Hundreds of Millions in U.S. Data Surveillance Tools, with Few Safeguards, in Taliban Hands

The United States and its allies spent hundreds of millions of dollars towards building data surveillance tools for the Afghan people, but left the databases with few data-protection safeguards, and they have now apparently fallen into Taliban hands.

With the Taliban's swift takeover of the Afghan government, information including biometrics for verifying identities are now at their disposal, raising concerns the Taliban will use it for social control and punishing perceived foes.

Since the Taliban's takeover of Kabul on August 15, there are indications that the government data may have been used to identify and intimidate Afghans who worked with the U.S. A 27-year-old U.S. contractor in Kabul told the Associated Press that he and co-workers who developed a U.S. funded database have received phone calls summoning them to the Defense Ministry.

"It is a terrible irony," said Frank Pasquale, Brooklyn Law School scholar of surveillance technologies. "It's a real object lesson in 'The road to hell is paved with good intentions.'"

For more reporting from the Associated Press, see below.

In victory, the Taliban's leaders say they are not interested in retribution. Restoring international aid and getting foreign-held assets unfrozen are a priority. There are few signs of the draconian restrictions – especially on women – they imposed when they ruled from 1996 to 2001. There are also no indications that Afghans who worked with Americans have been systematically persecuted.

The Taliban are on notice that the world will be watching how they wield the data.

Uncertain for the moment is the fate of one of the most sensitive databases, the one used to pay soldiers and police.

The Afghan Personnel and Pay System has data on more than 700,000 security forces members dating back 40 years, said a senior security official from the fallen government. Its more than 40 data fields include birth dates, phone numbers, fathers' and grandfathers' names, fingerprints and iris and face scans, said two Afghan contractors who worked on it, speaking on condition of anonymity for fear of retribution.

Only authorized users can access that system, so if the Taliban can't find one, they can be expected to try to hack it, said the former official, who asked not to be identified for fear of the safety of relatives in Kabul. He expected Pakistan's ISI intelligence service, long the Taliban's patron, to render technical assistance. U.S. analysts expect Chinese, Russian and Iranian intelligence also to offer such services.

Originally conceived to fight payroll fraud, that system was supposed to interface eventually with a powerful database at the Defense and Interior ministries modeled on one the Pentagon created in 2004 to achieve "identity dominance" by collecting fingerprints and iris and face scans in combat areas.

But the homegrown Afghanistan Automated Biometric Identification Database grew from a tool to vet army and police recruits for loyalty to contain 8.5 million records, including on government foes and the civilian population. When Kabul fell it was being upgraded, along with a similar database in Iraq, under a $75 million contract signed in 2018.

U.S. officials say it was secured before the Taliban could access it.

Among crucial databases that remained are the Afghanistan Financial Management Information System, which held extensive details on foreign contractors, and an Economy Ministry database that compiled all international development and aid agency funding sources, the former security official said.

Then there is the data — with iris scans and fingerprints for about 9 million Afghans — controlled by the National Statistics and Information Agency. A biometric scan has been required in recent years to obtain a passport or a driver's license and to take a civil service or university entrance exam.

Western aid organizations led by the World Bank, one of the funders, praised the data's utility for empowering women, especially in registering land ownership and obtaining bank loans. The agency was working to create electronic national IDs, known as e-Tazkira, in an unfinished project somewhat modeled on India's biometrically enabled Aadhaar national ID.

"That's the treasure chest," said a Western election assistance official, speaking on condition of anonymity so as not to jeopardize future missions.

Yet another database the Taliban inherit contains iris and face scans and fingerprints on 420,000 government employees — another anti-fraud measure — which Nadery oversaw as civil service commissioner. It was eventually to have been merged with the e-Tazkira database, he said.

On August 3, a government website touted the digital accomplishments of President Ashraf Ghani, who would soon flee into exile, saying biometric information on "all civil servants, from every corner of the country" would allow them to them to be linked "under one umbrella" with banks and cellphone carriers for electronic payment. U.N. agencies have also collected biometrics on Afghans for food distribution and refugee tracking.

"ISI (Pakistani intelligence) would be interested to know who worked for the Americans," said John Woodward, a Boston University professor and former CIA officer who pioneered the Pentagon's biometric collection.