PRESS CONFERENCE NOTES AND QUESTIONS TO GOVERNMENT ON TRIDENT ID

CITIZENS OF BARBADOS ASK GOVERNMENT PERTINENT QUESTIONS ABOUT THE TRIDENT ID & BARBADOS IDENTITY MANAGEMENT BILL.
Friday, Jan. 26th, 2024

The below questions regarding the Trident ID card and system have been compiled and contributed by several members of the citizenry of Barbados.

Questions related to the Security, Privacy and Management of Personal Data:

Barbados has been victim to a “barrage of cyber-attacks on critical institutions”. Cyber-attacks have been launched on the QEH, commercial banks and  Credit unions, retail operators and individuals. In the last three years alone, government agencies themselves have been victim to several data breaches, three of which are as follows:

1. The Barbados Electoral List:
On December 29th, 2021, a preliminary list of over 264,000 Barbadians including our names, national registration number (NRN), gender, date of birth, residential status, constituency, polling station and address was exposed to the open web. Though the list of voters has been removed, the 5,520 paged  Adobe PDF document which could be downloaded by anyone with access to the internet, has been shared multiple times on social media and Whatsapp and has even been uploaded to online platforms such as Reddit.

One digital expert commentator states “it should be assumed this information is in the hands of criminals and may be used to launch general or targeted attacks against individuals.” What are the risks? This faux pas by the Electoral Office has exposed us Barbadians to significant risks of financial fraud, stolen identity, stalking, home invasion and assault, the creation of fake IDs which may be used to open lines of credit, change legal titles, withdraw
funds from financial organisations, obtain new passports at foreign consulates or otherwise solicit business services illegally.

Who was responsible for managing and securing this data? The same Electoral and Boundaries
Commission that will be controlling our Trident Digital ID.

2. The IDB Computer Pre-Test:
The IDB controversial Computer Science pre-test was administered on October 3 at five secondary schools in Barbados without parental consent and under the aegis of the Ministry of Education. It included “distasteful and invasive” questions that quizzed students on their sexuality, gender identity, substance use and abuse as well as personal information about their parents.

Who was responsible for managing and securing this data? The same government that will be controlling our Trident Digital ID.

3. The Cyber-attack on the QEH
In December, 2022, there was the cybersecurity breach at the Queen Elizabeth Hospital (QEH),
which resulted in the suspension of critical medical facilities and services such as the dispensing
of medication for new prescriptions at outpatient clinics and the Accident and Emergency
Department (A&E).

Who was responsible for managing and securing this data? The same government that will be controlling our Trident Digital ID.

§ Within the context of the historical failure of government agencies to adequately
protect our data, what mechanisms have been put in place to effectively store,
protect and manage the information of hundreds of thousands of Barbadian adults
and minors – information that will be accessible on the Trident Digital ID from
January 31st, 2024??
§ In light of the engagement of private companies to supply, build and manage the
DID system, what specific and clear measures have been implemented to counter
potential risks of misuse or abuse by corporations and to protect the personal data
of hundreds of thousands of Barbadians from being used to increase corporate
profit?

Questions regarding the technical, financial, and human infrastructure surrounding the Trident DID System:

During the rollout of the Trident Digital ID, there have occurred several hiccups that prevented the full implementation over the past two years of the card. For example, the deadline for use of the old Barbados ID has been extended four times since the
roll-out of the new Trident ID cards in 2022.
And in February 2023, a technical issue with online registrations slowed the process.

Niel Harper (a Digital Trust expert adviser to global organizations such as Aspen Institute, AT&T Wireless, Bemol, Canonical, CIBC, Deloitte Consulting, Doodle, European Commission, Internet Society, UNICEF, UNOPS) has commented that:
“The Government of Barbados DOES NOT have the resources (people, processes, or
technologies) to secure complex IT systems and provide consistent privacy-enabling solutions. If
they did, there would not be so many successful cyber-attacks and data breaches of government
online systems in recent years (e.g., Queen Elizabeth Hospital, Ministry of Information and
Smart Technology, Immigration Department, Barbados Police Service, and many others). Until
government invests significantly in building their capacity in these areas, their IT systems and
the personal data of Barbadians will be AT RISK.”

§ Within the context of a clearly ill-equipped government infrastructure that has
attempted to and repeatedly delayed the full rollout of this Digital ID in the past two
years, what measures have been implemented that ensure that our data is not
breached now and in the long-term?
§ Are there expert and skilled government personnel trained to deploy and support
the DID system now and in the long-term??
§ What alternative and contingent methods of Identification are in place to counter
unintended consequences that can lead to the exclusion of persons from access to
critical services?
§ What mechanisms will be put in place to address grievances and complaints from
citizens who may encounter difficulties or discrimination in obtaining or using the
Barbados Trident Digital Card, and how will the government ensure transparency
and accountability in the resolution of such issues?

Questions regarding risks associated with the centralized nature of the Trident DID System:

In addition to security and proper management of data, there are the concerns related to risks that accompany the centralisation of so much data in one entity and the sharing of our personal data without user consent.

According to PART II (Fifth Schedule) of the BIMA,
Particulars contained in the digital chip of the identification card include:
Our Electronic signature.
Our Password.
A Certificate for electronic identification.
A Certificate for electronic signature.
Other representations or unique identifiers that may be stored electronically.
Other personal data required pursuant to
(a) a relevant enactment; or
(b) an international convention to which Barbados is a party.

The Act suggests that, when pinned, the card will also contain banking and transactional data, as well as location-based information culled for example from using pinned cards in public transportation.

§ What provisions are in place to address concerns regarding potential misuse or
abuse of personal data collected through the Barbados Trident Digital Card system,
and how will the government ensure transparency and accountability in its handling
of citizens’ sensitive information?
§ How does the government plan to resolve public concerns regarding the centralized
nature of the Barbados Trident Digital Card system, including fears of surveillance,
identity theft, and unauthorized access to personal information by government
authorities or third parties?

Part III (5th Schedule) (15 a & b) states that the ID will contain:
Other personal data required pursuant to (a) a relevant enactment; or (b) an international
convention to which Barbados is a party.

§ What international convention is the act referring to?
§ Why would a law be written subject to unknown events and conditions?
§ Why would an identification mechanism not be fixed and static?
§ Who is the owner and beneficiary of the Trident ID card?

Questions related to the expiry of the National Identification Card and the establishment of a January 31st deadline to acquire the Trident ID card:

The government has issued a directive that the old National Identification Card expires on Wednesday, January 31, 2024, after which it will not be valid as proof of identity.

§ What contingency plans are in place to assist individuals who may face difficulties
or delays in obtaining the Barbados Trident Digital Card by the January 31, 2024
deadline, especially considering the potential risk of being rendered stateless and
unable to access critical government services?
§ How does the government justify the requirement for citizens to obtain the
Barbados Trident Digital Card in order to access essential services such as welfare,
medical treatment, and unemployment benefits, particularly for those who may face
challenges in obtaining the card? For those who do not want to have a digital ID or
who do not want to pin their ID card?
§ Will there be provisions for alternative forms of identification or verification for
individuals who are unable to obtain the Barbados Trident Digital Card due to
extenuating circumstances, such as lack of documentation or technical limitations,
and if so, what criteria will be used to assess eligibility for such alternatives?
§ What exactly is the ID card intended to do?
§ Why are cardholders required to pin the card?
§ Is it required or is it optional?
§ What are the implications for cardholders who pin the card?
§ What are the implications for cardholders who DO NOT pin the card?
§ Where can we go to get accurate, up to date information on the Trident card?
§ Where used for identification purposes, can citizens use other official forms of
identification? (Drivers Licence, Passport)?
§ Can the Government clarify what is required in relation to the issuing of
identifications cards for children under 18 years old?
§ If the government wants to give citizens access to technology for convenience, why
not create a separate mechanism for that purpose? Why tie this need for
convenience and access to technology to the national identification card?

Questions related to human rights, discrimination, and legality of the Trident ID Card system:

When Government said that from January 31st, 2024, the old National Identification Card will expire and that only the Trident ID will be accepted as identification, the Trident ID will become mandatory in practice, even if not in law.

In 2019, the Supreme Court of Jamaica found Jamaica’s national identification system in violation of the constitution and by unanimous decision declared the entire National Identification and Registration Act (NIRA) void since the DID system went beyond identification of persons to a repository of biographical information that could potentially serve as digital surveillance.

The Trident ID system, similar to the Jamaica ID system, aims to consolidate identity and demographic information of persons in Barbados and under the BIMA, makes it a criminal offence for a person not to register under the new law. Like Jamaica, the system surrounding the Trident ID system potentially creates good grounds for the violation of our constitutional rights as citizens of Barbados.

§ Can the government provide clarification on the legal basis for requiring citizens to
obtain the Barbados Trident Digital Card in order to access government services,
and how does this requirement align with existing laws and constitutional rights
pertaining to freedom of movement and access to public services?
§ Which law empowers the Government of Barbados to declare that the current
National ID expires?
§ How will the government ensure that the transition to the Barbados Trident Digital
Card system does not disproportionately impact vulnerable or marginalized groups,
including the elderly, disabled, or socioeconomically disadvantaged individuals, who
may encounter barriers to obtaining or using the new identification card?
§ What provisions are in place to ensure accessibility for illiterate people, people with
disabilities, minority groups such as members of Rastafarian communities?
§ What features of this DID system will ensure that international human rights and
constitutional standards are served in the interest of various communities?
§ Has the government conducted thorough assessments of the potential social and
economic impacts of mandating the Barbados Trident Digital Card, including its
effects on employment, privacy rights, and access to justice for individuals who may
face challenges with the new identification system?
§ Can the government provide assurance that the implementation of the Barbados
Trident Digital Card system complies with international standards of human rights,
particularly regarding the right to identity and access to essential services without
discrimination?

Violation of constitutional and human rights – basis for court action:
The Government of Barbados has issued a deadline by which the old ID card will no longer be acceptable as identification and the Trident ID card will be the only acceptable means of identification.

As citizens we assert that this action by the government renders the Trident ID card mandatory in
practice even if not in law.
As citizens we declare that our constitutional rights and freedoms are being infringed upon and that those who do not sign up for the ID card or do not pin their Trident ID card will be disadvantaged and discriminated against as they would be denied access to public services. If these conditions are applied regarding the Trident ID card, the citizens of Barbados will take this matter to court to protect their constitutional rights and freedoms.