYSTEMS population registers . It is organized according to the 6 five dimensions used by the IMSA—administration, accessibility, technology, integration, and legal frameworks—and begins with a general overview of countries’ identification ecosystems. ECOSYSTEM OVERVIEW The assessed countries vary substantially in the structure, quality, and utility of their identity ecosystems. As shown in Figure 2, they can be loosely groups into one of three categories: advanced, are relatively robust. This robustness relies both intermediate, and early. Although these categories on technology (e.g., biometric deduplication and are simplifications of complex systems, they provide credential security features) and local-level vetting a rough idea of the relative development of major and identity validation. In addition, they have partially foundational systems, including civil registries, or fully digitized and harmonized their identity national IDs, and other population registers among ecosystems, creating dependencies and some level the IMSA countries. of integration between foundational and functional Five countries have relatively advanced identity registers (see Figure 2). In Rwanda, for example, the ecosystems compared to the rest: Botswana, NID is held by approximately 90 percent of the adult Kenya, Morocco, Namibia and Rwanda. These population (or 52 percent of the total population), and countries have long (mostly colonial) histories of civil is used to access virtually all government services, registration and identity documents. In Kenya, for travel in the EAC region, open bank accounts, and example, birth registration (initially for Europeans and vote in elections. Asians only) dates back to 1904, and an ID card has The second category are countries with intermediate been in place since 1915. What sets these countries identity systems. For the most part, this includes those apart, however, is the progress they have made in that are in the process of modernizing decades-old increasing the coverage and use of their foundational legacy identification systems and paper-based civil identity systems and ensuring that processes registers, or implementing new identification projects to register individuals and establish uniqueness to leapfrog past these systems. Although each of 6 See glossary for definitions of these terms. 18 / The State of Identification Systems in Africa FIGURE 3. ADVANCED IDENTITY ECOSYSTEMS: COVERAGE AND LINKAGES BETWEEN FOUNDATIONAL ASSETS these countries has operational civil registration and for less robust systems and credentials that are identification systems, they have not yet reached the susceptible to fraud. Although a few have recently level of coverage, harmonization, or functionality of rolled out state-of-the-art national ID cards, these the more advanced countries (see Figure 4). Absent lack widespread adoption and integration with widespread, streamlined foundational documents, other systems. One example is Nigeria, which has a many residents rely on alternative credentials for fragmented identity landscape and ongoing efforts proof of ID, such as voter cards or village-issued to increase the coverage of it’s technowlogically certificates. In some cases, continued reliance advanced national ID card7. Although Nigeria’s rollout on legacy registers and analog processes makes has been slow, the system has the potential to form a 7 The National Identity Management Identity Management Commission (NIMC) was created in 2007 by an act of Parliament, and work to create a new identity system began in earnest in 2009. National Identity Numbers (NINs) have been issued since 2012, and cards have been issued since 2014. 19 / The State of Identification Systems in Africa FIGURE 4. INTERMEDIATE IDENTITY ECOSYSTEMS: COVERAGE AND LINKAGES BETWEEN FOUNDATIONAL ASSETS 20 / The State of Identification Systems in Africa robust foundation for identity management. Many of the countries in the early and intermediate categories are now in the process of “reverse A final category are those countries in the early engineering” their identity ecosystems, rather than stages of providing proof of legal identity. These attempting to develop them “linearly” (i.e., birth countries currently lack major identity assets and registration ➔ national ID ➔ functional IDs). Some (e.g., are in various stages of planning new identification Chad) are focusing on national IDs before developing initiatives that have not yet been implemented. As civil registration capacity, while others (e.g., Sierra with the intermediate category, the demand for Leone) are working to strengthen civil registration identity documents in the early-stage countries has and the national ID simultaneously. Others are often been met by functional identification programs, attempting to use existing functional registers (e.g. such as voter IDs and social security cards. In both a voter list, as in Tanzania) to help populate their the DRC and Guinea, for example, there is no national national ID register8. An exception is Ethiopia, which identity cards or centralized population register, and has begun to create a civil registry before rolling out citizens must rely on voter ID cards for legal proof of a national ID card. identity. Liberia similarly lacks a national ID program, although it has concrete plans to implement a new GOVERNANCE : biometric-based system. Sierra Leone is slightly more advanced, and is in the beginning stages of INSTITUTIONS AND CAPACITY rolling out a new eID card and database, which will Governance institutions, practices, and capacity eventually be integrated with the civil registry system. are critical components of an effective and robust Ethiopia is an unusual case in that it has only recently identification system. In particular, a well-functioning created a civil registry, but has for several decades identity system requires political consensus, support, achieved high coverage of its kebele cards, which and solid institutional frameworks. Although the are issued independently by more than 17,000 appropriate institutional architecture for an identity local administrative units. Although the cards do not ecosystem will vary by country, strong systems will constitute a national ID—the central government is not include harmonization across government agencies involved in issuing them, and there is no centralized and private sector stakeholders, with well-defined database—they represent a nationally recognized and codified roles. In addition, agencies that manage form of identification and are highly integrated into civil registration and identification must be equipped many functional uses (e.g., opening bank accounts, to carry out their missions, including access to obtaining a passport etc.). Therefore, while Ethiopia’s sufficient financial, human, and technological overall identity ecosystem may be classified as “early” resources. due to its nascent civil registry system and lack of a The IMSAs in Africa reveal a wide variety of centralized, robust foundational ID, its kebele cards institutional arrangements and practices, along with offer more widespread coverage and functionality differing levels of staff capacity and technology than other systems in this category. The country is assets. A few countries have well institutionalized also in the planning stages of developing a national and resourced legal identity providers. However, ID system. many others have identity agencies that lack clear mandates and institutional coordination, despite the political consensus around the importance of 8 In Tanzania, the National Identification Authority (NIDA) is currently in the process of migrating the voter registry data into the national ID database in order to pre-register individuals, who will then be verified at a later date. 21 / The State of Identification Systems in Africa FIGURE 5. EARLY IDENTITY ECOSYSTEMS: COVERAGE AND LINKAGES BETWEEN FOUNDATIONAL ASSETS identification that exists in most countries. As Institutional Frameworks a result, most of the assessed countries have highly fragmented identity systems, with multiple There are two main areas of variation in the authorities and databases responsible for civil institutional arrangements for identity systems: the registration and identification, and for functional degree to which identity agencies are autonomous uses. In addition, a majority of the surveyed agencies institutions and the level of horizontal and vertical have been hampered by inadequate funding, lack of decentralization of identity management systems. high-speed internet connectivity, and/or insufficient Each has implications for organizational efficiency, power supply. fiscal sustainability, and harmonization across the identity ecosystem. 22 / The State of Identification Systems in Africa TABLE 1. INSTITUTIONAL ARRANGEMENTS FOR FOUNDATIONAL IDENTITY SYSTEMS National Identity Agency Autonomy semiautonomous National Registration Secretariat (NRS)—which currently handles only the national The responsibility for administering legal identity ID database—into a fully autonomous agency that systems may be delegated to an agency or directorate manages a national population registry. Liberia is of an existing ministry, or to an autonomous body also in the early stages of creating an autonomous that reports directly to the executive (e.g., UIDAI National Identification Register (NIR). In all other in India) or a stakeholder board (e.g., NADRA in countries, legal identification systems are owned Pakistan). Among the assessed countries, the former by one or more departments within a cabinet-level is far more typical. As shown in Table 1, only two of ministry, most often the Ministry of Interior or Home the surveyed agencies that manage national ID Affairs. systems and population registries are autonomous and governed by stakeholder boards: Nigeria’s Although agency autonomy is not a requirement for National Identity Management Commission (NIMC) creating a robust, inclusive system, it can be beneficial and Rwanda’s National Identity Agency (NIDA) . 9 in a number of ways. Establishing an autonomous Sierra Leone is also planning to transition its national identity agency (NIA) can help to coordinate key stakeholders and insulate the identification 9 Rwanda’s NIDA is nominally under the Ministry of Local Government (MINALOC), however it is a fully autonomous and self-financing agency. 23 / The State of Identification Systems in Africa projects from politically-based manipulation. In silos. addition, autonomous agencies generally have the Most countries have horizontally decentralized authority to raise and spend their own revenues, and systems, with various agencies and departments may be partially or completely self-funded (e.g., as in responsible for maintaining separate databases for Rwanda). This requires, however, sufficient technical foundational identification and the administration capacity, political consensus, and appropriate legal of a variety of programs (see Figures 3, 4, and 5). and regulatory frameworks. Autonomous agencies Combined with a lack of integration between these created in the absence of these conditions will databases (described below), this leads to highly face significant challenges. In the DRC, for example fractured identity systems. Decentralization of identity the Office National D’Identification de la Population is evident in a number of institutional arrangements. (ONIP) was created in 2011 to serve as an autonomous As shown in Table 2 and Appendix 2, civil registration NIA. However, it has overlapping mandates with and identification agencies are housed in different other identity agencies and little political capital, ministries or departments in a majority of countries. hampering its ability to function or begin any new Notable exceptions are Botswana, where the identity initiatives. Department of Civil and National Registration (DCNR) Horizontal Centralization of Identity manages the birth and death registry and the national identification database; Namibia, where the In addition to autonomy, institutions for managing Department of Civil Registration (DCR) manages the identity systems vary in their level of centralization national population register that issues both civil/vital along both horizontal and vertical dimensions. certificates and the national ID; and Zambia, where Horizontally centralized identity ecosystems are the Department of National Registration, Passport those with a small number of core identity agencies— and Citizenship (DNRPC) maintains both the civil e.g., a civil registration agency that issues certificates registry system and national ID records. Botswana’s of vital and civil events, and a national identity agency IMSA indicates that bringing these agencies under that maintains a population register and issues an ID one roof has greatly stabilized the registration card—that provide foundational documents on which process and facilitated improvements in the identity all or most other identity systems depend. In a high system. A few other countries (e.g., Côte d’Ivoire, centralized system, these foundational or “breeder” Kenya, Morocco, and Rwanda) have a single ministry documents serve as the basis for public and private in charge of civil registration, national IDs, national service providers to issue derivative forms of population and/or social registries, but these are identity for the administration of voter registration, systems are managed by different departments or pensions, and safety nets, health insurance, driver’s agencies within the ministry. licenses, and more. In the most centralized systems, single agencies may be responsible for both civil Another common feature of centralized identity registration and national identification, with high systems is the establishment of a National population levels of interoperability or integration between register (NPR), a database of the entire population that databases and services. In horizontally decentralized is continuously updated with data on civil and vital systems, foundational and functional providers events, potentially along with demographic and/or maintain separate, standalone identity systems. socioeconomic characteristics, and can serve as the Some decentralized systems are integrated with a basis for a number of identity-related applications. unique identity number (UIN); others are “fractured” NPRs are uncommon among the assessed countries with systems that exist in distinct, non-interoperable but are growing in number (see Table 1). Rwanda 24 / The State of Identification Systems in Africa maintains an NPR that covers roughly 95 percent of Insurance and Trust (NASSIT). the population and serves as a basis for generating Finally, centralization is evident in the degree to national ID numbers (NINs) and ID cards to those which other government agencies and service over 16 years. In Namibia, the National Population providers depend on or are integrated with Registration System (NPRS) integrates a variety of foundational identity systems. Voter registers, for civil registry data for individuals and uses an NIN to example, are typically the functional identity system link children with their parents. Kenya is also building with the highest coverage rate, and generally require an Integrated Population Registration Service (IPRS) basic identity data including name, age, citizenship, that aggregates data from the civil register, national ID address. Because this information needs to be database, and immigration services for the purpose updated every few years ahead of elections, there of offering online validation of identity documents are large efficiencies to be gained either by using to public and private service providers. Botswana’s national ID or NPR databases to generate voter lists Department of Civil and National Registration (DCNR) on behalf of electoral agencies, or by maintaining has already established live links between the civil separate electoral databases that are interoperable registration and national identity database and is with foundational systems and can pull relevant data working to integrate this with the immigration and (e.g., deaths, change of address, individuals that have Citizenship System in order to create a full-fledged turned 18) as needed. Of the assessed countries, few NPR or “People Hub.” have undertaken either of these options (see Table In addition, countries may also centralize the 1). Although most electoral commissions use national administration of social programs by creating social IDs to establish voters’ identities at registration or registers—databases that contain socioeconomic polling stations, they typically maintain separate data on the population for the purpose of unifying the and non-interoperable voter databases that need targeting and distribution of social programs. To date, frequent and expensive updating. Some (e.g., Kenya, only a few of the assessed countries have created Namibia) also involve separate biometric enrollment social registers (see Table 1). Rwanda’s Ubudehe campaigns to de-duplicate and/or authenticate register is the most established, and aggregates voters. Exceptions include Botswana and Rwanda, individuals into households based on periodic where the voter rolls are generated based on the surveys and assigns each a poverty or vulnerability national registration and identification systems. score used to target safety net programs. The register Although Namibia’s NPRS is not integrated with the covers approximately 100 percent of households voter registry, the MHAI does provide the electoral in Rwanda, and in 2015 began recording national ID commission with information on deceased nationals numbers in order to harmonize it with the national (though not on individuals who will be turning 18). population register and ID system. Tanzania’s Social Sierra Leone also plans to integrate its NRS with the Action Fund (TASAF) has recently completed a voter registry. Unified Registry of Beneficiaries, however it is not yet linked to the NID or any other identity system. Other Vertical Decentralization of Identification social registers in various stages of implementation Services include Nigeria’s planned Social Registry for the Poor In addition to variation in the horizontal division of (NSSNP, which will be linked with the NIMC number), responsibilities between ministries, countries have Botswana’s planned development of a social registry different institutional arrangements for the vertical with technical assistance from the World Bank, and decentralization of identification services and Sierra Leone’s planned National Social Security 25 / The State of Identification Systems in Africa TABLE 2. DECENTRALIZATION OF CIVIL REGISTRATION AND IDENTIFICATION SERVICES infrastructure to lower levels of government. As a level. A partial exception is Liberia, which requires result, the number of locations to register a vital adults whose births were never registered to travel to event or obtain a national ID varies widely by country, Monrovia to complete the late registration process10. with implications for administrative efficiency, the In general, national ID systems are less decentralized extension of information and communications than civil registers, with fewer local offices operated technology (ICT) infrastructure, and proximity to the primarily by staff from the national-level ministry. population (see Table 3). In nearly all cases, there For records of civil events such as birth and death, is some level of deconcentration of registration or there are also some cases where registration is entirely identification to the provincial or (usually) district 10 Before a 2011 decentralization measure, Liberian parents also had to travel to Monrovia to register children born anywhere in the country. 26 / The State of Identification Systems in Africa decentralized or devolved to the local level, with little identity are used to prove residential address (e.g., central oversight outside of regulation (in general, for opening a bank account, applying for a loan, etc.). this correlates with paper-based systems that lack central databases and is most common in former Fiscal Sustainability French colonies). In Côte d’Ivoire, for example, data Countries vary in terms of the mechanisms used to is manually recorded and stored in paper registers fund identification systems, and the degree to which at 427 local offices of the civil registrar (DGAT)—there financing is sustainable. The most self-sufficient is no centralization or aggregation of records. In agency among the IMSA countries is Rwanda’s Madagascar, civil registration is the responsibility of NIDA, which is an autonomous agency that covers the Ministry of Interior, but is carried out by municipal 100 percent of its operating costs through fees officials. Chad also has completely decentralized charged for identity services12. Most other systems registration, supported by the Direction des Affaires appear to fund a majority of their budgets through Politiques et de l’Etat Civil (DAPEC), which has eight legislative appropriations, although in some cases staff in N’Djamena whose function is primarily to (e.g., Liberia) agencies are also able to solicit outside lobby government stakeholders and print the books funding13. Many countries also receive support used by local offices to record vital events. The for both foundational and functional identification situation is similar in the DRC, where over 2000 civil systems from development partners, in particular registration offices serve as points of contacts with UNICEF, UNDP, UNHCR, and the WBG. Uniquely, citizens. However, the lack of centralized records Morocco’s decentralized civil registration system is or connectivity reduces the utility of the records for financed not by the central government, but by local portable identification11. municipalities at their discretion. This has resulted in Even where identification services are more significant regional disparities in the quality of local centralized, as in most national ID programs, registration offices. local communities often play an important role in On the whole, there is a dearth of information identification process. In Madagascar, for example, available regarding the budgets and financing of local traditional administrations (fokontany) assist both CRVS and national ID systems. In some cases, with dispute resolution regarding identification and we may expect costs for these systems to be maintain local population registers used to verify substantial. One estimate puts the average cost of the residency of national ID and voter registration enrollment and registration for a national ID system at applicants. Rwanda’s national identity and population approximately US$ 3-6 per person, plus an additional registry system also relies on personal knowledge 15-25 percent per year for maintenance, software, of individuals—aka, “know-your-population”—at the and data updating. Card production and distribution village and cell level in order to validate identities and may cost and additional US$ 1-5 per person (and an ensure authenticity. In Tanzania, absent widespread additional US$ 0.50 for digital certificates) depending coverage of birth registration or the national ID, letters on the card type, plus US$ 0.05-0.10 per card per from the ward or village attesting to an individual’s 11 DRC law calls for the centralized archival storage of civil registers, but transportation challenges have prevented compliance. 12 Currently, NIDA does not charge for online identity verification services provided to other Rwandan government agencies or banks, and has no plans to do so. Instead, the majority of its revenue is based on fees charged for services such as driver’s licenses and expedited applications. In the future, it will also offer an optional e-ID upgrade to the national ID card set at a higher price point for those who can afford it, and is also looking into the possibility of using its production facility to secure credentials for other agencies, such as diplomas, professional certificates, and potentially an e-passport. 13 As an autonomous ID agency, Nigeria’s NIMC also has authority to raise revenue and may eventually be self-sustaining. Currently, however, it relies in part on budget allocations from the government. 27 / The State of Identification Systems in Africa year for maintenance14. India has achieved the multiple standalone systems (particularly voter benchmark for low costs, with US$ 1.16 per person registries) that augments overall costs. An exception for enrollment and registration, and no distribution is Rwanda, where NIDA’s self-financing model has of cards. National ID projects in Africa have thus allowed the agency to break even for several years. far been higher in cost. In Nigeria, for example, the In order to reduce this fiscal burden and leverage IMSA estimates a conservative rate of US$ 5 per private sector innovation, some countries have person for the identity lifecycle of the country’s engaged in public-private partnerships (PPPs), current programs—including both functional and such as BOT-type concessions where a private foundational identities—and an average smartcard firm provides the initial capital investment in the cost of US$ 3.50. As a result, it estimates the total identification system in exchange for a portion of its fiscal impact of the country’s national ID program to revenues. To date, these have mostly been used for be around US$ 4.3 billion, of which US$ 1.2 billion has driver’s licenses and passport systems (e.g., Côte already been spent and another US$ 3.1 billion will d’Ivoire, Liberia, DRC) where profit margins are higher. be needed15. However, there have been a few PPPs for national Identification agencies frequently report that they are IDs and other legal identity credentials, including in underfunded, leading to the inability to implement Chad, Guinea and Nigeria. In Chad, the government programs (e.g., DRC, Tanzania). In Zambia, for granted a concession to a local company in 2002 to example, the Department of National Registration, produce ID cards and passports, based on a revenue- Passport and Citizenship (DNRPC) faces a chronic sharing model where the firm received 90 percent lack of funds for daily civil registration operations. In of the revenues and the government received 10 addition, there is concern that a recent contract to percent. After a 10-year contract, the concession was implement a new eID has underestimated the cost of renewed in 2012 but then cancelled in 2015, and the developing a quality ID project by approximately US$ government now retains all revenues. 100 million . In Cameroon, the costs of computerizing 16 In other cases, PPPs have been less successful. the civil registration system and digitizing records In Nigeria, the NIMC awarded two separate were also underestimated, and much of the concessions for its eID card project, with the goal of country’s budget for reform was spent on opening concentrating on back-end operations while relying new civil registration offices. In Namibia, the MHAI on a private partner for the front end. However, the also reports inadequate financing and yearly budget partnerships faced serious challenges, resulting in cuts as large as N$2.4 million (approximately US$ significant delays in project implementation. The 163,396) that have at times led to insufficient funds concessions were cancelled in 2014. In Guinea, a BOT for printing ID application forms, issuing passports, for a national ID has been on hold since 2010, and etc. In some cases, the problem is not a general lack the IMSA report indicates that the project remains of funding for foundational systems, but rather the stalled due to the failure of the firm to provide all fragmentation of the identification ecosystem across 14 Costs differ based on technology choices (e.g., card, vs. no card), providers (e.g., digital certificates issued by the private sector may cost more than US$0.50 per card), as well as the the country’s size, terrain, and population density. Sources: Atick, Joseph (2015) “Digital Identity: The Essential Guide”, ID4Africa, and Gelb, Alan (2015) “The Economics of ID Systems: How to Frame the Business Case?” ID4Africa, Kigali, Rwanda, 24 May 2016. 15 The figure of US$ 3.1 billion is based on an estimated cost of US$ 5 for each of the 167.9 people projected to be enrolled by NIDA and receive a national ID card, plus US$ 3.5 (the cost of a card) for each of the people who have been enrolled but still need ID cards, plus a cost of US$ 5 for each of the 385 million people projected to be enrolled in functional ID programs. 16 The Zambia mission was unable to ascertain the value of the ID contract; this figure is calculated assuming a current budget of US$ 25 million. 28 / The State of Identification Systems in Africa the information needed by the government to take management, which has delayed the creation of ownership of the system. a national identity database or card. Currently, the temporary, laminated-paper voter card is the most Administrative Capacity widely used form of identification—the DRC has no general register of the population, no national ID In addition to finances, the assessed countries face card, and a non-performing civil register. a variety of challenges in terms of administrative capacity. In the DRC, for example, the lingering As shown in Table 3, the ratio of people-to-service- effects of conflict, violence, and economic crisis center is extremely high in many countries, which have left most state agencies with a low capacity to may deter users or result in slow service and a plan or execute programs. Aside from one-off voter backlog of documents to be issued. In other cases, registration campaigns and smaller-scale functional the proliferation of offices results in hiring many identity systems (e.g., biometric registration for police new staff that have not been properly trained. In and army), there is a general lack of operational Cameroon, for example, civil registry staff process experience with sustainable identity registration or fewer than one registration per day, allowing little TABLE 3. ICT ACCESS AND INFRASTRUCTURE 29 / The State of Identification Systems in Africa opportunity to gain experience and specialization. options for interoperability between ministries Low administrative capacity may also be due to and connectivity between central and local complex identity verification processes that rely on registration and identification offices. Without a manual transportation and verification of documents, network connection, data cannot be transmitted adding significant burdens for both staff and civilians. In Guinea, for example, births and deaths in rural TABLE 4. MAJOR ICT ISSUES HIGHLIGHTED BY REPORTS areas are entered in to a paper-based rural register kept by the village chief, and then physically carried to the commune civil registry bureau. Paper-based systems that lack integration also add to the length of time needed to validate identities. In Côte d’Ivoire, it takes 2-3 months to issue a national ID because of manual checking of required documents (a person is sent to physically consult civil records in a potentially remote location). This problem is compounded by poor infrastructure (roads, etc.) and lack of sufficient staffing. Other countries may have higher organizational capacity but still lack sufficient staff with technical knowledge. In Botswana—one of the more electronically, and must be carried in paper or hard- advanced systems in this sample—employees with drive form, increasing inefficiency and security risks. specialized IT skills are scarce, forcing the country to In addition, a lack of connectivity means that identity rely on expensive contracts with international firms verification procedures and biometric de-duplication for systems design and maintenance. Still, some cannot be done instantaneously, increasing the time countries have made impressive efforts to improve it takes to process enrollments and issue credentials. the timeliness of their identity services. Namibia’s Many IMSAs highlighted the burden of uneven power Department of Civil Registration, for example, supply to offices—either due to a lack of connection recently underwent a change management to the grid or intermittent power outages—and the process that streamlined procedures and increased additional costs associated with purchasing diesel professionalism in the department. As a result, the for the generators that power data centers during time to issue an NID was reduced from 100 days in blackouts (see Table 4). 2014 to 16 days in 2015. In Kenya, for example, only 29 out of 107 civil ICT Limitations registration offices have internet connectivity. Namibia is currently working toward last-mile Beyond technical skills, many identity providers connectivity of its MHAI offices to the government- lack the necessary ICT infrastructure, including wide area network to facilitate registration. However, reliable internet connections, computer equipment, Telekom Namibia reports that, in addition to the and adequate power supply. This is symptomatic challenges of covering a large and sparse territory, of broader issues with ICT coverage in the region efforts to boost internet coverage are hampered (see Table 3) and poses a number of challenges by the high cost of power and the common theft of for identification systems. Technically, it limits the solar panels and cables near mobile phone towers. 30 / The State of Identification Systems in Africa In Madagascar, integration is hindered by the aging and possession of a national ID, a variety of legal interministerial network that connects different and practical barriers deter large segments of the building and lacks sufficient speed and connectivity. population from registering and receiving credentials. As a result, different agencies have begun to operate This identity gap is most likely to affect those who their own parallel ICT systems, creating a series of are poor and vulnerable, and thus most in need of isolated, independent networks. In Zambia, it was the legal protection and social assistance enabled by estimated that an investment of approximately US$ proof of identity. In addition, low coverage makes it 22 million in ICT is required to meet the government’s difficult to administer government programs such as CRVS strategic action plan. social protection, compile vital statistics necessary for development planning, and ensure security. A lack of ICT infrastructure also creates obstacles Death registration is also important for population for digital authentication, which can be used to statistics and tracking disease, and helps ensure the secure remote transactions including eGovernance robustness of identity systems—unless deaths are serives, banking, and delivery of social benefits. recorded, systems become bloated with inactive Kenya, for example, has built nearly 300 “Huduma” identities, increasing inefficiency and opportunities centers around the country for one-stop access to for fraud. As shown in Table 5, many of the countries government services, including identification. Outside that have made significant progress in coverage of Nairobi, however, many lack regular connectivity are small- to medium-sized, while big identity gaps and power, reducing their utility as potential points remain in most of the larger ones. Until progress is of access for online identity services. Authentication made Africa’s most populous countries, the overall over mobile networks or using offline smartcards is coverage of legal identification in the region is likely a potential solution to this problem17, made more to stagnate. feasible by the fact that most African countries have high levels of mobile coverage (see Table 3). Of the assessed countries, most have poor rates of However, digital identity systems are likely to lack birth registration, with some exceptions, including flexibility and functionality as long as high-speed Morocco (95 percent), Madagascar (83 percent), and internet coverage and power supply remain poor. Namibia (80 percent) (see Table 4). The countries A lack of power also makes digital registration and with the lowest birth registration rates are Zambia (12 authentication more difficult in remote areas, while percent), Chad (16 percent), and Tanzania (16 percent). power outages in major cities affect the security of Death registration is even lower in most countries, digital databases. although notable exceptions include Namibia (89 percent)18, Morocco (60 percent) and Rwanda (51 INCLUSIVITY: BARRIERS percent). In Guinea, death registration is less than 6 percent, which has created difficulties for tracking AND CONSTRAINTS TO and managing the Ebola epidemic. According to ENROLLMENT UNICEF data, there are no major gender gaps in registration for most of these countries19. Cameroon Universal coverage and non-discrimination are basic and Kenya, however, show slight underegistration principles that should underlie any foundational of girl children, with registration of boys around 2 identification system. However, despite the fact that percentage points higher than that of girls. most countries require birth and death registration 17 For example, if a mobile phone number is linked to a national ID number, a one-time-password (OTP) can be used to authenticate the card holder. 18 This figure is from the 2011 Namibian census. However, the IMSA report notes that the true percent is lower as the number of deaths may have been underreported. Still, the percentage of deaths registered in Namibia is likely to be significantly higher than many other countries. 19 World Bank ID4D dataset. 31 / The State of Identification Systems in Africa TABLE 5. REGISTRATION AND IDENTIFICATION RATES Coverage of national IDs is medium-to-low in all In Cameroon, for example, birth registration rates countries except Botswana, Kenya, Morocco, have decreased to just over 66 percent in 2014 from Rwanda, and Zambia. In some countries, birth and a high of 79 percent in 2000. Furthermore, birth death registration rates have always been low; in registration levels are not the same as the rate at others, rates have decreased over the past decade. which individuals possess birth certificates or other 32 / The State of Identification Systems in Africa FIGURE 6. BIRTH REGISTRATION AND NATIONAL ID COVERAGE, SCALED BY POPULATION SIZE documents that can be used as proof of identity— Importantly, the coverage of registration and in many countries, the percentage of the population identification systems is not distributed evenly that possesses a birth certificate is much lower20. In across territories or demographic groups. Within a Rwanda, for example, the under 5 birth registration given country, the costs associated with registration rate is 63 percent, however it is estimated that only and identification are often the highest for the most 2-5 percent of Rwandans have a birth certificate, marginalized and vulnerable individuals, including partly due to the fact that these can only be obtained the poor, rural and remote populations, the illiterate, if a birth is registered within 15 days. Instead, people speakers of non-dominant languages, orphans and rely on “attestations of birth” which are issued by the other vulnerable children (OVCs), and refugees and registrar as needed and valid only for 90 days. stateless populations. These groups are also most likely to live in geographic areas where state capacity In countries where foundational systems lack and connectivity are weak or non-existent. Women coverage, functional identity systems have often and girls among these groups often face constraints filled the gap in legal identification. In the DRC and on their mobility, limited access to income and other Guinea, for example, there are no national population gender specific constraints that compound their registers or national IDs, and civil registration disadvantage. Social norms that stigmatize children record are generally of poor quality. In both cases, born to unmarried women, as well as gender-based periodically-issued voter IDs are the most widely discrimination in registration laws, create additional used forms of identification. However, these registers barriers to birth registration. As a result, we see are non-inclusive as they do not contain minors, significant inequalities in the coverage of birth non-citizens, or those who turned 18 after the last certificates and national ID cards among different elections. 20 Among other reasons, this may related to the extra steps it may take parents to obtain a certificate, as well as the mandates of different agencies. For example, a health ministry employee can register that a birth has taken place and report details, but may not be in the position to certify other details with integrity (e.g., the citizenship of the parents) that may be required for a birth certificate. 33 / The State of Identification Systems in Africa FIGURE 7. THE URBAN-RURAL DIVIDE IN BIRTH REGISTRATION Source: UNICEF. 2013. Every Child’s Birthright: Inequities and Trends in Birth Registration. Available at https://www.un.org/ruleoflaw/files/ Embargoed_11_Dec_Birth_Registration_report_low_res.pdf. populations within most countries. In addition to the lack of capacity and inadequate infrastructure described in the previous section, the Most countries in Africa and elsewhere, for example, IMSAs highlight a number of other persistent barriers have significant differences in accessibility rates to universal coverage of identification systems. These between urban and rural communities and between include high costs associated with registration and rich and poor provinces (e.g., Côte d’Ivoire, Guinea, obtaining supporting documents, the destruction Kenya), as shown in Figure 7. This internal identity of paper-based records due to violence or disaster, gap arises due to a number of demographic, social, complex legal and administrative requirements to and political factors, including historical patterns of obtain identification, geographic conditions, and a development and identity management. Tanzania lack of demand from citizens. As is evident in the provides a stark example. The overall birth registration following summaries of each issue, these problems rate is around 16 percent, but it is 42 percent in urban often interact to compound the exclusion of poor areas and 8 percent in rural areas. In Zanzibar, which and marginalized groups from identification services. has its own well-developed registration agency, rates are 90 percent. In Cameroon, the decrease in High Costs for Users birth registration since 2000 has disproportionately affected the poorest regions, including the provinces Costs to the user are the most consistently observed of Adamaoua, Nord, and Extrême Nord. barrier to civil registration and identification in the assessed countries. Though these costs may be 34 / The State of Identification Systems in Africa direct—e.g., fees for late birth registration and late registration, although informal fees can add to some national IDs—they are more often indirect, this amount substantially. In order to obtain a copy due to missed work, transportation costs to various of a lost birth certificate in Guinea, an individual government offices, and facilitation fees by local first needs to obtain a supplementary judgment brokers21. In most countries, on-time birth and death from a court, which is a paper record that requires registration is free, although copies of certificates the testimony of two witnesses with ID cards and a may cost small sums (e.g., 50 shillings or US$ 0.50 residence certificate. Once this judgment is obtained, for a birth certificate in Kenya). However, even where the individual then needs to travel separately to their registration and certificates are free, indirect costs place of birth to request a new birth certificate—a may be prohibitive, particularly when government process that many people skip and simply rely on offices are sparse and travel costs are high. In Namibia, the supplementary judgment for proof of identity. for example, a 2000 Demographic and Health Survey A similar process occurs in Cameroon, where found that the main reason for not registering births registration after 60 days requires a separate trip was the distance to the nearest registration office, and to get a written demand from a Procureur de la that this factor alone accounted for approximately Républic. After six months, parents must obtain a one-third of unregistered births. In Cameroon, high supplementary judgment from a court, paying fees expenses are the most frequently cited reason for late of approximately FCFA 4,500 (USD 7.65)—however, registration. There, the burden of transportation costs due to bribes and other fees, the true cost ranges and sometimes unofficial payments to intermediaries from US$ 20 to 200. can be a heavy burden for poor families, especially For national IDs, some countries offer the first card in the months after birth when parents have already free of charge, while others charge various sums. spent their limited resources on hospital care, Rwanda has purposefully kept the fee for its basic supplies, and birth celebrations. national ID card low (500 Rwf, or US$ 0.72) and Although birth registration may at times be done offers waivers for poor individuals in order to ensure on location (e.g., in a hospital or using mobile coverage and accessibility. In contrast, the first CNIE technology), parents must nearly always visit a card in Morocco costs approximately US$ 7, which government office in order to obtain a birth certificate, is relatively high and may deter poor applicants23. potentially requiring travel and missed work . Costs 22 In addition, many individuals face additional costs to obtain birth certificates increase substantially due to transportation and missed work: because when registration is late and procedures to verify an the CNIE has only 100 enrollment centers that identity require multiple visits to government offices serve approximately 330,000 people each, those and additional fees. In the DRC, individuals spend in rural areas must travel long distances to obtain approximately US$ 31 fulfilling the requirements of a national ID card. In Côte d’Ivoire, an ID card costs 21 Fees for functional ID systems like passports and driver’s licenses are often higher than for foundational IDs. While these fees may serve as a channel for revenue generation to cross-subsidize foundational services, they also present opportunities for rent-seeking by driving up prices, and may therefore create extra barriers for inclusion. In DRC, for example, the new biometric passport is one of the most expensive in the world at a cost of US$ 185 dollars (Le Monde 2017). Given an estimated GDP per capita of US$ 456 in 2015 (World Bank Databank), this fee is likely to be unaffordable for a majority of individuals. 22 Botswana is an exception to this, where an online system allows health workers to register the birth with the DCNR and then deliver certificates to the mother before she leaves the hospital. The same process exists for death certificates when death occurs at a hospital. 23 Charging fees for IDs may not always be a significant barrier to inclusion where IDs are valued and demand is significant. In Chad, for example, the fee for an NID is 4000 FCFA (US$ 6.6, the equivalent of 3-day income for the average person). While this cost is relatively high, the IMSA reports that it does not appear to deter many people from registering, as IDs are seen as essential for everyday life. In parallel, where demand for birth registration is low, a majority of people seem content to pay the late birth registration fee of 2000-5000 FCFA rather that register their child on time for free. Still, given that ID coverage in Chad is approximately 30-40 percent of the adult population, it is likely that these costs are too high for some. 35 / The State of Identification Systems in Africa approximately 5000 FCFA (US$ 8.60), but individuals infrastructure, staff, and training that may stretch an must spend an additional 10000-13000 FCFA (US$ 17- identity agency’s resources and capacity too thin. 22) on transportation and supporting documentation in order to obtain it. This high cost—which amounts Complex Legal and Administrative to over a month’s earnings for a poor person—is due Requirements to the fact that the national ID application requires The administrative procedure described above is a copy of the birth registration act (birth certificate) not unique to Côte d’Ivoire and Cameroon; many and a certificate of nationality. The latter is issued countries have similarly complicated legal and and kept by decentralized courts, necessitating administrative procedures that significantly increase multiple trips to administrative offices and additional the burden of registration and identification and may supporting documentation (which may itself require prove insurmountable for marginalized groups. More separate office visits and fees). A similar procedure often than not, applying for one identity document exists in Madagascar, where the fee for replacement requires the presentation of other documents—often ID cards is low (AR 500 or US$ 0.16), but individuals called “breeder documents”—each of which may must obtain numerous supporting document that have direct or indirect costs. The identity gap may each require travel and potential additional fees, then be compounded to the extent that barriers including a copy of the original application from the that prevent and individual from obtaining one local issuer, a declaration of lost ID from the policy, type identity document affect their ability to obtain a certificate of existence and conduct from the local subsequent identification. For example, individuals government, and potentially two witnesses to verify without birth certificates may face difficulties in the person’s identity. obtaining ID cards that require proof of birth, unless Although high transportation costs and multiple alternative documents or vetting procedures are trips to government offices create barriers to accepted. registration and identification, it is important to note This problem is particularly acute with regard to that a proliferation of offices in the countryside is not identification systems that require proof of nationality sufficient to ensure high levels of coverage. Before (e.g., many NID cards, such as in Madagascar). Zambia rationalized its civil registration offices and Many of the assessed countries have stringent and procedures, for example, a large decentralized complex citizenship laws based on the principle network of civil registry offices was within reach of jus sanguinis, which extends citizenship based of the majority of the population. However, birth on lineage, instead of (or in addition to) location of registration rates remained low due to the protracted birth.24 In order to obtain documentation that certifies process of registering a birth (visiting the office citizenship, individuals therefore must prove the multiple times), and the need to travel to Lusaka identity and nationality of their parents in addition to actually obtain a birth certificate. The situation in to their own. In Tanzania, for example, complicated Cameroon is similar, where over 2,700 registration nationality laws are based on paternal line of decent points serve a population of 22.7 million, and process (or maternal if the father is unknown) and presence in less than one registration per day. The proliferation the country at time of independence. For many people of offices has actually coincided with a decrease in whose legal status is unclear or undocumented, birth registration rates. And, as noted in the previous this creates a risk of exclusion. In countries such as section, opening new offices requires additional 24 An exception is Chad, which grants citizenship based on jus soli—birth on Chadian soil—and as a result, individuals only need to produce their own birth certificate to be registered in the national ID system. 36 / The State of Identification Systems in Africa Kenya, the challenge of documenting nationality is such as a volcanic eruption in 2002 further destroyed exacerbated by the fact that birth registration is often government records. Following the 2010 elections the lowest in border areas and regions with high in Côte d’Ivoire, the fact that a quarter of those on refugee populations. Other countries assessed here, the voter register lacked proof of nationality fueled including Chad and Côte d’Ivoire, also have large violence over who had the legitimate right to vote. The numbers of stateless or refugee populations that ensuing conflict led to the destruction of ID records, are similarly vulnerable to exclusion from identity massive displacement, and weakening of institutions systems. (especially in rural areas). Civil records were similarly destroyed in Guinea during the violence of 2007, and Furthermore, a lack of identification for parents is in Rwanda during the conflict in the 1990s. likely to propagate to their children. In Kenya, for example, a 2008 law requires parents’ national In each case, records were particularly vulnerable ID numbers to be included in birth registration . 25 to tampering or destruction because they were While this helps to increase the robustness of the paper-based and not aggregated into a centralized birth certificate and the IDs that use it as a breeder repository or database. However, as shown in the document, it may deter parents without ID cards following section in Table 5, many countries continue from registering their children . In Namibia, where 26 to rely on decentralized, paper-based registers. birth certificates are relied upon to prove nationality, These systems can be problematic for accessibility there is reluctance among some to issue these because they are easily damaged, less likely to be certificates to the children of undocumented parents, stored in secured facilities, and lack robust backup even those that have been continuously resident on systems. Once documents are lost or destroyed, the Namibian territory for many decades. Additionally, cost and procedural barriers discussed above may there is reportedly some reluctance among the prevent individuals from obtaining a replacement. undocumented population to register their children This is a challenge for individuals to obtain proof of for fear of retribution. This under-documentation has identity, and for countries attempting to modernize serious implications for the ability to access services. their systems. In Cameroon, for example, studies One report estimates that approximately 10,000 have estimated that approximately 40 percent of civil orphans and vulnerable children in Namibia are not registration records are in such poor condition that receiving the social grants to which they are entitled they cannot be scanned. due to lack of birth certificates. Geographic Constraints Loss of Paper-Based Records Geography poses ongoing challenges for many Many people also lack identification because countries attempting to increase the coverage of government registers or their own copies of their identification systems (e.g., Chad, DRC, Namibia, credentials have been lost or destroyed. In the DRC, and Zambia). First, certain territory (e.g., dense forests for example, a significant portion of civil records were or mountainous terrain) can be difficult for enrollment systematically vandalized, destroyed, or falsified by agents to reach, particularly when combined with a rebel groups during the conflict, and natural disasters lack of infrastructure. Second, where populations are 25 The same has been required in Cameroon since 2011. 26 Because parents’ ID numbers have only been included in birth registration since 2008, for the next 11 years even applicants for ID cards who can produce birth certificates will need a “vetting” process to verify that they are citizens. However, after 2026, anyone turning 18 who was registered at birth will have a birth certificate that proves nationality. 37 / The State of Identification Systems in Africa sparse, the per-person effort and cost of enrollment only 10 percent of the adult population has enrolled may be much higher than in small, dense countries . 27 in the national eID system during the five years it Third, extensive borders—particularly in remote has been active. Despite initially high demand for areas—pose challenges for migration control and the the project, delays in wide coverage have led to the identification of nationals. voter ID becoming the most widely used identity credential. However, NIDA expects to complete full The DRC, for example, faces significant geographic enrollment in 2017, primarily using data from the challenges, including a vast territory with many areas electoral roll. that are inaccessible due to ongoing conflict, lack of roads, dense forests, and isolated ethnic groups such Similarly, there is a chronic lack of demand for birth as the Pygmies. Large borders and significant groups certificates in countries where these documents are of refugees and internally-displaced people make perceived to have little value. In Cameroon, studies it particularly difficult to determine who is a citizen. have found that low birth registration is due in part to This challenge can partly be overcome by concerted a perceived lack of benefits. Birth registration rates efforts to engage local communities and decentralize increase with age as children reach school age and registration to the village level, as Botswana has 18 years old, when national IDs become mandatory. successfully done. In Chad, the security challenges The same is true in Côte d’Ivoire, where 86.7 percent posed by a long (6406 km2) and porous border have of 15-17 year olds are estimated to be registered, notably increased demand for a strong identification compared with only 65.5 percent for those ages system to combat terrorist and insurgent activity. 0-428. In Chad, birth registration remains quite low, The speed with which voter IDs have been rolled despite a national ID system with moderate coverage. out in many countries also suggests some ability to Although the birth certificate is technically required overcome geographic challenges quickly if there for school enrollment, there is lax enforcement in due diligence or documentary requirements are low. primary schools and as a result most parents have At the same time, rapid roll-out may compromise no incentive to register their children until they the quality of the biographic and biometric data turn 12 and enter secondary school, where the collected. requirement is enforced. This exemplifies a cycle found in many countries: lack of coverage leads to Lack of Demand weak enforcement to avoid exclusion, which then decreases demand, leading to potentially lower Finally, some people may choose not to register vital coverage. events or obtain an identity card because they do not find it immediately useful or because it conflicts Traditional practices and social norms may also with their beliefs or cultural practices. For some, depress demand for registration. One example of particularly those who live “off the grid” (e.g., nomadic this is in Namibia, where customary naming practices groups) or in areas where informal practices allow have prevented timely birth registration in some access to services without identification, enrollment communities—many parents leave the hospital may have little apparent value. In general, uptake is before giving the child a legal name (and thus do likely to remain low without clear and well advertised not register the birth) in order to name the child with benefits to registration or identification. In Tanzania, their family or community. Additionally, Namibian 27 Rwanda, for example, was able to enroll 9.2 million people (76 percent of the population) in its NPR in the course of a three-day weekend. Although this campaign required additional time for advanced preparation and coordination, the ability to physically reach and enroll this many people in such a short period of time is due in part to the country’s dense population and small size (12 million people over 26,000km2). 28 Source: DHS Survey, available at http://dhsprogram.com/pubs/pdf/FR272/FR272.pdf. 38 / The State of Identification Systems in Africa TABLE 6.DATABASE TECHNOLOGY FOR LEGAL IDENTIFICATION SYSTEMS Table 5). A majority of these—including Cameroon, Chad, Côte d’Ivoire, Guinea, Madagascar, and Morocco—do not have any central repository of civil registration records. Instead, records exist only at local registration offices. Many of these countries have planned projects to digitize civil registration records, which have achieved varying levels of success. Before elections in 2010, for example, Côte d’Ivoire embarked on a modernization project to try and migrate its civil register to an electronic database and digitize paper records. However, this project was put on hold in law requires that if parents are unwed, both must 2011 during the post-election crisis, and has not been be present in order to include their names on the restarted due to a lack of financing and capacity29. certificate and have the option of giving the child Guinea, Tanzania, and Sierra Leone have also the father’s surname. Where the father is unwilling begun projects to modernize their registries, which or unable to be present, the stigma associated are in various stages of proposal and procurement. with giving the child the mother’s surname often Zambia and Madagascar are the only countries deters registration among unmarried mothers. This where national ID records are kept only in paper form exemplifies how a combination of administrative with no digital database30. However, the Zambian regulations may interact with social norms to government is working to digitize these records and disincentivize registration. create an integrated civil registration and NID system (INRIS) for a future eID. TECHNOLOGY: USE AND Beyond the level of digitalization, the assessed MANAGEMENT identification systems vary in the technology used for enrollment and system maintenance, the nature Technology use and management for civil of credentials issued, and protocols for verifying and registration and identification varies widely by authenticating identities. These variations dictate a country. A key distinguishing factor is the degree system’s level of robustness—i.e., its ability to establish to which identification systems are digital or paper- unique identities and resist identity fraud and theft— based. Although most countries have made strides throughout the identity lifecycle. In order to evaluate towards digital identity in the last decade, many the robustness of identity management systems, the still rely on paper records with manual verification IMSA looks at the degree to which uniqueness of and authentication for some components of the identities can be established at enrollment, whether identification system. Specifically, just over half of credentials can be duplicated or tampered with, the surveyed countries still have paper-based civil whether or not the system is embedded in a trust registration systems that have not been digitized (see framework to verify or authenticate identities once 29 A plan to reconstitute and modernize the civil register in Côte d’Ivoire was one element of the 2007 Ouagadougou Peace Accords. However, since the project stalled during the 2010-2011 crisis, there have been no credible plans to migrate the civil register to electronic form. 30 Currently, records of Zambia’s National Registration Cards (NRCs) are analog, with one copy of the application form kept at the district office, and a second sent to DNRPC headquarters. However, with support from the UNDP election fund, approximately 8.2 million of the duplicate forms at headquarters are being scanned and entered into a database. 39 / The State of Identification Systems in Africa they are issued, and the degree to which data are digital databases, with the exception of Zambia securely stored and protected. and Madagascar. Still, few have digitized the data capture processes or have online data transfers Enrollment from local ID offices to the center (Botswana is an exception). In Kenya, for example, paper applications Enrollment is the process of capturing an individual’s for IDs are made locally and then physically sent to personal attributes—such as biographic information, Nairobi. The physical transfer of personal information biometrics, and/or supporting documentation—and and documents creates significant inefficiencies then verifying the authenticity and/or uniqueness and poses security risks. During the DRC’s 2006 of these attributes before the identity is created and voter registration campaign (which produced one of recorded. the country’s de facto ID cards31), for example, 1.27 Data capture and transfer million voter records were lost in transit and never recovered. This created problems, as these people For paper-based civil registries, data capture is had been issued with voter cards during registration, normally done by completing birth and death but did not appear on the voter lists on election day. registration forms by hand. For digital civil registers, data capture may be manual (in which case forms Verification are digitized at a later date) or electronic. In nearly Once identity information is captured, it is then all cases—including those countries with digital normally verified using a variety of technological registers—civil registration is completed at the local and administrative procedures. The goals of this level and any transmission of records to the central process are generally to verify the veracity of the agency are done manually, either in paper copy or via personal information collected, establish that the hard drive. The exceptions are Botswana and Liberia person exists (i.e., is alive) and is unique, and link their (and Zambia in the future), which have online data identity with existing records or databases. For civil transfer between local civil registry offices and their registration, verification procedures are generally central databases; a feature which increases security simple and may include verifying the authenticity of and efficiency. In Liberia, parents fill out a paper birth a birth notification form presented by the parents, notification form that is sent to the district office, and perhaps examining parents’ ID cards or other where the birth is recorded and transmitted to the credentials. central database. The central registrar then issues a birth certificate to the facility where the child was For national IDs, verification processes are much born, that the parent can claim upon presentation more complex, and normally begin with a process to of proof of ID. In addition, a number of countries— establish that the applicant is unique in the database including Nigeria, Guinea, and Kenya—have piloted (i.e., deduplication). With the exceptions of Zambia, the use of mobile devices to capture and send birth Madagascar, and Sierra Leone, all countries with registration data via SMS to central servers, however national IDs deduplicate applicants using biometrics this technology is not ubiquitous. (fingerprints), as shown in Table 6. The technology employed for this, however, varies in terms of how the In contrast to civil registration, all of the surveyed fingerprints are captured, what technology is used for countries with existing national identification deduplication, and how the biometric data is stored. programs manage these systems using centralized, In Kenya, for example, 10 inked fingerprints are taken 31 In addition to the voter ID, people in the DRC prove their identity using work IDs, driver’s licenses, certificates of lost IDs, and other records. 40 / The State of Identification Systems in Africa TABLE 7. FINGERPRINT TECHNOLOGY USED FOR NATIONAL IDS and stored as JPEG images to be de-duplicated and increased the security of the system. In with an AFIS system after the application has been contrast, countries that de-duplicate data all at once completed. The country is attempting to move following a mass-registration exercise have faced towards digital prints, first by converting ink records significant challenges. In the DRC, the 2006 voter to electronic format. This is in contrast to Nigeria’s registration exercise only deduplicated voters after NIMC, which collects 10 digital fingerprints and all enrollments were complete. This was problematic deduplicates using more advanced ABIS technology because the system could not process the enormous that matches the biometric templates in real-time number of matches necessary to compare all 25 while the applicant remains in the office. Morocco million fingerprint records against each other, and uses a hybrid system, where four fingerprints are this function was eventually outsourced to a foreign captured digitally (one at a time) in addition to 10 firm. In addition, because laminated paper cards were inked fingerprints that are later scanned. issued during enrollment, the AFIS process revealed a number of duplicate individuals who had already In Nigeria, the ability to deduplicate an identity on the received multiple cards. This was not a problem spot—using digital fingerprint readers networked to for voter authentication as voters needed to be on a central database—has significantly improved the a list that had been updated to remove duplicates. processing time associated with an ID application However, it created confusion and the potential for 41 / The State of Identification Systems in Africa fraud with excess IDs in circulation32. the applicant and sending them back to collect additional supporting information. A similarly In addition to deduplication via biometrics, many stringent manual vetting process in Chad requires countries have extensive vetting processes in order independent approval of three commissioners to verify identity information, and in particular, before an NID application can be processed. nationality. This process is complicated by the lack of interoperability between national ID databases, Credentials civil registries, and other agencies that maintain supporting documents often required to prove Countries issue a variety of credentials following citizenship. In Côte d’Ivoire, for example, the ONI has enrollment in civil or national ID registries, with to manually check the documents presented by an varying degrees of security and functionality. In applicant (a copy of the birth registration act and a terms of birth certificates—the primary document certificate of nationality) against the records of the issued by civil registrars—all are paper-based, most court and of the local civil registration bureau by are handwritten, and few have advanced security sending a person to physically consult the records. features (e.g., watermarks or seals33). As a result, As a result, the time from application to the issuing of most of these certificates may be easily counterfeited a national ID is between 2-3 months. In Madagascar, in the absence of stringent procedures to control national IDs (CINs) are issued at the district (or their quality and distribution34. In Sierra Leone, for sometimes municipal) level, where officials process example, it is apparently easy to fraudulently obtain a the application and assign a temporary, non-random birth certificate under any name. With the exception ID number coded for district, municipality, sex, and of Botswana, which has laminated birth certificates in chronological number. The application is then sent remote areas since 2015, all paper-based certificates to the Ministry of Justice for central filing (there is no are also highly vulnerable to damage. electronic database) and to verify the uniqueness National ID credentials range widely in form and of the number, while the police check the person’s level of security. As shown in Table 7, cards in the criminal record. Once the CIN has been approved Madagascar, Sierra Leone, and Zambia are paper- and issued, it must then be registered with the local based, and may be easily damaged and forged. In community (fokontany). In Tanzania, applications for addition, the DRC and Guinea have paper-based an NID are thoroughly vetted both centrally and at voter card that serve as the de facto identity the local level. First, a list of individuals with photos document, while Ethiopia’s kebele cards are also is posted in the community, and members are asked paper-based. As voter IDs, where the identity of the to correct information. Applications are then vetted cardholder is checked against a printed voter list at by “village and district security committees”, which the polls, the security risks are reduced. However, includes NIDA officials and representatives of other these cards are insufficiently robust to serve as agencies including the immigration department, national IDs. In Zambia, for example, the current intelligence, military, police, and local government. National Registration Cards (NRCs) are reportedly The due diligence process can involve interviewing 32 In Tanzania, voter ID cards were also issued before the deduplication of electoral lists, resulting in the proliferation of invalid cards. This problem was compounded because the voter database is shut down after the election, making it impossible to check whether a presented card is linked to a unique identity. 33 e.g., Namibia is planning to add security features to its certificates to increase trust. 34 Morocco is an example of a country with a decentralized, paper-based register system with stringent controls on the ledgers that record civil events. The ledger books have numbered pages and are sealed each year to prevent future tampering and revisions. Instead of permanent birth certificates, local registrars issue certified copies of the birth act upon request, which are only valid for three months and cost approximately US$ 0.25. However, while this system provides for relatively robust registers, it cannot control the forgery of the birth acts themselves. 42 / The State of Identification Systems in Africa TABLE 8. NATIONAL ID CREDENTIALS AND AUTHENTICATION prone to forgery through the substitution of photos barcodes contain fingerprints and photos that and text alteration. can potentially be used for authentication of the individual against the card. Cost figures for many of Just under a third of countries, including Botswana, these cards are not provided, however it is notable Chad, Kenya, Namibia, and Rwanda, have machine- that Botswana’s card costs approximately US$ 15 to readable plastic cards that provide much higher levels produce. of robustness due to the medium and embedded security features. Chad’s second generation ID, for A final group of countries, including Côte d’Ivoire, example, is protected by nine security features (e.g., Morocco, Nigeria, and Tanzania, have issued a multispectral hologram) that make counterfeiting robust smartcards with a range of features. In or tampering difficult. In some cases (e.g., Botswana), Morocco, for example, a state-of-the-art card 43 / The State of Identification Systems in Africa includes an electronic credential on the chip signed information provided by an individual (e.g., on an by the issuing agency. Nigeria’s card includes 13 application). This can be done by examining security applets for different functionality (5 of which have features of the document itself or by checking against been activated), and also functions as a prepaid a central database (e.g., confirming the existence of debit card35. Tanzania’s card—a 80kb near-field a particular NIN). Authenticating individuals involves communication (NFC) smartcard that in the future establishing whether or not a person is who she claims can serve as a mobile wallet—is one of three with to be, using biometrics and/or other knowledge (e.g., contactless technology (the others are Côte d’Ivoire a PIN) and checking these either against a credential and Morocco). Other countries, including Botswana, or a central database. In general, only more advanced Cameroon, Kenya, Guinea, Sierra Leone, Rwanda, identity ecosystems (e.g., Pakistan, Peru, India) are and Zambia, are all planning to introduce smartcards able to authenticate individuals directly in addition to in the near future. The cost of these cards can be verifying credentials. high (e.g., US$ 4 in Tanzania to US$ 7 per card in For the most part, authentication of civil registry Morocco), and production time may be longer than credentials (e.g., birth certificates) and national IDs for plastic cards (e.g., in Nigeria, card issuance takes is done manually in the surveyed countries. This over a month). means that in most cases, identity documents Moving from paper to a plastic card or smartcard, (including paper-based certificates and cards, as well however, does not guarantee security or utility. In as plastic and smart cards) are visually inspected Côte d’Ivoire, for example, the card itself is relatively when presented as proof of identity, potentially in secure, but fraud continues to exist as there is no way combination with other forms of ID. However, a few to deactivate the card, and people can buy cards countries have enabled service providers (including with similar-looking pictures on the black market. government ministries and private sector firms) Kenya’s NID has no expiration date, which means to authenticate the validity of national ID cards that old cards stay in circulation, and pictures may themselves against the central database. In Kenya, no longer resemble their owners, hampering their for example, the IPRS system can be accessed by use for authentication. In addition, the security level financial institutions, mobile operators, tax authorities, of many cards (e.g., Cameroon, Chad, Tanzania) may etc., to verify information on the national ID card. It be undermined by the insecurity of the breeder reports responding to 1.5 million identity queries per documents (e.g., birth certificates) on which they are day, mostly from the financial sector. Botswana and based . 36 Rwanda similarly provide a number of government agencies with an interface to their identity databases Authentication to authenticate card information. Finally, three countries have links with a single agency—Morocco In general, there are two potential types of and Namibia (passports) and Nigeria (Department authentication: that of credentials and that of of State Security)—while Tanzania is in the process individuals. Authenticating credentials involves of establishing links with government agencies and checking the validity of identity documents or banks to the NIDA data center for authentication of numbers to confirm that they are genuine and match 35 Nigeria’s card is currently co-branded with the MasterCard logo, and future plans include co-branding with Visa and Verve. 36 The black market for credentials is function of incentives faced by officials and residents. Local civil registrars are often paid paltry sums for their work and therefor have an incentive to make money on the side. Individuals who face high fees for obtaining documents may find it more cost effective to buy a forgery. In Cameroon, for example, a counterfeit birth certificate reportedly costs between FCFA 3,000 (US$ 6) and FCFC 10,000, (US$ 21), which may be less than the fees and transaction costs associated with registering a late birth, which can reach approximately US$ 200. 44 / The State of Identification Systems in Africa its eID. conditions that risk deterioration or destruction due to humidity, fires, flooding or other natural disasters, Direct authentication of individuals is even less or conflict. Where there are no duplicate files—e.g., common. As described above, a number of countries in countries with complete registry decentralization currently have smartcards or machine readable and no duplicate copies (e.g., Cameroon, Guinea) or cards that digitally store identity attributes including in capital cities where local registration takes place biometrics (i.e., Chad, Côte d’Ivoire, Morocco, Nigeria, at the central agency—there is no backup and lost Rwanda, and Tanzania). In principle, these cards can or destroyed records are unrecoverable. Of the be used in combination with fingerprints or PINs to countries with digitized civil registries, the quality securely and digitally authenticate a person against and security of storage is uneven. In Namibia, the their ID card. Currently however, none appear to be NPRS system is backed-up by the Office of the Prime using this technology widely, as shown in Table 7. In Minister, while no form of digital back-up exists yet large part, this is because these countries have not in Zambia. Kenya keeps scanned birth and death yet developed networks of connected or offline point- records backed-up using onsite tape storage, but of-sale (POS) devices that will allow for individual there is no offsite disaster recovery facility. authentication. Another limitation is that some countries (e.g., Kenya, Namibia) have only included The robustness of national ID and population registry images of inked fingerprints on the card, which storage is also mixed. Namibia, for example, lacks cannot be compared against biometric templates a back-up facility for its national ID system, though that are digitally captured during the authentication one is currently being created. Although Kenya has a process. As a result, identity checks at the point of mirror offsite backup for its IPRS database, biometric services are done manually (i.e., via visual inspection data from inked fingerprints are stored in JPEG format or photocopying of credentials). Thus, even with the and not encrypted. In Botswana, digitally captured most advanced card technology, impersonation of biometrics are also stored in JPEG form rather than identity holders is still possible in these countries. templates, and are not encrypted. Although there have been no publicized security breaches in the In order to make up for the lack of digital authentication country to date, this system poses risks for the with the national ID, some countries have developed security and confidentiality of personal data. functional systems with sophisticated credentials and individual authentication procedures. For Exemplary cases include Nigeria, where the NIMC example, the Botswana Post (a service provider has received ISO certification for its data storage for the Department of Social Protection) issues a and disaster recovery facilities and procedures. The programmatic smartcard based on information agency has a strong emphasis on security, and has in the NID database. It then captures additional designed its system to mitigate risks from physical biometric data that is stored on the card and used and cyber attacks, including a database security to authenticate transfers for a variety of social safety system, PKI encryption, a disaster recovery site with net programs. backup servers, and continuous power from diesel generators. In Rwanda, NIDA has a state-of-the-art Data Storage and Security data center with strong built-in security mechanisms, built-in redundancies, backup, and disaster recovery. As discussed above, many countries maintain paper- Morocco similarly stores and protects its CNIE data based civil registries that store records locally, and using internationally recognized best practices, and in some cases send copies of the files to the central Tanzania’s data center is also supported by backup registers. These files are often kept in in subpar 45 / The State of Identification Systems in Africa power system (using generators and batteries) and a the CNIE card is robust and used for almost all official data recovery center. or financial transactions. With the exception of online verification with the passport agency, however, INTEGRATION: verification is manual and service providers wishing to authenticate an identity simply request and store INTEROPERABILITY AND a photocopy of the CNIE card. This process is similar INTERCONNECTIVITY for many other systems. For example, when Liberia’s public pension office wishes to cross-check its Interoperability is the ability of different IT systems beneficiaries with the Civil Service Authority’s (CSA) and software applications—e.g., the civil register and database of personnel, the pension offices uses a civil identity systems—to communicate, mutually printed list of active civil servants from the CSA. authenticate, and/or exchange data. An interoperable or harmonized architecture increases the efficiency Similarly, despite a mandate to harmonize the of the identity system by avoiding multiple redundant identification ecosystem, Nigeria’s NIMC has made and costly identification programs, and can help slow progress in integrating its National Identity detect and eliminate fraud. The use of a robust Database with the many fragmented identity common identifier, such as a unique ID number (UIN) programs that exist in the country. To date, it has only or national ID, can also simplify identification for the one link to the Department of State Security, although user by allowing them to carry fewer credentials and it has planned future linkages with 14 other agencies enroll in fewer systems. Where systems are highly via government-wide and fiber-optic networks. In linked or integrated, however, there is the potential addition, NIMC began a pilot to use its data to help danger that overly-concentrated data may be deduplicate beneficiaries in a Registry of Farmers vulnerable to security breaches or misuse. used for a support scheme. The NIMC has developed a robust NIN—an 11-digit random number—that has In most of the surveyed countries, each foundational the potential to serve as a UIN, however it is not and functional program owns and operates its own yet used to link databases or connected to birth databases (or paper registers), technology, and registration. processes. Very few have effectively integrated disparate systems and databases, and links between Notable exceptions to the lack of progress with these systems are often sporadic and manual. integration are Botswana, Kenya, Namibia, and Although many countries have national ID numbers Rwanda, which have each made important advances (NINs) created and maintained by government in harmonizing their identification systems. In agencies, few play the role of a true UIN—one that Botswana, both the National Identification System uniquely identifies an individual for their lifetime (NIS) and Birth and Death Registry are linked by a UIN and links records across databases (Botswana is an (called the “UID”) for real-time integration. As of 2011, exception, as described below). this number is issued at birth registration and used at age 16 when a person obtains their first identity In countries where the national ID program is strong card37. The national ID card (Omang Card) issued by and has wide coverage, other agencies frequently DCNR is used as the foundational document to verify record the national ID number during their own identity used by the electoral system, the Social enrollment processes, and in some cases validate the Benefit Registration System (SOBERS), government identity with the ID register. In Morocco, for example, 37 In 2011, presentation of a birth certificate became a requirement to complete national registration and obtain a national identity card in Botswana. 46 / The State of Identification Systems in Africa payroll, driver’s license, passports, and many other across databases, and has no hash or control digits services. As described above, these agencies can to prevent error or fraud. pull or verify core data—e.g., name, date of birth, In Namibia, a UIN is used to link child and family sex, and address—from the NIS database online in records within NPRS, which includes records of real-time. This data can be used to validate a user’s birth, death, ID, marriage and divorce. However, the Omang Card details, or as the foundation when UIN is not used for birth registration, passports or creating a new functional identity. The country has the legacy South West African (SWA) ID card from plans to integrate the currently unlinked database for the colonial period39. In addition, there are limited non-citizens (Immigration and Citizenship System) to linkages with other ministries, with the exception that the NIS, developing a full NPR or “People Hub”. the Department of Civil Registration provides the Kenya has also made significant progress towards electoral commission with information on deceased interoperability within an ecosystem of many well- residents in order to clean the voter list. However, developed but fractured functional registries. in the absence of a networked connection, these Traditionally, civil registration, identification and data are physically transferred in paper format or via immigration services (which registers non-citizens) flash drive. Given this inefficiency, the agencies are have functioned in silos, each maintained by different currently developing a more permanent link, and departments in paper databases within the Ministry the Office of the Prime Minister (OPM) is designing of the Interior. Recently, however, the country has a government-wide are network to connect all moved to near-full digitization of records38 (with ministries and agencies in the capital, regions, and the exception of immigration services), and created districts. its IPRS database to aggregate key information Rwanda has also made significant strides in the from each of these sources in order to offer online integration of its civil register with its NPR and NID authentication services to other government system, and has created a social register to unify agencies and the private sector. In principle, data will benefits delivery. Currently, Rwanda’s civil register is be pulled from the source databases several times paper-based and decentralized, requiring extensive a day, for almost real-time updating. However, there manual work to keep the NPR updated. Each time a is not yet automatic transmission of data on deaths new record is entered in the various paper registers to other parts of this system, which—combined maintained by local officials (e.g., for birth, death, with the low rates of death registration—means marriage, adoption, residence, etc.), a separate that it is impossible to know whether many ID card paper notification form is generated for NIDA. These holders are still alive. In addition, other important forms are collected by NIDA and brought to Kigali registries, such as the pension registry, are not yet on an ongoing basis, where some 30 staff members set up to check against the IPRS. As a result, it is more manually enter the data into the NPR. Although this difficult to detect fraud, and there have been known is not a perfect system, it has worked as stop-gap instances of pension payments being made to the measure and helped Rwanda make a rapid transition wrong person because of errors in identification. In from a country with devastated identity records in addition, although the NIN associated with the ID card the 1990s to one of the more advanced systems is widely used for authentication, it is not universal 38 Birth registrations have only been scanned into and are still being put in relational database. Immigration records are still paper files, and there is not yet automatic transfer of death records. 39 The SWA card has yet to be phased out and is still accepted as proof of ID, and is particularly common among war veterans. However, its continued use has complicated the ID system in Namibia by creating an additional layers of complexity in the identity verification process, and presenting security risks given the poorer quality of the SWA cards. 47 / The State of Identification Systems in Africa on the continent. In addition, NIDA has created a govern mandates and institutional arrangements for biometrically-based ID number (called the NIN) that identity actors, and (2) laws that relate to privacy and is unique to each individual for their lifetime. Although data protection, protecting individual rights and the it is not yet incorporated into birth registration, it is security and integrity of networks and databases. quickly becoming the foundational identifier for In order to be effective, privacy and data protection a variety of agencies and services, including the laws must endow government agencies with the electoral commission, police, notaries, and banks. authority to monitor and enforce these laws. As countries increasingly adopt digital identity systems, Many other countries have plans to improve legal frameworks must also be updated in order to interoperability as they roll out new foundational ID cover the capture, use, and storage of personal data programs (see Appendix 2). In some cases, this will in electronic format. involve a centralized system built around a core national ID or population register (e.g., Sierra Leone, With a few exceptions, the majority of the IMSA Guinea, Liberia). In countries with more developed countries lack adequate legal frameworks to functional registers, it may involve a federated ID support and regulate modern identification systems. system, such as Kenya’s current system or Nigeria’s As shown in Table 8, eight countries (Cameroon, planned system. In the mean time, however, these Chad, DRC, Guinea, Liberia, Rwanda, Sierra Leone, countries differ substantially in the level to which and Zambia) have no viable data protection law or foundational identity documents—including birth authority endowed to regulate the use of personally certificates and NIDs—are the central means of identifying information (PII). An additional six proving one’s identity, with functional systems largely countries (Botswana, Kenya, Madagascar, Namibia, dependent upon them as breeder documents. Some Nigeria, and Tanzania) have draft laws on data of these relationships are documented in Figures protection that are currently not in force. Only Côte 3-5 at the beginning of this section. In Madagascar, d’Ivoire and Morocco have well-institutionalized for example, there is no digital integration or legal frameworks and authorities to protect PII. interoperability between the NID and functional In some cases, issues of data protection and privacy registers; however, the ID card and NIN are used for appear to be low priorities for identity providers. In most public transactions and administrative functions. Chad and Tanzania, for example, the IMSAs report In Sierra Leone, in contrast, the national ID is not that a greater awareness of the privacy-related widely held, and most core functional programs (e.g., implications of collecting and storing personal data electoral commission, social security administration, is needed. As a result, there may be individuals etc.) operate their own ID systems, often requiring a enrolling in these national identity systems who are birth certificate as a breeder document. In Chad, the uninformed about what the data will be used for, national ID is more common (it is held by some 30- by whom, or for how long. Although Tanzania has 40 percent of the adult population), however people drafted a data privacy law, the legislation may need also commonly use voter IDs and passports as a revision—for example, it currently gives NIDA officials means of establishing their identities. immunity in the case that data are mishandled or their security is compromised. Other countries, LEGAL AND REGULATORY including DRC and Guinea, currently have no data FRAMEWORK protection or privacy laws, no laws on digital identity management, and overlapping mandates for various Two aspects of a country’s legal framework are identity stakeholders. In addition, many countries’ essential for identity management: (1) laws that 48 / The State of Identification Systems in Africa laws give overlapping or unclear mandates to identity identity management to the NIMC. The agency also agencies, and are ill-adapted to the digital era. conducted a privacy assessment 2013 and a set of policies on privacy have been adopted by the A number of countries have made progress government. However, although a draft bill on data on developing coherent and comprehensive protection is currently being reviewed by Parliament, legal frameworks, although many issues remain there are currently insufficient legal safeguards for addressed or unresolved. In Kenya, for example, privacy and data protection. Although Rwanda has a the government has drafted a National Registration comprehensive law regulating NIDA and all aspects and Identification Bill (currently under discussion in of population registration and the national ID, its civil parliament) that would support the integration efforts registration laws are out of data, and it lack adequate of the IPRS by combining the separate processes data protection and privacy legislation. and institutions responsible for birth and death registration, immigration, and national ID issuance. Two exemplary cases stand out. The first is Côte In addition, the constitution guarantees the right d’Ivoire, which passed a law on the Protection to privacy, and the government has drafted a data of Personally Identifying Information in 2013. protection bill. However, the bill has not yet passed, The law is a codification of the 2008 Economic which is a problem given that the IPRS is already in Community of West Africa States (ECOWAS) treaty the process of integrating lots of personal information and supplementary 2010 act on privacy. It is highly without clear policies on its privacy or protection of developed in a number of regards, including the this data. establishment of a comprehensive legal system for processing and circulating PII for government and In Liberia, the National Identification Registry Act private entities irrespective of context, a prohibition of 2011 created the National Identification Registry against the transfer of personal data to third countries (NIR) and endowed it with the authority to issue that do not offer adequate protection, recognition of biometric ID cards to all citizens and residents. the right to be forgotten, the right to personal data Although the NIR act requires the collection and use portability, and the right to refuse personal profiling. of data to conform to freedom of information laws In addition, the government has demonstrated a and the right to privacy guaranteed by constitution, clear commitment to implementing these provisions. the country has no specific law on data protection. As of 2014, the oversight responsibility for data In addition, law does not define digital identity as a protection has been given to the telecommunication legally recognized category, or specific how digital regulatory body (ARTCI), which is considered to be identity will be used or asserted. In Sierra Leone, the competent and has the capacity and political backing current identity system is covered by a number of to effectively enforce the law. overlapping laws, causing confusion and duplication of roles. At present, the country is drafting a reform Morocco also has a well developed legal framework bill to harmonize the identity landscape, define digital related to privacy and data protection. It has an identity as a legally recognized category, and add omnibus data protection law (Law 08-09) that covers provisions for privacy and data protection. all data that can be considered personal or private regardless of the application. The law explicitly Nigeria also has a relatively positive policy and legal incorporates internationally recognized principles environment, including the passage of a cybercrime for the protection of PII, including the establishment act to define penalties for breaches of data security. of a national privacy commission (CNDP), individual The NIMC act of 2007 gives clear authority for consent to data collection, requirements regarding 49 / The State of Identification Systems in Africa data quality and accuracy, proportionality of data collection, limited storage duration, and the rights to access, review, and dispute personal data. However, the IMSA mission was unable to determine if DGSN officials are bound by this framework, as there is an ambiguous provision in the law which provides for a national security exemption, and the DGSN is also the body in charge of national security. 50 / The State of Identification Systems in Africa Conclusions MANY OF THE ASSESSED COUNTRIES HAVE MADE SIGNIFICANT IMPROVEMENTS IN THEIR IDENTIFICATION SYSTEMS OVER THE PAST FIVE YEARS. Notably, we have seen a strong commitment to the Despite the adoption of advanced digital identity right to identity in most countries and concerted systems in a number of countries, most have not yet efforts by governments to build more effective, been able to leverage this technology in a way that robust, and accessible civil registration and allows them to reap the full benefits of digital ID for identification systems and services. A recognition increasing efficiency, interoperability, and access to of the importance of identification has led services. This is due in part to a lack of enabling ICT countries and their development partners to invest infrastructure or scarce resources. However, the utility significant resources in technology and registration and integrity of a number of identification systems campaigns. As a result, many countries have been have also been compromised by poor procurement able to improve the coverage of birth registration practices and problems with vendor lock-in that and national identification systems. Finally, some hamper system growth and adaptation. Where the agencies have found innovative ways to improve potential of digital technology to integrate disparate registration and identification rates and facilitate registers has not yet been realized, identification access to government services. systems remain fractured. As a result, billions of dollars are wasted in developing various overlapping Along with these successes, however, we have identity programs to serve single-purpose needs. also seen a number of persistent challenges and Finally, few countries have established the requisite weaknesses that have undermined the development legal frameworks for identification, and most of robust, accessible identity systems in many currently lack adequate measure for privacy and the countries. Despite a general commitment to identity, protection of personal data, as well as clear mandates many countries are still struggling to coordinate for identity providers and regulatory authorities. The diverse stakeholders and develop national mandates following sections briefly summarize each of these for identification. Efforts at institutional coordination strengths and weaknesses. and rationalization are further hampered by a lack of capacity due to histories of conflict and a lack STRENGTHS of resources and infrastructure. As a result—and despite some progress on improving coverage—a Strong Commitment to Identity majority of these countries are still unable to meet the demands for identity services expressed by There is growing demand for and commitment to citizens, government service providers, and private ID systems in a majority of the surveyed countries. firms. Huge gaps in identification still remain, and Drivers include development plans that require the underserved are often members of marginalized greater knowledge of and contact with the population groups, including the poor, women, rural populations, (including social transfers, etc.), a desire to move to and the large number of refugees and stateless e-government services, and frustration with costly people who reside in these countries. and redundant identity systems. In addition, many countries have recognized identity as a right and are motivated by its inclusion among the SDGs. 51 / The State of Identification Systems in Africa In Botswana, for example, creating a robust district office to retrieve it later. To boost inclusion, identification system is part of its Tenth and Eleventh 30 officers have been trained in sign language, and National Development Plans, and the government registration forms have been translated into braille. sees civil identification and registration as critical for In addition, a grievance redressal process was put good governance, development, and the extension of in place in 2015 that includes a customer feedback rights. Political commitment and leadership is visible system to analyze complaints and a monthly call-in at both the national and local levels. In Namibia, civil program with the Minister. registration is an important instrument to achieving Namibia—the most sparsely populated country the Fourth National Development Plan’s goal of in Sub-Saharan Africa with many difficult to reach improving service delivery. In addition, the country’s groups—has also made great strides in improving the planned switch to an eID is part of an e-government coverage of its national population register, including strategic action plan for public service through the outreach campaigns to inform citizens of the use of ICT. The situation is similar in Zambia, where importance of birth registration, mobile registration the Revised Sixth National Development Plan in remote areas, and a formal partnership with the includes programs for e-government and public Ministry of Health and Social Services (MOHSS) to service transformation that will require investments increase registration capacity at hospitals. Other in identity management. Sierra Leone also has high countries (e.g., Liberia, Nigeria) have also improved levels of cooperation among identity stakeholders, birth registration rates by integrating registration and a detailed operational plan for the launch of its into hospital or clinic services at the time of birth or Integrated National Civil Registration System (INCRS). establishing electronic transfers of birth notification Efforts to Improve Coverage from hospitals (e.g., Zambia). Some (e.g., Kenya and Tanzania) have also begun linking registration In addition, many countries have undertaken serious with immunization. Where immunization rates efforts to increase the coverage of IDs, particularly are high (e.g., 96 percent in Kenya), this has the with regard to birth registration. Botswana, for potential to substantially increase residents’ access example, has taken significant steps over the past to registration services. In Tanzania, births recorded five years to improve its registration rates. In 2012, the during immunization are uploaded to the central country launched a campaign to register vulnerable system via SMS, and initial tests indicate that this has people, and in 2015 began a second campaign to increased registration by 50 percent. achieve universal birth registration among vulnerable groups, including remote populations and OVCs. As in Namibia and Botswana, other countries have During the campaigns, stringent documentation also begun innovative mobile registration campaigns requirements were relaxed, making verification in order to reach remote groups. In Kenya, the of identity reliant on community-level vetting and Monitoring Vital Events through Technology (“MOVE- witnesses. A high level of decentralization and IT”) program pays a modest allowance to community engagement with community leadership and NGOs health workers to report geo-coded births to local has helped boost coverage in rural and sparsely subchiefs (who are responsible for registration) and populated areas, as have on-site registration offices the central database via mobile phones. The project at hospitals. Mothers who give birth in a hospital (94 was developed in partnership with the Ministry of percent of births) now leave the facility with birth Health, and is intended to incentivize chiefs to file certificate, eliminating the cost of traveling to a registration reports40. Guinea has also implemented 40 To date, progress has been modest. Of the 3,000 births reported in the first month of the program, for example, only 120 were understood to 52 / The State of Identification Systems in Africa mobile birth registration by village chiefs using In addition, the Kenyan government has created mobile phone networks. county-level “Huduma” centers, which are one-stop shops for a variety of services, including access to Notably, Nigeria has made a concerted effort to the e-citizen portal and applications for the National increase the coverage of both birth registration and ID. One Nairobi Huduma center receives 6 to 12 national identification for young students. A 2012 thousand visitors daily—however, many other centers campaign supported by UNICEF helped register lack the internet connectivity and reliable power some 7-10 million school children and reduce supply to function at their full potential. Although not the backlog of birth registrations, and the country yet operational, the Côte d’Ivoire Ministry of Telecom has also implemented SMS-enabled mobile birth is also creating 5,000 community cyber centers to registration with support from the UN. In addition, the bring more people online. In the future, these could NIMC also registers children in the national identity be key access points for e-government services and system, issuing them with an NIN that is linked to identity registration. their parents. Biometrics are taken (though not used for deduplication), and the child is expected to have As described above, mobile technology—including their records updated every two years, until they SMS services—can be leveraged to remotely and receive an eID at age 16. Sierra Leone similarly plans digitally register births in areas with low broadband to enroll children as young as 6 years old as part of coverage. Countries have also begun incorporating its INCRS. SMS notifications into their national ID verification and credentialing processes. In Nigeria and Namibia, Innovations in Governance citizens can receive a text message when their identity document is ready for pickup, increasing In addition to leveraging technology to improve transparency and convenience for the user. In Nigeria coverage, a number of countries have found this service is free, whereas in Namibia it costs N$ innovative ways to improve the delivery of identity 3.50. In Tanzania, NIDA will use a mobile-phone- services and better connect citizens to government. based USSD gateway to update applicants on the Kenya is a prime example. The country has adopted a status of their ID cards. government-wide e-Governance strategy, including shifting services to an “e-citizen” web portal that Finally, a few countries have been able to improve requires the NID number and name to log-on. As the efficiency and accessibility of their registration of the IMSA report, there were 295,000 registered and identification services through more traditional e-citizen users, and the government received some organizational reforms and restructuring. As KSH 8 million in fees and payments daily (e.g., described previously, Namibia’s Department of renewing licenses and passports, etc.). Kenya’s ability Civil Registration underwent a change management to uniquely identify the holders of bank and mobile process that, thorough streamlined procedures and accounts41 has also facilitated the integration of increased professionalism, reduced the time to issue financial information, including the creation of a Credit an ID from 100 days in 2014 to 16 days in 2015. In Reference Bureau, which has led to a substantial 2013, Zambia received support from USAID, the CDC, decline in the share of non-performing loans. UNICEF, the EU and other partners for an institutional reform program (the Zambia Institutional Reform Program, or ZIRP) intended to improve birth and have been officially registered as of the IMSA report date. 41 The NID is required to open a bank or mobile money account and when activating a SIM card. 53 / The State of Identification Systems in Africa death registration. The project primarily consisted population register. However, its functions overlap of changes to administrative procedures and with the Ministry of Territorial Administration and organization, the implementation of a client charter, Decentralization (MINATD), which currently oversees staff training and support, and a new document the civil register, with no clarity in roles. In Guinea, management system. As a result of these reforms, the Ministry of Security and Civil Protection (MSPC) the DNRPC was able to reduce the time it takes to is planning a project to create a national ID system issue birth certificates from an average of 41 to 13 (none currently exists) and issue smartcards to days countrywide (and between 1-5 days in Lusaka). citizens. The contract for a build-own-transfer (BOT) In addition, customers reported paying fewer bribes concession was awarded to a firm in 2010, but the in 2013 (0.4 percent of customers) than in 2011 (6 project stalled and was only reinitiated in 2010. Once percent). Due to these success, the DNRPC received source of the delay has been discord and a lack of a national award for most improved public service coordination and communication between the MSPC department. and other agencies involved in identity management, including the civil registration authority (DNEC), the WEAKNESSES agency in charge of electronic governance (A.N.GE. IE), and the Ministry of Economy and Finance. As Lack of Stakeholder Coordination and described previously, the DRC’s identification plans Integration are not progressing, despite the creation of a national identity agency (ONIP). However, it has overlapping Despite these notable political commitments and mandates with other identity agencies that and tangible improvements, there is a persistent lack of relatively little political capital, hampering its ability coordination and planned integration among identity to function or begin any new identity initiatives. stakeholders in a number of countries. Where identification efforts have been uncoordinated Even in countries with advanced identification or rivalrous, the quality and coverage of legal technology—e.g., Tanzania or Nigeria—we still see identification systems have suffered. a high level of fragmentation and duplication in government ID programs. In large part, this is due to In Cameroon, for example, a 2013 law created a the fact that many past identification projects have new National Civil Status Bureau (BUNEC) with the had limited success or expanded too slowly, and goal of modernizing the civil registry and creating a government service providers and private firms have TABLE 9. DATA PROTECTION LAWS AND AUTHORITIES IN AFRICA had to develop their own identity systems in order to fill this gap. In Nigeria, for example, there are at least 13 government agencies that operate identity systems in the country. Many of these—including the voter registry, driver’s license registry, SIM card registry, and banking registry—all collect separate biometric data to ensure uniqueness. Even projects that are currently in the planning stage (including a biometric census, pension registry, and social registry for the poor) intend to collect their own biometrics and have minimal plans for integration with NIMC. These parallel identity systems are inconvenient to users (who must enroll many times and carry 54 / The State of Identification Systems in Africa multiple ID cards in order to access services), and countries. This is particularly evident in those areas represent inefficient use of public resources by the that have recently faced violent conflict or economic government. crisis, such as the DRC and Guinea. In addition to the intentional destruction of identity infrastructure in Such challenges are not unique to Nigeria. In addition these countries, the general administrative capacity to their civil registration and identification systems, to plan and execute projects has been weakened. most countries maintain separate voter rolls that are Furthermore, in regions where violence and not linked to other existing databases. Furthermore, insurgence remains endemic, enrollment campaigns most conduct costly mass enrollment campaigns for may be hampered. In the DRC, for example, a each election, rather than establishing a continuous biometric census of civil servants was unable to register42. In Zambia, for example, the cost of elections reach some 66,000 workers in the eastern provinces in 2016 is estimated to be approximately US$ 90 due to security concerns, although the government million, or US$ 9 per registered voter. This is 60 was able to identify police across the entire country. percent above the average cost for the 23 elections Where areas of insecurity continue to exist within held in Sub-Saharan Africa held since 200043. In countries, this has serious implications for the Chad, a one-time biometric census of the population coverage of identity systems and the accessibility of to establish a voter roll (completed in January 2016) identity services by the population. cost US$ 6-7 per adult. In the DRC, producing the voter list and cards for elections in 2006 and 2011 cost The capacity of governments to effectively operate US$300 million. These exercises are thus inefficient or reform identity systems is hampered by high costs and costly—particularly because they require a large and a chronic lack of funding, or by the division of investment in registration kits to cover the country in resources for identification among many programs a short amount of time—and waste an opportunity to and schemes (e.g., foundational identity systems, build lasting identification systems44. In Côte d’Ivoire, voter registration, etc.). Most countries appear to be for example, the first computerized voter roll was beholden to the legislative process or development created in 2010 following mass biometric enrollment partners for the majority of their budgets. The for the national ID. However, what began as the same exception are those cases (e.g., Rwanda), where database has now become two distinct systems, as identity agencies are autonomous and self-financing. the NID records have been updated continuously In addition, even those countries that have substantial since then, while the voter register remains static. government capacity (e.g., Botswana and Kenya) still face crucial deficits in ICT infrastructure, including a Limited Administrative, Fiscal, and lack of digitized databases, broadband connectivity Technical Capacity and reliable power supply. Related to the problem of coordination and integration is the persistent lack of capacity— administrative, fiscal, and technological—in some 42 Botswana is an exception, where the voter list is based on the NIS. In Namibia, the MHAI provides information (via paper records) to the electoral commission on the deceased, but does not supply information on cohorts that are turning 18. The agencies are currently discussing how to automate this link. 43 According to the Zambia report, pre-2000 elections in African countries were a little lower in cost per capita than world average. Since then, they have become more than two times as expensive as the world average, despite the significantly lower purchasing power for the average African citizen. 44 For more, see Gelb & Diofasi. 2016. “Biometrics and Elections in Poor Countries: Wasteful or a Worthwhile Investment?”. Center for Global Development Working Paper. https:/ /www.cgdev.org/publication/biometric-elections-poor-countries-wasteful-or-worthwhile-investment 55 / The State of Identification Systems in Africa Inaccessibility and Unmet Demand lack of motivation to acquire particular credentials does not necessarily mean that the overall demand A number of countries have significant barriers to for identification services is low. Rather, it often enrollment. In general, the high indirect costs of indicates that existing credentials are perceived to fulfilling requirements of civil registration and national be of little value to many citizens. In the absence identification—in particular, proof of citizenship—are of strong foundational identification systems, primarily due to complex administrative procedures the popularity of certain functional programs and inadequate or inconvenient points of contact demonstrates that there is an unmet demand for with the population. These barriers disproportionately identity services among citizens and government affect marginalized or vulnerable groups, particularly agencies. In the DRC, for example, the government poor people, rural dwellers, children, women, and has implemented a relatively successful program refugees and stateless groups. The latter group to register police and other civil servants. In these deserves special mention, as the surveyed countries cases, the prospect of an immediate benefit created are ones with significant numbers of internal and significant enthusiasm among the target population. external migrants and displaced peoples, including Police officers were motivated to register as they saw many of whom are undocumented. In Côte d’Ivoire, this process as a legitimization of their authority, with for example, there are some 750,000 people the potential to improve the timeliness of wages. The without a recognized nationality; in Chad, there are Zambia report also highlights a pent-up institutional approximately 200-400 thousand refugees. demand for digital identity systems by public sector agencies (who want to offer e-government services) Some countries have made progress in dealing and private firms (who want to authenticate the with the identification of refugees and stateless identities of their customers). populations through cooperation with UNHCR. However, few have fully incorporated these groups Unrealized Technology Potential into their national identity management systems. In Kenya, for example, UNHCR maintains a separate Although all countries have moved toward digital biometric database (PROGRES) that is checked identity for national ID systems, many civil registers against the national AFIS for deduplication. Refugees remain paper-based. And with a few exceptions, are issued two separate identity documents—one processes and transactions based on national IDs— by the Kenyan Department of Refugee Affairs and including enrollment, data transfer, verification, one by UNHCR, which they can use to access rights and authentication—remain manual. Although a and benefits. Under this system, some 620,000 number of countries have developed state-of- refugees (mostly from neighboring Somalia) have the-art systems within agency headquarters, a been registered. However, many of these people lack of countrywide ICT infrastructure means that were born in Kenya or have lived in the country for many civil registry and identification offices remain over 20 years, and authorities often have difficultly unconnected. Most countries, including those with distinguishing between refugees, migrants, and advanced smartcards, lack the infrastructure to Kenyan nationals of Somali ethnicity. authenticate individuals remotely. This is a potential waste of resources on a card that is not being used to In addition to persistent barriers to enrollment, the its full potential, and a missed opportunity for service fact that demand for birth certificates and national delivery and driving demand for identification. In IDs appears to be low in some countries has made addition, manual identification is not reliable and it difficult to extend coverage. However, individuals’ decreases the robustness of the system. 56 / The State of Identification Systems in Africa Problems with Vendors and Finally, Nigeria has had limited success in partnerships to build its national ID system. For example, a US$ 236 Procurement million contract was awarded to a foreign company In some cases, problems with procurement and in 2001 to enroll the population and issue cards. The vendor lock-in have contributed to poorly functioning program ran for five years, registering 52.6 out of technology, stalled projects, and difficulties bringing planned 60 million people and issuing 37.3 million identification systems to scale. A number of countries, NIDs. However, the project was discontinued in 2006 including Botswana, Cameroon, Côte d’Ivoire, and due to allegations of impropriety over the contract Morocco, have invested in proprietary technology award. Addressing the legacy of this failed project that limits future expansion. In Botswana, the initially hampered the NIMC’s implementation of choice of a proprietary system has made it difficult a new ID card. In Cameroon, difficulties with the to change vendors, and prevented the DCNR from international supplier responsible for providing a developing in-house capacity to manage its identity 2008 version of the national ID card resulted in a infrastructure. Instead, it must rely on ongoing termination of its contract and replacement with a maintenance contracts with a foreign firm, at a price new supplier in 2014. The short lifespan of this system of US$ 3 million above its yearly operational budget and the need to migrate to a new database may add of US$ 5.6 million. In Côte d’Ivoire, data on smartcards significant costs and delays to the rollout of a new are signed with a proprietary encryption mechanism identity card. rather than by a national certificate authority, reducing interoperability. Morocco has similarly experienced Missing legal and regulatory vendor lock-in on the biometric templates stored foundation on its smartcards. As a result, third parties would be required to license this technology in order to read A majority of the surveyed countries lack adequate these templates, driving up the cost of developing an legal frameworks to support and regulate modern extensive POS network for authentication. identity management systems. Many have overlapping mandates with duplicative or unclear Other issues with procurement and opaque contracts jurisdiction over registration and identification have hampered identification projects in a number of processes, and few have laws that account for the countries. In the DRC, the government signed a US$ increasingly digital nature of personal data. And 479 million contract in 2011 with a Chinese company although a number of countries are in the process of to conduct a biometric census. However, the project drafting laws on data protection and privacy, many of stalled due to financing and contractual issues. these laws are inadequate. Only two countries—Côte Guinea has also had protracted challenges with the d’Ivoire and Morocco—have well-institutionalized BOT concession it awarded to a foreign firm create legal frameworks and authorities that conform to a national ID system. The project has been stalled international best practices. since 2010, and no documentation on the contract is available. In addition to issues with the national ID, the country has also faced difficulties developing a driver’s license. In 2009, it awarded contract for licenses to a different firm, which was paid upon delivery of the materials. However, the system was never made operational due to a lack of premises for housing it. 57 / The State of Identification Systems in Africa RECOMMENDATIONS THE IMSA IS AN ADAPTABLE TOOL THAT PROVIDES COUNTRY-SPECIFIC RECOMMENDATIONS FOR IMPROVING IDENTIFICATION SYSTEMS. In some cases, these recommendations are arrangements for an NIA can vary dramatically applicable only to the country in question. However, from country to country. They can be the reports also offer a number of suggestions that autonomous bodies created for the purpose of are nearly universal for the assessed countries, identity management that report directly to the and are likely to apply in other developing-country executive or a board of directors, or agencies/ contexts. This includes harmonizing existing directorates of an existing ministry. They can databases and registers, modernizing the civil be a small agency whose main function is registry, planning for fiscal sustainability, extending coordinating existing identity stakeholders, or a coverage in an inclusive manner, following best large agency that itself manages one or multiple practices for technology acquisition and use, building identity systems. Importantly, however, NIAs infrastructure for user authentication, and reforming must be high-capacity agencies that represent legal frameworks. In addition, the analyses indicate a all stakeholders (e.g., via a steering committee), number of areas where World Bank engagement can embody good governance practices, and are continue to support the development of robust and resilient to political change. inclusive identification systems, including through • Adopt a unified approach to identity future IMSAs, additional feasibility assessments, management. Each country should adopt a technical assistance, and support for both functional harmonization approach suitable to its context. and foundational identity systems. One option is a minimalist or federated system, where identity databases are “loosely coupled” COUNTRY and a UIN is used as a common reference RECOMMENDATIONS among databases. In India, for example, the government used a loosely coupled model Harmonize and Modernize Identity to harmonize different identity platforms Systems throughout the country. Other options include a “tightly coupled approach,” with live integration In order to provide efficient, effective identification of all ID databases, or a single warehouse, such systems capable of uniquely identifying individuals as in Pakistan, where all information is held in a from birth to death, countries must work to single system. Countries should carefully weight coordinate various identity stakeholders and ensure the costs and benefits of each configuration, and that disparate systems are interoperable and any approach must be endorsed by (and include modernized. Specifically, countries should: the cooperation of) a variety of stakeholders. • Empower a national identity coordinator or • Establish a UIN. Unique identifying numbers authority (NIA). Efforts to build an identity that represent citizens from birth to death can ecosystem should be led by single entity, with be used to streamline identity management (in a input from relevant government, private sector, tightly coupled system) or integrate a fractured and citizen stakeholders. The institutional 58 / The State of Identification Systems in Africa identity landscape (in a federated system). national borders. In 2016, for example, ECOWAS This will help reduce the fragmentation of began implementation of a regional biometric identification, improve administrative efficiency, ID card that will gradually be extended within eliminate leakages, and increase the portability its member states. The development of digital of identities. A UIN can also be an important tool identity systems that comply with regional to help accelerate electronic service delivery requirements and standards such as ECOWAS (e-Governance). In order to be a true UIN, the can help facilitate border crossing, improve number should be established at birth via the regional integration, and facilitate electronic registration process and be used to create and/ services and digital commerce between or link identity records created later in life . 45 countries. • Modernize civil registries. Digitizing and Plan for Fiscal Sustainability centralizing civil registry systems—particularly birth and death registration—and linking them Advanced identification systems require sufficient with national identification and population registry and reliable financing in order to ensure operational systems via a UIN will improve the accessibility, stability and growth, and the ability to subsidize utility, and robustness of these systems. In some free or low-cost identification services to promote cases, the cost of digitizing old records can inclusion. In order to design fiscally sustainable be significant (e.g., between US$ 0.25-0.3 per systems, countries should: record based on recent experiences in Africa). • Consider various options for financing identity However, there are ways to mitigate these costs, systems. There are a variety of potential including digitization in stages, beginning with financing models that can be used in isolation or those records that are less than 1-2 decades combined in order to ensure the sustainability of old. Another option is to index records rather civil registration and identification systems. This than digitizing them. This involves taking digital includes funding from the national budget, PPPs, photos of each page and then transcribing and self-financing from revenues generated limited basic information into a database of by user fees (i.e., “corporate financing”, as in searchable text—a faster and cheaper process Rwanda). In Pakistan, for example, NADRA that full digitization. The potential returns to this operates without budgetary allocations, and investment are large given the foundational instead relies on fees levied for providing role that civil registry records play.46 In Zambia, identity services to a variety of service providers for example, the mission estimates that an including banks and border security, as well as investment in civil registration of US$ 50-60 from contracts with foreign entities to provide million would save between US$ 140-330 million identity services and systems. PPPs such as in other identification costs (e.g., the national ID BOTs and concessions can also help reduce and elections) over 10 years. upfront costs to the government. However, they • Consider international interoperability. should be used with care; before engaging with Countries should take into account plans for a private firm, governments should prepare potential integration and interoperability across detailed technical specifications with adequate 45 See the WB Digital Identity Toolkit for guidelines on the structure of a UIN. 46 For example, improving the quality and security of birth certificates will boost the robustness of national ID systems that rely on these certificates as breeder documents. Similarly, improving death registration can help reduce the amount of ghosts in the system, eliminating common sources of leakage and fraud. 59 / The State of Identification Systems in Africa provisions for scalability, reliability, affordability. registration for a cash transfer program saved the World Food Program US$ 1.5 million. • Ensure that cost is not a barrier to identification. It may be desirable to create an identity Extend Coverage in an Inclusive system that is self-sustaining by charging Manner fees for credentials. However, the first issue of foundational identity documents—including the Identification systems are only as useful as their level first copies of birth certificates and national IDs— of coverage. In order to achieve the goal of universal should be free of charge to ensure that cost is coverage, countries should work to reduce barriers not a barrier to access. Other sources of revenue to access, address specific barriers faced by women, may be used to cross-subsidize the issuance of and increase incentives for enrollment: these foundational identity credentials, including • Increase points of contact with citizens. fees for passports and driver’s licenses, charges Coverage is likely to be low where people for expedited service, applications for digital have limited contact with government agents certificates, verification and authentication and offices are difficult to reach. Where it is not services for third parties, etc. Another option is to feasible or cost-effective to open additional have a have multi-tiered system of cards priced registration and identification facilities, there are according to sophistication, e.g., higher fees for a number of alternative ways that governments cards with online authentication capabilities (e.g., can give citizens more opportunities to enroll in as done in Ghana and planned in Rwanda). identity systems and keep their information up- • Bridge the investment gap by prioritizing high- to-date. For example: return areas. Countries can also help bridge the >> Partnering with health ministries to train and cost gap by rolling out systems according to equip health workers to assist with birth priority uses where savings are expected to be registration (e.g., using mobile technology), large. This could include enrolling civil servants install links to the central register in major where identity can be linked to payrolls and hospitals, and potentially link registration pensions, or low-income groups where identity with vaccination campaigns and schedules can be used to facilitate social benefits delivery. (as in Côte d’Ivoire). • Plan for potential long-term savings. Getting >> Engaging schools to register children (like rid of redundant identity systems (e.g., periodic the MASSAR database of school children mass voter registration campaigns) will save in Morocco), which not only increases significant funds in the medium to long-run. coverage but helps ensure the robustness of Strengthening identity management and linking the identity system by establishing identities it to benefits programs, public payroll, and at an early age. tax registries also has the potential to reduce program leakages and improve tax collection >> Creating special provisions for low-coverage and revenue. These savings can be used to areas, such as extended office hours or underwrite the development of more robust mobile registration units (as in Chad, which foundational systems. In Argentina, for example, was able to enroll 6 million remote people linking 13 registers at cost of $10 million yielded in the voter register in 45 days using mobile a savings of $104 million. Kenya, biometric units). 60 / The State of Identification Systems in Africa >> Ensuring that social, economic, and legal the population. barriers for women to register are addressed • Extend systems rapidly. Demand and utility (e.g., in Pakistan, NADRA created women- are likely to increase as identity systems reach only enrollment stations staffed by women). critical mass, and governments should attempt >> Translating registration forms into local to scale systems as rapidly as possible without languages, and/or ensuring that registration compromising quality. One option is to seed agents are fluent in local languages (as in underpopulated identity registers with existing Namibia). databases that have high coverage, and then begin campaigns to register those individuals • Align supply and demand. In addition to who are not yet covered by either system (e.g., reducing the cost of enrollment, increase the Tanzania is populating its NID database with benefits of obtaining identification. Citizen data from the voter roll). This type of “reverse- demand for useful ID is high, and will likely grow engineering” is not always easy, however, as with increased digitization of transactions. For existing databases may not be interoperable or citizens, demand for identification may be direct of suitable quality. Another option is to decrease (when ID is generally useful as proof of identity), the age at which individuals can apply for identity or indirect (when the ID is a requirement to cards in order to reduce the interval between obtain other credentials or enroll in functional birth registration and obtaining other forms of programs). One option to boost demand is thus identification such as a national ID. Fingerprints to make birth certificates and/or national IDs become stable around 12 years old, and children mandatory for access to services. In Tanzania, between 12 and 16 or 18 could be issued with for example, the government mandated that lower-cost cards in order to bring them into the students receiving educational loans must system before they receive identification at the register with NIDA and present their NID when age of majority (e.g., in Nigeria). Iris prints can applying. Student registration was given priority be captured at a far younger age, and India’s by NIDA, and appears to have successfully Aadhaar program is registering children as covered some 80,000 students. However, young as 5 years old. where ID coverage is low or documents are hard to obtain, this type of policy risks increasing Follow Best Practices for Technology the exclusion of marginalized groups from key services. This is particularly the case if an ID In order to ensure that identification systems are that requires citizenship status is mandated robust, scalable, and affordable, countries should for programs intended to be accessible for all follow international best practices and standards residents (e.g., social protection and healthcare). when adopting and procuring identification systems It may be possible to reduce the risk of exclusion technology: by making identity credentials mandatory only • Use open-source and off-the-shelf (OTS) for new users of a service (e.g., new applicants technology. The hardware and IT platform— for bank accounts), rather than post hoc including servers, storage equipment, and all requiring all existing beneficiaries to re-enroll. communication (ICT) components—should be Any changes to enforce mandatory ID must be based on OTS modules in order to reduce cost accompanied by strong information campaigns and avoid vendor lock-in. Software should be and efforts to reach undocumented segments of based on open-source standards. Ensuring that 61 / The State of Identification Systems in Africa system components are not proprietary and • Choose a credential wisely. When choosing a can be obtained through multiple suppliers will credential, countries must balance the potential allow countries to take advantage of market- utility and integration capacity of a multi- based competition. This has the potential to purpose identity card with its cost—both in terms improve system performance and reduce of the card itself and the extension or creation the cost of scaling the system (e.g., adding of infrastructure needed to support its function new authentication capabilities such as POS (internet or mobile networks, power, etc.)—as devices). 47 well as potential privacy concerns. It is possible to stagger the rollout of smartcards (e.g., as in • Adopt international standards for biometrics. Pakistan), or opt for a credentialless cloud-based Biometrics should be captured digitally. Inking ID (e.g., in India), although the latter requires and then scanning fingerprints does not produce robust ICT infrastructure. It is also possible to the same quality as live-scan capture, and produce multiple tiers or types of credentials, makes fingerprint use for authentication more such as in Ghana, where the government offers difficult. Capturing multiple fingerprints at once a simple card free of charge, and a smartcard using the 4:4:2 standard is recommended, as for a fee. scanning fingers one at a time increases the time and cost to enrollment and can potentially • Collect minimum data. Although it is tempting introduce sequence errors (or fraud) if captured to collect personal information beyond basic out of order. Biometric equipment should be identifiers—e.g., demographics, profession, certified for quality and have a standard interface family information, income status etc.—more to ensure plug-and-play interchangeability. data fields take longer to fill out and are likely Though not always necessary or appropriate, to become out of date faster, requiring more countries may want to consider using iris scan frequent updates to maintain their accuracy and technology, which has a lower failure-to-capture utility. In addition, indiscriminate data collection rate than fingerprints (e.g., among manual without purpose specification may violate fair laborers) and can be used with younger children. information practices and pose risks to individual The technology will become cheaper as iris privacy. scanning capabilities are increasingly integrated • Consider alternative technologies. Where into mobile devices. internet coverage and electricity supply are • Encrypt data and transactions. Countries should unreliable, consider the use of portable and follow internationally accepted standards for handheld devices (e.g., mobiles, tablets, etc.) to data storage and exchange. This includes improve access, coverage, and authentication. encrypting databases, storing (encrypted) biometric templates separately from captured Build Authentication Infrastructure images, ensuring that transfers of data are In order to boost demand and take full advantage encrypted (e.g., on a USB key or https network of digital identity systems for administration, service transmission), and using public key infrastructure delivery, and user-friendliness, countries should for credentials and certificates. work to rapidly build authentication infrastructure for credentials as well as individual identities: 47 See the World Bank’s Digital Identity Toolkit for a more detailed discussion of technical choices, including avoiding vendor lock-in, which biometric features to use, and tradeoffs for different credential media. 62 / The State of Identification Systems in Africa • Increase linkages with service providers • Implement international guidelines for privacy to authenticate credentials. As a part of and data protection. There are two main sources harmonization, identity systems should ensure of international standards on data protection interoperability with a variety of identity providers, and privacy that can be adapted to any country including public and private sector entities, in context: the ECOWAS framework (e.g., used as a order to enable the secure online verification of basis for reforms in Côte d’Ivoire) and the OECD identity credentials. There is a huge demand for Updated Guidelines. Among other provisions, this service from banks and mobile operators countries should ensure that any identification in most countries, and establishing these law: linkages will likely increase demand and uptake >> Governs the use of digital data, including of identification, in addition to increasing the NIN, civil and vital records, biometric, records robustness of the system. of use/access • Introduce the capacity to authenticate >> Specifies the context in which data can be individuals. The most secure protocols for used and by whom, and asserts penalty for authentication involve validating an identity a violation digitally using multiple factors. With a smartcard, this authentication can be done offline using >> Provides for safety measures against loss of POS devices that match data stored on the data card to information input by the user at the point of service (e.g., a fingerprint and/or PIN). >> Enables citizens to know all data attached Where network connectivity is available, users to their identity and see who has accessed it can also be authenticated directly against a >> Specifies how long each type of data can be central database, as is the case with India’s kept in the system Aadhaar system. Both of these protocols require investment in technology and infrastructure (i.e., >> Provides for the management of undeclared POS terminals or mobile devices, broadband persons networks, power sources), which can be costly. This costs can be brought down by using OTS >> Defines cybercrime and specifies devices with open standards that promote punishments competition between vendors. • Create clear lines of authority for identification. Reform the Legal and Administrative Countries should ensure that agencies empowered to manage digital identity systems Framework have a clear and unambiguous mandate Modern identity systems require clear and and business model, and that the roles and comprehensive legal frameworks to empower responsibilities of other identity stakeholders are identification providers, protect personal information, well-defined. When possible, it is recommended guarantee sufficient oversight, and address the that countries reform existing legal measures to unique challenges of data in digital form. In order to unify disparate regulations on identification into meet these demands, countries should: a single instrument. • Update administrative procedures and legal requirements to reduce barriers to enrollment. 63 / The State of Identification Systems in Africa Countries are sovereign entities with citizenship completing feasibility studies before finalizing and nationality laws based on historical identity plans and (especially) before beginning development and cultural norms. While a procurement. These studies can provide more wholesale revision of the criteria for citizenship detailed recommendations than the IMSAs may not be desirable or feasible, there are a (including cost-benefit analyses) and help number of cases where countries might revise countries avoid common pitfalls as they upgrade legislation and administrative procedures to to digital identity systems. reduce the cost and complexity of requirements • Technical assistance. Following IMSAs and to obtain credentials, including reducing the feasibility assessments, there appears to be number of times applicants must visit disparate substantial demand from client governments offices and registers in order to substantiate for deep technical assistance to adopt their identity. In Tanzania, for example, NIDA has international standards for identity technology been able to secure a change in the nationality and legal frameworks. Many countries need law that gives its officials more control over the vendor-neutral experts to consult on context- process of determining legal status, although appropriate systems that are technically and complex nationality criteria remain unchanged. fiscally sustainable. The ID4D group can help Furthermore, identification systems should be by preparing a roster of international experts underpinned by the principle that all persons and advisors, and by working with a variety of living in the country—whether citizens, migrants, public and private sector stakeholders to adopt refugees, or stateless peoples—are entitled to the common Principles for legal identification some form of identification. For individuals who that protect against vendor lock-in. The WBG cannot prove citizenship but are not yet declared can also leverage its existing relationships stateless, countries should assign a temporary with global identity leaders (e.g., Peru, India, ID until permanent status is confirmed. Pakistan, Thailand) to foster more South-South cooperation and assistance. Additionally, the FUTURE ENGAGEMENT BY Bank should work to increase its ability to provide THE WORLD BANK GROUP expert consultation for countries developing their legal frameworks. This could include The reports identified a number of areas where WBG engaging international and local specialists to engagement can continue to support these and other review relevant laws and developing additional countries in building robust, inclusive identification guidelines on legal best practices. systems: • Programmatic support for functional identity • Additional IMSAs and feasibility assessments. systems. Many of the WBG’s existing and In general, the IMSA missions to date have been planned projects in these countries involve the successful in facilitating collaboration between creation or use of identity systems for functional the WBG and identity stakeholders, and have programs, including for social protection catalyzed a number of plans and projects to programs, pension and civil service reforms, and improve identity systems in client countries. financial inclusion. Indeed, a number of the IMSAs Continued use and development of this tool in (e.g., Morocco, Chad, and Côte d’Ivoire) were new countries will provide a solid and productive undertaken in order to support the development foundation for future partnerships. Following an of social registers in harmony with other IMSA, the WBG should also assist countries in 64 / The State of Identification Systems in Africa identification systems. As the WBG continues to engage in these programs, it can play an important role in creating functional identity systems that reinforce or lay the groundwork for foundational identity systems and build the capacity of functional agencies to manage data and take advantage of central identity system— rather than building stand-alone, duplicative systems for program administration. In addition, linking foundational identity systems with benefits programs supported by the Bank may also increase demand for identity services. • Investment in foundational identity systems. The WBG can continue to play a direct role in supporting the development of robust and inclusive foundational identification systems. This may involve investment in modernizing and integrating data systems, including digitization of records, ICT equipment and infrastructure, staffing and training, setting up enabling agencies such as Data Ombudsman offices, etc.   65 / The State of Identification Systems in Africa Bibliography Atick, Joseph. 2015. “Digital Identity: The Essential Guide”, ID4Africa, Kigali, Rwanda, 24 May 2016. Atick, Joseph J; Gelb, Alan Harold; Pahlavooni, Seda; Gasol Ramos, Elena; Safdar, Zaid. 2014. Digital identity toolkit: a guide for stakeholders in Africa. Washington, DC : World Bank Group. http://documents.worldbank.org/ curated/en/2014/06/20272197/digital-identity-toolkit-guide-stakeholders-africa. Election Guide Website. http://www.electionguide.org/. Gelb, Alan. 2015. “The Economics of ID Systems: How to Frame the Business Case?” ID4Africa, Kigali, Rwanda, 24 May 2016. Gelb & Diofasi. 2016. “Biometrics and Elections in Poor Countries: Wasteful or a Worthwhile Investment?”. Center for Global Development Working Paper. https://www.cgdev.org/publication/biometric-elections-poor- countries-wasteful-or-worthwhile-investment Le Monde. 2017. “RDC: la piste du scandale des passeports biométriques mène au clan Kabila.” Le Monde Online. Accessed 19 April 2017 at http://www.lemonde.fr/afrique/article/2017/04/13/rdc-la-piste-du-scandale-des- passeports-biometriques-mene-au-clan-kabila_5110933_3212.html#l0jvCdjDFgKAfBJ4.99 National Elections Commission of Liberia. 2014. Voter Registration Update Statistics: Final Report June 30, 2014. http://www.necliberia.org/pg_img/VRUREPORT_2014_Final1.pdf. UNICEF. 2013. Every Child’s Birthright: Inequities and Trends in Birth Registration. Available at https://www.un.org/ ruleoflaw/files/Embargoed_11_Dec_Birth_Registration_report_low_res.pdf. World Development Indicators. 2012, 2015, 2016. Washington, DC: World Bank. World Bank. 2015. Identity Management Systems Analysis: Guidelines and Questionnaire. Washing-ton, DC: World Bank. —2016. ID4D Strategic Framework. http://pubdocs.worldbank.org/en/179901454620206363/Jan-2016-ID4D- Strategic-Roadmap.pdf. —2016. ID4D Global Dataset. http://data.worldbank.org/data-catalog/id4d-dataset. —2016. Digital identity: towards shared principles for public and private sector cooperation. Washington, DC: World Bank Group. http://documents.worldbank.org/curated/en/600821469220400272/Digital-identity-towards- shared-principles-for-public-and-private-sector-cooperation. —2017. Principles on identification for sustainable development: toward the digital age. Washington, DC: World Bank Group. http://documents.worldbank.org/curated/en/213581486378184357/Principles-on-identification- for-sustainable-development-toward-the-digital-age. 66 / The State of Identification Systems in Africa Appendix 1: IMSA Reports in Africa 67 / The State of Identification Systems in Africa Appendix 2: Institutional Structure of Foundational Identity Systems