RAND warns security biometrics, digital ID can become tools for targeting

According to a new RAND Europe report, security agencies adopting biometric identification, digital identity, and AI systems should be required to justify the need for the technology before acquiring it and to build independent oversight, audit trails, and human rights protections into its deployment.

The report, Novel Technologies for Security Sector Governance and Management, examines how technologies such as biometrics, digital ID, AI decision support, and social media monitoring are transforming policing, border management, and other security functions.

RAND says the same systems that can speed identity verification, reduce fraud, and improve government services can also enable discriminatory surveillance, opaque decision-making, and the targeting of individuals or groups when governance is weak.

RAND Europe produced the report as part of a project supported by the UK Foreign, Commonwealth & Development Office (FCDO) and implemented in collaboration with the Royal United Services Institute for Defense and Security Studies (RUSI).

RAND conducted a five-month scoping study to identify opportunities and risks in security sector uses of emerging technology and to draw out governance practices that could reduce those risks.

The work included a targeted literature review, interviews with 13 practitioners and experts, and an internal workshop to develop recommendations.

The researchers identified nine technology areas increasingly relevant to security sector governance and management, ranging from augmented and virtual reality and drones to blockchain and satellite imagery.

However, several of the report’s most consequential findings concern the convergence of biometrics, digital identity, AI, and large-scale data systems.

RAND describes a biometric landscape already expanding beyond familiar fingerprint, facial, and iris recognition.

Emerging systems include voice and gait recognition, as well as what the report calls “behaviometrics,” in which typing speed, swipe patterns, and other behavioral characteristics can become identifying signals.

Potential law enforcement applications are moving toward multimodal systems that combine several biometric traits, AI-assisted facial recognition that can work with low-resolution images or masked faces, contactless three-dimensional recognition, and increasingly compact biometric systems that could be incorporated into mobile devices or drones.

Gaze analysis is also developing to estimate where a person is looking and potentially anticipate movement.

Those capabilities can improve identity verification, reduce impersonation and fraud, and create digital records that make activity more auditable. But RAND says the benefits are inseparable from risks related to discrimination, consent, cybersecurity, and surveillance.

The report cites research indicating higher rates of facial recognition misidentification among women, black people, and ethnic minorities.

It also warns that people required to provide biometrics to obtain essential services may not meaningfully understand or consent to how their data will be used, a concern that can be especially acute for refugees and other vulnerable populations.

In fragile or post-conflict environments, weak cybersecurity and regulatory controls can make biometric databases especially vulnerable to breaches, misuse, or surveillance overreach.

Biometrics implemented without adequate protections could also be used to discriminate against or deliberately target individuals or groups, according to RAND.

The report points to the European Union’s EURODAC fingerprint system as an example of the tension between identity management and fundamental rights. Originally built around asylum and migration management, EURODAC has expanded over time, and law enforcement can access it.

RAND raises concerns about AI integration, data sharing, and the revised system’s collection of biometrics from migrant children beginning at age six.

Clearview AI offers another case study. RAND describes the company’s facial recognition platform, built by scraping facial images from online sources, as an example of how identity technologies can conflict with data protection requirements and expectations of transparency.

The report argues that biometric systems therefore require more than technical accuracy. It calls for legal and ethical rules defining data ownership, purpose limitations, oversight responsibilities, and avenues for redress, along with community engagement to ensure that the use of biometrics is understood and, where appropriate, voluntary.

RAND reaches a similarly mixed conclusion on digital identity platforms.

It highlights Ukraine’s Diia application as an example of how digital ID can increase government resilience during a crisis. During Russia’s invasion, the platform enabled displaced people to retain digital identity documents and obtain government and financial assistance remotely.

RAND says Ukraine’s control over the system architecture and data illustrates the importance of local ownership and data sovereignty.

But concentrating identity and other sensitive personal information within a single state-linked system creates another category of risk.

A compromise can expose unusually rich collections of personal information, while weak governance can allow the same infrastructure to be repurposed for surveillance.

Reliance on foreign companies for underlying technology also raises questions about who ultimately accesses the data and where it is stored. Digital ID can also exclude people without suitable documents, Internet access, or sufficient digital literacy.

RAND points to Estonia as a model for building transparency into such systems. Its Eesti application includes a data tracker that allows individuals to see attempts to access their information.

The report recommends independent auditing, clear rules on data ownership, state control over system architecture where appropriate, secure authentication and encryption, and accessible mechanisms for users to challenge misuse.

The report is particularly skeptical of treating a “human-in-the-loop” requirement as a sufficient safeguard against AI risks.

Automated decision-support tools can process data at a scale that is impossible for individual analysts and free personnel from repetitive work. However, RAND concludes that current AI systems remain too opaque to justify removing humans from consequential decision-making.

Even retaining a human operator does not necessarily solve the problem.

The researchers warn of automation bias, in which people give excessive weight to an algorithm’s recommendation. One expert interviewed for the study described police officers acting on a facial recognition match even when they were not confident in it.

RAND says contradictory evidence may still be discounted once an automated system has made a positive identification.

Human involvement can also create what the report calls a “moral buffer,” shifting responsibility for a bad outcome from the operator to the machine. RAND therefore recommends multiple layers of oversight rather than simply placing a person at the end of an automated process.

That oversight should include traceable data provenance, logging of access and decisions, bias testing, and the ability of trained personnel to understand and challenge algorithmic outputs.

The report also stresses that security agencies increasingly dependent on private vendors need to know who controls the underlying data, where it is stored, and whether foreign governments or other third parties could access it.

The broader conclusion is that emerging security technology should not be treated as a procurement problem alone.

RAND recommends pre-acquisition assessments that consider the intended purpose, local conditions, infrastructure, data ownership, misuse risks, and the direct and indirect costs of deployment.

External regulation should support internal agency rules and impose consequences for misuse of technology.

The report cites Oakland, California’s civilian oversight process as an example. The city requires public disclosure of the purpose and planned use of surveillance technology, an analysis of its potential human rights effects, and protections for collected data, along with ongoing audits, public consultation, and enforcement mechanisms.

For RAND, the issue is less about whether security agencies will deploy biometrics, digital ID, and AI than about the institutional controls that accompany them.

The report calls for a shift toward a human-centered, rights-based model in which efficiency does not take precedence over transparency, accountability, the rule of law, or the protection of individual rights.

Article Topics

automation  |  biometrics  |  digital ID  |  RAND Corp.  |  regulation