More than two months since the Russian invasion of Ukraine, over 5.3 million refugees have fled to neighboring countries, including Poland, Romania, Russia, Hungary and Moldova.
For once, the humanitarian sector has enough funds to reach most refugees. The adoption of the “no regrets” approach to registration of refugees has meant that the vast majority are receiving some form of assistance from the UN High Commissioner for Refugees (UNHCR), to its credit, and due to the scale of funding already received. However, as the response scaled up, the UN High Commissioner for Refugees (UNHCR) revealed they would be collecting refugees’ biometric data to register them for a cash transfer. This extends to each family member, even children, instead of the family member registered to receive the cash transfer alone.
This is alarming for multiple reasons. First, the UN has a terrible precedent with data security. In 2021, Human Rights Watch exposed that UNHCR shared personal information from ethnic Rohingya refugees with the Myanmar government to assess the refugees’ eligibility for potential repatriation. The principle of informed consent had been violated since refugees had no idea that their data would be used in this way. UNHCR refutes all claims of wrongdoing.
Petra Molnar, associate director of the Refugee Law Lab, York University, highlighted that the same issues were repeating themselves in Ukraine. “Refugees fleeing Ukraine spoke about feeling like they had no option to opt-out if they wanted access to services,” she told me.
“Very little regulation exists in conflict zones and refugee situations, so people forcibly displaced often experience the sharpest edges of new technologies.” Poignantly, the UN body, World Food Programme, which will be providing similar assistance to Moldovans, will not be collecting biometric data.
The risk that biometric data may end up in the wrong hands is especially severe in Moldova. Moldova, which has the largest number of refugees fleeing Ukraine per capita, has a breakaway region, Transnistria, permanently holding 1500 Russian soldiers. Fears of Russia invading Moldova have increased as the Ministry of State Security in Transnistria was damaged in two blasts just this week.
As Europe’s poorest country, Moldova’s ability to withstand a potential invasion is exacerbated by its poor infrastructure. As one Moldovan official told me: “Moldova is nothing like Ukraine. Our army has fewer than 5000 soldiers – if the Russian government invades from Transnistria, they’ll reach the Moldovan capital within 30 minutes.”
UNHCR considers sharing data with the government a matter of sovereign right, and therefore it is not impossible that data might be shared in the future. In which case, if the Moldovan government was replaced by a pro-Russian president, the biometric data of refugees might be shared. It is inadvisable to collect data that might be safe under one government that would be untenable under another. The current government of Moldova might be receptive to the data privacy concerns that biometric registration entails – but the next one may not be.
"The risk that biometric data may end up in the wrong hands is especially severe in Moldova"
This is especially pertinent for the Russian activists protesting the war in Ukraine who have sought refuge in Moldova since the invasion began on February 24. Even without Russian soldiers’ boots on the ground, the humanitarian sector leaves itself open to the risk of cyber-war, one of the major faultlines of the conflict thus far.
Risks of biometric registration aside, the approach is both needless and inaccurate. UNHCR argues that the use of biometric data is to “protect [refugees’] unique access to cash assistance” since it is “very difficult for someone else to copy [their] fingerprints.”
Anti-fraud measures sound like a laudable cause. After all, they are one of the humanitarian actors’ accountability mechanisms, ensuring that every cent gets into the hands of the most vulnerable. However, these measures should be analyzed in light of cost-efficiency.
Recent data has suggested that biometric registration is not as cost-effective as once assumed. The savings from the removal of duplicate records of refugees may not come close to the potential fraud that could have taken place.
Biometrics might add value when refugees come from a country where most citizens do not have documentation and are fleeing to a country where they will not receive documentation due to institutional and structural discrimination. In such a scenario, UNHCR could offer biometric registration in place of documentation provided either by the country of origin or the host country.
In the case of Ukraine, however, it is totally needless. The vast majority of Ukrainians have documentation, a minority only having access to a photocopy or photo of a passport. Moreover, almost all have memorized their tax ID numbers.
Even putting the above aside, biometric data is not infallible. The uniqueness of your fingerprints is not easily translated. False matches are inevitable, meaning that some of the most vulnerable will not access assistance or face significant impediments in doing so in a refugee crisis of this scale.
In the past, I have seen displaced persons in Somalia cut off their fingers to evade the ramifications of a false match. Though funding for Ukrainians now is plentiful, when conflict becomes protracted and resources scarce, the denial of assistance based on false matches may prove incredibly dangerous.
The Moldovan government has been incredibly collaborative with the humanitarian sector thus far, and accordingly, the humanitarian sector could invest in long-term solutions. One would be to assist those fleeing Ukraine to access Moldovan identification documents, which would be used for humanitarian assistance.
The knee-jerk reaction to using biometrics in a country where it is totally gratuitous is concerning – but it also means that the humanitarian sector can change course. It must do so urgently before it puts refugees’ lives at risk.
Tiara Ataii approached UNHCR Moldova for comment prior to writing this article, but they declined to comment.
Since this opinion piece was published, UNHCR provided the following statement to Infosecurity Magazine:
“UNHCR cash assistance program has provided refugees arriving in Moldova with means to sustain living away from their homes and livelihoods, including to cover costs of accommodation, food, clothes and hygiene items. Since the beginning of the cash assistance program on 25 March in Moldova, over 38,000 refugees have received the cash grant.
UNHCR takes the safeguarding of data extremely seriously. Biometrics is collected in Moldova only in support of the cash assistance program and is not collected for refugee status determination, international protection, and other services. Biometric data is encrypted and securely stored, in full compliance with UNHCR’s Policy on the Protection of Personal Data of Persons of Concern.”