RAND Calls for Layered Oversight of Biometrics and Digital ID in Security Agencies

A RAND Europe study commissioned by the UK Foreign, Commonwealth and Development Office has called for layered oversight when security agencies deploy biometrics, digital identity and other emerging technologies.

The 59-page study examines nine technology areas that can affect security-sector governance, including biometric systems, digital identity platforms, automated decision support and data-management tools. Researchers conducted a targeted literature review, semi-structured interviews and a workshop.

RAND found that the technologies can improve operational efficiency, recordkeeping and traceability. It also identified risks involving privacy, exclusion, bias, data sovereignty and the concentration of sensitive information in systems that may be vulnerable to misuse or attack.

The study recommends that agencies establish a clear need and risk assessment before adopting a system, adapt deployments to local legal and social conditions, and build data governance into the program from the beginning. It also calls for continuous training and a combination of internal controls, independent regulation and external audit.

A human-in-the-loop requirement is not sufficient by itself, according to the researchers. They argue that staff can defer too readily to automated outputs, so accountability should be distributed across multiple review points rather than resting on a final human approval.

Co-design with affected communities is another of the recommended practices. The study says early participation can identify practical harms, local constraints and patterns of exclusion that may not be apparent to a procuring agency or technology supplier.

The recommendations align with recent calls to keep legal safeguards central to biometric deployments. The UK Information Commissioner’s Office has argued that data-protection law must remain central to police facial-recognition governance, including when deployments are expanded through new legislation.

Security also extends to the databases behind identity systems. The Center for Strategic and International Studies has warned that large immigration biometric databases are attractive espionage targets because they combine identity, travel and other sensitive records.

Canadian policy debates have similarly placed surveillance capability alongside biometric privacy safeguards. RAND’s framework treats those operational and rights concerns as connected governance questions that must be addressed throughout a system’s lifecycle. Its recommended controls begin before procurement, continue through deployment and include repeated review as technology, data and operational conditions change.

Sources: RAND Corporation

–

By the ID Tech Editorial Team