Fingers Keepers

Khadija Sharife / GIJN

Because everything is electronic, our shadow selves exist

• Unlike a password or an alarm code, your fingerprint, iris and DNA cannot be changed.
• Most developing countries lack data privacy and data protection laws including how biometric data is collected, retained, shared or transferred, safeguarded, audited and what use rights exist for the government and third parties.
• Most developing countries may be corrupted or corruptible in terms of tender procedures, conflict-of-interest rules, opaque subcontracting

​

• Most developing lack strong and resourced oversight bodies responsible for identity systems including ownership of citizen data, cybersecurity and critical infrastructure laws such as protection of national databases, vendor limits, transfer prohibitions, security standards for foreign contractors etc.

​

• Most developing countries fall short of human rights and constitutional protections including the right to privacy, non-discrimination, freedom from surveillance.

Developed countries aren’t much better

Just better legislated

Department of Homeland Security (DHS) in the U.S. regarding expanded biometric collection (including DNA) — in five key points:

1. A proposed rule allow DHS to require submission of biometric data from virtually anyone filing an immigration-benefit request, or connected to such a request (including sponsors, dependents, U.S. citizens), and irrespective of age.
2. “Biometrics” under the proposal is broadened to include traditional identifiers (fingerprints, iris scans, facial recognition, voiceprints) and DNA samples/ profiles.
3. The proposal would eliminate, or significantly loosen, age-exemptions, meaning children (including under age 14) could be subject to DNA/biometric collection.
4. The rule also expands DHS’s power to reuse or retain biometrics for broader purposes: continuous vetting, immigration enforcement, fraud prevention, identity verification, and possibly law-enforcement uses
5. The US government has also primarily outsourced data contracts to companies like Palantir

Alex Karp did not star in Lord of the Rings

But still wants to kill a bunch of people

• How do you defend your country and kill your enemies? Our product is used on occasion to kill people”.
• "I'm super proud of... what we do to protect our soldiers... (using our AI) to kill our enemies and scare them, because they know they will be killed”.
• The company looks to "bring violence and death to our [the United States'] enemies”.
• The company's software helps "fewer good guys kill more bad guys.”
• In December 2024 Palantir announced an extension of a contract with the United States Army worth up to $619 million. The stock climbed from $17 to $70. After that announcement PLTR “shares climbed” — Trump Trade
• Palantir has added more than $23 billion to its market capitalisation since Donald Trump was elected.

Private foreign companies aren’t better.

Run by shareholders, not stakeholders

• Biometrics are permanent — unlike passwords, fingerprints & irises can never be changed.

​

• When a foreign private company controls enrollment & databases, citizens lose control over their identities.
• Cross‑border data storage from companies like Semlex (EU–UAE–Africa) exposes populations to hacking, trafficking & political misuse.
• Weak contracts in developing states, often with little to no data privacy laws, often omit safeguards: ownership, retention, encryption, oversight.
• A compromised biometric system can rig elections, enable surveillance and repression & lifetime vulnerability for millions.

Contracts like these

Who needs to rig elections…

• DRC regime & Belgian-based Semlex
• Production of biometrics under BOT
• Design / implementation / operation etc
• Multiple entities / jurisdictions incl
• UAE / Lithuania / Belgium

What they do

SbBiometric passport system typically involves:

• Collection of personal data
• Collection of biometric identifiers (fingerprints, facial image, possibly iris)
• Storage, transfer, and processing of sensitive data
• Integration with national civil registry systems

wh ……So who owns the biometric data: who stores it, who has access, how long is it retained, who is subcontracted, where are back-ups stored?

Contract failed to ensure data protection and privacy laws, purpose limitation, minimization, retention limits etc.

• Congolese had a centralized biometric database operated by a private vendor
• There were no / unclear encryption standards
• There were no / unclear access logs and audit trails
• There was obvious and probably cross-use for surveillance or political control
• The vendor’s financial interests leading to oversharing or resale of identity data
• The vendor outsourced to multiple third parties
• The vendor corruptly agreed to kickback $60 USD to Kabila for each document
• Multiple legal violations vis-a-vis EU GDPR laws but little reach where partner is corrupt: Relevant, GDPR articles: Art. 3(1) – territorial scope, Art. 4 – definition of processing, Art. 5–6 – necessity of lawful basis, Art. 9 – special-category biometric data, Art. 44–49 – transfers outside EU

Semlex’s War Games

Using the little black book

• The Take
• $1.6M transfer from Semlex via Caminex for Russian arms through broker
• 1.6M barrels of crude ($160M) bought by Gunvor with $2 commission per barrel
• Weapons list: millions of rounds, thousands of RPGs, hundreds of grenades from Russian

​

• Financial & Arms Flows:
• Semlex → Caminex (arms dealers) → Gbagbo regime
• Russian owned commodity trader Gunvor → Oil purchases from sanctioned regime → facilitated procurement network

​

• Key Players:
• Semlex Europe S.A. (Belgium)
• Gunvor (Swiss oil trader)
• Laurent Gbagbo regime (Ivory Coast)
• Olivier Bazin, Frédéric Lafont, Robert Montoya (intermediaries/arms dealers)
• Russian gov supplier of arms

Crude deals

Still, Gunvor.

• Bribe Mechanism:
• Semlex charged $2 per barrel as a hidden commission
• Total barrels in the deal — $2 billion worth

​

• Known Financial Scale:
• Gunvor bought $2.2 billion of Congolese crude signed off at the highest level
• Pre‑payment loans to SNPC: $750 million government debt through prepayment circumventing disclosed loan ceilings

​

• Flow Structure:
• Gunvor → SNPC (oil‑backed loans)
• SNPC → Gunvor (discounted crude allocations)
• Gunvor → Semlex (access fees)
• Semlex → Intermediaries → Political elite

The Aftermath

• Criminality Identified:
• Violations of Congolese procurement law (no public tender)
• Bribery payments routed through shell companies
• Corrupt enrichment of political elites
• Potential violations of international anti‑bribery laws

​

• Loss to the Congolese State:
• Oil sold at below‑market value due to corrupt access deals
• State assumed hundreds of millions in long-term oil‑backed debt
• Public revenue diverted into private offshore networks
• Reduced national benefit from its primary natural resource

​

• Impact Summary:
• Congo lost substantial revenue
• Gunvor secured massive profit margins
• Semlex extracted per‑barrel fees by exploiting political access