Artificial Intelligence & Machine Learning

What is AI and ML?

Artificial Intelligence (AI) is a field of computer science dedicated to solving cognitive problems commonly associated with human intelligence, such as learning, problem solving, and pattern recognition. Put another way, AI is a catch-all term used to describe new types of computer software that can mimic human intelligence. There is no single, precise, universal definition of AI.

Machine learning (ML) is a subset of AI. Essentially, machine learning is one of the ways computers “learn.” ML is an approach to AI that relies on algorithms on large datasets trained to develop their own rules. This is an alternative to traditional computer programs, in which rules have to be hand-coded in. Machine Learning extracts patterns from data and places that data into different sets. ML has been described as “the science of getting computers to act without being explicitly programmed.” Two short videos provide simple explanations of AI and ML: What Is Artificial Intelligence? | AI Explained and What is machine learning?

Other subsets of AI include speech processing, natural language processing (NLP), robotics, cybernetics, vision, expert systems, planning systems and evolutionary computation. (See Artificial Intelligence – A modern approach).

artificial intelligence, types

The diagram above shows the many different types of technology fields that comprise AI. When referring to AI, one can be referring to any or several of these technologies or fields, and applications that use AI, like Siri or Alexa, utilize multiple technologies. For example, if you say to Siri, “Siri, show me a picture of a banana,” Siri utilizes “natural language processing” to understand what you’re asking, and then uses “vision” to find a banana and show it to you. The question of how Siri understood your question and how Siri knows something is a banana is answered by the algorithms and training used to develop Siri. In this example, Siri would be drawing from “question answering” and “image recognition.”

Most of these technologies and fields are very technical and relate more to computer science than political science. It is important to know that AI can refer to a broad set of technologies and applications. Machine learning is a tool used to create AI systems.

As noted above, AI doesn’t have a universal definition. There are lots of myths surrounding AI—everything from the notion that it’s going to take over the world by enslaving humans, to curing cancer. This primer is intended to provide a basic understanding of artificial intelligence and machine learning, as well as outline some of the benefits and risks posed by AI. It is hoped that this primer will enable you to a conversation about how best to regulate AI so that its potential can be harnessed to improve democracy and governance.

Definitions

Algorithm:An algorithm is defined as “a finite series of well-defined instructions that can be implemented by a computer to solve a specific set of computable problems.” Algorithms are unambiguous, step-by-step procedures. A simple example of an algorithm is a recipe; another is that of a procedure to find the largest number in a set of randomly ordered numbers. An algorithm may either be created by a programmer or generated automatically. In the latter case, it is generated using data via ML.

Algorithmic decision-making/Algorithmic decision system (ADS): A system in which an algorithm makes decisions on its own or supports humans in doing so. ADSs usually function by data mining, regardless of whether they rely on machine learning or not. Examples of a fully automated ADSs are the electronic passport control check-point at airports, and an online decision made by a bank to award a customer an unsecured loan based on the person’s credit history and data profile with the bank. An example of a semi-automated ADS are the driver-assistance features in a car that control its brake, throttle, steering, speed and direction.

Big Data: Extremely large data sets that may be analyzed computationally to reveal patterns, trends, and associations, especially relating to human behavior and interactions. Data is classified as Big Data based on its volume, velocity, variety, veracity and value. This video provides a short explainer video with an introduction to big data and the concept of the 5Vs.

Class label: The label applied after the ML system has classified its inputs, for example, Is a given email message spam or not spam?

Data mining: The practice of examining large pre-existing databases in order to generate new information.” Data mining is also defined as “knowledge discovery from data.

Deep model, also called a “deep neural network” is a type of neural network containing multiple hidden layers.

Label: A label is what the ML system is predicting.

Model: The representation of what a machine learning system has learned from the training data.

Neural network: A biological neural network (BNN) is a system in the brain that enables a creature to sense stimuli and respond to them. An artificial neural network (ANN) is a computing system inspired by its biological counterpart in the human brain. In other words, an ANN is “an attempt to simulate the network of neurons that make up a human brain so that the computer will be able to learn things and make decisions in a humanlike manner.” Large-scale ANNs drive several applications of AI.

Profiling: Profiling involves automated data processing to develop profiles that can be used to make decisions about people.

Robot: Robots are programmable, artificially intelligent automated devices. Fully autonomous robots, e.g., self-driving vehicles, are capable of operating and making decisions without human control. AI enables robots to sense changes in their environments and adapt their responses/ behaviors accordingly in order to perform complex tasks without human intervention. – Report of COMEST on robotics ethics (2017).

Scoring: ¨Scoring is also called prediction, and is the process of generating values based on a trained machine-learning model, given some new input data. The values or scores that are created can represent predictions of future values, but they might also represent a likely category or outcome.” When used vis-a-vis people, scoring is a statistical prediction that determines if an individual fits a category or outcome. A credit score, for example, is a number drawn from statistical analysis that represents the creditworthiness of an individual.

Supervised learning: ML systems learn how to combine inputs to produce predictions on never-before-seen data.

Unsupervised learning: Refers to training a model to find patterns in a dataset, typically an unlabeled dataset.

Training: The process of determining the ideal parameters comprising a model.

 

How do artificial intelligence and machine learning work?

Artificial Intelligence

Artificial Intelligence is a cross-disciplinary approach that combines computer science, linguistics, psychology, philosophy, biology, neuroscience, statistics, mathematics, logic and economics to “understanding, modeling, and replicating intelligence and cognitive processes by invoking various computational, mathematical, logical, mechanical, and even biological principles and devices.”

AI applications exist in every domain, industry, and across different aspects of everyday life. Because AI is so broad, it is useful to think of AI as made up of three categories:

  • Narrow AI or Artificial Narrow Intelligence (ANI) is an expert system in a specific task, like image recognition, playing Go, or asking Alexa or Siri to answer a question.
  • Strong AI or Artificial General Intelligence (AGI) is an AI that matches human intelligence.
  • Artificial Superintelligence (ASI) is an AI that exceeds human capabilities.

Modern AI techniques are developing quickly, and AI applications are already pervasive. However, these applications only exist presently in the “Narrow AI” field. Narrow AI, also known as weak AI, is AI designed to perform a specific, singular task, for example, voice-enabled virtual assistants such as Siri and Cortana, web search engines, and facial-recognition systems.

Artificial General Intelligence and Artificial Superintelligence have not yet been achieved and likely will not be for the next few years or decades.

Machine Learning

Machine Learning is an application of Artificial Intelligence. Although we often find the two terms used interchangeably, machine learning is a process by which an AI application is developed. The machine-learning process involves an algorithm that makes observations based on data, identifies patterns and correlations in the data, and uses the pattern/correlation to make predictions about something. Most of the AI in use today is driven by machine learning.

Just as it is useful to break-up AI into three categories, machine learning can also be thought of as three different techniques: Supervised Learning; Unsupervised Learning; and Deep Learning.

Supervised Learning

Supervised learning efficiently categorizes data according to pre-existing definitions embodied in a labeled data set. One starts with a data set containing training examples with associated labels. Take the example of a simple spam-filtering system that is being trained using spam as well as non-spam emails. The “input” in this case is all the emails the system processes. After humans have marked certain emails as spam, the system sorts spam emails into a separate folder. The “output” is the categorization of email. The system finds a correlation between the label “spam” and the characteristics of the email message, such as the text in the subject line, phrases in the body of the message, or the email address or IP address of the sender. Using the correlation, it tries to predict the correct label (spam/not spam) to apply to all the future emails it gets.

“Spam” and “not spam” in this instance are called “class labels”. The correlation that the system has found is called a “model” or “predictive model.” The model may be thought of as an algorithm the ML system has generated automatically by using data. The labelled messages from which the system learns are called “training data.” The “target variable” is the feature the system is searching for or wants to know more about — in this case, it is the “spaminess” of email. The “correct answer,” so to speak, in the endeavor to categorize email is called the “desired outcome” or “outcome of interest.” This type of learning paradigm is called “supervised learning.”

Unsupervised Learning

Unsupervised learning involves having neural networks learn to find a relationship or pattern without having access to datasets of input-output pairs that have been labelled already. They do so by organizing and grouping the data on their own, finding recurring patterns, and detecting a deviation from the usual pattern. These systems tend to be less predictable than those with labeled datasets and tend to be deployed in environments that may change at some frequency and/or are unstructured or partially structured. Examples include:

  1. an optical character-recognition system that can “read” handwritten text even if it has never encountered the handwriting before.
  2. the recommended products a user sees on online shopping websites. These recommendations may be determined by associating the user with a large number of variables such as their browsing history, items they purchased previously, their ratings of those items, items they saved to a wish list, the user’s location, the devices they use, their brand preference and the prices of their previous purchases.
  3. detection of fraudulent monetary transactions based on, say, their timing and locations. For instance, if two consecutive transactions happened on the same credit card within a short span of time in two different cities.

A combination of supervised and unsupervised learning (called “semi-supervised learning”) is used when a relatively small dataset with labels is available, which can be used to train the neural network to act upon a larger, un-labelled dataset. An example of semi-supervised learning is software that creates deepfakes – photos, videos and audio files that look and sound real to humans but are not.

Deep Learning

Deep learning makes use of large-scale artificial neural networks (ANNs) called deep neural networks, to  create AI that can detect financial fraud, conduct medical image analysis, translate large amounts of text without human intervention and automate moderation of content of social networking websites . These neural networks learn to perform tasks by utilizing numerous layers of mathematical processes to find patterns or relationships among different data points in the datasets. A key attribute to deep learning is that these ANNs can peruse, examine and sort huge amounts of data, which enables them, theoretically, to find new solutions to existing problems.

Although there are other types of machine learning, these three – Supervised Learning, Unsupervised Learning and Deep Learning – represent the basic techniques used to create and train AI systems.

Bias in AI and ML

Artificial intelligence doesn’t come from nowhere; it comes from data received and derived from its developers and from you and me.

And humans have biases. When an AI system learns from humans, it may inherit their individual and societal biases. In cases where it does not learn directly from humans, the “predictive model” as described above may be biased because of the presence of biases in the selection and sampling of data that train the AI system, the “class labels” identified by humans, the way class labels are “marked” and any errors that may have occurred while identifying them, the choice of the “target variable,” “desired outcome” (as opposed to an undesired outcome), “reward”, “regret” and so on. Bias may also occur because of the design of the system; its developers, designers, investors or makers may have ended up baking their own biases into it.

There are three types of biases in computing systems:

  • Pre-existing bias has its roots in social institutions, practices, and attitudes.
  • Technical bias arises from technical constraints or considerations.
  • Emergent bias arises in a context of use.

Bias may affect, for example, the political advertisements one sees on the Internet, the content pushed to the top of the pile in the feeds of social media websites, the amount of insurance premium one needs to pay, if one is screened out of a recruitment process, or if one is allowed to go past border-control checks in another country.

Bias in a computing system is a systematic and repeatable error. Because ML deals with large amounts of data, even a small error rate gets compounded or magnified and greatly affects the outcomes from the system. A decision made by an ML system, especially one that processes vast datasets, is often a statistical prediction. Hence, its accuracy is related to the size of the dataset. Larger training datasets are likely to yield decisions that are more accurate and lower the possibility of errors.

Bias in AI/ ML systems may create new inequalities, exacerbate existing ones, reproduce existing biases, discriminatory treatment and practices, and hide discrimination. See this explainer related to AI bias.

Back to top

How are AI and ML relevant in civic space and for democracy?

Elephant tusks pictured in Uganda. In wildlife conservation, AI/ ML algorithms and past data can be used to predict poacher attacks. Photo credit: NRCN.

The widespread proliferation, rapid deployment, scale, complexity and impact of AI on society is a topic of great interest and concern for governments, civil society, NGOs, human-rights bodies, businesses and the general public alike. AI systems may require varying degrees of human interaction or none at all. AI/ML when applied in design, operation and delivery of services offers the potential to provide new services, and improve the speed, targeting, precision, efficiency, consistency, quality or performance of existing ones. It may provide new insights by making apparent previously undiscovered linkages, relationships and patterns, and offer new solutions. By analyzing large amounts of data, ML systems save time, money and effort. Some examples of the application of AI/ ML in different domains include using AI/ ML algorithms and past data in wildlife conservation to predict poacher attacks  and discovering new species of viruses.

TB Microscopy Diagnosis in Uzbekistan. AI/ML systems aid healthcare professionals in medical diagnosis and easier detection of diseases. Photo credit: USAID.

The predictive abilities of AI and the application of AI and ML in categorizing, organizing, clustering and searching information have brought about improvements in many fields and domains, including healthcare, transportation, governance, education, energy, security and safety, crime prevention, policing, law enforcement, urban management and the judicial system. For example, ML may be used to track the progress and effectiveness of government and philanthropic programs. City administrations, including those of smart cities , use ML to analyze data accumulated over time, about energy consumption, traffic congestion, pollution levels, and waste, in order to monitor and manage them and identify patterns in their generation, consumption and handling.

Digital maps created in Mugumu, Tanzania. Artificial intelligence can support planning of infrastructure development and preparation for disaster. Photo credit: Bobby Neptune for DAI.

AI is also used in climate monitoring, weather forecasting, prediction of disasters and hazards, and planning of infrastructure development. In healthcare, AI systems aid healthcare professionals in medical diagnosis, robot-assisted surgery, easier detection of diseases, prediction of disease outbreaks, tracing the source(s) of disease spread, and so on. Law enforcement and security agencies deploy AI/ML-based surveillance systems, face recognition systems, drones , and predictive policing for the safety and security of the citizens. On the other side of the coin, many of these applications raise questions about individual autonomy, personhood, privacy, security, mass surveillance, reinforcement of social inequality and negative impacts on democracy (See the Risks section ).

Fish caught off the coast of Kema, North Sulawesi, Indonesia. Facial recognition is used to identify species of fish to contribute to sustainable fishing practices. Photo credit: courtesy of USAID SNAPPER.

The full impact of the deployment of AI systems on the individual, society and democracy is not known or knowable, which creates many legal, social, regulatory, technical and ethical conundrums. The topic of harmful bias in artificial intelligence and its intersection with human rights and civil rights has been a matter of concern for governments and activists. The EU General Data Protection Regulation (GDPR) has provisions on automated decision-making, including profiling. The European Commission released a whitepaper on AI in February 2020 as a prequel to potential legislation governing the use of AI in the EU, while another EU body has released recommendations on the human rights impacts of algorithmic systems. Similarly, Germany, France, Japan and India have drafted AI strategies for policy and legislation. Physicist Stephen Hawking once said, “…success in creating AI could be the biggest event in the history of our civilization. But it could also be the last, unless we learn how to avoid the risks.”

Back to top

Opportunities

Artificial intelligence and machine learning can have positive impacts when used to further democracy, human rights and governance issues. Read below to learn how to more effectively and safely think about artificial intelligence and machine learning in your work.

Detect and overcome bias

Humans come with individual and cognitive biases and prejudices and may not always act or think rationally. By removing humans from the decision-making process, AI systems potentially eliminate the impact of human bias and irrational decisions, provided the systems are not biased themselves, and that they are intelligible, transparent and auditable. AI systems that aid traceability and transparency can be used to avoid, detect or trace human bias (some of which may be discriminatory) as well as non-human bias, such as bias originating from technical limitations. Much research has shown how automated filtering of job applications reproduces multiple biases; however research has also shown that AI can be used to combat unconscious recruiter biases in hiring. For processes like job hiring where many hidden human biases go undetected,  responsibly-designed algorithms can act as a double check for humans and bring those hidden biases into view, and in some cases even nudge people into less-biased outcomes, for example by masking candidates’ names and other bias-triggering features on a resume.

Improve security and safety

Automated systems based on AI can be used to detect attacks, such as credit card fraud or a cyberattack on public infrastructure. As online fraud becomes more advanced, companies, governments, and individuals need to be able to identify fraud even more quickly, even before it occurs. It is like a game of cat and mouse. Computers are creating more complex, unusual patterns to avoid detection, the human understanding of these patterns is limited— humans need to use equally agile and unusual patterns too, that can adapt and iterate in real time, and Machine Learning can provide this.

Moderate harmful online content

Enormous quantities of content uploaded every second to the social web (videos on YouTube and TikTok, photos and posts to Instagram and Facebook, etc.). There is simply too much for human reviewers to examine themselves. Filtering tools like algorithms and machine-learning techniques are used by many social media platforms to screen through every post for illegal or harmful content (like child sexual abuse material, copyright violations, or spam). Indeed, artificial intelligence is at work in your email inbox, automatically filtering unwanted marketing content away from your main inbox. Recently, the arrival of deepfake and other computer-generated content requires similarly advanced approaches to identify it. Deepfakes take their name from the deep learning artificial-intelligence technology used to make them. Fact-checkers and other actors working to diffuse the dangerous, misleading power of these false videos are developing their own artificial intelligence to identify these videos as false.

Web Search

Search engines run on algorithmic ranking systems. Of course, search engines are not without serious biases and flaws, but they allow us to locate information from the infinite stretches of the internet. Search engines on the web (like Google and Bing) or within platforms (like searches within Wikipedia or within The New York Times) can enhance their algorithmic ranking systems by using machine learning to favor certain kinds of results that may be beneficial to society or of higher quality. For example, Google has an initiative to highlight “original reporting.”

Translation

Machine Learning has allowed for truly incredible advances in translation. For example, Deepl is a small machine-translation company that has surpassed even the translation abilities of the biggest tech companies. Other companies have also created translation algorithms that allow people across the world to translate texts into their preferred languages, or communicate in languages beyond those they know well, which has advanced the fundamental right of access to information, as well as the right to freedom of expression and the right to be heard.

Back to top

Risks

The use of emerging technologies can also create risks in civil society programming. Read below on how to discern the possible dangers associated with artificial intelligence and machine learning in DRG work, as well as how to mitigate for unintended – and intended – consequences.

Discrimination against marginalized groups

There are several ways in which AI may make decisions that can lead to discrimination, including  how the “target variable” and the “class labels” are defined; during the process of labeling the training data; when collecting the training data;  during the feature selection; and when proxies are identified. It is also possible to intentionally set up an AI system to be discriminatory towards one or more groups. This video explains how commercially available facial recognition systems trained on racially biased data sets discriminate against people of dark skin, women and gender-diverse people.

The accuracy of AI systems is based on how ML processes Big Data , which in turn depends on the size of the dataset. The larger the size, the more accurate the system’s decisions are likely to be. However, women, Black people and people of color (PoC), disabled people, minorities, indigenous people, LGBTQ+ people, and other minorities, are less likely to be represented in a dataset because of structural discrimination, group size, or attitudes that prevent their full participation in society. Bias in training data reflects and systematizes existing discrimination. Because an AI system is often a black box, it is hard to conclusively prove or demonstrate that it has made a discriminatory decision, and why it makes certain decisions about some individuals or groups of people. Hence, it is difficult to assess whether certain people were discriminated against on the basis of their race, sex, marginalized status or other protected characteristics. For instance, AI systems used in predictive policing, crime prevention, law enforcement and the criminal justice system are, in a sense, tools for risk-assessment. Using historical data and complex algorithms, they generate predictive scores that are meant to indicate the probability of the occurrence of crime, the probable location and time, and the people who are likely to be involved. When relying on biased data or biased decision-making structures, these systems may end up reinforcing stereotypes about underprivileged, marginalized or minority groups.

A study by the Royal Statistical Society notes that “…predictive policing of drug crimes results in increasingly disproportionate policing of historically over‐policed communities… and, in the extreme, additional police contact will create additional opportunities for police violence in over‐policed areas. When the costs of policing are disproportionate to the level of crime, this amounts to discriminatory policy.” Likewise, when mobile applications for safe urban navigation, software for credit-scoring, banking, housing, insurance, healthcare, and selection of employees and university students rely on biased data and decisions, they reinforce social inequality and negative and harmful stereotypes.

The risks associated with AI systems are exacerbated when AI systems make decisions or predictions involving minorities such as refugees or “life and death” matters such as medical care. A 2018 report by The University of Toronto and Citizen Lab notes, “Many [asylum seekers and immigrants] come from war-torn countries seeking protection from violence and persecution. The nuanced and complex nature of many refugee and immigration claims may be lost on these technologies, leading to serious breaches of internationally and domestically protected human rights, in the form of bias, discrimination, privacy breaches, due process and procedural fairness issues, among others. These systems will have life-and-death ramifications for ordinary people, many of whom are fleeing for their lives.” For medical and healthcare uses, the stakes are especially high because an incorrect decision made by the AI system could potentially put lives at risk or drastically alter the quality of life or wellbeing of the people affected by it.

Security vulnerabilities

Malicious hackers and criminal organizations may use ML systems to identify vulnerabilities in and target public infrastructure or privately-owned systems such as IoT devices and self-driven cars, for example.

If malicious entities target AI systems deployed in public infrastructure, such as smart cities , smart grids, and nuclear installations as well as healthcare facilities and banking systems, among others, they  “will be harder to protect, since these attacks are likely to become more automated and more complex and the risk of cascading failures will be harder to predict. A smart adversary may either attempt to discover and exploit existing weaknesses in the algorithms or create one that they will later exploit.” Exploitation may happen, for example, through a poisoning attack, which interferes with the training data if machine learning is used. Attackers may also “use ML algorithms to automatically identify vulnerabilities and optimize attacks by studying and learning in real time about the systems they target.”

Privacy and data protection

The deployment of AI systems without adequate safeguards and redress mechanisms may pose many risks to privacy and data protection (See also the Data Protection . Businesses and governments collect immense amounts of personal data in order to train the algorithms of AI systems that render services or carry out specific tasks and activities. Criminals, rogue states/ governments/government bodies, and people with malicious intent often try to target these data for various reasons ranging from carrying out monetary fraud to commercial gains to political motives. For instance, health data captured from smartphone applications and Internet-enabled wearable devices, if leaked, can be misused by credit agencies, insurance companies, data brokers, cybercriminals, etc. The breach or abuse of non-personal data, such as anonymized data, simulations, synthetic data, or generalized rules or procedures, may also affect human rights.

Chilling effect

AI systems used for surveillance, policing, criminal sentencing, legal purposes, etc. become a new avenue for abuse of power by the state to control citizens and political dissidents. The fear of profiling, scoring, discrimination and pervasive digital surveillance may have a chilling effect on citizens’ ability or willingness to exercise their rights or express themselves. Most people will modify their behavior in order to obtain the benefits of a good score and to avoid the disadvantages that come with having a bad score.

Opacity (Black box nature of AI systems)

Opacity may be interpreted as either a lack of transparency or a lack of intelligibility. Algorithms, software code, ‘behind-the-scenes’ processing and the decision-making process itself may not be intelligible to those who are not experts or specialized professionals. In legal/judicial matters, for instance, the decisions made by an AI system do not come with explanations, unlike those of judges which are required to state the reasons on which their legal order or judgment is based. The legal order or judgment is quite likely to be on public record.

Technological unemployment

Automation systems, including AI/ML systems, are increasingly being used to replace human labor in various domains and industries, eliminating a large number of jobs and causing structural unemployment (known as technological unemployment). With the introduction of AI/ML systems, some types of jobs will be lost, some others will be transformed, and new jobs will appear. The new jobs are likely to require specific or specialized skills that are amenable to AI/ML systems.

Loss of individual autonomy and personhood

Profiling and scoring in AI raise apprehensions that people are being dehumanized and reduced to a profile or score. Automated decision-making systems may impact the wellbeing, physical integrity, quality of life of people, the information they find or are targeted with, the services and products they can or cannot avail, among other things. This affects what constitutes an individual’s consent (or lack thereof), the way consent is formed, communicated and understood, and the context in which it is valid. “[T]he dilution of the free basis of our individual consent – either through outright information distortion or even just the absence of transparency – imperils the very foundations of how we express our human rights and hold others accountable for their open (or even latent) deprivation”. – Human Rights in the Era of Automation and Artificial Intelligence

Back to top

Questions

If you are trying to understand the implications of artificial intelligence and machine learning in your work environment, or are considering using aspects of these technologies as part of your DRG programming, ask yourself these questions:

  1. Is artificial intelligence or machine learning an appropriate, necessary, and proportionate tool to use for this project and with this community?
  2. Who is designing and overseeing the technology? Can they explain to you what is happening at different steps of the process?
  3. What data are being used to design and train the technology? How could these data lead to biased or flawed functioning of the technology?
  4. What reason do you have to trust the technology’s decisions? Do you understand why you are getting a certain result, or might there be a mistake somewhere? Is anything not explainable?
  5. Are you confident the technology will work as it is claimed when it is used with your community and on your project, as opposed to in a lab setting (or a theoretical setting)? What elements of your situation might cause problems or change the functioning of the technology?
  6. Who is analyzing and implementing the AI/ML technology? Do these people understand the technology, and are they attuned to its potential flaws and dangers? Are these people likely to make any biased decisions, either by misinterpreting the technology or for other reasons?
  7. What measures do you have in place to identify and address potentially harmful biases in the technology?
  8. What regulatory safeguards and redress mechanisms do you have in place, for people who claim that the technology has been unfair to them or abused them in any way?
  9. Is there a way that your AI/ML technology could perpetuate or increase social inequalities, even if the benefits of using AI and ML outweigh these risks? What will you do to minimize these problems and stay alert to them?
  10. Are you certain that the technology abides with relevant regulations and legal standards, including GDPR?
  11. Is there a way that this technology may not discriminate against people by itself, but that it may lead to discrimination or other rights violations, for instance when it is deployed in different contexts or if it is shared with untrained actors? What can you do to prevent this?

Back to top

Case Studies

“Preventing echo chambers: depolarising the conversation on social media”

“Preventing echo chambers: depolarising the conversation on social media” 

“RNW Media’s digital teams… have pioneered moderation strategies to support inclusive digital communities and have significantly boosted the participation of women in specific country settings. Through Social Listening methodologies, RNW Media analyses online conversations on multiple platforms across the digital landscape to identify digital influencers and map topics and sentiments in the national arena. Using Natural Language Processing techniques (such as sentiment and topic detection models), RNW Media can mine text and analyze this data to unravel deep insights into how online dialogue is developing over time. This helps to establish the social impact of the online moderation strategies while at the same time collecting evidence that can be used to advocate for young people’s needs.”

Forecasting climate change, improving agricultural productivity

In 2014, the International Center for Tropical Agriculture, the Government of Colombia, and Colombia’s National Federation of Rice Growers, using weather and crop data collected over the prior decade, predicted climate change and resultant crop loss for farmers in different regions of the country. The prediction “helped 170 farmers in Córdoba avoid direct economic losses of an estimated $ 3.6 million and potentially improve productivity of rice by 1 to 3 tons per hectare. To achieve this, different data sources were analyzed in a complementary fashion to provide a more complete profile of climate change… Additionally, analytical algorithms were adopted and modified from other disciplines, such as biology and neuroscience, and were used to run statistical models and compare with weather records.”

Doberman.io developed an iOS app

Doberman.io developed an iOS app that employs machine learning and speech recognition to automatically analyze speech in a meeting room. The app determines the amount of time each person has spoken and tries to identify the sex of each speaker, using a visualization of the contribution of each speaker almost in real time with the relative percentages of time during which males and females have spoken. “When the meeting starts, the app uses the mic to record what’s being said and will continuously show you the equality of that meeting. When the meeting has ended and the recording stops, you’ll get a full report of the meeting.”

Food security: Detecting diseases in crops using image analysis (2016)

Food security: Detecting diseases in crops using image analysis (2016) 

“Using a public dataset of 54,306 images of diseased and healthy plant leaves collected under controlled conditions, we train a deep convolutional neural network to identify 14 crop species and 26 diseases (or absence thereof). The trained model achieves an accuracy of 99.35% on a held-out test set, demonstrating the feasibility of this approach.”

Can an ML model potentially predict the closure of civic spaces more effectively than traditional approaches? The USAID-funded INSPIRES project is testing the proposition that machine learning can help identify early flags that civic space may shift and generate opportunities to evaluate the success of interventions that strive to build civil society resilience to potential shocks.

Back to top

References

Find below the works cited in this resource.

Additional Resources

Back to top

Categories

Automation

What is automation?

Worker at the assembly line of car-wiring factory in Bizerte, Tunisia. The automation of labor disproportionately affects women, the poor and other vulnerable members of society. Photo credit: Alison Wright for USAID, Tunisia, Africa

Automation involves techniques and methods applied to enable machines, devices and systems to function with minimal or no human involvement. Automation is used, for example, in applications for managing the operation of traffic lights in a city, navigating aircrafts, running and configuring different elements of a telecommunications network, in robot-assisted surgeries, and even for automated storytelling (which uses an artificial intelligence software to create verbal stories). Automation can improve efficiency and reduce error, but it also creates new opportunities for error and introduces new costs and challenges for government and society.

How does automation work?

Processes can be automated by programming certain procedures to be performed without human intervention (like a recurring payment for a credit card or phone app) or by linking electronic devices to communicate directly with one another (like self-driving vehicles communicating with other vehicles and with road infrastructure). Automation can involve the use of temperature sensors, light sensors, alarms, microcontrollers, robots, and more. Home automation, for example, may include home assistants such as Amazon Echo, Google Home and OpenHAB. Some automation systems are virtual, for example, email filters that automatically sort incoming email into different folders, and AI-enabled moderation systems for online content .

The exact architecture and functioning of automation systems depend on their purpose and application. However, automation should not be confused with artificial intelligence in which an algorithm-led process ‘learns’ and changes over time: for instance, an algorithm that reviews thousands of job applications and studies and learns from patterns in the applications is using artificial intelligence, while a chatbot that replies to candidates’ questions is using automation.

For more information on the different components of automation systems, read also the resources about the Internet of Things and sensors, robots and drones, and biometrics.

Back to top

How is automation relevant in civic space and for democracy?

Automated processes can be built to increase transparency, accuracy, efficiency, and scale. They can help minimize effort (labor) and time; reduce errors and costs; improve the quality and/or precision in tasks/processes; carry out tasks that are too strenuous, hazardous or beyond the physical capabilities of humans; and generally free humans of repetitive, monotonous tasks.  

From a historical perspective, automation is not new: the first industrial revolution in the 1700s harnessed the power of steam and water; the technological revolution of the 1880s relied on railways and telegraphs; and the digital revolution in the 20th century saw the beginning of computing. Each of these transitions brought fundamental changes not only to industrial production and the economy, but to society, government, and international relations.  

Now, the fourth industrial revolution, or the automation revolution as it is sometimes called, promises to once again disrupt work as we know it as well as relationships between people, machines, and programmed processes.  

When used by governments, automated processes promise to deliver government services with greater speed, efficiency, and coverage. These developments are often called e-government, e-governance, or digital government. E-government includes the government communication and information sharing on the web (sometimes even the publishing of government budgets and agendas), facilitation of financial transactions online such as electronic filing of tax returns, digitization of health records, electronic voting, and digital IDs  

A health worker receives information on disease outbreak in Brewerville, Liberia. Automated processes promise to deliver government services with greater speed, efficiency, and coverage. Photo credit: Sarah Grile.

The benefits of automating government services are numerous, as the UK’s K4D helpdesk explains, by lowering the cost of service delivery, improving quality and coverage  (for example, through telemedicine or drones ); strengthening communication, monitoring, and feedback, and in some cases by encouraging citizen participation at the local level. In Indonesia, for example, the Civil Service Agency (BKN) introduced a computer-assisted testing system (CAT) to disrupt the previously long-standing manual testing system that created rampant opportunities for corruption in civil service recruitment by line ministry officials. With the new system, the database of questions is tightly controlled, and the results are posted in real time outside the testing center.  

In India, an automated system relying on a specifically designed computer (an Advanced Virtual RISC) and the common telecommunications standard GSM (Global System for Mobile) is used to inform farmers about exact field conditions and to point to the necessary next steps with command functions such as irrigating, ploughing, deploying seeds and carrying out other farming activities. 

Drone used for irrigation scheduling in southern part of Bangladesh. Automated systems have vast applications in agriculture. Photo credit: Alanuzzaman Kurishi.

As with previous industrial revolutions, automation changes the nature of work, and these changes could bring unemployment in certain sectors if not properly planned. The removal of humans from processes also brings new opportunities for error (such as ‘automation bias’) and raises new legal and ethical questions. See the Risks section below. 

Back to top

Opportunities

Islamabad Electric Supply Company’s (IESCO) Power Distribution Control Center (PDC), Pakistan. Smart meters enable monitoring of power demand, supply and load shedding in real-time. Photo credit: USAID.

Automation can have positive impacts when used to further democracy, human rights and governance issues. Read below to learn how to more effectively and safely think about automation in your work.
Increase in productivity

Automation may improve output while reducing the time and labour required, thus increasing the productivity of workers and the demand for other kinds of work. For example, automation can streamline document review, cutting down on the time that lawyers need to search through documents or academics through sources, etc. In Azerbaijan, the government partnered with the private sector in the use of an automated system to reduce the backlog of relatively simple court cases, such as claims for unpaid bills. In instances where automation increases quality of services or goods and/or brings down their cost, a larger demand for the goods or services can be served.  

Improvements in processes and outputs

Automation can improve the speed, efficiency, quality, consistency and coverage of service delivery and reduce human error, time spent, and costs. It can therefore allow activities to scale up. For example, the UNDP and the government of the Maldives used automation to create 3-D maps of the islands and chart their topography. Having this information on record would speed up further disaster relief and rescue efforts. The use of drones also reduced the time and money required to conduct this exercise: while mapping 11 islands would normally take almost a year, using a drone reduced the time to one day. See the Robots and Drones resource for additional examples. 

Optimizing an automated task generally requires trade-offs among cost, precision, the permissible margin of error, and scale. Automation may sometimes require tolerating more errors in order to reduce costs or achieve greater scale. For more, see the section “Knowing when automation offers a suitable solution to the challenge at hand” in Automation of government processes. 

Increase transparency

Automation may increase transparency by making data and information easily available to the public, thus building public trust and aiding accountability. In India, the State Transport Department of Karnataka has automated driving test centers hoping to eliminate bribery in the issuing of driver’s licenses. A host of high-definition cameras and sensors placed along the test track captured the movement of the vehicle while a computerised system decides if the driver has passed or failed the test. See also Are emerging technologies helping win the fight against corruption in developing countries? 

Back to top

Risks

The use of emerging technologies can also create risks in civil society programming. Read below on how to discern the possible dangers associated with automation in DRG work, as well as how to mitigate for unintended – and intended – consequences.
Labor issues


When automation is used to replace human labor, the resulting loss of jobs causes structural unemployment known as “technological unemployment.” Structural unemployment disproportionately affects women, the poor and other vulnerable members of society, unless they are re-skilled and provided with adequate protections. Automation also requires skilled labor that can operate, oversee or maintain automated systems, eventually creating jobs for a smaller section of the population. But the immediate impact of this transformation of work can be harmful for people and communities without social safety nets or opportunities for finding other work.

Discrimination towards marginalized groups and minorities and increasing social inequality

Automation systems equipped with artificial intelligence (AI) may produce results that are discriminatory towards some marginalized and minority groups when the system has learned from biased learning patterns, from biased datasets or biased human decision making. The outputs of AI-equipped automated systems may reflect real-life societal biases, prejudices and discriminatory treatment towards some demographics. Biases can also occur from the human implementation of automated systems, for instance, when the systems do not function in the real world as they were able to function in a lab or theoretical setting, or when the humans working with the machines misinterpret or misuse the automated technology.  

There are numerous examples of racial and other types of discrimination being either replicated or magnified by automation. To take an example from the field of predictive policing, ProPublica reported after conducting an investigation in 2016 that COMPAS, a data-driven AI tool meant to assist judges in the United States, was biased against Black people while determining if a convicted offender would commit more crimes in the future. For more on predictive policing see How to Fight Bias with Predictive Policing and A Popular Algorithm Is No Better at Predicting Crimes Than Random People.  

These risks exist in other domains as well. The University of Toronto and Citizen Lab report titled “Bots at the gate: A human rights analysis of automated decision-making in Canada’s immigration and refugee system notes that[m]any [asylum seekers and immigrants] come from war-torn countries seeking protection from violence and persecution. The nuanced and complex nature of many refugee and immigration claims is lost on these technologies, leading to serious breaches of internationally and domestically protected human rights, in the form of bias, discrimination, privacy breaches, due process and procedural fairness issues, among others. These systems will have life-and-death ramifications for ordinary people, many of whom are fleeing for their lives.” 

Insufficient Legal Protections

Existing laws and regulations may not be applicable to automation systems and, in cases where they are, the application may not be well-defined. Not all countries have laws that protect individuals against these dangers. Under the GDPR (the European General Data Protection Regulation), individuals have the right not to be subject to a decision based only on automated processing, including profiling. In other words, humans must oversee important decisions that affect individuals. But not all countries have or respect such regulations, and even the GDPR is not upheld in all situations. Meanwhile, individuals would have to actively claim their rights and contest these decisions, usually by seeking legal assistance, which is beyond the means of many. Groups at the receiving end of such discrimination tend to have fewer resources and limited access to human-rights protections to contest such decisions.

Automation Bias

People tend to have faith in automation and tend to believe that technology is accurate, neutral and non-discriminating. This can be described as “automation bias”: when humans working with or overseeing automated systems tend to give up responsibility to the machine and trust the machine’s decisionmaking uncritically. Automation bias has been shown to have harmful impacts across automated sectors, including leading to errors in healthcare. Automation bias also plays a role in the discrimination described above.
Uncharted ethical concerns

The ever-increasing use of automation brings ethical questions and concerns that may not have been considered before the arrival of the technology itself. For example, who is responsible if a self-driving car gets into an accident? How much personal information should be given to health-service providers to facilitate automated health monitoring? In many cases, further research is needed to even begin to address these dilemmas.
Issues related to individual consent

When automated systems make decisions that affect people’s lives, they blur the formation, context and expression of an individual’s consent (or lack thereof) as described in this quote: “…[T]he dilution of the free basis of our individual consent – either through outright information distortion or even just the absence of transparency – imperils the very foundations of how we express our human rights and hold others accountable for their open (or even latent) deprivation. See additional information about informed consent in the Data Protection resource . 

High capital costs

Large-scale automation technologies require very high capital costs, which is a risk in case the use of the technology becomes unviable in the long term or does not otherwise guarantee commensurate returns or recovery of costs. Hence, automation projects funded with public money (for example, some “smart city ” infrastructure) require thorough feasibility studies for assessing needs and ensuring long-term viability. On the other hand, initial costs also may be very high for individuals and communities. An automated solar-power installation or a rainwater-harvesting system is a large investment for a community. However, depending on the tariffs for grid power or water, the expenditure may be recovered in the long run.

Back to top

Questions

If you are trying to understand the implications of automation in your work environment, or are considering using aspects of automation as part of your DRG programming, ask yourself these questions:

  1. Is automation a suitable method for the problem you are trying to solve?
  2. What are the indicators or guiding factors that determine if automation is a suitable and required solution to a particular problem or challenge?
  3. What risks are involved regarding security, potential for discrimination, etc? How will you minimize these risks? Do the benefits of using automation or automated technology outweigh these risks?
  4. Who will work with and oversee these technologies? What is their training and what are their responsibilities? Who is liable legally in case of an accident?
  5. What are the long-term effects of using these technologies in the surrounding environment or community? What are the effects on individuals, jobs, salaries, social welfare, etc.? What measures are necessary to ensure that the use of these technologies does not aggravate or reinforce inequality through automation bias or otherwise?
  6. How will you ensure that humans are overseeing any important decision made about individuals using automated processes? (How will you abide by the GDPR or other applicable regulations?)
  7. What privacy and security safeguards are necessary for applying these technologies in a given context regarding, for example, cybersecurity, protection or personal privacy, protecting operators from accidents, etc.? How will you build in these safeguards?

Back to top

Case studies

Automated Farming Vehicles

Automated Farming Vehicles

“Forecasts of world population increases in the coming decades demand new production processes that are more efficient, safer, and less destructive to the environment. Industries are working to fulfill this mission by developing the smart factory concept. The agriculture world should follow industry leadership and develop approaches to implement the smart farm concept. One of the most vital elements that must be configured to meet the requirements of the new smart farms is the unmanned ground vehicles (UGV).”

Automated Mining in South Africa

Automated Mining in South Africa

“Spiraling labour and energy costs are putting pressure on the financial performance of gold mines in South Africa, but the solution could be found in adopting digital technologies. By implementing automation operators can remove underground workers from harm’s way, and that is going to become an ever-bigger imperative if gold miners are to remain investable by international capital. This increased emphasis for the safety of the workforce and mines is motivating the development of the mining automation market. Earlier, old-style techniques of exploration and drilling compromised the security of mine labour force. Such examples have forced operators to develop smart resolutions and tools to confirm security of workers.”

Automating Processing of Uncontested Civil Cases to Reduce Court Backlogs in Azerbaijan, Case Study 14

Automating Processing of Uncontested Civil Cases to Reduce Court Backlogs in Azerbaijan, Case Study 14

“In Azerbaijan, the government developed a new approach to dealing with their own backlog of cases, one which addressed both supply side and demand side elements. Recognizing that much of the backlog stemmed from relatively simple civil cases, such as claims for unpaid bills, the government partnered with the private sector in the use of an automated system to streamline the handling of uncontested cases, thus freeing up judges’ time for more important cases.”

Reforming Civil Service Recruitment through Computerized Examinations in Indonesia, Case Study 6

Reforming Civil Service Recruitment through Computerized Examinations in Indonesia, Case Study 6

“In Indonesia, the Civil Service Agency (BKN) succeeded in introducing a computer-assisted testing system (CAT) to disrupt the previously long-standing manual testing system that created rampant opportunities for corruption in civil service recruitment by line ministry officials. Now the database of questions is tightly controlled, and the results are posted in real time outside the testing center. Since its launch in 2013, CAT has become the de facto standard for more than 62 ministries and agencies.”

Hiring Tech Has Potential but Beware Automation Bias

Hiring Tech Has Potential but Beware Automation Bias

“Are we getting to the point where technology can nearly replace humans in the hiring process? It can screen applicants’ resumes and conduct prescreening outreach—and much more. But beware the misconceptions and risks involved in having tech take over for HR professionals, particularly in decision-making processes…. When deciding how to use technology appropriately in the talent acquisition process, avoid “automation bias”—the tendency to believe that technology is better than humans in performing various functions. Is it OK to automate rote tasks such as scheduling interviews with candidates? Sure. Conducting initial interviews with candidates? Maybe. Making hiring decisions? Probably not. ”

Real Time Automation of Indian Agriculture

Real Time Automation of Indian Agriculture

“Real time automation of Indian agricultural system’ using AVR (Advanced Virtual RISC) microcontroller and GSM (Global System for Mobile) is focused on making the agriculture process easier with the help of automation. The set up consists of processor which is an 8-bit microcontroller. GSM plays an important part by controlling the irrigation on field. GSM is used to send and receive the data collected by the sensors to the farmer. GSM acts as a connecting bridge between AVR microcontroller and farmer. Our study aims to implement the basic application of automation of the irrigation field by programming the components and building the necessary hardware. In our study different type of sensors like LM35, humidity sensor, soil moisture sensor, IR sensor used to find the exact field condition. GSM is used to inform the farmer about the exact field condition so that [they] can carry necessary steps. AT(Attention) commands are used to control the functions like irrigation, ploughing, deploying seeds and carrying out other farming activities.”

Back to top

References

Additional resources

Back to top

Categories

Data Protection

What is data protection?

Data protection refers to practices, measures and laws that aim to prevent certain information about a person from being collected, used or shared in a way that is harmful to that person.

Interview with fisherman in Bone South Sulawesi, Indonesia. Data collectors must receive training on how to avoid bias during the data collection process. Photo credit: Indah Rufiati/MDPI – Courtesy of USAID Oceans.

Data protection isn’t new. Bad actors have always sought to gain access to individuals’ private records. Before the digital era, data protection meant protecting individuals’ private data from someone physically accessing, viewing or taking files and documents. Data protection laws have been in existence for more than 40 years.

Now that many aspects of peoples’ lives have moved online, private, personal and identifiable information is regularly shared with all sorts of private and public entities. Data protection seeks to ensure that this information is collected, stored and maintained responsibly and that unintended consequences of using data are minimized or mitigated.

What are data?

Data refer to digital information, such as text messages, videos, clicks, digital fingerprints, a bitcoin, search history and even mere cursor movements. Data can be stored on computers, mobile devices, in clouds and on external drives. It can be shared via e-mail, messaging apps and file transfer tools. Your posts, likes and retweets, your videos about cats and protests, and everything you share on social media is data.

Metadata are a subset of data. It is information stored within a document or file. It’s an electronic fingerprint that contains information about the document or file. Let’s use an email as an example. If you send an email to your friend, the text of the email is data. The email itself, however, contains all sorts of metadata like, who created it, who the recipient is, the IP address of the author, the size of the email, etc.

Large amounts of data get combined and stored together. These large files containing thousands or millions of individual files are known as datasets. Datasets then get combined into very large datasets. These very large datasets, referred to as to big data , are used to train machine-learning systems.

Personal Data and Personally Identifiable Information

Data can seem to be quite abstract, but the pieces of information are very often reflective of the identities or behaviors of actual persons. Not all data require protection, but some data, even metadata, can reveal a lot about a person. This is referred to as Personally Identifiable Information (PII). PII is commonly referred to as personal data. PII is information that can be used to distinguish or trace an individual’s identity such as a name, passport number or biometric data like fingerprints and facial patterns. PII is also information that is linked or linkable to an individual, such as date of birth and religion.

Personal data can be collected, analyzed and shared for the benefit of the persons involved, but they can also be used for harmful purposes. Personal data are valuable for many public and private actors. For example, they are collected by social media platforms and sold to advertising companies. They are collected by governments to serve law-enforcement purposes like prosecution of crimes. Politicians value personal data to target voters with certain political information. Personal data can be monetized by people with criminal purposes such as selling false identities.

“Sharing data is a regular practice that is becoming increasingly ubiquitous as society moves online. Sharing data does not only bring users benefits, but is often also necessary to fulfill administrative duties or engage with today’s society. But this is not without risk. Your personal information reveals a lot about you, your thoughts, and your life, which is why it needs to be protected.”

Access Now’s ‘Creating a Data Protection Framework’, November 2018.

How does data protection relate to the right to privacy?

The right to protection of personal data is closely interconnected to, but distinct from, the right to privacy. The understanding of what “privacy” means varies from one country to another based on history, culture, or philosophical influences. Data protection is not always considered a right in itself. Read more about the differences between privacy and data protection here.

Data privacy is also a common way of speaking about sensitive data and the importance to protect it against unintentional sharing and undue or illegal  gathering and use of data about an individual or group. USAID recently shared a resource about promoting data privacy in COVID-19 and development, which defines data privacy as ‘the  right  of  an  individual  or  group  to  maintain  control  over  and  confidentiality  of  information  about  themselves’.

How does data protection work?

Participant of the USAID WeMUNIZE program in Nigeria. Data protection must be considered for existing datasets as well. Photo credit: KC Nwakalor for USAID / Digital Development Communications

Personal data can and should be protected by measures that protect from harm the identity or other information about a person and that respects their right to privacy. Examples of such measures include determining which data are vulnerable based on privacy-risk assessments; keeping sensitive data offline; limiting who has access to certain data; anonymizing sensitive data; and only collecting necessary data.

There are a couple of established principles and practices to protect sensitive data. In many countries, these measures are enforced via laws, which contain the key principles that are important to guarantee data protection.

“Data Protection laws seek to protect people’s data by providing individuals with rights over their data, imposing rules on the way in which companies and governments use data, and establishing regulators to enforce the laws.”

Privacy International on data protection

A couple of important terms and principles are outlined below, based on The European Union’s General Data Protection Regulation (GDPR).

  • Data Subject: any person whose personal data are being processed, such as added to a contacts database or to a mailing list for promotional emails.
  • Processing data means that any operation is performed on the personal data, manually or automated.
  • Data Controller: the actor that determines the purposes for, and means by which, personal data are processed.
  • Data Processor: the actor that processes personal data on behalf of the controller, often a third-party external to the controller, such as a party that offers mailing list or survey services.
  • Informed Consent: individuals understand and agree that their personal data are collected, accessed, used and/or shared and how they can withdraw their consent.
  • Purpose limitation: personal data are only collected for a specific and justified use and the data cannot be used for other purposes by other parties.
  • Data minimization: that data collection is minimized and limited to essential details.

 

Healthcare provider in Eswatini. Quality data and protected datasets can accelerate impact in the public health sector. Photo credit: Ncamsile Maseko & Lindani Sifundza.

Access Now’s guide lists eight data-protection principles that come largely from international standards, in particular the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (widely known as Convention 108) and the Organization for Economic Development (OECD) Privacy Guidelines and are considered to be “minimum standards” for the protection of fundamental rights by countries that have ratified international data protection frameworks. 

A development project that uses data, whether establishing a mailing list or analyzing datasets, should comply with laws on data protection. When there is no national legal framework, international principles, norms and standards can serve as a baseline to achieve the same level of protection of data and people. Compliance with these principles may seem burdensome, but implementing a few steps related to data protection from the beginning of the project will help to achieve the intended results without putting people at risk. 

common practices of civil society organizations relate to the terms and principles of the data protection framework of laws and norms

The figure above shows how common practices of civil society organizations relate to the terms and principles of the data protection framework of laws and norms.  

The European Union’s General Data Protection Regulation (GDPR)

The data-protection law in the EU, the GDPR, went into effect in 2018. It is often considered the world’s strongest data-protection law. The law aims to enhance how people can access their information and limits what organizations can do with personal data from EU citizens. Although coming from the EU, the GDPR can also apply to organizations that are based outside the region when EU citizens’ data are concerned. GDPR therefore has a global impact.

The obligations stemming from the GDPR and other data protection laws may have broad implications for civil society organizations. For information about the GDPR- compliance process and other resources, see the European Center for Not-for-Profit Law ‘s guide on data-protection standards for civil society organizations.

Notwithstanding its protections, the GDPR also has been used to harass CSOs and journalists. For example, a mining company used a provision of the GDPR to try to force Global Witness to disclose sources it used in an anti-mining campaign. Global Witness successfully resisted these attempts.

Personal or organizational protection tactics

How to protect your own sensitive information or the data of your organization will depend on your specific situation in terms of activities and legal environment. A first step is to assess your specific needs in terms of security and data protection. For example, which information could, in the wrong hands, have negative consequences for you and your organization 

Digitalsecurity specialists have developed online resources you can use to protect yourself. Examples are the Security Planner, an easy-to-use guide with expert-reviewed advice for staying safer online with recommendations on implementing basic online practices. The Digital Safety Manual offers information and practical tips on enhancing digital security for government officials working with civil society and Human Rights Defenders (HRDs). This manual offers 12 cards tailored to various common activities in the collaboration between governments (and other partners) and civil society organizations. The first card helps to assess the digital security

Digital Safety Manual

  1. Assessing Digital Security Needs
  2. Basic Device Security
  3. Passwords and Account Protection
  4. Connecting to the Internet Securely
  5. Secure Calls, Chat, and Email
  6. Security and Social Media Use
  7. Secure Data Storage and Deletion
  8. Secure File Transfer
  9. Secure Contract Handling
  10. Targeted Malware and Other Attacks
  11. Phone Tracking and Surveillance
  12. Security Concerns Related to In-Person Meetings

 

The Digital First Aid Kit is a free resource for rapid responders, digital security trainers, and tech-savvy activists to better protect themselves and the communities they support against the most common types of digital emergencies. Global digital safety responders and mentors can help with specific questions or mentorship, for example, The Digital Defenders Partnership and the Computer Incident Response Centre for Civil Society (CiviCERT) . 

Back to top

How is data protection relevant in civic space and for democracy?

Many initiatives that aim to strengthen civic space or improve democracy use digital technology. There is a widespread belief that the increasing volume of data and the tools to process them can be used for good. And indeed, integrating digital technology and the use of data in democracy, human rights and governance programming can have significant benefits; for example, they can connect communities around the globe, reach underserved populations better, and help mitigate inequality.

“Within social change work, there is usually a stark power asymmetry. From humanitarian work, to campaigning, documenting human rights violations to movement building, advocacy organisations are often led by – and work with – vulnerable or marginalised communities. We often approach social change work through a critical lens, prioritising how to mitigate power asymmetries. We believe we need to do the same thing when it comes to the data we work with – question it, understand its limitations, and learn from it in responsible ways.”

What is Responsible Data?

When quality information is available to the right people when they need it, the data are protected against misuse and the project is designed with protection of its users in mind, it can accelerate impact.

  • USAID’s funding of improved vineyard inspection using drones and GPS-data in Moldova, allowing farmers to quickly inspect, identify, and isolate vines infected by a ​phytoplasma disease of the vine. 
  • Círculo is a digital tool for female journalists in Mexico to help them create strong networks of support, strengthen their safety protocols and meet needs related to protection of themselves and their data. The tool was developed with the end-users through chat groups and in-person workshops to make sure everything built in the app was something they needed and could trust.

At the same time, data-driven development brings a new responsibility to prevent misuse of data, when designing,  implementing or monitoring development projects. When the use of personal data is a means to identify people who are eligible for humanitarian services, privacy and security concerns are very real.  

  • Refugee camps In Jordan have required community members to allow scans of their irises to purchase food and supplies and take out cash from ATMs. This practice has not integrated meaningful ways to ask for consent or allow people to opt-out. Additionally, the use and collection of highly sensitive personal data like biometrics to enable daily purchasing habits is disproportionate, because other less personal digital technologies are available and used in many parts of the world.  

Governments, international organizations, private actors can all – even unintentionally – misuse personal data for other purposes than intended, negatively affecting the wellbeing of the people related to that data. Some examples have been highlighted by Privacy International: 

  • The case of Tullow Oil, the largest oil and gas exploration and production company in Africa, shows how a private actor considered extensive and detailed research by a micro-targeting research company into the behaviors of local communities in order to get ‘cognitive and emotional strategies to influence and modify Turkana attitudes and behavior’ to the Tullow Oil’s advantage.
  • In Ghana, the Ministry of Health commissioned a large study on health practices and requirements in Ghana. This resulted in an order from the ruling political party to model future vote distribution within each constituency based on how respondents said they would vote, and a negative campaign trying to get opposition supporters not to vote.  

There are resources and experts available to help with this process. The Principles for Digital Development  website offers recommendations, tips and resources to protect privacy and security throughout a project lifecycle, such as the analysis and planning stage, for designing and developing projects and when deploying and implementing. Measurement and evaluation are also covered. The Responsible Data website offers the Illustrated Hand-Book of the Modern Development Specialist with attractive, understandable guidance through all steps of a data-driven development project: designing it, managing data, with specific information about collecting, understanding and sharing it, and closing a project. 

NGO worker prepares for data collection in Buru Maluku, Indonesia. When collecting new data, it’s important to design the process carefully and think through how it affects the individuals involved. Photo credit: Indah Rufiati/MDPI – Courtesy of USAID Oceans.

Back to top

Opportunities

Data protection measures further democracy, human rights and governance issues. Read below to learn how to more effectively and safely think about data protection in your work.

Privacy respected and people protected

Implementing dataprotection standards in development projects protects people against potential harm from abuse of their data. Abuse happens when an individual, company or government accesses personal data and uses them for purposes other than those for which the data were collected. Intelligence services and law enforcement authorities often have legal and technical means to enforce access to datasets and abuse the data. Individuals hired by governments can access datasets through hacking the security of software or clouds. This has often led to intimidation, silencing and arrests of human rights defenders and civil society leaders criticizing their government. Privacy International maps examples of governments and private actors abusing individuals’ data.  

Strong protective measures against data abuse ensure respect for the fundamental right to privacy of the people whose data are collected and used. Protective measures allow positive development such as improving official statistics, better service delivery, targeted early warning mechanisms and effective disaster response. 

It is important to determine how data are protected throughout the entire life cycle of a project. Individuals should also be ensured of protection after the project ends, either abruptly or as intended, when the project moves into a different phase or when it receives funding from different sources. Oxfam has developed a leaflet to help anyone handling, sharing or accessing program data to properly consider responsible data issues throughout the data lifecycle, from making a plan to disposing data. 

Back to top

Risks

The collection and use of data can also create risks in civil society programming. Read below on how to discern the possible dangers associated with collection and use of data in DRG work, as well as how to mitigate for unintended – and intended – consequences.

Unauthorized access to data

Data need to be stored somewhere. On a computer or an external drive, in a cloud or on a local server. Wherever the data are stored, precautions need to be taken to protect the data from unauthorized access and to avoid revealing the identities of vulnerable persons. The level of protection that is needed depends on the sensitivity of the data, i.e. to what extent it could have negative consequences if the information fell into the wrong hands.

Data can be stored on a nearby and well-protected server that is connected to drives with strong encryption and very limited access, which is a method to stay in control of the data you own. Cloud services offered by well-known tech companies often offer basic protection measures and wide access to the dataset for free versions. More advanced security features are available for paying customers, such as storage of data in certain jurisdictions with data- protection legislation. The guidelines on how to secure private data stored and accessed in the cloud help to understand various aspects of clouds and to decide about a specific situation.

Every system needs to be secured against cyberattacks and manipulation. One common challenge is finding a way to protect identities in the dataset, for example, by removing all information that could identify individuals from the data, i.e. anonymizing it. Proper anonymization is of key importance and harder than often assumed.

One can imagine that a dataset of GPS-locations of People Living with Albinism across Uganda requires strong protection. Persecution is based on the belief that certain body parts of people with albinism can transmit magical powers, or that they are presumed to be cursed and bring bad luck. A spatial-profiling project mapping the exact location of individuals belonging to a vulnerable group can improve outreach and delivery of support services to them. However, hacking of the database or other unlawful access to their personal data might put them at risk by people wanting to exploit or harm them.

One could also imagine that the people operating an alternative system to send out warning sirens for air strikes in Syria run the risk of being targeted by authorities. While data collection and sharing by this group aims to prevent death and injury, it diminishes the impact of air strikes by the Syrian authorities. The location data of the individuals running and contributing to the system needs to be protected against access or exposure.

Another risk is that private actors who run or cooperate in data-driven projects could be tempted to sell data if they are offered large sums of money. Such buyers could be advertising companies or politicians that aim to target commercial or political campaigns at specific people.

The Tiko system designed by social enterprise Triggerise rewards young people for positive health-seeking behaviors, such as visiting pharmacies and seeking information online. Among other things, the system gathers and stores sensitive personal and health information about young female subscribers who use the platform to seek guidance on contraceptives and safe abortions, and it tracks their visits to local clinics. If these data are not protected, governments that have criminalized abortion could potentially access and use that data to carry out law-enforcement actions against pregnant women and medical providers.

Unsafe collection of data

When you are planning to collect new data, it is important to carefully design the collection process and think through how it affects the individuals involved. It should be clear from the start what kind of data will be collected, for what purpose, and that the people involved agree with that purpose. For example, an effort to map people with disabilities in a specific city can improve services. However, the database should not expose these people to risks, such as attacks or stigmatization that can be targeted at specific homes. Also, establishing this database should answer to the needs of the people involved and not driven by the mere wish to use data. For further guidance, see the chapter Getting Data in the Hand-book of the Modern Development Specialist and the OHCHR Guidance to adopt a Human Rights Based Approach to Data, focused on collection and disaggregation. 

If data are collected in person by people recruited for this process, proper training is required. They need to be able to create a safe space to obtain informed consent from people whose data are being collected and know how to avoid bias during the data-collection process. 

Unknowns in existing datasets

Data-driven initiatives can either gather new data, for example, through a survey of students and teachers in a school, or use existing datasets from secondary sources, for example by using a government census or scraping social media sources. Data protection must also be considered when you plan to use existing datasets, such as images of the Earth for spatial mapping. You need to analyze what kind of data you want to use and whether it is necessary to use a specific dataset to reach your objective. For third-party datasets, it is important to gain insight into how the data that you want to use were obtained, whether the principles of data protection were met during the collection phase, who licensed the data and who funded the process. If you are not able to get this information, you must carefully consider whether to use the data or not. See the Hand-book of the Modern Development Specialist on working with existing data. 

Back to top

Questions

If you are trying to understand the implications of lacking data protection measures in your work environment, or are considering using data as part of your DRG programming, ask yourself these questions:

  1. Are data protection laws adopted in the country or countries concerned?
    Are these laws aligned with international human rights law, including provisions protecting the right to privacy?
  2. How will the use of data in your project comply with data protection and privacy standards?
  3. What kind of data do you plan to use? Are personal or other sensitive data involved?
  4. What could happen to the persons related to that data if the government accesses these data?
  5. What could happen if the data are sold to a private actor for other purposes than intended?
  6. What precaution and mitigation measures are taken to protect the data and the individuals related to the data?
  7. How is the data protected against manipulation and access and misuse by third parties?
  8. Do you have sufficient expertise integrated during the entire course of the project to make sure that data are handled well?
  9. If you plan to collect data, what is the purpose of the collection of data? Is data collection necessary to reach this purpose?
  10. How are collectors of personal data trained? How is informed consent generated when data are collected?
  11. If you are creating or using databases, how is anonymity of the individuals related to the data guaranteed?
  12. How is the data that you plan to use obtained and stored? Is the level of protection appropriate to the sensitivity of the data?
  13. Who has access to the data? What measures are taken to guarantee that data are accessed for the intended purpose?
  14. Which other entities – companies, partners – process, analyze, visualize and otherwise use the data in your project? What measures are taken by them to protect the data? Have agreements been made with them to avoid monetization or misuse?
  15. If you build a platform, how are the registered users of your platform protected?
  16. Is the database, the system to store data or the platform auditable to independent research?

Back to top

Case Studies

People Living with HIV Stigma Index and Implementation Brief

The People Living with HIV Stigma Index is a standardized questionnaire and sampling strategy to gather critical data on intersecting stigmas and discrimination affecting people living with HIV. It monitors HIV-related stigma and discrimination in various countries and provides evidence for advocacy in countries. The data in this project are the experiences of people living with HIV. The implementation brief provides insight in data protection measures. People living with HIV are at the center of the entire process, continuously linking the data that is collected about them to the people themselves, starting from research design, through implementation, to  using the findings for advocacy. Data are gathered through a peer-to-peer interview process, with people living with HIV from diverse backgrounds serving as trained interviewers. A standard  implementation  methodology has been developed, including the establishment if a steering committee with key  stakeholders and population groups. 

RNW Media’s Love Matters Program Data Protection

RNW Media’s Love Matters Program offers online platforms to foster discussion and information-sharing on love, sex and relationships to 18-30 year-olds in areas where information on sexual and reproductive health and rights (SRHR) is censored or taboo. RNW Media’s digital teams introduced creative approaches to data processing and analysis, Social Listening methodologies and Natural Language Processing techniques to make the platforms more inclusive, create targeted content and identify influencers and trending topics. Governments have imposed restrictions such as license fees or registrations for online influencers as a way of monitoring and blocking “undesirable” content, and RNW Media has invested in security of its platforms and literacy of the users to protect them from access to their sensitive personal information. Read more in the publication 33 Showcases – Digitalisation and Development – Inspiration from Dutch development cooperation’, Dutch Ministry of Foreign Affairs, 2019, p 12-14. 

The Indigenous Navigator

The Indigenous Navigator is a framework and set of tools for and by indigenous peoples to systematically monitor the level of recognition and implementation of their rights. The data in this project are experiences of indigenous communities and organizations and tools facilitate indigenous communities’ own generation of quality data. One objective of the navigator is that this quality data can be fed into existing human rights and sustainable development monitoring processes at local, national, regional and international levels. The project’s page about privacy shows data protection measures such as the requirement of community consent and how to obtain it and an explanation about how the Indigenous Navigator uses personal data.  

Girl Effect

Girl Effect, a creative non-profit working where girls are marginalized and vulnerable, uses media and mobile tech to empower girls. The organisation embraces digital tools and interventions and acknowledge that any organisation that uses data also has a responsibility to protect the people it talks to or connects online. Their ‘Digital safeguarding tips and guidance’ provides in-depth guidance on implementing data protection measures while working with vulnerable people. Referring to Girl Effect as inspiration, Oxfam has developed and implemented a Responsible Data Policy and shares many supporting resources online. The publication ‘Privacy and data security under GDPR for quantitative impact evaluation’ provides detailed considerations of the data protection measures Oxfam implements while doing quantitative impact evaluation through digital and paper-based surveys and interviews.  

The LAND (Land Administration for National Development) Partnership

The LAND (Land Administration for National Development) Partnership led by Kadaster International aims to design fast and affordable land administration to meet people’s needs. Through the processing and storage of geodata such as GPS, aerial photographs and satellite imagery (determining general boundaries instead of fixed boundaries), a digital spatial framework is established that enables affordable, real-time and participatory registration of land by its owners. Kadaster is aware of the sensitive nature of some of the data in the system that needs to be protected, in view of possible manipulation and privacy violation, and the need to train people in the digital processing of data. Read more in the publication 33 Showcases – Digitalisation and Development – Inspiration from Dutch development cooperation’, Dutch Ministry of Foreign Affairs, 2019, p. 25-26.

Back to top

References

Find below the works cited in this resource.

Additional Resources

Back to top

Categories

IoT & Sensors

What is the IoT and what are sensors?

The Internet of Things (IoT) refers to a network of objects connected over the internet. IoT-connected devices include everyday items such as phones, doorbells, cars, watches, and washing machines. The IoT links these devices for a range of tasks, processes and environments – from streetlights on a “smart” urban grid to refrigerators in a “smart home” and even to “smart” pacemakers inside human bodies, which belong to the category of so-called “wearable” smart technology. Once installed and connected, these devices can communicate to one another with reduced human involvement.

Scientific diver in Indonesia. Autonomous reef monitoring structure uses sensors to support conservation efforts. Photo credit: Christopher Meyer.

An integral component of the IoT are sensors, devices that detect and respond to changes in an environment from a variety of sources — such as light, temperature, motion and pressure. When placed on devices and linked to an IoT network, sensors can share data in real time with other connected devices and management systems.

It is important to note that the IoT is an evolving concept, continually expanding to include more devices and to increase the level of connection and communication between devices.

How does IoT work and how do sensors work?

IoT devices connect wirelessly to an internet network. They are provided with unique identifiers (UIDs) and have the ability to transmit data to one another over the network without human intervention. IoT systems may combine the use of wearable devices, sensors, robots, data analytics, artificial intelligence, and many other technologies.

Sensors generally work by taking an input — such as light, heat, pressure, motion or another other physical stimulus— and converting this into an output that can then be communicated to a human user through some kind of signal or interface (for example, the display on a digital thermometer or the noise of a fire alarm). The output could also be forwarded directly into a larger, extended system such as an industrial plant. Usually, devices will have multiple sensors: for example, a smart phone has a touchscreen, a camera, a GPS, and an accelerometer to measure acceleration.

Sensors can be “smart” or “non-smart,” meaning that they may connect to the Internet or not. Smart sensors accept an input from their surroundings and convert it into digital data using in-built computing capabilities. These data are then passed on for further processing. Take for example a “smart” irrigation system: an Internet-connected water meter might be used to continually measure the quantity and quality of the water in a reservoir. These data would be transmitted in real time to a water- management interface that a human could interpret to adjust the water delivery, or alternately, the irrigation system could be programmed to self-adjust without human intervention, shutting off automatically when the water is below a certain quality or quantity.

Smart sensors may be considered IoT devices themselves. The sensor in a mobile phone that automatically adjusts the brightness of its screen based on ambient lighting is an example of a smart sensor. Remote sensing involves the use of sensors in applications in which the sensing instrument does not make physical contact with the object or phenomenon being measured and recorded, for example, satellite imaging, radar, and aerial photography or videography by drones. The US National Aeronautics and Space Administration has a list of the types of sensors used in remote sensing instruments. This short video provides a basic introduction to the different types of sensors.

Back to top

How is the IoT and how are sensors relevant in civic space and for democracy?

The IoT has been harnessed for a range of civic, humanitarian and development purposes, for example, as part of smart cities infrastructure, urban traffic management and crowd-control systems, and for disaster risk reduction by remote-sensing environmental dangers. The city of London has been using the IoT and big data systems to improve public transportation systems. These systems handle unexpected delays and breakdowns, inform passengers directly regarding delays, create maps of common routes via anonymized data, offer personalized updates to travelers, and make it possible to identify areas for improvement or increased efficiency. Transportation via autonomous vehicles represents one of the domains where the IoT is anticipated to bring important advancements.

In the Boudry community, Burkina Faso, smartphones and GPS are connected to identify land parcel boundaries. Photo credit: Anne Girardin.

Many uses of the IoT are being explored in relation to health care and assistance. For instance, wearable  glucose monitors in the form of skin patches can continuously and automatically monitor the blood glucose levels of diabetic persons and administer insulin when required.

Device systems equipped with sensors are frequently used by researchers, development workers and community leaders for gathering and recording data on the environment— for example, air and soil quality, water quality and levels, radiation levels, and even the migration of animals.

Sensor datasets may also reveal new and unexpected information, enabling people to tell evidence-backed stories that serve the public interest.

Finally, the use of the IoT is also being explored in relation to human rights defenders. IoT systems equipped with sensors can be used to document human-rights violations and collect data about them. A bracelet developed by the Natalia Project automatically triggers an alert when forcibly removed or activated by the wearer. The bracelet uses GPS and mobile networks to send a pre-defined distress message, along with the location of the device and a timestamp, to volunteers present nearby and to the headquarters of Civil Rights Defenders, a Swedish NGO.

However, along with these exciting applications come serious concerns. Digital devices have inherent vulnerabilities, and linking devices to the Internet and to one another magnifies security threats. These concerns and other implications of a vast and pervasive network of data-collecting devices are explored in the Risks section.

Back to top

Opportunities

Biological investigators in Madidi, Bolivia, set up a camera to photograph jaguars using a sensor that detects body heat. Photo credit: Julie Larsen Maher, Wildlife Conservation Society

The IoT and sensors can have positive impacts when used to further democracy, human rights and governance issues. Read below to learn how to more effectively and safely think about IoT and sensors in your work.
Monitoring and Evaluation

IoT systems can facilitate the continuous monitoring of small and intricate details, transmitting these data to systems that can analyze and evaluate it in real time. This kind of monitoring has many implications for resource efficiency and sustainability. In Mongolia, inexpensive temperature sensors have been used in the monitoring and evaluation of a subsidy program that offered energy-efficient stoves for home heating. The stoves aimed to reduce air pollution and fuel expenditure. Information obtained from the sensors led to the conclusion that fuel efficiency had indeed been achieved even though the coal consumption of the surveyed households had remained constant. Other examples of sensor-enabled monitoring include the Riffle (Remote, Independent Field Friendly Logger Electronics), a set of open-source instrument designs that enables communities to collect data and monitor their water quality. The designs deploy different types of sensors for measuring parameters such as the temperature, depth, turbidity and conductivity of water. Riffle is a part of Public Lab’s Open Water Project.

Safety and security systems

IoT systems, when installed legally in private homes and workplaces, can provide security. Smart locks, video cameras and motion detectors can be used to alert to or prevent against possible intrusion, while smart smoke detectors and thermostats can alert to and react to fire, dangerous air quality, etc. “Smart homes” advertise these security benefits. For instance, a video doorbell can send an alert to your smartphone when motion is detected and record a video of who or what triggered it for later viewing. Smart locks allow you to lock and unlock your doors remotely, or to grant access to guests through an app or keypad. Of course, these home-security conveniences come with their own concerns. Amazon’s Ring home security system has been in the headlines multiple times after stories of hacking and vulnerabilities surfaced.

Early Warning Systems

IoT systems, when paired with data analytics and artificial intelligence, can help with early warnings about environmental or health risks, for example about the possibility of floods, earthquakes, or even spread of infectious diseases like Covid-19. The company Kinsa Health has been able to leverage data gathered from its Bluetooth-connected thermometers to produce daily maps of which US counties are seeing an increase in high fevers, thereby offering real-time indications of where the disease may be clustering. Sensor networks combined with data analytics can be used by governments and ecologists to detect environmental changes that may indicate an emerging threat — for instance a dangerous rise in water level or change in air quality — information which can be analyzed and shared rapidly to better understand, respond to, and alert others to the threat.

Autonomous Vehicles

By allowing vehicles to communicate with one another and with road infrastructure — like traffic lights, charging stations, roadside assistance, and even sensor-lined highway lanes — the IoT could improve the safety and efficiency of road transport. Autonomous vehicles have a long way to go (both in terms of the technology and safety and the legal frameworks necessary for proper functioning); but the IoT is making self-driving vehicles a possibility, bringing new opportunities for car sharing, urban transport, and service delivery.

Back to top

Risks

The use of IoT and sensors can also create risks in civil society programming. Read below on how to discern the possible risks associated with use of these technologies in DRG work.
Mass surveillance and stalking

IoT systems generate large amounts of data, which in the absence of adequate protections, may be used by governments, commercial entities, or other actors for mass surveillance. IoT systems collecting data from their environments may collect personal data about humans without their knowledge or consent, or process and combine these data in an invasive, nonconsensual manner. IoT systems — when coupled with monitoring capabilities, AI systems (for example, face recognition and emotion recognition) and big data analysis — present opportunities for mass surveillance and potentially for repressive purposes that harm human and civil rights.

Concerns about privacy, data protection and security

The United States Federal Trade Commission (FTC) identified three key challenges the IoT poses to consumer privacy (2015): ubiquitous data collection, potential for unexpected uses of consumer data, and heightened security risks. IoT systems generate immense amounts of data and create large datasets. Meanwhile, IoT applications, especially consumer applications, are known to have privacy and security vulnerabilities, the risks of which are magnified given the quantity and potentially sensitive nature of data involved. Seemingly harmless information, or information collected without the full awareness of the people involved, can bring serious threats. For example, a visualization of exercise routes of users published by a fitness tracker app exposed the location and staffing of US military bases and secret outposts inside and outside the country.

Commercial entities may use data obtained from IoT systems to influence the behavior of consumers, for example through targeted advertising. Indeed, sensors in stores are increasingly being used to leverage data about users based on their in-store shopping behavior.

See also the Data Protection, Big Data and Artificial Intelligence resources for additional information on privacy, data protection and security concerns.

Increased risk of cyberattacks

The hardware and software of IoT devices are known to be highly vulnerable to cyberattacks, and cybercriminals actively try to exploit these security vulnerabilities. Increasing the number of devices on an IoT network means increasing the surface area for cyberattack. Common devices such as Internet-connected printers, web cameras, network routers and television sets are used by cybercriminals for malicious purposes, such as executing coordinated distributed denial of service (DDoS) attacks against websites, distributing malware, and breaching the privacy of individuals. There have been numerous incidents of hackers gaining access to feeds from home security cameras and microphones, including from monitors that enable parents to keep an eye on their infant while they are away. These incidents have led to a demand to regulate entities that design, manufacture and deploy commercial IoT devices and systems.

Uncharted ethical concerns

The ever-increasing use of automation brings ethical questions and concerns that may not have been considered before the arrival of the technology itself. Here are just a few examples: Would smart devices in the home recognize voice commands given by people who speak different languages, dialects and in different accents? Would it be appropriate to collect voice recording data in these other dialects and accents— in a fully consensual and ethical way — in order to improve the quality of the device and its ability to serve more people?

Data obtained from IoT devices are also increasingly being used as digital evidence in courtrooms or for other law enforcement purposes, raising questions about the ethics and even the legality of such use, as well as about accuracy and appropriateness of such data as evidence.

Vendor lock-in, insufficient interoperability between networks, and the challenge of obtaining informed consent from data subjects must also be taken into account. See more about these risks in the Digital IDs and Data Protection resources.

Back to top

Questions

If you are trying to understand the implications of IoT and sensors in your work environment, or are considering using some aspects of IoT and related technologies as part of your DRG programming, ask yourself these questions:

  1. Are IoT-connected devices suitable tools for the problem you are trying to solve? What are the indicators or guiding factors that determine if the use of IoT or sensor technology is a suitable and required solution to a particular problem or challenge?
  2. What data will be collected, analyzed, shared, and stored? Who else will have access to this information? How are these data protected? How can you ensure that you collect the minimum amount of data needed?
  3. Are any personal or sensitive data being collected? How are you obtaining informed consent in this case? Is there the possibility that devices on your network will combine datasets that together create sensitive or personally identifying information?
  4. Are the technologies and networks you are using sufficiently interoperable for you to bring new technologies and even new providers into the network? Are they designed with open standards and portability in mind? Is there any risk of becoming locked into a particular technology provider?
  5. How are you addressing the risk of vulnerabilities or flaws in the software? How can you mitigate against these risks from the start? For instance, is it necessary for these devices to connect to the internet? Can they connect to a private intranet or a peer internet network instead?

Back to top

Case studies

Instructor pictured in Tanzania, where GPS-captured data can be used to map and assign land titles. Photo credit: Riaz Jahanpour for USAID / Digital Development Communications

IoT to enhance the process of fortifying flour with key nutrients

IoT to enhance the process of fortifying flour with key nutrients

Sanku (Project Healthy Children), an organization that aims to end malnutrition around the world, is equipping small flour mills across Africa with IoT technology to provide nutritious fortified flour to millions of people. Daily production data are sent in real time, via the cellular link, to a dashboard that allows the organization to monitor the mills’ performance. Data collected include flour produced, nutrients dispensed, people reached, and any technical issues with the machine performance. “The IoT is enabling us to completely automate our operations and how we run our business.… It’s no longer a struggle trying to determine which mills need to be visited, which dosifiers need maintenance, and when products need to be delivered to avoid stock-outs.”

The Guardian Project develops apps for human rights defenders
The Guardian Project’s Proof Mode is an open-source camera application for mobile devices designed for activists, human rights defenders and journalists. When a photo or video is shot using the device, the app gathers as much metadata as possible, such as a timestamp, the device’s identity and location from different sensors present in the device. The app also adds a publicly verifiable digital signature to the metadata file, all of which ultimately provides the user with secure and verifiable digital evidence.

Another app by the Guardian Project, Haven, uses the sensors present in a mobile device, such as the accelerometer, camera, microphone, proximity sensor and battery (power-on status) for monitoring changes to a phone’s surroundings. These changes are a) stored as images and sound files, b) registered in an event log that can be accessed remotely or anytime later, and c) used to trigger an alarm or to send secure notifications about intrusions or suspicious activity. The app developers explain that Haven is designed for journalists, human rights defenders, and people at risk of forced disappearance.

Temperature sensors to measure stove use behaviors in Ulaanbaatar
Temperature sensors to measure stove use behaviors in Ulaanbaatar

“…[I]n an impact evaluation of the [subsidy program]…, which aimed to reduce air pollution and decrease fuel expenditures through the subsidized distribution of more fuel-efficient heating stoves….[t]o gather unbiased and precise measurements of stove use behavior, small temperature sensors (stove use monitors or SUMs) were placed in a sub-set of surveyed households… The SUMs data on ambient temperature also indicated that homes with [subsidy program] stoves were kept warmer than those with traditional stoves, although the fuel used was the same on average. This suggests that households were utilizing fuel efficiency to increase home temperatures, whether knowingly or not. Ultimately, inexpensive temperature sensors were critical for collecting accurate outcome data on and explaining unexpected results.” 

Motion sensors to monitor hand-pump functionality in Rwanda, Case study 3
Motion sensors to monitor hand-pump functionality in Rwanda,  Case study 3

“In the featured pilot project in Rwanda, more than 200 censors were installed at water pumps, with data from each sensor transmitted wirelessly through the cellular network to a dashboard for the operations and maintenance team. The dashboard displays the real-time status of each pump equipped with a sensor. This enables operations and maintenance teams to employ an “ambulance” model, dispatching teams only to water points flagged for repair or check-up.”

Back to top

References

Find below the works cited in this resource.

Additional resources

Back to top

Categories

Smart Cities

What are smart cities?

While there is no single definition of a smart city, smart cities typically use a variety of digital technologies and data to improve the efficiency of city service delivery, enhance quality of life and increase equity and prosperity for residents and businesses.

“Smart” often includes technologies that rely on citizen surveillance by government; but from democratic- governance and human-rights perspectives, surveillance is the opposite of “smart”.

How do smart cities work?

Solar power lights an evening market in Msimba, Tanzania. Smart cities monitor and integrate their infrastructure to optimize resource use. Photo credit: Jake Lyell.
Solar power lights an evening market in Msimba, Tanzania. Smart cities monitor and integrate their infrastructure to optimize resource use. Photo credit: Jake Lyell.

Smart cities aim to monitor and integrate their infrastructure — roads, bridges, tunnels, rails, subways, airports, seaports, communications, water, power, major buildings, sometimes even private residences —  to optimize resource use, to conduct maintenance, and to monitor safety. At the same time, smart cities aim to improve the quality of life for their citizens by improving quality of services, access to services, the livability of the city, and civic participation.

The term smart city does not refer to any single kind of technology, but rather a variety of technologies used together. There is no official checklist for what technological features a city needs to be considered “smart”. But a smart city requires urban planning: generally, a growth strategy is managed by city governments with significant contribution from the private sector, which provides technology services.

Data is at the heart of the smart city
Smart cities generally rely on data-driven technologies and decision making. This usually means gathering and analyzing data to address issues like traffic, air pollution, waste management, water leakages and security. Often, smart sensors are installed across the city and connected to a grid, and data from these sensors are collected and analyzed. The Internet of Things , an expanding network of devices connected to one another through the internet, can allow all of these smart devices to communicate to one another: for instance, a smart phone may connect to an electronic bike through the internet. Advancements in data analytics and algorithmic decision-making can help city governments implement a circular economy, cutting down on waste, monitoring emissions, reducing energy use.

Data shared by citizens with their city governments is also a way of giving feedback to improve services and strengthen the relationship between citizens and government. Responsible digitization and data use can create a better relationship between citizens and governments — for example, a government can make their budget and spending visible online to the public. However, the use of sensitive personal data and the invasive use of surveillance technology can alienate citizens and reduce trust — for example, surveillance cameras that track citizens during their daily activities to monitor their behavior. For a city to be truly “smart”, people need to understand and agree to what is happening with their data. Smart cities also require a detailed and rights-respecting data management strategy in advance so that everyone knows what data is being collected, that citizens agree to sharing these data, how data are processed and used, and why these data will be useful.

All Smart Cities are different
Cities are extremely diverse, and so every city will have different needs for how it can become “smart,” depending on its location, its citizens, and its priorities. Some smart cities are built on the existing infrastructure of cities, like Nairobi, overlaying ICTs on existing infrastructure, while others some smart cities are built “from scratch,” like Konza City, Kenya’s “Silicon Valley.” Many elements of smart city development are not necessarily digital, such as improvements in housing, walkability, parks, the preservation of wildlife, etc. Some smart cities focus on technology, digitization, and growth as the end goal, though this is not ultimately “smart” for citizens. Others focus on inclusive governance and sustainability. China has the most “smart cities” (or “safe cities” they are often called in China) of any country or continent in the world, followed by Europe. But these Chinese urban projects are surveillance-focused and are very different from smart cities that are focused on civic participation, inclusion, and sustainability.

Smart cities in developing countries face fundamentally different challenges than smart cities in countries without the same legal, regulatory, or socioeconomic challenges.

Drivers for Smart City Development in Developing Countries
  • Financing capacity of the government
  • Regulatory environment that citizens and investors trust and investors
  • Technology and infrastructure readiness
  • Human capital
  • Stability in economic development
  • Active citizen engagement and participation
  • Knowledge transfer and participation from the private sector
  • Ecosystem that promotes innovation and learning

Barriers to Smart City Development in Developing Countries

  • Budget constraints and financing issues
  • Lack of investment in basic infrastructure
  • Lack of technology-related infrastructure readiness
  • Fragmented authority
  • Lack of governance frameworks and regulatory safeguards for smart cities
  • Lack of skilled human capital
  • Lack of inclusivity
  • Environmental concerns
  • Lack of citizen participation
  • Technology illiteracy and knowledge deficit among the citizens

Children playing at Limonade plaza, Haiti. Improving the quality of life for citizens is at the heart of smart city projects. Photo credit: Kendra Helmer/USAID.
Children playing at Limonade plaza, Haiti. Improving the quality of life for citizens is at the heart of smart city projects. Photo credit: Kendra Helmer/USAID.

The process of developing a truly smart city – one that is smart for its citizens – takes time and careful planning. Smart city planning can take several years, and then the city infrastructure itself should be updated gradually, over time and as political will, civic engagement demand and private-sector interests converge. Smart city projects can only be successful when the city has cared for the basic needs of residents, and when basic infrastructure and legal protections for residents are in place. For instance, if technology will be collecting data about citizens, the city must have a data-protection law to protect citizens’ personal data from misuse. The infrastructure needed for smart cities is very expensive and requires routine, ongoing maintenance and review, and many skilled professionals. Many smart city projects have become graveyards of sensors because these sensors were not well maintained, or because the data gathered were not ultimately valuable for the government and citizens.

Common Elements of a Smart City

Below is an overview of technologies and practices common to smart cities, though by no means exhaustive or universal.

Open Wi-Fi: Affordable and reliable Internet connectivity is essential for including citizens throughout a smart city. Some smart cities provide free access to high-speed Internet through city-wide, wireless infrastructure. Free Wi-Fi can encourage residents to use public places, be used for emergency services to aid rescue workers, and can facilitate data collection, since smart cities that use sensors to collect data remotely control these sensors through wireless networks.

Internet of Things (IoT) : The Internet of Things is an expanding network of physical devices connected through the internet. From cars and motorbikes to refrigerators to heating systems, these devices communicate with users, developers, applications and one another by collecting, exchanging, and processing data. For example, smart water meters can collect information to better understand problems like water leaks or water waste. The IoT is largely facilitated by the rise of smart phones that allow people easily to connect to one another and to devices.

5G : Smart city services need internet with high speeds and large bandwidth to handle the amount of data generated by the IoT and to process these data in real time. 5G is a new internet infrastructure with increased connectivity and computing capacity that facilitates many of the internet-related processes needed for smart cities.

Smart Grids: Smart Grids are energy networks that use sensors to collect data in real time about energy usage and requirements of infrastructure and of citizens. Beyond controlling utilities, smart grids monitor power, distribute broadband to improve connectivity, and control processes like traffic. Smart grids rely on a collection of power- system operators and involve a wide network of parties: vendors, suppliers, contractors, distributed generation operators, and consumers.

Intelligent Transport Systems (ITS): Like Smart Grids, various transportation mechanisms can be coordinated to reduce energy usage, decrease traffic congestion, and decrease travel times. Intelligent Transport Systems monitor traffic, manage congestion, provide public information, optimize parking, integrate traffic-light management, provide for emergency response, etc. ITS also focuses on “last mile delivery”, or optimizing the final step of the delivery process. Often autonomous vehicles are associated with smart cities, but ITS goes far beyond individual vehicles.

Surveillance: As with connected objects, data about residents can be transmitted, aggregated, and analyzed. In some cases, existing CCTV cameras can be paired with advanced video-analytics software and linked to the IoT to manage traffic and public safety. Solutions for fixed-video-surveillance infrastructure account for the vast majority of the global market of smart city surveillance, but mobile-surveillance solutions are also growing fast. There are many kinds of surveillance—for instance, surveillance of objects versus surveillance of people, and then surveillance that actually identifies the identities of people. This last kind of surveillance is a hotly debated topic with significant ramifications for civil society and DRG actors and in many places is illegal.

Digital IDs and Services Delivery : Digital-identification services can link citizens to their city, from opening a bank account to accessing health services to proving their age. Digital IDs centralize all information and transaction history. This brings some conveniences but also security concerns. Techniques like minimal disclosure (also known as the data minimization principle, this means asking for and relying on as little of a user’s data as possible) and decentralized technologies like ‘Self Sovereign Identity (SSI)’ (which avoid data being controlled in a central registry) can help separate identity, transaction and device.

E-government: Electronic government—the use of technology to provide government services to the public—aims to improve service delivery and quality, to enhance citizen involvement and engagement, and to build trust. Making more information available to citizens is another element of e-government, for instance making government budgets public. Mobile smartphone service is another strategy, as mobile technology combined with an e-government platform can offer citizens access to services remotely without having to go to municipal offices.

Chief Technology Officer: Some smart cities have a Chief Technology Officer (CTO) or Chief Information Officer (CIO), who leads the city’s efforts to develop creative and effective technology solutions and who collaborates with residents and elected officials. The CTO studies the community, learns the needs of the citizens, plans and executes related initiatives, and oversees implementation and continued improvements.

Interoperability: The many different services and tools used in the smart city should be interoperable, which means they should be able to function together, to communicate with each other, and to share data. This requires dialogue and careful planning between business suppliers and city governments. Interoperability means that the new infrastructure must be able to function on top of the city’s existing infrastructure. (for example, combining new “smart” LED lighting on top of existing city streetlight systems.)

“A smart city is a process of continuous improvements in city operation methods. Not a big bang.”

Smart city project leader in Bordeaux, France

Back to top

How are smart cities relevant in civic space and for democracy?

Smart cities raise difficult questions for democratic governance and civic participation. Technology must be overlaid on a functional democratic foundation, with transparency, legal safeguards, and citizen participation.

Streetlights in Makassar, Indonesia. Smart cities have the potential to reach carbon reduction and renewable energy goals and improve economic efficiency and power distribution. Photo credit: USAID.
Streetlights in Makassar, Indonesia. Smart cities have the potential to reach carbon reduction and renewable energy goals and improve economic efficiency and power distribution. Photo credit: USAID.

The multinational company IBM originally coined the term “smart city” in 2009. Smart cities were at first a business opportunity for private-sector actors looking to sell their technology to governments, particularly after the 2008 economic downturn reduced their market opportunities. Even today, “smart city” is not an academic term as much as it is a marketing term. The fact that smart cities are promoted by the private sector raises significant concerns for civic and human rights, democracy, and even for government authority and national sovereignty.

Often smart city technologies are purchased from outside one’s own country: China, followed by South Korea and Singapore, have sold considerable smart city products to countries in Africa. China’s sale of smart city technology is framed as part of the country’s Belt & Road Initiative (BRI), an ambitious plan to connect Asia with Africa and Europe through trade and economic growth. China is also investing heavily in Latin America.

Smart city technologies are interconnected so that they can function together: for example, connecting LED streetlights with sensors to the city’s energy grid. All parts must be compatible, and so groups of technologies are often sold by companies as a package. Chinese companies, for example, are developing comprehensive smart city technology packages so that they can supply everything a city government would need.

Nairobi Business Commercial District, Kenya. Some smart cities, like Nairobi, are built on the existing infrastructure of cities. Photo credit: USAID East Africa Trade and Investment Hub.
Nairobi Business Commercial District, Kenya. Some smart cities, like Nairobi, are built on the existing infrastructure of cities. Photo credit: USAID East Africa Trade and Investment Hub.

Smart city technology, then, is at best a double-edged sword: potentially improving civic participation and democracy on the one hand, and potentially imposing government surveillance on the other. For example, the country with the most smart city projects, China, also has the largest surveillance system in the world. The project, known as “Skynet,” involves 300 million connected cameras. The data-collection capacities of these cameras are enhanced with advancements in artificial intelligence, data analysis, and facial recognition. To support these surveillance technologies, China is developing its own global satellite system, an alternative to GPS, called BeiDou. When linked to 5G internet infrastructure, this satellite system will be able to access the geolocations of all mobile phones on Chinese 5G networks.

Surveillance technology, in addition to being potentially being used in repressive and undemocratic ways, is also often faulty. Indeed, technology is not perfect, and in fact, the more complex and interconnected it is, and the more data it collects, the higher the risk that something will not function as planned, or that it will be vulnerable to attacks. Other risks of smart city technology are explored below, related to cybersecurity, inequality, marginalization, and freedom of expression.

Smart cities raise difficult questions for democratic governance and civic participation

When planning a democratic, inclusive, and sustainable city, it is essential to know what information will be gathered and how it will be used. Will the smart city help citizens access government services online, or access safe Wi-Fi, healthcare, and educational opportunities? As in Estonia (described below), will citizens be able to vote from their homes, to ensure full participation in democratic elections? Or will citizens be tracked without their knowledge or consent, or discouraged from meeting in groups or with certain friends or relatives?

Surveillance can be a barrier to human rights like freedom of assembly, even for people who have “nothing to hide.” Imagine your cousin is wrongfully on a government blacklist, accused of being in a gang. Would you want the government to know you went to her house? Surveillance reduces citizens’ trust in the government, and could make citizens less likely to access services or to participate in civic and social activities.

As more and more devices are connected, where will the line be drawn between convenience and risk? Perhaps an e-payment app that allows you to purchase groceries is convenient. But should the data on that app then be sent to insurance companies, who would then know everything you eat and adjust the price of your insurance in response?

Smart cities raise difficult questions for democratic governance and civic participation. Technology must be overlaid on a functional democratic foundation, with transparency, legal safeguards, and citizen participation. Having data collected by government about citizens is not the same thing as information citizens choose to share about themselves. For example, a facial recognition camera on a train that claims to read someone’s emotions is likely less accurate compared to that person sharing openly how she feels.

It is important that citizens participate actively in the formation and functioning of the smart city. As with any technology, citizens must be empowered to participate in all municipal processes, and there must be ways for them to give meaningful input and feedback. Education and training programs are necessary, so that citizens understand and master the technology surrounding them: the technology should be at their service, not the other way around.

Legal infrastructure is critical to defend against discrimination and abuse through technology. In addition to privacy and data-protection regulations , due-process systems must be in place. Technology suppliers and governments must uphold high standards of transparency and must be accountable for the effects of their technology. Smart cities brand themselves as “inclusive”, but smart city technology is often criticized for benefitting the elite and for failing to address the needs and rights of society’s most vulnerable: women, children, migrants, minorities, persons with disabilities, persons operating in the informal economy, those will lower levels of literacy and digital literacy, low-income groups and other disadvantaged communities. In particular, smart city infrastructure can disproportionately harm the poor. In India, where the government has pledged to construct  100 smart cities between 2015 and 2020, government entities have often evicted people from their homes to do so. Along with protective legal frameworks, human-rights standards and indicators are needed to monitor the implementation of smart city developments, to ensure they benefit the whole of society and do not harm vulnerable communities. The “Triple Test” is a good starting point for civil society and governments to determine if smart city technology will harm citizens more than it benefits them: First, is the technology appropriate for the objective (does it actually achieve the goal)? Second, is it necessary (does it not exceed what is required, is there no other way of achieving the goal)? Third, is it proportionate (the burdens and problems it brings do not outweigh the benefit of the result)?

Back to top

Opportunities

Smart Cities can have a number of positive impacts when usedto further democracy, human rights and governance issues. Read below to learn how to more effectively and safely think about smart cities in your work.
Environmental Sustainability

According to the OECD, modern cities use almost two-thirds of the world’s energy, produce up to 80% of global greenhouse-gas emissions, and create 50% of global waste. Smart cities have the potential to reach carbon reduction and renewable energy goals, and improve economic efficiency and power distribution, among other sustainability goals. Smart cities can relate directly to Sustainable Development Goal 11 on sustainable cities and communities. Smart cities are often linked to circular economic practices: these include “up-cycling” (creative reuse of waste products), the harvesting of rainwater for reuse, and even the reuse of open public data (see below). Urban areas are ideal environments for reconfiguring the flow of building materials, food, water, and electronic waste. In addition, smart city technologies can be leveraged to help prevent the loss of biodiversity and natural habitat.

Disaster Preparedness

Smart cities can help achieve disaster-risk-reduction and resilience goals: preparedness, mitigation, response, and recovery from natural disasters. Data collection and analysis can be applied to monitoring environmental threats, and remote sensors can map hazards. For example, open data and artificial intelligence can be used to identify which areas are most likely to be hardest hit by earthquakes. Early warning systems, social media alert systems, GIS and mobile systems can also contribute to disaster management. A major issue during natural disasters is a loss of communication: interconnected systems can share information about what areas need assistance or replenishment when individual communication channels go down.

Social Inclusion

Smart cities can facilitate social inclusion in important ways: through fast, secure internet access, improvements in access to government and social services, avenues for citizen input and participation, improvements in transportation and urban mobility, etc. For example, smart cities can establish a network of urban access points where residents can access digital-skills training; digitization of health services can improve healthcare opportunities and help patients connect to their medical records, etc. Cities may even be able to improve services for more vulnerable groups by drawing responsibly from more sensitive datasets to improve their understanding of these citizens’ needs — though this data must be given with full consent, and robust privacy and security safeguards must be in place.  Smart city technologies can also be used to preserve cultural heritage.

Knowledge Sharing and Open Information

An open approach to data captured by smart technologies can bring government, businesses and civil society closer together. Public or open data — unlike sensitive, private data — are data that anyone can access, use and share. An open-access approach to data means allowing the public to access these kinds of public, reusable data to leverage the benefits for themselves and for social or environmental benefit. This open approach can also provide transparency and reinforce accountability — for example by showing the use of public funds — improving trust between citizens and government. In addition to open data, the design of software behind smart city infrastructure can be shared with the public through open-source design and open standards. Open source refers to technology whose source code is freely available publicly, so that anyone can review it, replicate it, modify it, extend it. Open standards are guidelines that help ensure that technology is designed to be open source in the first place. 

Citizen Participation

Smart cities can encourage citizens to participate more actively in their communities and their governance, by facilitating volunteering and community-engagement opportunities and by soliciting feedback on the quality of services and infrastructure. Sometimes referred to as “e-participation,” digital tools can reduce the barriers between citizens and decision making, facilitating their involvement in the development of laws and standards, in the choice of urban initiatives, etc. The United Nations identifies three steps in e-participation: E-information, E-consultation, and E-decision-making. 

Back to top

Risks

The use of emerging technologies can also create risks in civil society programming. Read below on how to discern the possible dangers associated with Smart Cities in DRG work, as well as how to mitigate for unintended – and intended – consequences.

Surveillance and Forced-Participation

As noted above, smart cities often rely on some level of citizen surveillance, which has many flaws. Surveillance can be marketed in positive ways, for example, in the Toronto Waterfront project Quayside (the project was abandoned in May of 2020). The company installing the smart city infrastructure in Toronto, a subsidiary of Google, promised to make street lights better for elderly people by ensuring that traffic stopped for as long as it took the elderly person to cross the street. This might sound positive; but to do this, the city must be watching the elderly person approach, track their movements with a camera and store that data somewhere. Perhaps this data is anonymous, stored locally by the city and not shared with any outside actors who might want to sell this person a product knowing that they are in the neighborhood; but it could be accessed by nefarious actors, who might wish to follow this person.

Even if this surveillance is truly 100% anonymous (extremely difficult, perhaps impossible), the question remains: did this person consent to the surveillance? In many countries, consent by individuals is required before information may legally be collected about them. This consent must be informed consent: the individual must understand what information is being collected and for what purpose. It is already complicated to give informed consent when browsing on the web — most people click “Yes” to access a webpage, even though advertisers may then collect data about them and adjust prices or services based on this data. Obtaining informed consent is even more complicated when surveillance is happening in a city. Do city residents consent to be watched when they are crossing the street? Will their behavior change? Certainly, one might say, we consent to being watched when we are shopping, and we know that a CCTV camera is making sure we don’t shoplift. But in most democratic societies, there are restrictions on how this security footage is used: only when necessary, by police authorities after a crime. It is not supposed to be shared with advertisers, companies, insurance providers, job recruiters and future employers, etc.

Discrimination is sometimes made easier because of smart city surveillance. Smart city infrastructure can provide law enforcement and security agencies with the ability to track and target certain groups, for instance, ethnic or racial minorities. This happens in democratic societies as well as non-democratic ones. A 2011 study showed that CCTV cameras in the UK disproportionately targeted people with certain features through a strategy of “preemptive” policing. Predictive policing is the use of data analytics to guess the potential locations of future crime and to respond by increasing surveillance in “high-risk” areas, usually neighborhoods inhabited by lower income and minority communities.

Unethical Data Handling and Freedom of Expression

As cities aggregate and process data about residents, expectations of privacy in people’s daily lives break down. Specific concerns about data protection and personal rights to privacy break down too. For example, smartphones increase data collection by sharing geo-location data and other metadata with other applications, which can in turn share data with other service providers, often without users’ knowledge and consent. As the city becomes more digitally connected, this data sharing increases. Much data may seem harmless, for instance data about your car and your driving practices. But when paired with other data it can become more sensitive, revealing information about your health and habits, your family and networks, the composition of your household, your religious practices, etc.

Personal information is valuable to companies, and many companies test their technology in countries with the fewest data restrictions. In the hands of private companies, these data can be exploited to target advertising to you, to calibrate your insurance costs, etc.  There are also risks when data are collected by third parties and, particularly, by foreign companies. Companies may lock you into their services, may not be open about security flaws, may have less data protection, or may have-data sharing agreements with other governments. Governments also stand to benefit from access to intimate data about their citizens: “[P]ersonal information collected as part of a health survey could be repurposed for a client that is, say, a political party desperate to win an election.” According to Bright Simmons, Ghanaian social innovator and entrepreneur, “the battle for data protection and digital rights is the new fight for civil rights in the continent.” For more on this topic, see Privacy International’s reporting: “2020 is a crucial year to fight for data protection in Africa: Africa is a testing ground for technologies produced elsewhere: as a result, personal data of its people are increasingly stored in hundreds of databases.”

Worsening Inequality and Marginalization

In many cases, smartphones and apps become the keys to the smart city. But increased reliance on smartphone applications to access services and to participate in city life can reduce access and participation for many inhabitants. In 2019 global smartphone penetration reached 41.5%, and while this number will surely grow, smartphone ownership and use reveals important equity divides. Other questions must also be asked. Can all residents use these apps easily? Are they comfortable doing so? Residents with low literacy and numeracy skills, or who do not speak the language used by an application, will have further difficulty connecting through these interfaces. The reliance on apps also alienates the unhoused populations in a city, who, even if they have smart devices, may not be able to charge their devices regularly, or may be at higher risk of their devices being stolen.

The term digital divide refers to the uneven distribution in the access to and familiarity with high-quality and secure technology. People with limited internet access, limited digital training, and visual or hearing impairments as well as society’s generally increasing reliance on digital technology could worsen the digital divide. Smart cities are often criticized as being designed for the elite and the already digitally connected. In this way, smart cities could speed up gentrification and displace, for example, the unhoused. For example, a smart city program that asks residents to alert the municipality about potholes on their street  through an app is catering  to people with smartphones, who know how to use the app and who have the time to participate in this initiative. As a likely result, more potholes will be identified and attended to in wealthier neighborhoods.

The use of surveillance in smart cities can also be used to repress minority groups. Much has been reported on government surveillance in Xinjiang, the Northern province where China’s Uyghur Muslim population lives. This surveillance is in part made possible through a phone app.

“It aggregates data – from people’s blood type and height, to information about their electricity usage and package deliveries – and alerts authorities when it deems someone or something suspicious. It is part of the Integrated Joint Operations Platform (IJOP), the main system for mass surveillance in Xinjiang.”As described by Human Rights Watch

Data Despotism and Automation Failures

Smart cities have been accused of “Data Despotism”. If city governments can access so much data about their citizens, then what is the use of speaking with them? Because of potential algorithmic discrimination, flaws in data analysis or interpretation, or inefficiencies between technology and humans, an overreliance on digital technology can harm society’s most vulnerable—intentionally or unintentionally without hearing their voices.

Much literature, too, is available on the “digital welfare state”. Philip Alston, the UN rapporteur on extreme poverty, reports that new digital technologies are changing relationships between governments and those most in need of social protection: “Crucial decisions to go digital have been taken by government ministers without consultation, or even by departmental officials without any significant policy discussions taking place.”

When basic human services are automated and human operators are taken out of the transaction, glitches in the software and tiny flaws in eligibility systems can be dangerous and even fatal. In India, where many welfare and social services have been automated, a 50-year old man died of malnutrition because of the failure of his biometric thumbprint identifier. “Decisions about you are made by a centralised server, and you don’t even know what has gone wrong…People don’t know why [welfare support] has stopped and they don’t know who to go to to fix the problem,” explains Reetika Khera, an associate professor of economics at the Indian Institute of Management Ahmedabad.

These automated processes also create new opportunities for corruption. Benefits like pensions and wages linked to India’s digital ID system (called Aadhaar) are often delayed or fail to arrive completely. When a 70-year-old woman found that her pension was being sent to another person’s bank account, the government told her to resolve the situation by speaking to that person.

Worsening Displacement

Smart city projects, like other urban projects, can displace residents by building over neighborhoods and pushing people out of their homes. In India the movement towards smart cities has meant that many have been evicted from slums and informal settlements without offering them adequate compensation or alternate housing. An estimated 60%–80% of the world’s forcibly displaced population lives in urban areas, not in camps as many would think. And among people living in developing cities, one billion people live in “slum” areas—defined by the UN as areas without access to improved water, sanitation, security, durable housing, and sufficient living area. This number is expected to double to 2 billion by 2030. In other words, urban areas are home to large populations of society’s most vulnerable. Smart cities may seem like an ideal solution for expanding populations, but they also risk building over these vulnerable groups.  The smart city emphasis on urban centers also neglects the needs of populations living in rural areas.

Refugees, internally displaced persons and migrants are inherently vulnerable, and these groups may not benefit from the same legal rights and protections as residents. Because of the sensitive nature of their data and because of their limited access to other basic resources, these most vulnerable populations in cities will likely experience the worst, most invasive elements of smart city technology.

The United Kingdom, like many countries, has digitized services for asylum seekers. Through partnerships with private companies, the ASPEN card gives asylum seekers access to products and services while they are awaiting a decision on their applications. However, this card also tracks their whereabouts and penalizes them for leaving their “authorized” cities. Tracking data about refugees and internally displaced persons can also be dangerous in the hands of actors with bad intentions. For example, the UNHCR collected sensitive biometric data about the Rohingya people fleeing persecution, data which was largely collected without informed consent and is not in sufficiently secure storage.

“Corporatization”: Dominance of the Private Sector

Smart cities present an enormous market opportunity for the private sector — one study estimates the smart city market will be worth $2.75 trillion by 2023, sparking fears of the “corporatization of city governance.” Large IT, telecommunication and energy-management companies such as Huawei, Alibaba, Tencent, Baidu, Cisco, Google, Schneider Electric, IBM and Microsoft are the driving forces behind many initiatives for smart cities. As Sara Degli-Esposti, an Honorary Research Fellow at Coventry University, explains: “We can’t understand smart cities without talking of digital giants’ business models… These corporations are already global entities that largely escape governmental oversight. What level of control do local governments expect to exercise over these players?”

The important role thereby afforded international private companies in municipal governance raises sovereignty concerns for governments, along with the privacy concerns for citizens cited above. In addition, reliance on private- sector software and systems can create a condition of business lock-in (when it becomes too expensive to switch to another business supplier). Business lock-in can get worse over time: as more services are added to a network, the cost of moving to a new system becomes prohibitive.

The city of Yachay, Ecuador, can serve a cautionary tale of a smart city project that was far too reliant on private companies, in particular private companies based outside the country. The “Ciudad del Conocemiento” (city of knowledge) as it was called, in Yachay, was conceived of as the first technology park in Ecuador, a science and technology hub like Silicon Valley. The project was largely supported by Chinese investment: it was partially funded in 2016 through a $198.2 million loan from China Export-Import bank, following investments from Chinese companies. Today in 2020, the city is still a construction site: half of the land dedicated to the project has been abandoned; the water and sewage infrastructure was not completed in time for the next stages of construction; and there are no basic services available. Some of the anticipated investment was never even received. The project is an example of the smart city package: with investment, city infrastructure, and supporting technology infrastructure all provided by Chinese companies. (The new government is examining the project for corruption).

Yachay is just one example of many Chinese-financed smart city projects around the world and in Latin America. Even in Ecuador, Yachay is one among multiple projects in the country that are financed by Chinese corporations. In 2011, the company China National Electronics Import and Export Corporation (CEIEC) was contracted to construct the national emergency response system, ECU-911. Marketed as a public emergency response system, in reality it was modeled on the Chinese government surveillance systems.2

Security Risks

Connecting devices through a smart grid or through the Internet of Things brings serious security vulnerabilities for individuals and infrastructure. Connected networks have more points of vulnerability and are susceptible to hacking, and anything connected to the Internet can be susceptible to cyberattacks. As smart systems share more data,  often private data about users (think about health records, for example), this raises risks that unauthorized actors can breach individual privacy. Public, open Wi-Fi is much less secure than private networks, so this convenience also comes with a cost. IoT has been widely criticized for its lack of security, in part because of its novelty and lack of regulation. Connected devices are generally manufactured to be inexpensive and accessible, without cybersecurity as the primary concern.

The more closely infrastructure is linked, the faster and more sweeping an attack can be. Digitally-linked infrastructure like smart grids increases cybersecurity risks due to the increased number of operators and third parties connected to the grid, and this multiplies supply-chain risk-management considerations. According to Anjos Nijk, Director of the European Network for Cyber Security: “With the current speed of digitisation of the grid systems.. and the speed of connecting new systems and technologies to the grids, such as smart metering, electrical vehicle charging and IoT, grid systems become vulnerable and the ‘attack surface’ expands rapidly.” Damaging one part of a large interconnected system can lead to a cascade effect,  infecting other systems as well. This can lead to a large-scale blackout, or the disabling of critical infrastructure like health or transportation systems. Energy grids can be brought down by hackers, as experienced in the December 2015 Ukraine power grid cyberattack. Smart city grids offer cyber threat actors an unprecedented attack surface.

Back to top

Questions

If you are trying to understand the implications of smart cities in your work environment, or are considering using aspects of Smart Cities as part of your DRG programming, ask yourself these questions:

  1. Does the service in question need to be digital or connected to the internet? Will digitization improve this service for citizens, and does this improvement outweigh the risks?
  2. Are programs in place to ensure that citizens’ basic needs are being met (access to food, safety, housing, livelihood, education) and to allow for humans to reach their full potential, outside of any smart-city technology?
  3. What external actors have control or access to critical aspects of the tool or infrastructure this project will rely on, and what cybersecurity measures are in place?
  4. Who will build and maintain infrastructure and data? Is there a risk of being locked into certain technologies or agreements with service providers?
  5. Who has access to collected data and how are the data being interpreted, used, and stored? What external actors have access? Are data available for safe, legal re-use by the public? How are open data being re-used or shared publicly?
  6. How will smart city services respect citizens’ privacy? How will residents’ consent be obtained when they participate in services that capture data about them? How will they be able to opt out of sharing this information? How will the government respect specific data protection regulations like the EU GDPR? What other legal protections are in place around data protection and privacy?
  7. Are the smart services transparent and accountable? Do researchers and civil society have access to the “behind the scenes” functioning of these services? (data, code, APIs, algorithms, etc.)
  8. What measures are in place to address biases in these services? How will this service be certain not to further socioeconomic barriers and existing inequalities? What programs and measures are in place to improve inclusion?
  9. How will these developments respect and preserve historical sites and neighborhoods?  How will changes adapt to local cultural identities?

Back to top

Case Studies

Rio de Janeiro, Brazil
The city of Rio partnered with the corporation IBM to build two large data-operation centers before its hosting of the 2014 World Cup and the 2016 Olympic games: the “Operations Center” and the “Integrated Center of Command and Control (CICC)”. These two data centers cost the city a combined $40 million. The goal was allegedly to help with environmental-disaster preparedness given the city’s geography. Rio was devastated by mudslides in 2010, and much of the city is at risk of landslides, particularly the favelas, which are home to the city’s poorer residents. However, the reality, as detailed by researchers Christopher Gaffney and Cerianne Robertson in 2016, was a system for city-wide monitoring to stop urban protests. The Guardian described the project as “the world’s most ambitious integrated urban command centre”. The CICC (or COR as it is also known) is essentially a monitoring center where different police units and municipal services can communicate and coordinate. The center receives all emergency calls and organizes the city’s security operations, including the controversial “pacification program” in the city’s favelas. The chief executive of the center admitted that the CICC’s activities had evolved after nationwide protests in 2012. In the words of one researcher, “COR plays a key role in positioning the mayor as somebody who’s in control of his city…Rio has historically been very unruly, very difficult to command – and now there’s a central operations centre that’s connected to not just social media but Globo TV and local radio stations. And they’re constantly reporting not from the mayor’s office, but from COR, very often with the mayor there, giving the public this impression that the city’s being managed; that Paes is in action, everyday, through the COR. Ofcourse, this is being contested, because if you talk to anyone they’ll tell you the city is a mess.”

For further reading, CityLab, Will Rio Be a ‘Smarter’ City After the Olympic Games?

Dharmshala, India
In 2015, India released a $7.5 billion plan to construct 100 cities by 2020 with high-speed internet, uninterrupted power and water supplies, efficient public transportation and high living standards. Not only has this plan not achieved its goals (as of March 2020, 54% of the completed projects are concentrated in only four Indian states and 34 cities have not had one a single completed project), but it does not address the needs of the most marginalized, including the poor, women, minorities, and migrants. The plan fails to provide them with basic services. It has even evicted thousands from their homes without providing them sufficient compensation or other accommodation. In the plans for the city of Dharmshala, the proposal says it will provide 212 houses for slum dwellers; however, 300 houses were demolished in the construction. The demolition of settlements in Dharmshala is just one example of many of this pattern of evictions and displacements. The citizens, and even the municipal government, were not given a voice in the project. The mayor revealed to a civil society group that she was unable to intervene — the private sector and a centralized government entity had so much control over the project. For further reading: India’s Smart Cities Mission: Smart for Whom? City for Whom?
Barcelona, Spain
Barcelona is often referred to as a best practice smart city because of its strongly democratic, citizen-driven design. The smart city infrastructure is built on three components: Sentilo, an open-source data-collection and sensor platform; CityOS, an open-source platform that processes and analyses the data; and a set of user-interface services apps that enable citizen access to the data. Open-source design mitigates the risk of business lock-in and allows citizens to maintain collective ownership of their data and how they are processed. The city has also focused on implementing e-democracy initiatives and improving the digital literacy of its citizens. In the words of Francesca Bria, Barcelona’s Chief Technology and Digital Innovation Officer: “We are reversing the smart city paradigm…Instead of starting from technology and extracting all the data we can before thinking about how to use it, we started aligning the tech agenda with the agenda of the city.” However, Barcelona’s smart city projects have not all been successful: many initiatives have been abandoned and left unused sensors across the city. One city analyst has described these as “graveyards of smart junk”.

Further Reading: Josep-Ramon Ferrer. Barcelona’s Smart City vision: an opportunity for transformation (2017)

Amsterdam, The Netherlands
Amsterdam is touted as a best practice smart city, in particular for its sustainability achievements. The city has recently revealed its aim to transition to a completely circular economy— based on the Doughnut economic model developed by environmental economist Kate Raworth—by 2050, through the reuse of raw materials to avoid waste and reduce Co2 emissions. It is also developing a monitoring tool to follow the use of raw materials and the initiatives that contribute most to their circular economy goals.. Amsterdam’s Smart City initiative has eight categories: smart mobility, smart living, smart society, smart areas, smart economy, big and open data, infrastructure, and living labs. There is also a strong emphasis on citizen innovation: the winners of a 2013 design contest are now key players in Amsterdam’s smart city efforts.
Tallinn, Estonia
Estonia is one of the most highly digitized countries in the world and a leader in cybersecurity, largely by necessity. In April of 2007, Estonia was hit by major cyber-attacks that took down critical parts of their infrastructure — banks, news outlets and government services. These attacks were later attributed to Russia and followed Estonia’s decision to move a Soviet World War II memorial from downtown Tallinn, the capital. Following these attacks, Estonia established technical as well as legal and internationally cooperative cybersecurity measures that brought attention to the small country from around the world. The Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence (CCD COE) was set up in 2008 to advance research and development in cyber defense and initiated the Tallinn Manual process, contributing to international norms in the field. Tallinn has a large number of digitized services and initiatives, and has prioritized Wi-Fi access (the No Citizen Left Behind program provides Public Internet Access Points) and interoperability (interoperability is crucial for allowing cross-usage of data by national and city databases). Meanwhile citizen data is secured and stored using strategies of encryption and decentralization technologies. Estonia is the first country to have a data embassy: government data are stored in the country of Luxembourg—under Estonian state control—where they are safe in case of crisis; and the data embassy is capable of providing data backups and of operating essential services.

Toronto, Canada
In 2017, Sidewalk Labs, a subsidiary of Alphabet (Google’s parent company) won a bid from the city of Toronto to develop the city’s Eastern Waterfront of 800 acres. Sidewalk Toronto sought to be a model for future cities around the world. However the project’s chief privacy expert, Dr Ann Cavoukian, resigned from her role over data privacy issues she found embedded in the project, writing in her resignation letter: “I imagined us creating a Smart City of Privacy, as opposed to a Smart City of Surveillance.” Sidewalk Labs’ head of data governance proposed that the data collected be controlled and held by an independent civic data trust and that all parties accessing data must file a publicly available Responsible Data Impact Assessment; but this approach was still criticized by many, and serious concerns remained about the disproportionate role played by a private company in the development of the city. In May 2020, the controversial project was officially called off, after years of investment and controversy.

Songdo City, South Korea
Many countries plan to build smart cities “from scratch,” often as satellite urban areas outside of existing cities. The utopian ambition is that these cities will attract foreign investment, skilled international workers, and tourists, and that such projects can also be experiments in governance and urban living. The problem with these model cities is that they sometimes end up as ghost towns. Songdo City, a satellite of Seoul, South Korea, is often cited as the quintessential smart city dystopia. A “ghetto for the affluent,” the city has not attracted the vibrant community that planners expected. Among other noted disincentives, extensive surveillance cameras constantly observe residents and create an alienating atmosphere.

Masdar City, United Arab Emirates
The project of building Masdar City in the United Arab Emirates began in 2006 and was promised to be an “ecotopia” and center for science and technology. The city was constructed as a satellite of the capital Abu Dhabi.  It was planned to host 1,500 green-energy businesses and a workforce of 110,000 people, and to be the first carbon-neutral city in the world. However it has failed to attract the residents it hoped would come. It has become a much more modest project: a cluster of clean technology and renewable energy businesses and a research institute. The renewable-energy goals have not been reached, and most other elements of the ecological city have been abandoned.

Further Listening: Gökçe Günel Ottoman History Podcast, Status Quo Utopias in the UAE. (2019)

Nice, France
For many years, Nice, France, has been experimenting with security surveillance technology. In 2008, the mayor was awarded the ironic “Big Brother Award” after his decision to install a pervasive video-surveillance system across the city.  By 2010, the city had installed 1,000 cameras in an effort to make France’s fifth-largest city into a “laboratory” for the fight against crime, an experiment that other French cities could learn from. Nice is now the most video-monitored city in France, with 1,962 cameras, or 27 per square kilometer. The city has leveraged facial recognition technology, installing it at a high school and deploying it at the annual celebration Carnival, as well as at the gates at its major airports. In the outline of the “Safe City Experimentation Project” launched in June of 2018, to be deployed by the private transportation company Thales, the company stated its aims to create a “Waze of Security… developing new analysis and correlation algorithms to better understand a situation and develop predictive capacities.” The experimentation project contact from 2018 is available here. In 2019, the city tried to install “emotion detection” on local trams. The tram project was to employ software leveraging “happiness algorithms” to detect emotions like stress in passengers, but it was ultimately aborted. The city has partnered with a private security company to develop a smartphone app to encourage citizens to report crime, which was eventually blocked by the French data-protection authority. Nice thus exemplifies the city-wide use of surveillance tech and predictive policing techniques, but it also exemplifies a city with successful data-protection safeguards and a strong civil society response.

For further reading, visit the website Technopolice, a project designed to raise awareness about the spread of “safe city” projects across France.

Back to top

References

Find below the works cited in this resource.

Additional Resources

 

Back to top

Categories

Digital Development in the time of COVID-19