ID4D Country Diagnostic: Nigeria © 2016 International Bank for Reconstitution and Development/The World Bank 1818 H Street, NW, Washington, D.C., 20433 Telephone: 202-473-1000; Internet: www.worldbank.org Some Rights Reserved This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Nothing herein shall constitute or be considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, or of any participating organization to which such privileges and immunities may apply, all of which are specifically reserved. Rights and Permission This work is available under the Creative Commons Attribution 3.0 IGO license (CC BY 3.0 IGO) http:// creativecommons.org/licenses/by/3.0/igo. Under the Creative Commons Attribution license, you are free to copy, distribute, transmit, and adapt this work, including for commercial purposes, under the following conditions: Attribution—Please cite the work as follows: World Bank. 2016. ID4D Country Diagnostic: Nigeria, Washington, DC: World Bank License: Creative Commons Attribution 3.0 IGO (CC BY 3.0 IGO) Translations—If you create a translation of this work, please add the following disclaimer along with the attribution: This translation was not created by The World Bank and should not be considered an official World Bank translation. The World Bank shall not be liable for any content or error in this translation. Adaptations—If you create an adaptation of this work, please add the following disclaimer along with the attribution: This is an adaptation of an original work by The World Bank. Views and opinions expressed in the adaptation are the sole responsibility of the author or authors of the adaptation and are not endorsed by The World Bank. Third Party Content—The World Bank does not necessarily own each component of the content contained within the work. The World Bank therefore does not warrant that the use of any third-party-owned individual component or part contained in the work will not infringe on the rights of those third parties. The risk of claims resulting from such infringement rests solely with you. If you wish to re-use a component of the work, it is your responsibility to determine whether permission is needed for that re-use and to obtain permission from the copyright owner. Examples of components can include, but are not limited to, tables, figures, or images. All queries on rights and licenses should be addressed to World Bank Publications, The World Bank, 1818 H Street, NW, Washington, DC, 20433; USA; email: pubrights@worldbank.org. Cover photos: Top left by Daniel Silva; top right by World Bank; bottom by Arne Hoel/World Bank. Contents About ID4D.............................................................................................................................................................. iv Acknowledgments.................................................................................................................................................... v Abbreviations .......................................................................................................................................................... vi Executive summary ..............................................................................................................................................viii  1. Introduction.........................................................................................................................................................1 1.1 Scope of the study .....................................................................................................................................................................................2 1.2 Limitations of the study ..........................................................................................................................................................................3  2. The role of identity ...........................................................................................................................................4 2.1 Accelerating development .....................................................................................................................................................................4 2.2 A cross-sectoral platform .....................................................................................................................................................................5 2.3 Foundational and functional identities ............................................................................................................................................6 2.4 Building blocks of national identity ..................................................................................................................................................6  3. Enabling environment ......................................................................................................................................8 3.1 Background .................................................................................................................................................................................................8 3.2 Policy landscape .......................................................................................................................................................................................9 3.3 NIMC act ....................................................................................................................................................................................................10 3.4 Additional acts ......................................................................................................................................................................................... 11 3.5 Security and privacy ............................................................................................................................................................................. 12 3.6 Technology infrastructure ................................................................................................................................................................... 14  4. Civil registration ............................................................................................................................................. 16 4.1 Legal mandate .......................................................................................................................................................................................... 16 4.2 Current state ............................................................................................................................................................................................ 16 4.3 Linkage with national identity............................................................................................................................................................ 17  5. Foundational identity: National identity registry ...................................................................................... 18 5.1 Mission ......................................................................................................................................................................................................... 18 5.2 Governance ............................................................................................................................................................................................... 18 5.3 Organization ............................................................................................................................................................................................ 19 5.4 Products and services .......................................................................................................................................................................... 19 5.5 Enrolment .................................................................................................................................................................................................20 5.6 Technology systems ............................................................................................................................................................................. 23 5.7 Authentication and verification ....................................................................................................................................................... 24 5.8 Current status ......................................................................................................................................................................................... 24 C onte nts i  6. Functional identities.......................................................................................................................................25 6.1 Voter registry............................................................................................................................................................................................ 25 6.2 Census registry........................................................................................................................................................................................ 26 6.3 Driver registry.......................................................................................................................................................................................... 27 6.4 Mobile phone subscriber registry.................................................................................................................................................... 28 6.5 Banker registry........................................................................................................................................................................................ 29 6.6 Pension registry .....................................................................................................................................................................................30 6.7 Social registry of the poor .................................................................................................................................................................. 31 6.8 Farmer registry ...................................................................................................................................................................................... 32 6.9 Challenge of parallel identities ........................................................................................................................................................ 32  7. Fiscal impact .................................................................................................................................................. 34 7.1 Methodology ............................................................................................................................................................................................ 34 7.2 Assumptions ............................................................................................................................................................................................ 35 7.3 Analysis ..................................................................................................................................................................................................... 35  8. Harmonization of identity registries ............................................................................................................37 8.1 Current approach ................................................................................................................................................................................... 37 8.2 Current status ......................................................................................................................................................................................... 38 8.3 Considerations for harmonization .................................................................................................................................................. 39 8.4 Models of harmonization ................................................................................................................................................................... 39  9. International experiences ............................................................................................................................. 43 9.1 India’s Aadhaar program ..................................................................................................................................................................... 43 9.2 Pakistan’s NADRA program ..............................................................................................................................................................46 10. Lessons learned .............................................................................................................................................. 51 11. Considerations for a roadmap ......................................................................................................................53 Figures Figure 1: Functional ID Programs Consulted .........................................................................................................................................2 Figure 2: Service Delivery Using National ID Registry........................................................................................................................5 Figure 3: Building Blocks of Identity Programs.....................................................................................................................................7 Figure 4: Mandate of NIMC ........................................................................................................................................................................10 Figure 5: NIN at a Glance ............................................................................................................................................................................. 11 Figure 6: Mobile and Broadband in Nigeria.......................................................................................................................................... 15 Figure 7: NIMC Card Design.......................................................................................................................................................................20 Figure 8: Process of Enrolment.................................................................................................................................................................20 Figure 9: Harmonization Approach of NIMC....................................................................................................................................... 38 Figure 10: Loosely Coupled Model...........................................................................................................................................................40 Figure 11: Tightly Coupled Model............................................................................................................................................................... 41 Figure 12: Single Warehouse Model.......................................................................................................................................................... 41 Figure 13: Aadhaar—A Digital Identity...................................................................................................................................................44 ii ID4 D C o u nt ry D i ag no s t ic : Ni geri a Figure 14: UID Enrolment Ecosystem in India...................................................................................................................................... 45 Figure 15: UIDAI’s Authentication Ecosystem...................................................................................................................................... 45 Figure 16: Aadhaar Based Technology Platforms..............................................................................................................................46 Figure 17: NADRA at a Glance................................................................................................................................................................... 47 Figure 18: NADRA Enrolment Infrastructure........................................................................................................................................ 48 Figure 19: Types of ID Cards Issued by NADRA.................................................................................................................................49 C onte nts iii About ID4D The World Bank Group’s Identification for Development (ID4D) initiative uses global knowledge and expertise across sectors to help countries realize the transformational potential of digital identification systems to achieve the Sustainable Development Goals. It operates across the World Bank Group with global practices and units working on digital development, social protection, health, financial inclusion, governance, gender, and legal, among others. The mission of ID4D is to enable all people to access services and exercise their rights, by increasing the number of people who have an official form of identification. ID4D makes this happen through its three pillars of work: thought leadership and analytics to generate evidence and fill knowledge gaps; global platforms and convening to amplify good practices, collaborate, and raise awareness; and country and regional engagement to provide financial and technical assistance for the implementation of robust, inclusive, and responsible digital identification systems that are integrated with civil registration. The work of ID4D is made possible with support from World Bank Group, Bill & Melinda Gates Foundation, and Omidyar Network. To find out more about ID4D, visit worldbank.org/id4d. iv ID4 D C o u nt ry D i ag no s t ic : Ni geri a Acknowledgments This report was prepared in 2015 by Zaid Safdar and the Digital Development Team of the World Bank. It benefited greatly from the inputs and reviews of the World Bank Group staff and the government officials of Nigeria. The team is grateful to each of the individual professionals who met with us, and the valuable information they provided during the diagnostic. Ac k now l e d g m e nts v Abbreviations BDCS Business Development and Commercial Services BVN Banking Verification Number CBN Central Bank of Nigeria CNIC Computerized National Identity Card (Pakistan) DNCR Department of National Civil Registration eKYC Electronic Know Your Customer ESNI Enterprise Services and Network Infrastructure FCT Federal Capital Territory FMARD Federal Ministry of Agricultural & Rural Development FRSC Federal Road Safety Commission G2P Government to Person GMIC General Multi-Purpose Identity Card HCM Human Capital Management ICAO International Civil Aviation Organization ICT Information and Communication Technology INEC Independent National Election Commission IT/IDD Information Technology and Identity Database MDG Millennium Development Goals NADRA National Database and Registration Authority (Pakistan) NBC National Broadcasting Commission NCA Nigerian Communications Act NCC National Communication Commission NEEDS National Economic Empowerment Development Strategy NHIS National Health Insurance Scheme NIDB National Identity Database NIMC National Identity Management Commission NIMS National Identity Management System NIN National Identification Number vi ID4 D C o u nt ry D i ag no s t ic : Ni geri a NIS Nigeria Immigration Services NPopC National Population Commission NSA National Security Adviser NSSNP National Social Safety Net Program NTP National Telecommunications Policy PENCOM National Pensions Commission PFA Pension Funds Administrator PMO Project Management Office SNIC Smart National ID Card (Pakistan) UIDAI Unique Identification Authority of India (UIDAI) UN United Nations A bbr e v i ati ons vii Executive summary Nigeria has long known the importance of identification, though it has wrestled with developing a robust identity program. In 1978, the Department of National Civil Registration (DNCR) was set up within the Federal Ministry of Interior (FMI). DNCR was tasked with issuing national identity cards. The program lasted 18 months. In 2001, DNCR contracted a private partner to enrol people, and issue national identity cards, at a fiscal cost of US$236.8 million. The program ran for five years, issued national identity cards to 37.3 million people, and was shelved. The system developed was not re-used. In 2007, the government passed a law, the National Identity Management Commission (NIMC) Act, and set up NIMC as the government agency responsible for identification in Nigeria. NIMC continues to operate today. Identity is a public good, and is necessary for modern development. In order for a government or a firm to offer services to people, it needs to know who is who. Without a reliable way of proving one’s identity, exercising basic rights, claiming entitlements, accessing a range of government services, and conducting many daily activities can be hampered. The advent of new technologies, including mobile phone, internet, social media, and digital applications, requires an electronic or digital form of identity. Digital identity serves as a “cross sector platform,” offering a unique identity for use across sectors. Identity comes in two varieties: foundational, or a national identity; and functional, or a use-specific identity. A foundational identity explains “who you are,” and a functional identity explains “whether you are eligible for a specific service.” Accelerating development Digital identity can be instrumental in hastening the pace of progress in Nigeria. The program can help improve delivery of safety net services to the poor, advance financial inclusion, support agriculture development, and strengthen electoral voting. In India, for example, the use of digital identity, as part of the country’s Aadhaar program, supported financial inclusion by helping 125 million people complete know- your-customer processes and open bank accounts in a short time span of 12 months. The program also helped improve social service delivery, by initiating direct benefits transfers for social sector schemes to Aadhaar-linked bank accounts of beneficiaries. These applications showcase the transformative potential of identity in improving the efficiency and effectiveness of service delivery, strengthening governance, and supporting private sector development. A fragmented identity landscape Nigeria operates a fragmented identity landscape. About 13 or more identity programs are run by different government agencies. Most identity systems are not interlinked. Most identity programs are geared towards issuing an identity card. Citizens thus have to carry multiple identity cards, for different uses. No single identity registry has reached full scale. As the lead government agency, NIMC offers a foundation identity. Since being established in 2007, NIMC issued the first unique national identification number (NIN) in February 2012. It offered the first national electronic identity card in August 2014. To date, NIMC has registered 6.1 million people, out of 173.6 million population, or 3.5% of the population. NIMC has issued 418,000 national identity cards. Thus punctuated by a time lag, NIMC has faced early hurdles. It took over operations from the previous DNCR, downsized organization, upgraded technology systems, and tried and stopped partnerships with two private firms. viii ID4 D C o u nt ry D i ag no s t ic : Ni geri a Functional identities in Nigeria have grown since before 2007. A voter registry, operated by the Independent National Election Commission (INEC), is the largest functional registry, with 69 million entries. A banker registry, partly operated by the Central Bank of Nigeria (CBN), is a newer one, and has 6.75 million entries. New registries, covering health insurance beneficiaries, and the poor and vulnerable, are expected to be developed. Civil registry is being automated. Currently, 38–42% of births are registered in Nigeria. The government has worked to link civil registration with the national identity registry, in order to improve the integrity of information in both systems, though further work is required. A supportive enabling environment The policy and legal environment for identification is positive. The NIMC Act was passed in 2007 for the setup of NIMC as the lead government agency. Several additional Acts support the development of civil registry and voter registry, amongst others. With the growth of digital applications and electronic data, legal safeguards are necessary for privacy and security of information. Draft bills are being reviewed by the country’s Parliament. The reliability and availability of electric power and high-speed internet are two additional challenges for digital identity in Nigeria, and cause high annual operating costs. Fiscal burden The duplication of work due to parallel identity registries in Nigeria creates significant inefficiencies. First, government agencies duplicate biometric enrolment, to uniquely identify each individual. Second, government agencies duplicate fiscal spending. Third, without a modern, integrated identity ecosystem, delivery and management of services, both public and private, are affected. Finally, citizens and residents are inconvenienced to face multiple biometric enrolments, and carry multiple identity cards. An illustrative fiscal analysis can show the enormity of fiscal impact due to the inefficiency in the identity ecosystem of Nigeria. The analysis uses a given methodology and assumptions, including a projected unit cost of US$5.0 per person for identity lifecycle, since actual financial data on identity systems in Nigeria is not readily available. Based on the analysis, the total fiscal impact of identity programs in Nigeria is US$4.3 billion, of which US$1.2 billion are spent, and another US$3.1 billion will need to be spent, following current trajectory. International experience International experience puts a lower threshold on the unit cost of identity per person. The unit cost is an important measure to benchmark the efficiency of an identity program, whether foundational or functional. In India, the government has spent US$2.0 per person for a lifetime of national identity. At this rate, the government is spending US$2.5 billion to set up a national identity system to serve 1.25 billion people. The program is already showing results. Launched 4.5 years ago, India’s program has completed 840 million enrolments, or roughly 67% of the population. Scale-up, integration, and low costs A rapid scale-up of national identity, integration of parallel identity systems, and low cost of identity programs are key challenges for the identity ecosystem of Nigeria. Executi v e s u m mary ix To obtain full benefits from digital identity, the federal government needs to rapidly scale up its national identity program. The objective should be to have an electronic registry with 173.6 million people, covering the total population, on a fast timetable. NIMC will need to scale up enrolments at a rapid pace in order to realize this objective. Integration of identity systems is necessary. Though a Harmonization Committee was conceived in 2006 and had spearheaded the NIMC Act in 2007, harmonization remains unrealized. In fact, the number of parallel identity systems has grown. A prerequisite for integration is a critical volume of entries in the national identity registry, and an online identity verification facility. Both of these are works in progress. The government may consider a simplified approach to integration, improving speed of execution, and allowing government agencies to serve their beneficiary populations with a unique ID. Lowering the cost of each identity program, both foundational and functional, will help make digital identity a reality in Nigeria. The government has attempted forging partnerships for its national identity program, but has faced challenges. Given the magnitude of task of developing digital identity in Nigeria, partnerships may be necessary for rapid scale-up, integration, and low cost, and may benefit from past experiences. Future roadmap The government may consider further sharpening its vision for identification in Nigeria, keeping in view objectives of rapid scale up, integration, and low cost of development. The vision would prompt strengthening the enabling environment, with conducive policy and laws, including for information security and privacy, and with an upgrade of technology and systems to scale up digital identity. Capacity building of key institutions, including NIMC, with an updated business model, public-private partnerships, and expedited enrolments would be important. A tactical look at harmonization, with a view on linking key user agencies, and with civil registration, would help foster a holistic ecosystem. Based on a refined vision, an updated policy and legal environment, and an optimized business model of identification, the government should prioritize mobilizing sufficient resources to fund identification in Nigeria. Funding may be sourced from fiscal budget, donors, or private sector partnerships. Digital identity can be a game-changer for Nigeria’s economic, social, and political development, and in helping deliver social benefits to the poor. A focused approach to driving the identity agenda of Nigeria will help trigger enormous benefits, and help improve management and delivery of services. x ID4 D C o u nt ry D i ag no s t ic : Ni geri a 1. Introduction In Nigeria, at present, several government agencies issue an identity credential to residents for specific uses. National Identity Management Commission (NIMC) leads the identity agenda of Nigeria, and offers a “foundational identity” or an “official identity.” Over the years, several government agencies have rolled out their own “functional identity” programs. Currently, there is little or no interoperability across these identity systems. The degree and nature of technology used in these identity systems varies. Currently, no identity system has fully reached scale to serve the masses in Nigeria. Since gaining independence in 1960, Nigeria has recognized the need to create a central system of national identity management for citizens and legal residents. In 1978, Nigeria created the Department of National Civic Registration (DNCR), within the Federal Ministry of Interior (FMI), as the organization responsible for civil registration, and made its first attempt to issue a national identity card to its citizens.1 Later, in 2001, DNCR launched a renewed effort to create a national identity database, and contracted a consortium led by a private firm. The Federal Government of Nigeria paid roughly $236.8 million for registering 52.6 million people, out of a planned 60 million, and issuing identity cards to 37.3 million Nigerian citizens.2 The project was later shelved in 2006, and involved allegations of impropriety over the award of the bid to the firm.3 In 2005, with an objective of revitalising the Nigerian economy, the Government of Nigeria embarked on a package of economic reforms, as encapsulated by the National Economic Empowerment Development Strategy (NEEDS).4 As part of this effort, the Government wanted to develop a national policy and regulatory framework on consumer credit aimed at enhancing access to consumer credit for Nigerians. Absence of a universal identity management system and verification process was seen to lead to distorted growth and underdevelopment of the consumer credit market in Nigeria. The federal government recognized the need to create a national identity program, incorporating lessons from past attempts of DNCR, and following leading practices of national identity programs in other countries. With an aim to create a comprehensive identity system, Nigeria constituted “The Committee on the Harmonisation of National Identity Cards” to create a national policy and institutional framework for an identity management system in Nigeria. As per the recommendation of the Committee, and subsequent enactment of a law, the government established NIMC as the agency responsible for developing a National Identity Management System (NIMS). NIMC was set up in 2007, based on NIMC Act No. 23 of 2007, with several functions: (a) create, own, operate, maintain and manage the national identity database (or registry); (b) register citizens and legal residents; (c) assign a unique national identification number (NIN) per enrolled person, based on a biometric check of uniqueness; (d) issue a national identity (smart) card to each registered individual; (e) provide an identity verification and authentication service infrastructure; and (f) harmonize and integrate existing identification databases in Nigeria. In essence, NIMC’s mandate is to create a national identity management system that enables secure, reliable and authentic verification of an individual’s identity anywhere in the country, and facilitates service delivery in government and the private sector. Since 2007, at the same time, functional ID programs recognized the need for a unique identity for their functional identity databases due to the presence of duplicates and fakes in their registries. Ideally, the desired uniqueness could be achieved by linking with a national identity program that has national coverage. However, until 2012, NIMC could not start on-ground enrolment of citizens of Nigeria to provide a unique 1 gesj.internet-academy.org.ge/download.php?id=2166.pdf 2 https://www.nimc.gov.ng/sites/default/files/sagem%20handover%20issues.ppsm 3 https://www.traceinternational2.org/compendium/pdf.asp?id=431 4 http://siteresources.worldbank.org/INTPRS1/Resources/Nigeria_PRSP%28Dec2005%29.pdf 1.  I ntrod u cti on 1 identification based on a biometric check of uniqueness. In the absence of a scaled-up national identity, government agencies started biometric enrolment of their own for their target beneficiary population with an objective of cleaning up their respective databases. Thus, Nigeria currently has one national identity program, and several functional identity programs, run by various government agencies, who conduct biometric enrolment of their target populations. The duplicated effort has led to inefficiencies in public resource management, as these programs require significant amounts of funding for enrolment, operations, and maintenance. Moreover, a resident of Nigeria has to provide biometrics to multiple government agencies, and carry multiple identity cards for different uses. To minimize the duplication of effort, reduce fiscal spending across identity programs, and streamline service delivery, the federal government is currently implementing harmonization5 of its functional identity programs with NIMC. 1.1  Scope of the study The objective of the study is to provide a rapid review of the identity landscape of Nigeria, in consultation with the government, and identify bottlenecks in the identity ecosystem. The assessment is intended to inform the future development needs of identification in Nigeria. The preparation of this study is based on extensive in-country consultations, with the government and identity stakeholders in Nigeria, and on desk research done over a period of two months. Apart from the foundational identity program of NIMC,6 the project team studied select identity programs serving the functional identity needs of government agencies. The team reviewed various identity services offered by government and nongovernment agencies, including their coverage, enrolment approach, use of demographic and biometric data, technology infrastructure, and institutional capacity. The team also studied the status of harmonization of these ID programs with NIMC. Figure 1: Functional ID Programs Consulted In addition to the identity programs given above, additional identity systems operate in Nigeria, including, but not limited to, Joint Tax Board (JTB), Nigeria Immigration Service (NIS), Nigeria Police Force (NPF), and National Health Insurance Scheme (NHIS). These identity programs were not covered as a part of the assessment. Moreover, some state governments run their own identity programs, such as the Lagos state resident ID card program, which were not covered for the purpose of this study. 5 Harmonization—Linking of disparate identity programs in the country with a unique identifier for the resident record. 6 Foundational ID program—An identity program with universal coverage which uniquely identifies citizens/residents of the country and issues a unique identification number after successful enrolment. 2 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 1.2  Limitations of the study This report is based on information gathered from discussions held with representatives of NIMC and of identity programs in Nigeria, and through rapid desk research, conducted over two months. The report presents the current identity landscape of Nigeria, along with lessons learned on identity programs in other countries. The rapid nature of the assessment limits the scope, coverage, and comprehensiveness of data collection. Given the analytical approach, an in-depth review of functional identity programs was not conducted. The report should be read accordingly with given constraints. 1.  I ntrod u cti on 3 2.  The role of identity Identity is a public good, and is necessary for modern development. In order for a government or a firm to deliver services to people, it needs to know who is who. In developed countries, an official identity is established by feeder documents, such as a birth certificate. In developing countries, reliable birth certificates are often lacking. As an alternative, developing countries use biometric technologies to uniquely identify individuals, and establish an official identity. The nomenclature of “official identity,” “national identity,” and “foundational identity” are used interchangeably. Without a reliable way of proving one’s identity, exercising basic rights, claiming entitlements, accessing a range of government services, and conducting many daily activities are hampered. Governments play an important role in establishing identity programs and inculcating trust, primarily through regulation.7 The advent of new technologies—such as internet, mobile phones, social media, and applications—requires an electronic or digital form of identity. When combined with mobile phones and the internet, identification allows services to be delivered electronically, giving a boost to government efficiency, and leading to new online products and services. With over 7 billion mobile phone users in the world today,8 mobile phones and the internet are the largest delivery channels for services. A detailed primer on digital identity is available in Digital Identity Toolkit: A Guide for Stakeholders in Africa, a publication of the World Bank.9 2.1  Accelerating development Digital identity offers developing countries an opportunity to hasten the pace of their national progress. It changes the ways services are delivered, helps grow a country’s digital economy, and provides effective safety nets for disadvantaged and impoverished populations. For some, digital identity is a “game changer” or a “poverty killer.”10 India’s Aadhaar and Estonia’s identity programs are examples in which digital identity has been effectively used to promote economic and social development. In India, for example, the use of the Aadhaar digital identity has produced the following outcomes: ƒƒ Financial inclusion: The program has been used to rapidly complete know-your-customer (KYC) processes and open bank accounts for 125 million people within a short span of 12 months through the Pradhan Mantri Jan Dhan Yojana, a government program of financial inclusion.11 ƒƒ Social benefits: The program has helped initiate direct benefits transfer (DBT) for several social sector schemes (e.g., mother and child benefits, cooking gas subsidies, pensions) directly to Aadhaar-linked bank accounts of beneficiaries. A large majority of these people were unbanked before the rollout of Pradhan Mantri Jan Dhan Yojana. 7  See Organization for Economic Co-operation and Development Report “Digital Identity Management for Natural Persons: Enabling Innovation and Trust in the Internet Economy” (2011). 8  Wireless Intelligence (2014). 9 The toolkit is available at: http://documents.worldbank.org/curated/en/2014/06/20272197/digital-identity-toolkit-guide-stakeholders- africa (last accessed March 25, 2015). 10 See press release: “India’s Massive I.D. Program Exemplifies ‘Science of Delivery,’” at http://www.worldbank.org/en/news/ feature/2013/05/02/India-8217-s-Massive-I-D-Program-Exemplifies-8216-Science-of-Delivery-8217 (last accessed May 10, 2014). 11 http://www.pmjdy.gov.in/account-statistics-country.aspx 4 ID4 D C o u nt ry D i ag no s t ic : Ni geri a ƒƒ Health services: The program is enabling rapid coverage of national life insurance and health insurance programs under the Prime Minister’s schemes for labourers and workers who are outside of formal employment. This scheme was launched in April 2015 and will use the bank accounts opened under the Pradhan Mantri Jan Dhan Yojana as the base. 2.2  A cross-sectoral platform A national identity registry is a cross-sectoral platform that offers a unique identity to each person, and on which new products and services can be built by firms and government agencies (see Figure 2). For example, a government offering safety net transfers to the country’s poor can use the national identity registry to uniquely identify target populations and issue cash transfers electronically. A financial institution can use the national identity registry to validate a person’s identity, thereby addressing a key aspect of KYC rules. Immigration authorities can track who enters and exits the country, and link national passports with the unique national identity of each person. Figure 2: Service Delivery Using National ID Registry12 Transform the efficiency of Safety Nets safety nets with electronic cash transfers Track immunization of Health Care children and delivery of Civil health care to citizens Registration Accelerate financial National Identity Finance inclusion using digital Identity Registry banking and payments Enrollment Issue driver’s licenses Transport linked to digital identity Register people registry Record unique identity for identity of people in a national Track border control and electronic registry Immigration issue passports linked to digital identity registry Impact of national ID in service delivery—the case of India and Pakistan India’s national ID—Aadhaar—was created with an objective of not only providing a unique ID to each resident of India but also to act as a mechanism for plugging leakages in safety net programs. Aadhaar acts as a tool to remove ghost and duplicate beneficiaries. Government of India has started an effort to include Aadhaar numbers in databases of functional identity programs and transfer benefits using Aadhaar numbers to linked bank accounts. This mechanism is currently being used for transferring subsidies provided on cooking gas and is expected to save ~10% of $6.5 billion annually spent on subsidy. This savings is achieved through elimination of ghost and duplicate beneficiaries in the database. A study by India’s National Institute of Public Finance and Policy (NIPFP) estimates that use of Aadhaar for transfer of benefits will save roughly $4 billion each year for the Government of India and provide a rate of return of about 52% for implementation of the Aadhaar program. The World Bank, ‘Digital identity toolkit: a guide for stakeholders in Africa’ at http://documents.worldbank.org/curated/ 12 en/2014/06/20272197/digital-identity-toolkit-guide-stakeholders-africa 2.  T he role of i d e nti ty 5 Pakistan was one of the first countries in the world to introduce a national ID program based on biometric de-duplication through National Database and Registration Authority (NADRA). After successful registration, NADRA issues a Computerized National Identity Card (CNIC) along with a 13  digit ID number. This CNIC is used by multiple government agencies for identity establishment and eligibility confirmation. The most significant usage of CNIC was made in 2010 for providing relief to citizens of Pakistan affected by flash floods. The Government of Pakistan disbursed about Rs. 77 billion to 2.84 million families under Citizens Damage Compensation Program (CDCP) that were affected by flash floods in Pakistan. CNIC was used as a tool for establishing eligibility for receipt of benefits. Similarly, CNIC is currently being used in multiple social safety net programs including Benazir Income Support Program (BISP), a program aimed to advance financial inclusion and provide financial stimulus to women living below the poverty line. 2.3  Foundational and functional identities A ubiquitous digital identity can be developed using two distinct pathways: 1. A top-down approach by creating a universal foundational identity, and then adopting the identity for service delivery by government agencies and the private sector; or 2. A bottom-up approach by creating a functional identity to address a specific need of a government agency, and evolving the identity over time for universal coverage. Each approach has its pros and cons. While a foundational identity can provide economies of scale and spur innovation, it requires intensive coordination amongst government agencies for adoption and use, and may face a slow uptake in initial days. In contrast, a functional identity is easy to launch and has low initial cost; but, evolving to become a multi-sector identity is difficult and costly, and sometimes not feasible, given duplication of efforts by multiple government agencies before any identity reaches scale. A foundational identity hosted in a “neutral institution” has the benefit of serving government agencies and the private sector, irrespective of sector, industry, or functional domain. 2.4  Building blocks of national identity The building blocks of developing a national identity program include the following: ƒƒ Collect: The national identity authority collects the unique identity of all people, using biometric technologies, into electronic profiles, by mobilizing nationwide enrolment. ƒƒ Store: The national identity authority stores information, and builds an electronic registry of unique identities of all people in the country. In addition, the authority establishes easy and standard interfaces to this national identity registry. ƒƒ Use: The national identity authority promotes use of the digital identity, by optionally offering an identity credential, such as a national identity card, and offering identity verification services. 6 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Figure 3: Building Blocks of Identity Programs Capture of Identity Storing Identity Data Data Building Blocks of Identity Offering Identity Offering Electronic Credential Services 2.  T he role of i d e nti ty 7 3.  Enabling environment 3.1 Background The Federal Government of Nigeria has long recognized the need to have a single national identity system for all citizens in order to carry out its mandate—law enforcement, intelligence, social and economic development, and political development. In 2005, as part of the National Economic Empowerment Development Strategy (NEEDS), the government highlighted the need to develop a national identity management system, especially to promote customer credit and drive economic development. It recognized that the absence of a central national identity database, and accompanying systems of secure, reliable identity verification and authentication, make it easy for an individual to acquire identity cards with different names, leading to a high incidence of identity fraud. The government also recognized that identity fraud is leading to high leakages and corruption in government programs, and a unique identity is a powerful tool to help address these leakages. Also in 2005, the government established the Harmonization Committee to get advice on how different identity programs, being spearheaded by the government and the private sector, could be harmonized.13 The Committee noted that countries are increasingly moving away from issuing a single purpose identity card to a more secure multi-application smart card. The Committee also observed that various government agencies maintain different identity databases and issue identity credentials specific to their own statutory responsibilities. Even though these agencies employ similar processes to collect resident identity data,14 there is no linkage amongst these different agencies to access or exchange related data. Also, these government agencies were at different levels of maturity; some relied on automated processes for data capture, storage, and verification, while others employed manual processes. This results in a high degree of duplication of work and has significant financial implications for government. The Committee recommended creating a new national identity database (or registry) that could serve as a central repository of unique identity information of all people in Nigeria. All government agencies and the private sector firms could link with this central repository to verify people’s identities. The connectivity amongst the various identity databases, government departments, and law enforcement agencies was proposed to be enhanced by the use of a chip-based general multi-purpose identity card (GMIC), or a smart card. The smart card would allow several applications to be based on one card. To effect the recommendation of the Committee, the NIMC Act No. 23 of 2007, which repealed the National Civic Registration Act of 1978, was enacted, and established NIMC as the lead government agency responsible for identification in Nigeria. The government had set up a Presidential Committee to implement the recommendations, including articulating a policy and establishing an institutional framework for identity management in Nigeria. The work was carried out in line with the Constitution of Nigeria and included biometrics in the exclusive legislative list schedule of the Constitution. 13 NIMC, Harmonization and Integration Policy, http://www.nimc.gov.ng/sites/default/files/harmonization_policy.pdf (last accessed May 25, 2015). 14 “Residents” refer to legal residents who are registrable foreigners and citizens who are registrable citizens of Nigeria. 8 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 3.2  Policy landscape Original national identity card program of 1978 The government conceived the notion of a national identity card for every Nigerian prior to 1977. In 1978, the Department of National Civic Registration (DNCR), within the Federal Ministry of Interior (FMI), was established by a decree and given the responsibility to enrol every Nigerian citizen of age 18 years or higher, and issue a national identity card based on biographic data.15 Decree 51 of 1979 stipulated the main objectives of the programme:16 ƒƒ Register all citizens of Nigeria who, at the commencement of the Decree or subsequently, had attained the age of 18 years or higher; ƒƒ Issue a national identity card to every person registered; and ƒƒ Collate all information returned by the registrars, in pursuance of their duties under the Decree, and produce such information, as may be required from time to time. The national identity program was thus focused on “issuing an identity card,” as a way to control illegal immigration, validate civic documents such as travel passports, and set up a reliable personal identity system for securing commercial transactions with financial institutions. The program reportedly failed after 18 months. Only a few government functionaries were issued a national identity card. Private sector program of 2001 In the early 2000s, the DNCR revived the program for creating and issuing the Nigerian national identity card, contracted a private sector service provider, and pursued the following mandate:17 ƒƒ Deploy necessary IT infrastructure to register residents; ƒƒ Use a biometric approach to confirm the unique identity of each registered person;18 ƒƒ Provide ICR form correction centre and 60,000 mobile registration workstation (MRWs); and ƒƒ Issue 60 million national identity cards, using card personalisation equipment.19 The project focused on issuing identity cards based on barcode technology to citizens and separated databases of female and male residents. The contracted firm completed enrolment of 52.6 million out of 60 million residents, and issued 37.3 million identity cards before closing operations.20 The government paid out roughly $236.8 million.21 The project was later shelved in 2006, and involved allegations of impropriety over the award of the bid to the firm.22 15 gesj.internet-academy.org.ge/download.php?id=2166.pdf 16 http://www.siliconinvestor.com/readmsgs.aspx?subjectid=1750&msgnum=24201&batchsize=10&batchtype=Next 17 http://www.nimc.gov.ng/sites/default/files/2013_Annual%20Report.pdf 18 The biometric approach involved the use of an automated fingerprint identification system (AFIS). 19 NBS Horizon personalisation machines were used. 20 Source: NIMC presentation, titled “Sagem S.A. France—Closure of 2001 Agreement and Handover of the Nigerian National Identity Card Programme: The Issues,” accessible at https://www.nimc.gov.ng/sites/default/files/sagem%20handover%20issues. ppsm (last accessed March 25, 2015). 21 https://www.nimc.gov.ng/sites/default/files/sagem%20handover%20issues.ppsm 22 https://www.traceinternational2.org/compendium/pdf.asp?id=431 3.  E na bling e nv i ronm e nt 9 NIMC program of 2007 Learning from two unsuccessful attempts of creating a national identity registry, the NIMC Act was drafted with a focus on not only creating a robust national identity platform, but also harmonization with other government agencies for adoption and use. It separated the objective of creating a unique national identification scheme from card issuance and provision of electronic verification services. Following passage of the NIMC Act in 2007, NIMC was set up the same year as a new Commission under the Presidency to serve as the government agency responsible for identification in Nigeria. NIMC took over the assets and liabilities of DNCR. NIMC aimed to establish a “unique identity per person,” based on biometrics, and issue a unique national identification number (NIN) to citizens. NIMC was given the mandate to design and implement a new NIMS based on best practices worldwide. The work on the NIMS began in earnest in the third quarter of 2009, after NIMC ascertained that it could not reuse most of the assets that it had inherited from the former DNCR. 3.3  NIMC act The vision of NIMC is to establish and regulate a reliable and sustainable system of national identity management that enables a citizen or legal resident to assert his or her identity. NIMC is working to achieve this vision by creating and managing a secure national identity database, setting and maintaining identification standards, and issuing an identity token and a secure means to irrefutably confirm the identity of an individual.23 Figure 4: Mandate of NIMC Mandate of NIMC Research and Establishment of Provide identity Harmonization of Development NIBD and issue verification existing identity in identity of GMIC services card schemes management According to the NIMC Act,24 the mandate of NIMC can be described as below: ƒƒ Establish National Identity Database (NIDB) and issue General Multi-Purpose Identity Card (GMIC): The Act entrusts NIMC with the responsibility to create, manage, maintain and operate a national identity database. NIMC is required to carry out the registration of citizens and lawful residents of Nigeria in the database using fingerprints and other biometric information as unique and unambiguous features of registerable persons. Persons who successfully register are to be assigned a unique national identification number and issued a general multi-purpose identity card. ƒƒ Provide identity verification services: Upon creating the national identity database, NIMC is required to provide verification services based on information in its database. 23 https://www.nimc.gov.ng/?q=about-us 24 http://resourcedat.com/wp-content/uploads/2013/03/National-Identity-Management-Commission-Act-2007.pdf 10 ID4 D C o u nt ry D i ag no s t ic : Ni geri a ƒƒ Harmonize existing identity schemes in Nigeria: The Federal Government of Nigeria is focused on creating an interoperable system to achieve integration of identity infrastructure and a ‘change- over’ to the new set of unique identifier requirements under the NIMC system. For the purpose of harmonization, NIMC is empowered to establish and maintain secured communication links with any existing identity database or agency; and harmonize and integrate identity databases in government agencies to achieve resource optimization through a shared services platform. ƒƒ Research and develop identity management: NIMC is expected to stay on top of trends in identity management and incorporate global practices of identity operations. In addition, NIMC was also responsible to wind up and take over the assets and liabilities of the former DNCR, including the personnel in both the state and local government offices nationwide. The NIMC Act requires every Nigerian citizen and legal resident to enrol with NIMC, but does not confer a citizenship status to the resident. The Act also mandates the use of NIN to obtain government services, and imposes penal provisions for not using NIN. Figure 5: NIN at a Glance ► An 11–digit random unique identity number ► Uniqueness determined by demographics and biometrics ► Assigned to every citizen of Nigeria ► Provides a smart “multi-purpose identity card” after successful registration ► Instrument for financial “Register once; Inclusion with prepaid card get identified for life.” ► Information update facility provided to citizens 3.4  Additional acts Several government agencies with functional identity or related programs operate under a specific legislation, including, amongst others, the following: ƒƒ Nigeria Immigration Act ƒƒ National Population Commission Act ƒƒ National Health Insurance Scheme Act ƒƒ Federal Inland Revenue Service Act ƒƒ Births and Deaths (Compulsory Registration) Act ƒƒ Pension Reform Act The mandate of functional identity programs is often limited to their specific service delivery domains and hence do not require universal coverage of Nigerian population. 3.  E na bling e nv i ronm e nt 11 3.5  Security and privacy Digital identity requires enabling policies, including for data privacy, cyber security, electronic transactions, and electronic communication. Data privacy In 2013, NIMC prepared a privacy study, leading to a privacy policy that was adopted by the government. A privacy law is currently undergoing a third reading by the National Assembly. The privacy policy helps ensure that NIMC meets its obligations under the NIMC Act in the management of data collected and held in its registry.25 The privacy policy is created with an objective of ensuring the protection of information by making reasonable security arrangements against risks caused by unauthorized forms of access, collection, use, disclosure, storage or disposal. Key provisions of the privacy policy include: ƒƒ NIMC will collect personal information directly from individuals in order to register for national identity, will not collect information about individuals through unlawful or unfair means, and will not unreasonably intrude in the personal affairs of individuals concerned. ƒƒ The purpose of collecting and storing data about residents in its registry include: facilitating identity authentication, boosting national security, assisting in economic planning and research, encouraging consumer credit, preventing identity theft, or assisting criminal investigation. ƒƒ NIMC will establish and implement procedures to ensure that requests for lawfully authorized use of information by authorized persons and agencies is granted. ƒƒ Unlawful access to or use of information of NIMC by any person, including employees of NIMC, is a criminal offence punishable by imprisonment for a term not less than ten years without the option of fine under the provision of section 28(1) and (2) of the NIMC Act. ƒƒ NIMC will make reasonable efforts and establish measures, processes and procedures to ensure the protection of registered information. These include both physical and technological safeguards. NIMC will take reasonable efforts to also create and maintain firewalls, restricted access, and other appropriate safeguards to ensure that it controls registered information. ƒƒ NIMC will not disclose or authorize the disclosure of any registered information except when consented by resident, required by a court order, or required for public interest or national security. Cyber security The National Security Adviser (NSA) is given the mandate of cybersecurity in Nigeria. In May 2015, the government passed a Cybercrime Act 2015 to provide a legal framework for the prohibition, prevention, detection, prosecution, and punishment of cybercrimes in Nigeria.26 The Act also aims to enhance cyber security and protection of information infrastructure, including computer systems and networks; electronic communications; data and computer programs; and intellectual property and privacy rights. 25 https://www.nimc.gov.ng/sites/default/files/pia_policy.pdf 26 http://allafrica.com/stories/201506020960.html (last accessed June 25, 2015). 12 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Key provisions of the Act include:27 ƒƒ The Act criminalizes specific computer and computer-related offences, which include: unlawful access to a computer; unauthorized disclosure of access code; data forgery; computer fraud; system interference; misuse of devices; denial of service; identity theft and impersonation; child pornography; records retention and preservation; unlawful interception; cybersquatting; cyber- terrorism; failure of service providers to perform certain duties; racist and xenophobic offences; attempt, conspiracy and abetment; and corporate liability. ƒƒ The Act provides for the security and protection of critical information infrastructure. It further provides for the audit and inspection of critical information infrastructure, and punishment for offences against critical information infrastructure. ƒƒ The Act deals with issues such as jurisdiction, powers of search and arrest, obstruction of law enforcement officers, prosecution, forfeiture of assets, compounding of offences, payment of compensation, and the power to make regulations. ƒƒ Cybercrime and cyber security issues are not restricted by geographical boundaries and legal jurisdictions but can be checked through international cooperation. The issues covered include: extradition; mutual assistance requests; expedited preservation of data evidence pursuant to a request; and form of requests. Electronic transactions and communications Nigeria wishes to remove barriers to electronic commerce through a proposed legislation, the Electronic Commerce Bill 2011, under review by the National Assembly.28 The draft bill covers electronic transactions done commercially or by federal and state governments in Nigeria. One of the objectives of the law on e-commerce is to ensure that records and documents are not considered invalid because of being in an electronic form. The law recognizes validity of an electronic signature for signing an electronic document. Key provisions of the draft bill include: ƒƒ The legal validity of information, communication, contract, record, signature, or transaction will not be denied because it is in electronic form. ƒƒ Where any law requires information to be in writing, the requirement of the law is fulfilled if the information is contained in an electronic message that is accessible and intelligible so as to be usable for subsequent reference. ƒƒ Where any law requires a seal to be affixed to a document, the requirement of the law is fulfilled if the document is in the form of an electronic message. ƒƒ Where any law requires a document to be in original form, the requirement of the law is fulfilled by a document in the form of an electronic message if (a) there is reliable assurance to the integrity of information from the time it is first generated in its final form; and (b) the electronic message is accessible and intelligible to be usable for subsequent reference. 27 Based on review of Nigeria Cybercrime Bill 2014, available at http://www.nassnig.org/document/download/1365 (last accessed June 25, 2015). 28 Note that, in May 2015, the outgoing government of Nigeria passed several bills. At the time of writing this report, information about the Acts and the specific provisions supported were not available. Acts and bills are accessible at: www.nass.gov.ng/nass/ legislation.php?id=1215 3.  E na bling e nv i ronm e nt 13 3.6  Technology infrastructure The use of digital identity relies on technology infrastructure and services, and related policies, regulations, and standards, in the following ways: ƒƒ For enrolment: The availability of high-speed internet connectivity is needed for enrolment data collected from centers throughout the country to be transmitted to the central office of NIMC in Abuja, and for checking the uniqueness of each new identity (via de-duplication). ƒƒ For national identity registry: Data centers, and related applications, are needed to operate the national identity registry in electronic form at the central office of NIMC in Abuja, and the disaster recovery centers elsewhere. ƒƒ For interoperability: Technology interfaces, standards, and protocols are needed for the national identity registry of NIMC to link with functional identity registries of other government agencies. ƒƒ For identity verification: The availability of internet connectivity is needed for national identity to be electronically verified anywhere in the country by checking against the central office in Abuja. ƒƒ For disaster recovery: Data centers, and related applications, are needed to back up information for the business continuity plan and do disaster recovery. Technology systems also rely heavily on electric power, in the forms of national power supply, industrial- grade electric power generators, solar panels, and uninterrupted power supply (UPS). Mobile Mobile phones are a growing phenomenon in Nigeria, as in the rest of Africa. By 2014, 136.2 million people, or 75.8% of the population, had a mobile phone, up from 53.9% five years ago in 2010, as shown in Figure 6. Mobile phones offers a new platform of service delivery, and offers prospects of linkage with digital identity. Broadband High-speed internet, or broadband, is a work in progress in Nigeria. By 2014, broadband penetration was at 6–7%, with mobile broadband reaching 12%. Prices of broadband remain high, and quality of service is mixed. The lack of reliable high-speed internet poses a possible challenge for digital identity. Current identity systems, such as of NIMC, spend high operating costs per month to pay for internet. 14 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Figure 6: Mobile and Broadband in Nigeria29 Mobile Subscribers Broadband Subscribers (per 100 people) (Mobile, per 100 people) 72.7 75.8 66.1 53.9 57.3 6.1 8.9 12.0 3.1 3.9 2010 2011 2012 2013 2014      2010 2011 2012 2013 2014 Indicator Status Mobile penetration (per 100 people) 75.8 Broadband penetration (per 100 people) 12 Internet penetration (per 100 people)29 33 Area covered with 2G wireless connectivity 98% Area covered with 3G wireless connectivity 35% (mostly in urban areas) Source: World Bank (2015), Wireless Intelligence (2014), Telegeography (2014). 29 As per Federal Ministry of Communication Technology. 3.  E na bling e nv i ronm e nt 15 4.  Civil registration A national identity registry can be populated in two ways (as depicted in Figure 2 on page 5): (a) using civil registration, with reliable birth and death certificates; or (b) by mass biometric enrolment of people throughout the country. In developing countries, national identity registries are being populated biometrically in absence of reliable birth and death certificates. In reality, following mass biometric enrolment, an electronic linkage with the civil registry is important in order to maintain the integrity of information in the national identity registry and the civil registry. 4.1  Legal mandate Following passage of the National Population Commission Act in 1988, and in line with the country’s Constitution, the National Population Commission (NPopC) was established by the federal government of Nigeria. The agency is responsible for census operations and civil registration in Nigeria. The Act sets out the following responsibilities for NPopC: ƒƒ Undertake enumeration of the population of Nigeria periodically, through census, sample surveys or otherwise; ƒƒ Establish and maintain a machinery for continuous and universal registration of births and deaths, throughout the Federation; ƒƒ Provide information and data on the population for purposes of facilitating national planning and economic development; and advise the President on population matters. 4.2  Current state NPopC maintains a civil registry to retain documentary evidence of people’s legal identity, family relationships, nationality, and ensuing rights, such as for social protection and inheritance. The registry is intended to help facilitate access to basic services, such as health, education, and social welfare, and contribute to activities, such as gaining formal employment, exercising electoral rights, transferring property, and opening bank accounts. NPopC has established 4,000 civil registration centres across the country, with more than five registration centres in each of the 774 local government areas (LGAs). It currently conducts registration of births, deaths, and stillbirths (for analysis of mortality). It plans to expand operations by conducting registrations of marriage, divorce, adoption, and other changes in civil status. Apart from conducting registration at its designated offices, NPopC has tie-ups with major hospitals for birth registration, and runs a registration desk at these hospitals. NPopC also has tie-ups with the National Primary Healthcare Agency to empower midwives for collection of birth registration data. During birth registration, an NPopC official captures demographic details of the child at their center. The registration can be done at any registration center irrespective of the location of birth. NPopC maintains physical paper files of registration data, and later digitizes them. A monthly manual collation of data occurs at levels of local government, state government, and NPopC headquarters in Abuja. Subsequently, data entry operators at NPopC headquarters in Abuja digitize the data received from physical paper files. Officials at the headquarters run analyses on the digitized data and publish reports periodically. In 2012, NPopC received funding from the World Bank to digitize civil registration processes. It has since started a digitized process for direct data capture in 144 centres in the country. Additionally, the United 16 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Nations (UN) has provided funding for deployment of handheld devices (via Rapid SMS) to capture civil registration data. These handheld devices are deployed at four centres in each state, and can be carried from place to place to capture data. The data entered by direct data capture centres and through handheld devices is transmitted directly to state level offices and to NPopC headquarters in Abuja. Currently, birth registration is estimated at 38%–42% of total births in the country, and NPopC has been working to increase the percentage of registration. In 2012, NPopC made an effort to clear the backlog of registrations in the country. A drive was launched in coordination with state governments and with UNICEF at schools that resulted in registration of 7–10 million children. In Nigeria, it is legally mandatory for each citizen to register birth and death. As per regulations, a delay in registering birth, past 60 days, and death, past 30 days, has a penalty. To date, NPopC has not charged any penalties to citizens. Each Nigerian citizen Eligibility at birth Target Population ~170 million Enrolment 1991 Start Date Number of 4000 Enrolment Stations Demographic Name, DoB, place of Details Captured birth, household details Biometric Details Captured None Technology Used N/A Current Status of Info not available Enrolment Form Factor Paper certificate 4.3  Linkage with national identity Linking a civil registry with the national identity registry is a substantial task, involving automation of manual processes of civil registration, and requires several iterative steps: ƒƒ Historic records: Digitizing historic records and electronically retaining in standard formats for easy search and access. ƒƒ New records: Electronically capturing new records of birth and death (and other changes in civil status) by establishing electronic terminals and interfaces for registration at respective institutions and agencies responsible for birth and deaths (such as hospitals, maternity centers, and others), and in this way bypassing a manual process of data capture. ƒƒ Electronic look-up: Electronically linking the civil registry with the national identity registry to cross- validate the uniqueness of information in the two systems. Efforts on linking civil registration with the national identity registry have been made, and further work is needed to achieve the integration. 4 .   C iv il r eg i strati on 17 5.  Foundational identity: National identity registry Though the federal government of Nigeria has long recognized the need for a foundational identity, its attempts to create a national identity in 1978 and in 2001 yielded mixed results. In 2007, the federal government decided to revive the national identity program. Following passage of law, the National Identity Management Commission was established in 2007. NIMC was given the mandate to design and implement a revolutionary new national identity management system based on best practices worldwide. NIMC is charged with responsibilities of registering every individual in Nigeria, issuing a unique national identification number, issuing a general multi-purpose identity card, establishing and integrating with all identity registries, and verifying and authenticating unique identities. At the time of its set-up in 2007, NIMC assumed assets and liabilities of DNCR that led the national identity card project in 2001. As a result, NIMC started with a sizable organization, mostly outdated technology systems, an oversized organization, capacity gaps, and financial liabilities. The handover of legacy systems from the private sector partner was not smooth and not achieved, and NIMC could not re-use any of the systems developed. NIMC thus faced a delay in starting operations. Moreover, NIMC wanted to focus only on back-end operations, and rely on private sector partners for front-end operations based on a concessions arrangement. The approach posed challenges, and added delay. Today, NIMC serves as the lead government agency responsible for identification in Nigeria. 5.1 Mission The vision of NIMC is to establish and regulate a reliable and sustainable system of “national identity management” that enables a citizen or legal resident to assert his or her identity. NIMC plans to achieve this vision by setting and maintaining identification standards, creating and managing a secure database, an identity token, and a secure means by which to irrefutably confirm the identity of an individual to help promote national security and enhance socioeconomic development.30 5.2 Governance NIMC is set up as a federal government agency under the office of President of Nigeria. NIMC is headed by a Director General and Chief Executive Officer (CEO) who is appointed by the President. With an objective of creating a universal identity program as well as harmonization of identities in Nigeria, NIMC Act provides for a 19-member Governing Board as the highest decision making body in the Commission.31 The Board comprises of a Chairman appointed by the President, Director General/ Chief Executive Officer of NIMC, one representative each from 14 government agencies and institutions, and 3 persons who are knowledgeable in Information Communication Technology. The Board of NIMC is represented by government agencies operating functional identity registries (as discussed in Section 6). 30 https://www.nimc.gov.ng/?q=about-us 31 https://www.nimc.gov.ng/?q=governing-board 18 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 5.3 Organization NIMC is organized into 9 departments, each headed by a General Manager (or Director). Apart from this, there are 6 subdivisions under the office of Director General of NIMC. At its inception, NIMC conceived the implementation of the unique identification as a system divided into two parts: ƒƒ Front-end operations: NIMC’s approach to handling front-end operations has changed since conception. These operations are three: (a) enrolment, (b) printing and issuance of general multi- purpose identity cards, and (c) deployment of card acceptance devices. In the beginning, NIMC signed up two concessionaries as front-end partners, but the partnerships did not materialize. NIMC ended the concessions. Subsequently, NIMC began in-house handling of front-end operations,32 and is currently conducting enrolment, and printing and issuing general multi-purpose identity cards. ƒƒ Back-end operations: NIMC has consistently run back-end operations. These operations are: (a) setting up, operating and managing the national identity database; (b) establishing and maintaining communication links with identity-related agencies and end users; and (c) providing identity verification services. In 2007, after completing takeover of DNCR, NIMC realized that the national identity program had oversized in-house manpower and an abundance of roles. With an objective of only handling back-end operations, NIMC started rationalizing the organization structure. NIMC downsized from an organization of 10,231 staff. At an aggregate level, NIMC has 3,400 staff today amongst all Departments and subdivisions. 5.4  Products and services At its core, NIMC offers three key products and services. ƒƒ NIN: The national identification number (NIN) is an 11-digit random, unique identity number assigned to an individual upon successful enrolment following biometric capture of information. Enrolment consists of recording an individual’s demographic data, capturing 10 fingerprints, a head-to-shoulder facial picture, and a digital signature. The information is used to cross-check existing data in the national identity database to confirm that there is no previous entry of the same individual. Once this de-duplication process is completed, a unique NIN is assigned to the person. The NIN once issued to a person cannot be used again (that is, it cannot be issued to another person even if the previous person has passed away). It is the NIN that helps to tie all the records about a person in the database and is used to check the identity. ƒƒ Multi-purpose identity card: The Nigerian National Identity Card is a microprocessor chip-based general multi-purpose identity card (GMIC) designed to handle multiple applications including identity verification and authentication and payment functionalities. All citizens and legal residents with age of 16 years or older (whose biometrics are captured during enrolment) are issued a national identity card free of charge. The smart card includes a payment functionality, currently provided by Mastercard, and in future by additional service providers.33 The card works as a prepaid debit card, and can be loaded with a monetary value for payment transactions. 32 NIMC started front-end operations first as a pilot while the concessionaries were there. Following termination of concessions in August 2014, NIMC adapted to capturing data by itself. The government issued a circular that enabled MDAs to align their data capture and to help populate the NIMC registry. 33 In the future, two additional payment service providers are expected, namely Visa and Verve. 5.  Foundation al ide ntity: Nation al ide nti ty r eg i stry 19 Figure 7: NIMC Card Design ƒƒ Authentication services: In the near future, NIMC plans to provide online, biometrics-based authentication services based on NIN. These services will be provided using an ecosystem of authentication user agencies and authentication service agencies. 5.5 Enrolment Incorporating learning from national identity programs across the world, NIMC has defined a 4-step process for enrolment of Nigerian citizens.34 Figure 8: Process of Enrolment Process of enrolment ƒƒ Pre-Enrolment (Optional): Pre-enrolment is an optional step whereby an applicant can fill out the demographic data required by NIMC at an online pre-enrolment portal—https://penrol.nimc.gov. ng/loginForm.tpl.html.php.35 This facility is provided to reduce the time required for enrolment, and reduce data entry errors made by the enrolment station operators. After completing the form, the applicant is required to print out a summary sheet that has a 2D barcode and carry it to an enrolment center. ƒƒ Enrolment: The enrolment process is initiated by the citizen appearing at the designated enrolment center operated by NIMC to be enrolled (i.e., provide demographic data and permit his/her 34 Note that the process depicts enrolment of people and issuance of cards only. NIMS additionally includes verification and authentication of unique identities. 35 Also available at: www.ninenrol.gov.ng 20 ID4 D C o u nt ry D i ag no s t ic : Ni geri a biometrics to be taken) with supporting document(s).36 In some geographic areas, NIMC dispatches a mobile enrolment unit to a community. If pre-enrolment form is not filled, the applicant is required to fill out the enrolment form.37 The enrolment form has more than 40 fields capturing demographic information such as name, address, name of parents and next of kin, details of birth, physical features, address of native place for self as well as parents, and address of next of kin. After ascertaining suitability for enrolment, the enrolment station operator accepts the application and captures demographic data for the applicant in the system (either by scanning the 2D barcode on the pre-enrolment summary sheet which automatically retrieves data from pre-enrolment, or manually entering data in the system provided in the enrolment form by the citizen). After demographic data capture, the operator captures scans of 10 fingerprints, a head to shoulder facial picture and a digital signature. This capture of biometrics is done for all applicants with age of 16 years or older. For all applicants below 16 years of age, biometrics are captured, a NIN is issued, and the NIN of his/her parents is captured for enrolment. After confirming correctness of data entered, the operator submits the citizen data for biometric de-duplication. A transaction slip is generated after successful submission of citizen data. This transaction slip carries a transaction reference number which can be used by the citizen for future communication with NIMC in case a NIN is not generated real-time. This process of enrolment, including capture of demographic and biometric data, takes an average of 20 minutes per person.38 ƒƒ Biometric de-duplication and NIN issuance: After submission of citizen data, a de-duplication check is run on the existing data in the national identity database in real-time to confirm that there is no previous enrolment by the same person. This check is done using ABIS L1 Solutions’ bimodal/ multimodal biometric solution. If this de-duplication check is successful, a unique NIN is assigned to the person and data is stored in the national identity database. The NIN is a non-intelligent set of numbers assigned to an individual upon successful enrolment and de-duplication check. After successful generation of NIN, a NIN slip is printed and handed over to the citizen. Currently, the process of de-duplication takes place live (in real-time), and a NIN slip is provided to the citizen on the spot. However, as the enrolment picks up and database size increases, de-duplication may not be done real-time and the citizen may be notified by text message that a NIN is generated in batch mode. The citizen will then need to come to an enrolment center to receive a NIN slip. ƒƒ Issuance of National ID card: After issuing a NIN to a citizen, the process for card personalization kicks in. NIMC has a card personalization set-up which is used to issue a national identity card to each citizen. Currently, NIMC is activating five of the thirteen applets on the card, namely: match-on-card, ICAO, payment (in coordination with UPSL and MasterCard), e-ID and e-PKI (for digital signatures). The other applets are meant for post-activation in collaboration with each respective agency. Once a national identity card is ready, the citizen is notified through SMS and the card can be collected at the enrolment station where the citizen enrolment was done. NIMC currently does not mail the national identity card to an address provided by the citizen since each cardholder is expected to activate his or her identity card at the time of collection with a fingerprint verification. Due to limited capacity of infrastructure for card personalization (given a peak capacity of roughly 16,000 cards per day),39 NIMC is currently not able to abide by a service-level agreement of issuing a national ID card in one month. NIMC has thus far issued 418,000 national identity cards. Since 2014, 36 A citizen is required to bring any of the following as a proof of identity for enrolment: old national ID card, valid driver’s license, valid international passport, voter’s ID card, government staff ID card, state of origin certificate, or birth certificate/declaration of age. Source: NIMC, http://www.nimc.gov.ng/?q=how-enrolregister (last accessed May 25, 2015). 37 https://www.nimc.gov.ng/?q=enrolment-form 38 The process reportedly takes less than 10 minutes when a 2D barcode is used. 39 The current capacity of 16,000 per day reflects backup and security measures. The card issuance was previously contracted to two private sector firms. Due to contractual issues, agreements were closed. NIMC has since begun conducting card personalization. NIMC has now contracted an expansion to 100,000 per day. 5.  Foundation al ide ntity: Nation al ide nti ty r eg i stry 21 these card facilities have been audited by NCC Group UK, and are certified by ISO 27001:2005 and 2013 by BSI. Mastercard has certified under its global vendor certification program (GVCP). Enrolling children The NIMC Act empowers NIMC to biometrically enrol all citizens and legal residents, including children. NIMC collects biometrics of children, though does not use it for de-duplication since the biometric information is not mature. NIMC issues a NIN to each child, and links the child’s NIN with the parent’s NIN. The child is expected to update his or her records every two years until reaching the age of 16. At that stage, NIMC can issue a national eID card to the individual. In case the child fails to provide biometrics within a given timeframe, NIMC can suspend the NIN issued to the child. NIMC is working with NPopC to help automate collection of vital registration data at site locations of NPopC and obtain data relevant to NIMC. Enrolment capacity NIMC operates 404 enrolment centers nationwide in Nigeria, with support of 2,500 enrolment staff, covering 332 of 774 LGAs. NIMC has enrolment centres in Federal Capital Territory (FCT) and in 34 states out of 36 states. In the states of Yobe and Borno, NIMC has not set up enrolment centres due to a prevailing security situation. In FCT, NIMC has also deployed mobile units for conducting enrolments, in the form of buses equipped with enrolment stations. At each enrolment center, NIMC operates multiple enrolment stations. Each enrolment station consists of technology systems to capture biometric information (fingerprints and facial picture; with upcoming iris) of people, and computers to record information electronically using a locally developed enrolment software. An online pre-enrolment portal is offered to encourage demographic data to be entered in advance to reduce the time spent at enrolment centers. Over 2,500 enrolment systems (i.e., computers, biometric terminals, etc.) are being used across the country.40 All enrolment systems are connected to a web application server located at a datacenter in Abuja. Currently, NIMC reports a capacity of issuing 100,000 NINs per week. NIMC is additionally working with NHIS to give access to data in helping establish the functional identity system of NHIS. NHIS is supplying 5,000 units of mobile enrolment kits, in two separate batches, to allow NIMC to populate the national identity database. NHIS plans to provide staff and space in offices nationwide for enrolment to happen. The collaboration would create extra enrolment centres for the NIMS. NIMC plans to increase the number of enrolment stations to 13,800 and capacity to >1,000,000 per day so that enrolment of all Nigerian citizens can be completed within three years. To improve the accuracy of de-duplication, NIMC plans to collect iris information, and use it for de-duplication. Citizen demand With parallel identification systems, citizens can face insurmountable obstacles to enrolment. These obstacles result from processes that pose unaffordable transaction or opportunity costs to citizens, or present untenable requirements for enrolment. The poor and marginalized may thus be deterred from Two concessionaries were previously expected to do enrolments. In August 2014, the NIMC Board approved termination of 40  concessions once enrolments did not happen. NIMC deployed 2,500 units with the need to prove concept, demonstrate technical viability, and pilot scheme. NIMC is now making a conscious effort to conduct massive deployment. The timely collaboration with NHIS and FMARD is expected to give a boost to the data gathering scheme. 22 ID4 D C o u nt ry D i ag no s t ic : Ni geri a enrolling and from enjoying the benefits of digital identification. In India, for example, despite processes being automated for improving access, applications for birth certificates incurred heavy transaction cost, such as to gather supporting documents, and resulted in a high rejection rate of 60%, since the issuance of a birth certificate had to be concurred by three different officers.41 Mapping citizens’ journey through the bureaucratic process of enrolment and card issuance across identity programs can help showcase the obstacles to achieving universal coverage, including for the most destitute citizens. Factoring the cost of enrolment from the demand side helps develop a practical approach to digital identification. 5.6  Technology systems Highlights of the technology systems of NIMC are as follows: ƒƒ Biometric: NIMC collects two biometric features for now, 10 fingerprints and a facial image, of each person. The biometric information of each new person being enrolled is checked against a central repository of all biometric profiles of previously enrolled people. NIMC plans to incorporate iris de-duplication in future. ƒƒ Automated biometric identification system (ABIS) for de-duplication: NIMC has implemented an L1 ABIS as a back-end system for biometric de-duplication. The ABIS provides the platform for processing enrolment, verification, and authentication services over the network. ƒƒ Data centers and disaster recovery: NIMC maintains two types of servers. The primary servers are located at the main data center at NIMC headquarters in Abuja. The secondary servers are located at the disaster recovery sites outside of Abuja. The data center and disaster recovery are designed to meet the demand of 1:1 and 1:N biometric de-duplication and the verification and authentication service requests from end-users of the national identity database. The entire data center is currently run on diesel generators and significantly impacts the operational cost of NIMC. ƒƒ Communications infrastructure: The communications network consists of several forms of connectivity, including VSAT, WAN, LAN, and fiber-network, linking NIMC’s data center with 14 government agencies. The network provides for two sets of functionality. First, enrolment centers can transmit massive data collected during enrolment, in a single or batched format, to the NIDB data center. Second, government agencies and end-users can send requests for identity verification as part of the harmonization with the NIDB. NIMC strives to achieve high-performance reliability and availability of its back-end systems. Currently, NIMS availability stands at 99.999%. There are several redundancies and system monitoring equipment put in place to ensure the availability of NIMS at all times. There are daily backup processes (tape-based backup) in addition to automatic replication facilities between primary and disaster recovery sites to further ensure the availability of relevant services at all times. ƒƒ Security of information: There is a strong emphasis on the security design to secure the various components from logical and physical cyberattacks. The security design covers server security, including firewall, intrusion detection systems (IDS), and intrusion prevention systems (IPS); network security; enrolment and end-user security, including with public-key infrastructure (PKI) and encryption. Also, there are adequate physical security measures put in place to protect the information assets on premise. In 2014, following an audit by the NCC Group, the British Standard Institute certified the data center facilities under the ISO 27001:2005. It again recertified in April 2015 under the ISO27001:2013. MasterCard certified the card personalization facility in 2014 and recertified in April 2015. Deloitte. 2014. Strengthening Service Delivery: Assessment of Implementation of Jharkhand Public Service Act, 2011. 41 5.  Foundation al ide ntity: Nation al ide nti ty r eg i stry 23 5.7  Authentication and verification Online authentication and verification services are currently not offered by NIMC to the public. It is currently being used by the Department for State Security, and testing for the pilot started June 21, 2015. NIMC plans to launch this service in upcoming months. As part of this work, NIMC plans to deploy an authentication and verification interface, authentication and verification clearing house, authentication service agents, and card acceptance devices. 5.8  Current status As of May 2015, NIMC has enrolled 6.1 million citizens and issued 418,000 national identity cards. Currently, more than 404 enrolment centres (physical locations) with 2,500 enrolment stations are operational in the country. 24 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 6.  Functional identities At present, 13 or more government agencies operate identity systems in Nigeria. Each government agency requires a different set of resident data. Over time, each functional identity program has recognized the need of unique identity, and has sought to collect biometric information to address issues of identity theft, duplicate entries, and ghost individuals. As a result, identity systems operate in parallel in Nigeria, with little or no linkage amongst one another. This section provides a snapshot of the functional identity programs examined, based on a rapid review. 6.1  Voter registry Independent National Election Commission (INEC) is entrusted with compiling, maintaining and updating, on a continuous basis, a national voter registry. The registry is intended to include names of all persons who are entitled to vote in elections in any federal, state or local government area. For the purpose of establishing a robust database of voters for the federal elections of 2015, INEC carried out biometric registration of voters from 2011 to 2015 at 120,000 polling booths. Valid voters were issued a voter’s identity card with 4 fingerprints data embedded on the card (out of 10 fingerprints that were captured). INEC deployed card terminals for biometric verification of voters before voting. Eligibility Age 18+ years Target Population 69 million Enrolment 2011 Start Date Number of 120,000 polling stations Enrolment Stations Demographic Name, DoB, gender, Details Captured address, occupation, etc. Biometric Details Captured De-Duplication National Institute of Technology Standards & Technology Current Status of 76 million enrolled, Enrolment 69 million found unique Form Factor Smart Card INEC has been able to optimize the national voter registry to retain 73.5 million records in 2011 and 69 million records in 2015. De-duplication of the registry would further establish uniqueness of the people registered. 6.  F un ction al i d e nti ti es 25 6.2  Census registry One of the primary objectives of NPopC is to periodically enumerate population of Nigeria, through census, sample surveys, or other mechanisms. Since census provides critical input to development plans of federal and state governments, NPopC is required to provide reliable census information. However, historically, census operations in Nigeria have been marred by controversies, and raised questions about reliability of figures in census. Eligibility All Nigerian citizens Target Population ~170 million Enrolment Planned in 2016 Start Date Number of Info not available Enrolment Stations Demographic Name, DoB, address, Details Captured household details, etc. Biometric Details Captured De-Duplication Info not available Technology Current Status of Enrolment Yet to start Form Factor No physical ID To address these concerns, NPopC plans to collect biometric data of individuals using enumerating exercises for Census 2016. This biometric data will be used for de-duplication to provide reliable information through census operations. 26 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 6.3  Driver registry In February 1988, the government created the Federal Road Safety Commission (FRSC). The agency is responsible for designing, producing, and issuing driver’s licenses for various categories of vehicles; and for designing and producing vehicle number plates. FRSC was one of the first to introduce a biometric de-duplication system in Nigeria. It started biometric enrolment for issuing driver’s licenses as early as December 2008. The coverage of identification under this program is limited to individuals aged 18 years or higher who seek a driver’s license. Exact data regarding the number of enrolees in FRSC’s drivers’ registry could not be determined in preparation of this study. Eligibility Age 18+ years Number of Info not available License Holders Enrolment December 2008 Start Date Number of 140 offices with 179 Enrolment Stations enrolment stations Demographic Name, DoB, gender, Details Captured address, blood group Biometric Details Captured De–Duplication L1 Identity Systems Technology (now Morpho) Current Status of Enrolment Info not available Form Factor Plastic card with barcode After biometric de-duplication, each license holder is issued a driver’s license with advanced safety features and a barcode at the back. To read the information on the card, barcode scanners are available with each patrol officer on highways. The history of violations or offences is recorded in a central system. Some patrol officers have tablets which provide additional functionalities, such as location tagging, and capturing photographs of the incident site. 6.  F un ction al i d e nti ti es 27 6.4  Mobile phone subscriber registry The unregulated use of mobile phones in a country is known to aid in robberies, kidnappings, internet banking fraud, and terrorism. The National Communications Commission (NCC) has been working to adopt an identification technology that requires civilians to register purchases of a subscriber identity module (SIM) in order to operate a mobile phone. The use of a mobile phone subscriber registry can thus be helpful to track SIM card usage, prevent fraud, stop crime, and prevent sale of pre-activated SIM cards. To address these problems, NCC has started biometric enrolment of subscribers in partnership with telecom service providers, namely mobile phone operators. Eligibility SIM card holders Number of 110 million connections Subscribers Enrolment 2010 Start Date Number of Info not available Enrolment Stations Demographic Name, DoB, address, Details Captured occupation, gender Biometric Details Captured De-Duplication Bio-key International Technology AFIS Current Status of 82.6 million enrolled, Enrolment 38 million found unique Form Factor No physical ID Each civilian who purchases a SIM card is required to register with NCC through respective mobile service provider. NCC currently has linkage with National Security Agency (NSA) and has helped the agency in crime detection and control. NCC started SIM registration in 2010, and continued until 2013. Over 110 million records were collected. The data is currently being further validated. To date, about 38 million records are retained in the mobile phone subscriber registry by NCC. Additional SIM registries are reportedly maintained by individual mobile operators. 28 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 6.5  Banker registry On February 14, 2014, the Central Bank of Nigeria (CBN), through the Bankers’ Committee and in collaboration with all banks in Nigeria, launched a centralized biometric identification system, named Bank Verification Number (BVN), for the banking industry. The purpose of the project is to use biometric information to, first, identify and verify individuals who have an account(s) in any Nigerian financial institution, and, second, establish credit history of the individual. Use of biometrics is also envisaged to prevent identity theft, thus reducing non-performing assets for Nigerian banks. Nigerian Interbank Settlement System (NIBSS), owned equally by all licensed banks in Nigeria and by CBN, maintains the ID repository for BVN and provides verification services. Eligibility Bank account holders Number of ~30–40 million Account Holders Enrolment July 2014 Start Date Number of 5,000 bank branches Enrolment Stations with 10,000 stations Demographic Name, DoB, address, Details Captured bank acct. details, etc. Biometric Details Captured De-Duplication L1 Identity Systems Technology (now Morpho) Current Status of 6.75 million Enrolment Form Factor Plastic card Since June 2015, CBN has mandated BVN for all banking transactions;42 any customer without BVN is deemed noncompliant with KYC rules, and hence ineligible to carry out financial transactions. The program started in February 2014, and began enrolments in August 2014. The program operates about 10,000 enrolment stations at 5,000 physical centers, and is enrolling at a pace of 400,000 people per week. The program is fully funded by banks. By March 2015, about 6.75 million records are retained in the BVN registry. http://www.cenbank.org/Out/2014/BPSD/CIRCULAR%20ON%20ACCELERATION%20ON%20BVN2.pdf 42 6.  F un ction al i d e nti ti es 29 6.6  Pension registry Pension Commission (PENCOM) was established following the pension reform in 2004. The reform brought a paradigm shift in Nigeria’s pension system from a defined benefit scheme to a defined contributory pension scheme. PENCOM issues a personal identification number (PIN) to each contributor of pensions. This PIN is a unique number which can be used by the contributor for porting pension account after changing employer or Pension Funds Administrators (PFAs). All public and private Eligibility sector employees Number of 6.4 million Contributors Enrolment Planned start Start Date Q4 2015/Q1 2016 Number of All offices of 21 PFAs Enrolment Stations Demographic Name, DoB, address, Details Captured employment record Biometric Details Captured De-Duplication Technology SoftAlliance Biometrics Current Status of Enrolment Yet to start Form Factor To be decided Due to the absence of a robust de-duplication mechanism, PENCOM observed that there were instances of duplicate enrolments by PFAs resulting in multiple PINs per individual, thus defeating the purpose of PIN issuance. PENCOM is currently considering biometric enrolment of all contributors to de-duplicate PIN database. This enrolment will be carried out by PFAs on behalf of PENCOM, and data will be transferred to a pension identity repository maintained by PENCOM. PENCOM has a beneficiary population of roughly 6.4 million people, and has 21 pension enrolment administrators for enrolment. The biometric-based registry of PIN is yet to start. 30 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 6.7  Social registry of the poor The National Social Safety Net Program (NSSNP) is being planned by the federal government of Nigeria, with support from various bi-lateral and multi-lateral development agencies. The program aims to develop necessary systems for social safety nets, and provide support to the most poor and vulnerable households of society to help alleviate poverty. The program is at conceptualization stage, and, amongst other steps, NSSNP is developing criteria of eligibility for issuing benefits under the program. Eligibility Criteria to be established Target Population ~10 million Enrolment Yet to start Start Date Number of To be planned with NIMC Enrolment Stations Demographic Details Captured To be finalized with NIMC Biometric Details Captured De-Duplication L1 Identity Systems Technology (now Morpho) Current Status of Yet to start Enrolment Form Factor NIMC’s Smart Card As part of the program, NSSNP plans to operate a unified social registry of the poor and vulnerable in Nigeria. The program’s vision is to maintain an electronic register of the poor, and use as a common reference for all social development programs in the country, including safety net, health care, and education. NSSNP is at an early stage of planning the social registry, and aims to link with the national identity registry of NIMC. The development of the social registry of the poor is yet to start. 6.  F un ction al i d e nti ti es 31 6.8  Farmer registry Federal Ministry of Agriculture and Rural Development (FMARD), through its Growth Enhancement Support Scheme (GESS) program, provides support directly to farmers to enable them to procure agricultural inputs at affordable prices, and at the right time and place. Under this program, fertilizers and seeds are made available to farmers at subsidized prices in order to encourage agricultural activity in the country. Eligibility Farmers Target Population ~14.5 million Enrolment 2014 Start Date Number of Info not available Enrolment Stations Demographic Name, address, phone Details Captured number, etc. Biometric Details Captured De-Duplication L1 Identity Systems Technology (now Morpho) Current Status of Enrolment Info not available Form Factor NIMC’s Smart Card FMARD started farmer registration under this program in 2012. By 2013, it built a database of 10.5 million farmers. Subsequently, in 2014, it registered an additional 4.5 million farmers under the program. To prevent farmers from registering multiple times to get program benefits, FMARD wants to de-duplicate the database by capturing biometrics of beneficiaries. For this purpose, FMARD has started a pilot program in collaboration with NIMC in Kogi, Zamfara and Kano states. After a successful pilot, the collaboration with NIMC is being expanded throughout the country for farmer registration. 6.9  Challenge of parallel identities The incidence of parallel identity systems, each doing biometric data capture, without integration of identity programs, poses two challenges: ƒƒ Duplicated effort and inefficient use of public resources: Conducting biometric enrolment by each identity program leads to heavy duplication of effort, in terms of procuring similar computing hardware, software, and systems across government agencies; setting up parallel enrolment centers; conducting multiple resident enrolments; issuing multiple identity credentials; and maintaining multiple identity systems. These activities require significant fiscal spending, and create inefficiencies, as each government agency is trying to solve the same problem. 32 ID4 D C o u nt ry D i ag no s t ic : Ni geri a ƒƒ Inconvenience to residents: As each identity agency conducts separate enrolment, residents of Nigeria are required to provide biometric and biographical information multiple times to several government agencies. Residents also have to provide different supporting documents to each government agency leading to potential confusion. Residents have to carry multiple identity cards for different uses. Information provided to different government agencies may vary, and, without integration of identity systems, is difficult to verify. 6.  F un ction al i d e nti ti es 33 7.  Fiscal impact Parallel identity systems and duplicate biometric enrolment take a fiscal toll on the federal government, in addition to creating inefficiencies in the way government services are managed and delivered. An illustrative fiscal analysis can help showcase the magnitude of fiscal impact caused by the plurality of digital identity systems in Nigeria, in absence of effective interconnection. The fiscal analysis, as presented here, is illustrative, based on a given methodology and assumptions, since actual financial data of identity systems in Nigeria is not readily available. The availability of financial data can further confirm this analysis, and validate the duplication in fiscal spending. The analysis, as presented here, is based on experiences derived from several developing countries, and showcases the lower threshold of fiscal spending made by the federal government of Nigeria. 7.1 Methodology The following methodology is used in preparing the fiscal analysis: ƒƒ Unit cost of identity per person: Each identity program, whether foundational or functional, incurs a unit cost of identity per person for the life cycle of identity. This unit cost is cumulative of all capital expenses (CAPEX), incurred by setting up real estate and physical facilities, developing technology systems, and procuring simple cards; and all operating expenses (OPEX), incurred by paying staff salaries, conducting enrolment, paying for utilities (including electric power, and high-speed internet connectivity), printing cards, paying for transportation, and other expenses (marketing, communications, cost of capital, insurances, depreciation, etc.). The unit cost projects a time horizon suitable for reaching full scale of enrolment, which can run 5–8 years. The unit cost varies based on the efficiency and effectiveness of the identity program. The unit cost can be offset by revenues, though revenues typically follow the setup of a full-fledged identity system. ƒƒ Number of identities: Each identity program, whether foundational or functional, serves a target population of “unique residents” or “unique beneficiaries” to be captured and retained in its respective identity system. For national identity, this is the total population. For a functional identity, it is the total number of eligible beneficiaries to be targeted under its program. ƒƒ Total life cycle cost of identity program: The total life cycle cost of an identity program, whether foundational or functional, is the product of the unit cost of identity per person and the number of identities that it plans to retain. 34 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 7.2 Assumptions In conducting the illustrative fiscal analysis for Nigeria, the following assumptions are made: ƒƒ As of 2013, there were 173.6 million people in Nigeria in total.43 ƒƒ As of 2013, there were 96.6 million adults in Nigeria, i.e., people of age 15 or higher.44 ƒƒ Each resident of Nigeria (whether citizen or legal resident) is expected to have a national identity, and each adult is to have a national identity card, currently a smart card. ƒƒ To date, 6.1 million people are already enrolled for national identity, and another 167.9 million are to be enrolled. 418,000 national identity cards are already issued, and another 96.4 million national identity cards are to be issued. ƒƒ To date, 179 million are already enrolled by all functional identity programs, and another 385 million are to be enrolled across different functional identity programs. ƒƒ The average unit cost of identity per person is assumed US$5.0 in Nigeria across all identity programs in Nigeria, whether foundational or functional. This is a major assumption, and is derived based on the average unit cost of identity per person in other developing countries. This is likely a lower threshold of unit cost. Actual unit cost will vary by government agency, and will reflect the efficiency of identity operations of each agency. Since most government agencies in Nigeria are currently conducting biometric enrolment, the unit cost, as assumed, is a reasonable estimate. ƒƒ The average unit cost per smart card is US$3.50, based on industry estimate, and is in addition to the unit cost of identity per person. ƒƒ The federal government has already spent US$236.8 million for national identity registry during 2001–2006, under a program run by DNCR, as discussed under Policy Landscape. 7.3 Analysis Based on the methodology and assumptions, as given above, Nigeria has to date spent US$1.2 billion, and, following the current trajectory of parallel identity programs, is expected to spend another US$3.1 billion on disparate identity programs throughout the country. Following this analysis, the total fiscal impact of identity programs for the federal government of Nigeria is US$4.3 billion. Life cycle Cost of Identity Programs (illustrative costs, amounts in US$ million) Foundational Identity Functional Identities Total Identities issued $266 $897 $1,163 Identities to be issued $1,177 $1,925 $3,102 Total $1,443 $2,822 $4,265 43 Source: World Bank WDI (2015). 44 Ibid. 7.  F i s cal i m pact 35 Several observations are noteworthy: ƒƒ Unit costs matter: The unit cost per identity per person denotes the operational efficiency of an identity program, and is a key measure in the planning and operational oversight of the program. ƒƒ An integrated identity program can offer significant cost savings and efficiency: An integrated identity program, where the national identity offers a unique identity per person, and functional identity programs keep a list of eligible beneficiaries linked with the national identity, can offer significant cost savings to the fiscal burden of the government. The integrated system can also create significant efficiencies in the management and delivery of government services. ƒƒ The fiscal cost of a modern, well-developed and integrated identity program can be offset by savings in government efficiency: An assessment done by the Government of India showed that the government spent US$60 billion on welfare payments annually, within which there was 40% leakage in the distribution of food grains, US$200 million of leakage in the distribution of cooking gas, and less than 20% of government-issued benefits actually reached intended beneficiaries. The cost savings from using national identity to issue social services more than paid for the US$2.5 billion cost of the national identity program of India aimed for 1.25 billion people. 36 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 8.  Harmonization of identity registries Nigeria faces an urgent need to harmonize identity databases using NIN, remove duplicate identities, and achieve universal coverage. Though identity programs undergo similar processes to collect identity data, the programs are not linked. A coordinated approach for digital identity offers prospects of good governance, efficient service delivery, and effective fiscal management. 8.1  Current approach According to law and a government policy on harmonization issued in 2014, NIMC is responsible for coordinating harmonization of identity programs in Nigeria. Currently, NIMC offers the following components for harmonization, as summarized in Figure 9. ƒƒ Data capture: NIMC offers its enrolment centers as a resource to jointly capture data of residents with government agencies. As part of enrolment, NIMC collects its own data. With joint enrolment, NIMC is able to collect additional data as needed by other government agencies.45 ƒƒ Card design: NIMC offers a smart card to each enrolled person in Nigeria. The smart card offers multiple applications spanning a range of functions for use by the public and private sectors. NIMC offers custom applets to government agencies to help make use of smart card features. There is provision for post-issuance activation of applets for specific MDAs. ƒƒ Network: NIMC operates a high-speed internet link with 14 government agencies, providing them with fast linkage with its data centers and technology systems in Abuja. The links are used for data submission, and for submission and verification of unique identity. ƒƒ Co-location: NIMC offers co-location facilities at its data centers in Abuja to host functional registries or databases as needed by government agencies. The co-location is also offered for enrolment. ƒƒ Policies, standards, and regulations: NIMC has published a host of policies, standards and regulations to help establish harmonization of different databases in Nigeria. 45 NIMC provides an enrolment software that can capture data for issuance of NIN and eID cards, and for the specific data needed by the MDA. The MDAs can also capture data for their own purposes and send mandatory data for issuance of NIN and eID cards to NIMC as given by the harmonization policy. Once an MDA sends the required 10 data fields, including biometrics, a NIN and an eID card can be issued. It is when the individual comes forward to collect his or her card that the rest of the demographic data is collected. In both cases, there is provision for pre-enrolment for demographic data only. 8 .  Ha rmoniz ation of ide ntity r eg i str i es 37 Figure 9: Harmonization Approach of NIMC • Privacy Act Min. of Agric • Cybercrime Act s/ dard Da ATV • Uniform demographic & an ta e s /St s Ca biometric standards lici ion pt PenCom • Harmonization policies Po gulat ur e Re SSS • Personal information & data protection bill tion ICPC FRSC n sig ca De NIS Co-lo rd Ca NIPOST Card applets enable integration Network Established with all 14 stakeholder agencies 8.2  Current status NIMC is currently working with the following government agencies on harmonization: 1. Federal Ministry of Agriculture and Rural Development (FMARD) Until 2012, Nigeria did not have an electronic database of its farmers which made it difficult to effec- tively target them, especially smallholder farmers, with public support programs. The FMARD launched the first-ever registration and development of a manual farmer database for the country in 2012. A total of 11,000 enumerators were employed across all 774 Local Government Areas (LGAs) of the country. About 14.5 million farmers were registered over a course of 3 years from 2012 to 2014. FMARD has now collaborated with NIMC to capture biometrics of the registered farmers and to de-duplicate the data- base to prevent possible leakages and corruption. Under this collaboration, NIMC, CBN and FMARD have signed a Memorandum of Understanding (MOU) to integrate farmers’ database and the National Agricultural Payment Initiative (NAPI) with the NIMS deployed by the NIMC. FMARD has adopted the data capture equipment specified by NIMC. NIMC has also customized their enrolment software solution to capture additional fields. NIMC provides a pro- cedure for registered farmers to be enrolled for their national identification number (NIN) under the MOU. This arrangement has been successfully piloted in Kogi, Zamfara and Kano States, and is being extended all over the country. 2. National Social Safety Net Program (NSSNP) Through the NSSNP, the Federal Government is adopting a systems-based approach to social safety nets in Nigeria, and providing social benefits to the poor and vulnerable in the country. In this regard, NSSNP aims to establish a unified social registry of the poor and vulnerable in Nigeria to be used for delivering safety net services at federal, state, and local levels. The unified registry will be instrumental in ensuring that the beneficiaries being targeted under NSSNP, or other social development programs in Nigeria, are eligible beneficiaries. For the purpose of creating this unified social registry, NSSNP is collaborating with NIMC, and plans to link the social registry of NSSNP with the national registry of NIMC. 38 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 8.3  Considerations for harmonization Following are certain preconditions for achieving effective harmonization: ƒƒ Scale of national identity registry: A necessary precondition for harmonization is having a critical volume of entries in the national identity registry. The larger the national database, the greater the incentive for government agencies not to duplicate biometric enrolment, and rely on the national identity registry for unique identification. The rapid scale-up of the national identity registry is thus a high priority for the timely integration of identity registries in Nigeria. ƒƒ NIN as common identifier: While functional identity programs can issue their own citizen identifier, there needs to be a single unique identifier across databases for sake of harmonization. Therefore, each functional ID agency needs to capture and provision for NIN as a part of resident information.46 ƒƒ Availability of identity authentication and verification services: Functional identity programs require the ability to biometrically verify the identity of a beneficiary before service delivery. NIMC plans to but has not yet launched an online authentication and verification service on a commercial basis. 8.4  Models of harmonization The federal government of Nigeria may consider alternative models for achieving harmonization: ƒƒ Loosely coupled: Using NIN as a common reference or index in each database. ƒƒ Tightly coupled: Achieving near live (or real-time) integration of all identity databases. ƒƒ Single warehouse: Adopting a single warehouse of all identity information, both foundational and functional, with different windows (or interfaces) for different government agencies. Loosely coupled The model is predicated on a “federated system” of identity registries and a “minimalist approach” to integration. With a federated system, each identity registry, whether foundational or functional, holds separate information. The national identity registry holds the unique identity of all individuals in Nigeria given by a NIN per person. The functional identity registries hold additional information per person, as may be relevant to the individual being a beneficiary, with NIN as a common reference. In the federated system, each registry does its own work. With a minimalistic approach to integration, NIN serves as a common link amongst the various identity registries. The national identity registry offers an easy and secure way for a NIN to be electronically looked up. The functional identity registries use the look-up facility to validate the uniqueness of each of its beneficiaries. A federated system and a minimalistic approach do not require joint data capture, dedicated high-speed links amongst government agencies, co-location of identity registries, and shared functionality on identity credentials. Standard formats for a minimal number of fields of information may be needed. A federated system offers the benefit of greater security and privacy of people’s information, since data is distributed across different registries, though linked by a NIN. Moreover, NIMC may include a field for identifier issued by each functional ID so that an integrated view of a resident is available 46 and a holistic view could be used for developmental planning. 8 .  Ha rmoniz ation of ide ntity r eg i str i es 39 Figure 10: Loosely Coupled Model BVN NIN Name Gender DoB Address XXXX1 XXXX2 XXXX3 CBN NIMC with Resident KYR Data Linkage with Scheme Database Using NIN NIN Name Gender DoB Address Family Details PIN NIN Name Gender DoB Address XXXX XXXX1 XXXX XXXX2 XXXX XXXX3 PENCOM Voter ID NIN Name Gender DoB Address XXXX1 XXXX2 XXXX3 INEC Tightly coupled The model is predicated on two concepts: (a) more information is retained by the national identity registry; and (b) a high-speed link exists between national identity registry and functional identity registries for fast information exchange. In this case, the national identity registry holds know your resident (KYR+) data (such as additional demographic information, functional identity numbers, etc.) on each resident. As information is updated in the functional identity registry, it is quickly transmitted and retained in part by the national identity registry. The reverse may also happen, based on inter-agency agreements. Since the national identity registry thus holds KYR+ data, the government is able to run more complex queries to check beneficiary eligibility for specific services, or for development planning (such as, obtain a list of residents who receive social welfare benefits but also own an automobile). 9538_Nigeria_ID4D_Fig10.indd 1 6/16/16 9:57 AM A tightly coupled approach does benefit from or require joint data capture, dedicated high-speed links amongst government agencies, co-location of identity registries, and shared functionality on identity credentials. Detailed policies, standards, and data formats for information exchange are necessary. A tightly coupled approach raises higher risks for information security and privacy, and requires stronger legal safeguards to mitigate such risks. 40 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Figure 11: Tightly Coupled Model 1. Occupation DB 1 2. Education 3. Household Details PENCOM 4. Economic Status 1. Name 5. Physical Features DB 2 2. Date of Birth FRSC 3. Gender KYR 4. Address Other Info DB 3 5. Photograph Static Details CBN/NIBBS Dept. IDs DB 4 NIMC NHIS 1. Driving License No. 2. Tax ID DB 5 3. Voter ID 1. Blood Group INEC 4. Passport No. 2. Origin 5. Insurance No. Single warehouse The model is predicated on the notion that a single identity registry exists in the entire country, and all government agencies reference the same registry. All data captured by all government agencies go to the same registry. Each government agency has its own window to the same larger registry. A single warehouse approach requires central or coordinated data capture, dedicated high-speed links amongst government agencies, a single location for the identity registry, and a single multi-functional identity card. Detailed policies, standards, and data formats are intrinsic to the entire warehouse. A single warehouse approach raises high risks for information security and privacy, and requires sound legal safeguards for security and privacy of people’s information. Figure 12: Single Warehouse Model Front End Applications and Transaction Systems NIN Authentication NIN Enabled Payments NIN Enabled KYC Other Components & Services Voter ID Pension CRVS Insurance Driving Vehicle NSSNP Tax ID Passport Data Data Data Data License Reg. Data Data Data Data Data Single Database for All Resident Data 8 .  Ha rmoniz ation of ide ntity r eg i str i es 41 India’s Aadhaar uses a loosely coupled model India runs multiple G2P programs which involve establishing citizen identity before service delivery. For this purpose, government agencies have created functional identity programs (e.g., rural job guarantee scheme run by the government issues a job card which needs to be carried to demand work under the scheme). Registries of these functional identity programs have multiple duplicate/ fake records, leading to leakage of government funds. To plug such leakages, Government of India initiated a drive to link registries of functional identity programs with Aadhaar. After Aadhaar is linked with citizen records in functional identity registries, it can be used to run advanced analytics to identify areas of improvement for service delivery. In this model, the functional identity program maintains full operational independence and maintains its own registry in its own desired format. The harmonization is achieved only through linkage of the the functional identity registry with Aadhaar. 42 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 9.  International experiences Today, with Information and Communication Technology (ICT), it is possible to create large electronic registries, which can each be searched; use biometrics to reliably enrol individuals; and check the unique biometric profile of each person. In addition, with a greater part of the world’s population today using a mobile phone, it is becoming easier to electronically verify the identity of a person. Governments around the world are working to help establish a reliable, unique identity per person that can be universally accepted within the country. The approaches taken by countries is different, based on the country’s own economic, social, political, and development context. This section examines the experiences of two countries, India and Pakistan, which have successfully deployed and currently use digital identities for economic and social development. 9.1  India’s Aadhaar program India’s National ID program, Aadhaar, has been a success story in helping overcome the development challenges of the country over six decades since its independence. Since inception in 2010, Aadhaar has cost-effectively covered 840 million Indians, or over 67% of India’s population of 1.25 billion, and has become central to all major public sector initiatives in the country. Aadhaar is being linked to India’s election identity system. It is central to one of the world’s largest and fastest growing financial inclusion programs—the Jan Dhan Yojana. Under this program, over 125.4 million bank accounts that are linked to Aadhaar have been opened since the program’s launch in August 2014. Aadhaar is also central to the country’s rapidly expanding Direct Benefits Transfer (DBT) scheme. The program has managed to create a highly efficient business model. The unit cost of identity per person is estimated to be as low as US$2.0. A key enabler for the program’s rapid rollout and cost reduction was the use of no identity credential. The approach significantly reduced logistical challenges. The program uses a simple 12-digit number system and an easily downloadable e-Aadhaar concept. The enrolment form is less than a page in length. Government of India has long recognized that a weak identity system limits the power of the country’s residents when it comes to claiming basic political and economic rights. Agencies in both the public and private sectors in India usually require a clear proof of identity to provide services. Since the poor often lack such documentation, they face enormous barriers in accessing benefits and subsidies.47 Before scaling up, the Aadhaar program experienced significant institutional and operational hurdles. The government initially decided to split enrolment responsibility amongst two different institutions, Ministry of Interior and UIDAI. Each institution were to enrol half of the country’s population. Enrolment was slow at the start, though with simplification and consolidation, reached a critical mass. Civil society organizations also pointed out the importance of citizen privacy in retaining biometric information. The Unique Identification Authority of India (UIDAI), established under the Planning Commission in January 2009, is responsible to provide a unique identification number to every resident. The number can be used by the resident to access a variety of services and benefits. UIDAI has the vision of empowering every resident of India with a unique identity and providing a digital platform to authenticate the identity anytime or anywhere. https://uidai.gov.in/UID_PDF/Front_Page_Articles/Documents/Strategy_Overveiw-001.pdf 47 9.  I nte rn ationa l e xp e r i e nces 43 Figure 13: Aadhaar—A Digital Identity What It IS What It IS NOT ► A 12-digit unique ► Not a card identity number ► No profiling information ► Uniqueness ► No transaction record determined by demographics and “A universal identity ► No residency or biometrics infrastructure, a citizenship status [fingerprint, iris] foundation over which public and private ► Not mandatory ► Assigned to every agencies can build but voluntary ‘resident’ of India services and applications ► Only Yes/No response that benefit residents during verification across India” ► KYC details shared – Nandan Nilekani only on resident consent Legal framework To address the urgent need of a universal identity program, the UIDAI was constituted as an attached office under the aegis of the Planning Commission on January 28, 2009. Through the Commission’s notification, UIDAI was given authority to start biometric enrolment of residents and issue Aadhaar numbers.48 Another mandate for UIDAI was to deploy Aadhaar-based services and promote usage of Aadhaar in service delivery through harmonization with other government agencies. The government drafted National Identification Authority of India Bill, 2010,49 to provide legal backing to UIDAI. The draft Act authorizes UIDAI to collect information from residents, establish a central identity data repository (CIDR), and provide identity authentication and KYC services. The draft Act also defines provisions for data privacy and confidentiality to protect resident information in CIDR. The draft Act contains a list of offences and penal provisions. To date, the draft Act is to be passed by the Indian Parliament. In the meantime, the program draws its authority from the Indian equivalent of an executive order by the Government of India to establish the UIDAI and roll out the Aadhaar program. Ecosystem approach UIDAI adopted an innovative ecosystem approach to achieving scale of enrolments, as required to cover 1.25 billion residents under the program. As the apex body, UIDAI was responsible for maintaining the core identity infrastructure and systems, while the task of conducting enrolments was managed through a network of “registrars” (a government agency authorized by UIDAI for the purpose of enrolling individuals) and “enrolment agencies” (a government or private agency that captures demographic and biometric data of residents at the enrolment stations). UIDAI also created a training and operator certification ecosystem to support the registrars and enrolment agencies. Registrars are provided an incentive of roughly US$1 per successful enrolment. This incentive acts as a catalyst for scaling up enrolment infrastructure and conducting genuine enrolments. https://uidai.gov.in/images/notification_28_jan_2009.pdf 48 49 http://www.prsindia.org/uploads/media/NIA%20Draft%20Bill.pdf 44 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Figure 14: UID Enrolment Ecosystem in India Features of Enrolment Ecosystem ► Apex Body UIDAI ► Multi-register model to achieve Regional scale of enrolments Offices ► Across the country 8 ► Monetary incentive per Registrars ► State govt., successful enrolment banks, etc. 73 Enrolment ► Training and on-boarding ► Engaged by registrars >200 to ensure quality Agencies ► Creating business opportunities Enrolment Stations ► Across the country for intermediaries—banks and financial institutions, device providers ► Residents 1.25 B Components Quality Training Ecosystem UIDAI Device Biometrics Certification Assurance— Centres— India Post Other Centre of Operator Registrar & & National Agency Certification EA On- Helpline Competence Agency boarding Using this approach, in a span of 4.5 years, UIDAI has thus been able to provide unique IDs to more than 840 million residents in India. After the citizen data is collected by UIDAI and an Aadhaar is issued to a citizen, the mandate for UIDAI is to develop a system that provides for a cost-effective, online interface for authentication or verification of citizen identity. The aim was to support various authentication request types, such as demographic, biometric, simple, or advanced. To enable this, UIDAI developed an authentication ecosystem using a network of authentication or KYC service agencies (which have secure leased-line connectivity to the identity repository to transmit authentication or KYC requests), authentication or KYC user agencies (such as banks or telecom service providers that use identity authentication or KYC to enable their services), and authentication devices (i.e., laptops, PCs, handheld devices that are connected to biometric devices) to prepare and transmit data packets and receive results from the ID repository. The ecosystem approach to authentication also develops further security for UIDAI’s identity registry, since all access to the identity registry is channelled through two layers of intermediaries. Figure 15: UIDAI’s Authentication Ecosystem Features of Applications Ecosystem UIDAI CIDR ► Only authorized agencies (AUA/KUA, ASA/KSA) for transaction with CIDR to ensure security of data ASA ASA KSA ► Capacity to handle 100 M transaction requests/day ► Provided “Staged/Buffered transactions” AUA AUA AUA AUA KUA KUA KUA facility for transaction with CIDR, when there is no connectivity Auth Auth Auth KYC KYC device device device device device Aadhaar holders 9.  I nte rn ationa l e xp e r i e nces 45 Platform approach Though UIDAI is the largest repository of identity data, it opted not to add all resident attributes in its registry, to fulfil the mandate of easing citizen service delivery. Instead, UIDAI took the approach of “identity as a platform.” The Aadhaar system collects minimal data, enough to provide unique identity, issue the Aadhaar number after biometric de-duplication, manage lifecycle changes of that identity record, and provide an application programming interface (API) for providing identity details (eKYC) and verifying the identity (i.e., with online authentication). Designing Aadhaar as a pure identity platform allowed clear separation of roles, leaving use of identity to partners, with various partner applications built on top of the Aadhaar platform. Apart from this, UIDAI has created a platform for payments in coordination with National Payments Corporation of India. The Aadhaar number is used as a financial address for transactions with a bank account linked with Aadhaar in the background. Figure 16: Aadhaar Based Technology Platforms Aadhaar Based Technology Platforms Payments Authentication eKYC SRDH (APBS/AEPS) Online, anytime, Simple and Aadhaar enabled Universal KYR anywhere paperless KYC transfer of benefits database for all authentication of using Aadhaar ID and transaction residents of Aadhaar ID services the state Using these platforms, the Government of India has initiated harmonization of identities using Aadhaar. Like Nigeria, India runs multiple G2P programs which involve establishing citizen identity before service delivery. For this purpose, government agencies have created functional identity programs (e.g., rural job guarantee scheme run by the government issues a job card which needs to be carried to demand work under the scheme). Registries of these functional identity programs have multiple duplicate/fake records, leading to leakage of government funds. To plug such leakages, Government of India initiated a drive to link registries of functional identity programs with Aadhaar. After Aadhaar is linked with citizen records in functional identity registries, it can be used to run advanced analytics to identify areas of improvement for service delivery. 9.2  Pakistan’s NADRA program In Pakistan, efforts to create a national identity system started in 1973, with promulgation of Article 30 of the second amendment of the Constitution of Pakistan to perform identification and maintain a statistical database of all citizens of Pakistan.50 Registration under this program required a citizen to provide demographic data, address, photograph, and thumb impressions, all of which were stored in physical paper files before issuing a national identity card. Thus, the ability of the government to provide a unique http://www.thenews.com.pk/Todays-News-3-142174-From-an-idea-to-reality-Pakistans-smart-card 50 46 ID4 D C o u nt ry D i ag no s t ic : Ni geri a identification to each citizen was limited, and a paper-based identity card could not be used as a reliable document for identity verification. In 1999, Pakistan’s military, charged with responsibility of conducting a door-to-door census, began contemplating to merge two institutions: the Directorate General of Registration (DGR) responsible for providing national ID cards to citizens; and the National Database Organization (NDO), created in 1998, responsible for conducting census, computerizing census data collected, and issuing computerized cards. The “National Database and Registration Authority (NADRA) Ordinance, 2000,” came into being on March 10, 2000, by merging the DGR and NDO, and was introduced with the aim of reducing government interference in the process of registering people and providing national ID cards.51 The ordinance lays out a blueprint for how to register individuals. Figure 17: NADRA at a Glance What It IS What It IS NOT ► A 13-digit unique ► No transaction record identity number with first stored 5 digits based on applicant's locality ► Registration is not enforced on citizen but required to ► Uniqueness determined by avail government services biometrics (fingerprints “Empowerment and facial recognition) through identity” ► Assigned to every citizen of Pakistan as well as legal resident with foreign nationality ► Issues a smart ‘multi-purpose identity card’ after successful registration ► Used extensively for service delivery by government departments The mandate NADRA was created as an autonomous body to operate independently, and given the mandate to replace the old DGR with a computerised system of registering all citizens of Pakistan. Specifically, the mandate of NADRA is to develop and provide:52 ƒƒ National identity documents for all citizens and noncitizen residents of Pakistan. ƒƒ A national data warehouse that draws together Pakistan’s main government databases. ƒƒ A national information infrastructure for online, nationwide access to the national data warehouse. ƒƒ A national spatial data warehouse infrastructure to establish a comprehensive geographic and land information system. http://www.cgdev.org/publication/ft/technology-service-development-nadra-story 51 52 http://www.egov4dev.org/success/case/nadra.shtml 9.  I nte rn ationa l e xp e r i e nces 47 Enrolment approach NADRA took the approach of setting up and running enrolment centres throughout the country on its own without notable partnerships. Due to limited technical capabilities, NADRA faced challenges in identification during 2001–2005.53 Many Pakistani citizens did not have identity cards, many non-nationals had national identity cards, and there were many fake identities. In 2007, NADRA started using fingerprint de-duplication to issue national identity cards, and, in 2008, the data architecture was further improved to include a full set of 10 fingerprints and a digital photograph. This technology was powerful enough to enable full de-duplication of the national database, and greatly reduced the prevalence of dual identities and identity theft. Using this organization and technology, NADRA rapidly increased registration from 54 million in 2008 to 98 million in 2014, covering roughly 55 million men and 43 million women. The below diagram provides the status of enrolment infrastructure as of 2014.54 Figure 18: NADRA Enrolment Infrastructure 537 Static Registration Centers 1,000 Servers Connected to 15 Overseas 9,000 Registration Computers Centers NADRA Enrolment Infrastructure Two Data 236 Centers Mobile Vans 74 Semi-mobile Units Products and services Using the national data warehouse created through enrolments, NADRA provides the following services to government and private agencies: ƒƒ Phonetics—search engine which searches on the basis of names ƒƒ Family identification—offers vertical and horizontal family linkages ƒƒ Verisys—web-based verification system based on biometrics ƒƒ Registration tracking—follows an applicant’s profile throughout the life cycle of processing 53 http://www.cgdev.org/publication/ft/technology-service-development-nadra-story 54 ibid 48 ID4 D C o u nt ry D i ag no s t ic : Ni geri a Apart from this, NADRA also provides additional services, including civil registration management system,55 multi-biometric e-passport,56 machine-readable seafarer’s identity document,57 biometric access control system,58 biometric attendance control system, automated border control system,59 e-driver’s license,60 secure document production,61 e-vehicle management system, e-commerce platform, and e-ballotting solution. Computerized National Identity Card Since its inception in 2000, NADRA issues a computerized national identity card (CNIC) to Pakistani citizens and an equivalent to Pakistani diaspora. The CNIC is issued at the age of 18, after capturing the biometrics of a resident.62 The identity card has the following information on it: legal name, gender (male, female, or transgender), father’s name (husband’s name for married females), identification mark, date of birth, national identity card number, family tree identity number, current address, permanent address, date of issue, date of expiry, signature, photo, and fingerprint (thumbprint). Figure 19: Types of ID Cards Issued by NADRA In 2012, with the aim to enhance security features of the card, mitigate forgery, and expand usage in government service delivery, NADRA introduced smart national identity card (SNIC). Pakistan’s SNIC contains a data chip, 36  security features, and complies with ICAO standard 9303 and ISO standard 7816‑4. The card contains match-on-card applets, enabling remote verification of citizens. The card also has a QR code at the back, which works as a security feature, as scanning the QR code provides the same information as on the front and back of the card. 55 https://www.nadra.gov.pk/index.php/solutions/auto-id/civil-registration-management-system 56 https://www.nadra.gov.pk/index.php/solutions/auto-id/multi-biometric-e-passport 57 https://www.nadra.gov.pk/index.php/solutions/auto-id/machine-readable-seafarer-identity-document 58 https://www.nadra.gov.pk/index.php/solutions/corporate/biometric-access-control-system 59 https://www.nadra.gov.pk/index.php/solutions/e-governance/automated-border-control 60 https://www.nadra.gov.pk/index.php/solutions/e-governance/e-drivers-license https://www.nadra.gov.pk/index.php/solutions/e-governance/secure-document-production 61 62 https://www.nadra.gov.pk/index.php/products/cards/cnic 9.  I nte rn ationa l e xp e r i e nces 49 Service delivery The Government of Pakistan has recognized the need of uniquely identifying citizens to improve service delivery and has made CNIC use mandatory for availing multiple government services. With about 98% coverage of Pakistani nationals above 18 years of age, NADRA offers an opportunity to reliably establish the identity of citizens at the time of enrolment under a government programme and at the time of service delivery. Increasingly, NADRA’s database is being used to validate eligibility of nominated beneficiaries at the time of their registration and identity establishment for service delivery. Under Pakistani law, it is not compulsory to carry CNIC. However, for Pakistani citizens, the CNIC is mandatory for conducting transactions with the government such as: ƒƒ Voting ƒƒ Opening and operating bank accounts ƒƒ Obtaining a passport ƒƒ Purchasing vehicles and land ƒƒ Obtaining a driver licence ƒƒ Purchasing a plane or train ticket ƒƒ Obtaining a mobile phone SIM card ƒƒ Obtaining electricity, gas, and water ƒƒ Securing admission to college and other post-graduate institutes ƒƒ Conducting major financial transactions 50 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 10.  Lessons learned The case studies of India and Pakistan illuminate lessons learned in developing digital identity systems. Nigeria’s own experiences in setting up earlier identity platforms, and the recent work of NIMC, offer additional lessons. In developing countries where well-built identity platforms exist, top-level government leadership serves as a common denominator, to help drive the agenda, financially support the identification program, and foster integration. Several lessons learned are noteworthy. Enrolment Enrolment poses a central challenge for identity platforms to achieve nationwide coverage of data collection about citizens. Partnerships are one way by which the task of enrolment can be managed. The approach worked well in India, where the government took an “ecosystem approach” and an “incentive approach” to brokering partnerships. The government still required extra effort to coordinate partnerships and make them work. In contrast, the government of Pakistan conducted enrolment centrally, under one institution, and spent greater time and effort to reach nationwide coverage. Citizen demand An understanding of citizen demand can help policymakers address challenges faced by citizens in being enrolled. These challenges may be due to bureaucratic literacy, transaction cost, opportunity cost, vulnerability to corruption, and lack of social capital. As a result, the poor may be unable to get registered or benefit from services offered by the government or the private using digital identity. In India, for example, despite processes being automated for enrolment, applications for birth certificates incurred heavy transaction cost, for gathering supporting documents, and resulted in high rejection rate, since birth certificate issuance had to be concurred by three different officers.63 Data Digital identity platforms capture sensitive data about citizens. As a harmonized identity ecosystem becomes more tightly coupled, or takes the form of a single warehouse, data about citizens gets clustered. The risks associated with information security and privacy thus become higher in case information is misused or exploited. Strong legal safeguards are necessary to mitigate the risks associated with data security and privacy. Credential The choice of credential poses several considerations: (a) a multi-functional identity credential offers new functionality though has the potential to conflate the institutional roles of unique identity and service delivery; (b)  a credential adds costs; and (c) supporting infrastructure for accepting multi-functional identity cards may be required. In Pakistan, the government used a simple card in its first rollout of national identity, and a smart card in subsequent rollouts. In India, the government opted not to use a physical 63 Deloitte. 2014. Strengthening Service Delivery: Assessment of Implementation of Jharkhand Public Service Act, 2011. 10.  L essons l e a r ne d 51 credential, and instead offered a unique identity number (i.e., Aadhaar) on a piece of paper. In Ghana, the government offers a simple card free of charge, and a smart card for a fee. Harmonization Each country adopts a harmonization approach suitable to its country context. A federated and minimalist approach to harmonization, in the form of a loosely coupled model, is a good way to start and can be powerful in simplifying harmonization and bringing coordination amongst identity platforms with a unique identity number. In India, the government used a loosely coupled model to harmonize different identity platforms throughout the country. In Pakistan, the government used the single warehouse approach, and thus faced greater risks for information security and privacy. 52 ID4 D C o u nt ry D i ag no s t ic : Ni geri a 11.  Considerations for a roadmap Nigeria has long recognized the need for national identity, and has made several attempts to establish a national identity registry, albeit with mixed success. Today, the advent of electronic applications and services puts a renewed emphasis on having a widely available digital identity in Nigeria. The need is acutely felt by government agencies and the private sector that strive to offer services to their beneficiaries and consumers. In the absence of a scaled-up national identity, multiple identities have mushroomed in Nigeria, creating a fiscal burden, and causing public and private sector inefficiencies. The federal government of Nigeria may consider the following steps in preparing a revised roadmap for a modern, well-developed, and integrated identity ecosystem in Nigeria. ƒƒ Sharpen the vision of identification with an emphasis on rapid scale-up, full integration, and cost optimization: The federal government started out with a wholesome and clear vision for national identification, as given by the NIMC Act of 2007, and additional related Acts. The NIMC Act mandates NIMC to set up a national identity registry, issue national identity cards, provide identity verification services, interlink all identity registries, and stay on the cutting-edge of identity management. The related Acts provide for civil registration, legal residency, and electoral voting, amongst other areas. Yet, eight years later, though progress is made, the vision of a widely available national identity is not fully realized, due to known hurdles and challenges. Nigeria faces an urgent need of scaling up national identity, integrating identity systems, cutting fiscal costs, and achieving efficiency in service delivery and management by addressing challenges more rapidly dealing with identity management. In light of these, the country’s vision for identification may require further refinement, keeping in view longer-term objectives of a modern identity system that is financially and operationally practical. ƒƒ Strengthen the policy and legal environment: A refined vision would dictate a re-examination of the policy and legal environment, with an eye towards scale-up, integration, and cost. Since 2007, new advances in identity management have emerged that may inform the policy and legal environment of identification in Nigeria. The proliferation of mobile phones, growing use of online and mobile applications, and resulting surge of electronic data require a hard look at security and privacy of information. Strong legal safeguards are thus necessary for security and privacy. A robust assessment of the legal enabling environment is an important step; to review, among other things, the existing institutional and governance arrangements, and the robustness of any safeguards for individual privacy and data protection. The incidence of multiple identity programs, with little or no interoperability across the systems, can be symptomatic of weaknesses in the legal framework (and underlying policy imperatives). A critical step towards harmonizing institutional and governance arrangements, ensuring consistent technical standards and interoperability, and providing robust privacy and data protection provisions, depends upon the development and implementation of a holistic and coherent legal enabling environment. A supportive enabling environment for digital identity can also pave the way for further innovations, including electronic commerce, mobile financial services, and modern transport, in Nigeria. ƒƒ Drive integration of parallel identity systems: Despite notable steps taken by government, the identity systems of Nigeria remain mostly unintegrated. The government set up a Harmonization Committee in 2005, a Presidential Implementation Committee in 2006–2007, a Cabinet Committee in 2011, and a Presidential Committee on Centralisation of biometric-linked databases in MDAs in 2013. NIMC has carried out work on harmonisation and integration since 2007 under its Implementation Committee. Despite these efforts, the number of parallel identity systems in Nigeria has grown. A 11.   Conside r ations for a roa d m a p 53 renewed focus on integration can be helped by a simplified approach to integration, and greater coordination amongst government agencies. The availability of identity verification is necessary for integration of identity systems, and needs to be expedited. ƒƒ Optimize costs: Low cost of identity development in Nigeria is critical. Low cost can achieved in three ways: (a) by reducing the cost of each identity program; (b) by eliminating costs due to inefficiencies of parallel identity systems; and (c) by streamlining several aspects of identity programs to avoid duplication of efforts and achieve synergy. In reducing the cost of each identity program, the unit cost of identity per person is a key measure. It defines the operational efficiency of an identity program. It drives planning of identity development. It serves as a benchmark to keep implementation on track. The unit cost of identity per person is derived by a detailed business model of the organization running the identity system. The unit cost of the foundational identity should be thoroughly checked and optimized, and be fully aligned with the organization and operations of the national identity registry. The unit cost of functional identity programs should be examined, in particular to minimize or eliminate any duplication in biometric enrolment, and to allow seamless and rapid integration. In eliminating costs due to inefficiencies of a parallel identity system, the integration approach is key. ƒƒ Support partnerships: Partnerships can be helpful for dividing large tasks, distributing responsibilities, and exploiting core competencies of diverse organizations. Yet, partnerships are tricky. They require heavy coordination amongst partnering parties. A weak partnership can at times be counter-productive, slowing down shared operations. The federal government of Nigeria has made several attempts to use partnerships in developing identity programs, though with mixed results. Partnerships may still be necessary, both for enrolment and for bulk services. Scaling up enrolments, for example, is a difficult exercise without partnerships. Similarly, partnering with the private sector may be helpful in card infrastructure and services, including for printing and acceptance. Building new capacity to carry out these functions is a tall order. ƒƒ Mobilize resources: The federal government should prioritize mobilizing sufficient resources for identity development in Nigeria, once a well-developed plan is in place, an integration model is refined, and unit cost of identity per person is fully optimized. The government may consider fiscal appropriations, donor contributions, and private sector participation. A coordinated approach to funding across government for different identity systems can help achieve fiscal efficiency. ƒƒ Scale up with speed: Since 2007, a lot of work has been done on identity in Nigeria. Though, rapid scale-up of enrolments remains a major hurdle. The speedy development of a national identity registry, with 173.6 million entries, reflecting the country’s total population, is necessary for Nigeria’s economic and social development, and for integrating the country’s different identity platforms. 54 ID4 D C o u nt ry D i ag no s t ic : Ni geri a worldbank.org/id4d