Rethinking Humanitarianism | Why the WFP cyber-attack matters

[02:28] – The breach timeline

[14:50] – The wider context of Israeli surveillance

[36:25] – Why the stakes are high

[43:47] – What WFP should have done

[46:27] – Palantir and the growing tech-humanitarian partnership 

[55:01] – Is the tech worth the risk?

[1:03:27] – Accountability: a key role for donors

Marwa Fatafta

I mean, the risk is is a question of life and death. It's a question of people being killed, targeted, now or in the future [...] Even if we park the question of who hacked WFP, the risk still stands, because it's based on facts. It's based on [the] fact that people's data – their names, their location, their address, where their family resides – all of that information has been used by Israel's AI targeting systems to identify target lists and then basically bombing people as they enter their family homes.

 

Tammam Aloudat

Welcome to Rethinking Humanitarianism, a show that explores the future of aid in a world of rising crisis. I’m your host Tammam Aloudat, CEO of The New Humanitarian.

 

This past May, a cyber-attack on the World Food Programme exposed sensitive personal information belonging to the vast majority of Gaza’s population. The data breach affected 600,000 households in Gaza, and included information like their names, IDs, phone numbers, and neighbourhood location data – information they gave to be able to receive food and cash assistance in the middle of an ongoing genocide. Since then, WFP has been largely silent about the issue, offering little information to media, other aid partners, donors, and most importantly, to the people of Gaza. On today’s episode, we do a deep dive into what may be the largest-known breach of humanitarian data to date, on the world’s largest humanitarian organisation. And we connect the dots to bigger picture trends: the rush for AI solutions, the pursuit of people’s data, and corporate tech partnerships. First – we get a recap from our own Irwin Loy, The New Humanitarian’s senior policy  editor. Irwin has been covering this story since it broke. And then we hear from Marwa Fatafta, MENA Policy and Advocacy Director at Access Now, to discuss where WFP went wrong, what aid agencies like it should do moving forward, and why this is bigger than one data breach story. Irwin, welcome.

 

Irwin Loy  

Thanks, Tammam.

 

Tammam Aloudat  

Irwin, take me back to the beginning. What was the timeline of the events?

 

Irwin Loy 

I reported the story with reporter Jacob Goldberg, our colleague, in June. We found that there was a cyber-attack on the World Food Programme in mid-May that exposed data belonging to essentially most of Gaza's surviving population. This was an attack that targeted the self-registration app known as People Portal. They haven't said exactly how many people are affected. What they've said publicly is that it exposed data belonging to 600,000 households. But you know, if we consider that there are roughly 2 million people left in Gaza at most, and calculating household counts, I think, and previous acknowledgement that 2 million people had registered through that app, you know, we’re guessing that roughly the entire population of Gaza had their data exposed. Now that timeline from mid-May to our reporting in early June, that means that WFP waited about two weeks before telling people in Gaza that their data was exposed. In fact, they told donors a day before they actually told people in Gaza. So that's the rough timeline for the cyber-attack.

 

Tammam Aloudat  

In your first article reporting on this breach, you said this may be the largest known breach of humanitarian beneficiary data to date. You talked just now about the magnitude. Can you give us, like, just a comparison? When you say the biggest one, you mentioned also previous ones.

 

Irwin Loy 

The biggest known breach of humanitarian data that we know of before that, I think, publicly was an attack on the ICRC a few years ago – the International Committee of the Red Cross – and that was on 500,000 people. So numbers wise, it's significantly more than that, and I think the reaction to it from WFP, or how they responded to it publicly, has also been a bit different. They've been much less public about their actions. You know the contrast is notable.

 

Tammam Aloudat

Do we know anything about how these households in Gaza have been affected by this breach?

 

Irwin Loy  06:24

Well, that's part of the problem, I think. What WFP has told us is that they don't know of any misuse or exploitation of the data. I suppose that's an inadequate response given what we know is data is used for in Gaza specifically, and by Israel's military. Again, we don't know who has targeted this data or who stole it. Those are just guesses. WFP, if they know, they're not saying it. And I don't know. I don't think they know. I don't know if there's been any risk assessment done for people in Gaza. What I do know from staff who have talked to us and people in Gaza have talked to us and our colleagues is that there's very little information from the World Food Programme being provided to people in Gaza who are reliant on this food aid. And that's despite the fact that the World World Food Programme restarted data collection in Gaza. In some of their messaging, they've been quite clear about instructing staff and partners not to talk about the breach so much as, you know, some of the messaging points. The talking points has been more around reassuring people that their data is safe, but diverting attention from the actual data breach.

 

Tammam Aloudat  

What did they say about the breach itself?

 

Irwin Loy  

They've said relatively little. When we brought the issue to them first in June, they acknowledged that there had been a cyber-attack, and that's more or less it. They acknowledge the, partially, the numbers on 600,000 households, and that's more or less the extent of it. Since then, they've sort of sidestepped or ignored many of our questions about this breach, about the cyber-attack. And you know many of the questions that we've talked about already, you know: the risk for people in Gaza, and what assessments they've done about that risk, how they've improved security, that sort of thing. I think what's notable to me is that, to some extent, I expect – I don't endorse – but I expect some level of lack of information, especially from UN agencies, as a journalist. But I found over the last couple of months that, or several months really, that the World Food Programme has had a similar reaction to others, including other aid workers, aid partners, people who partner with them in Gaza who really have a vested interest in knowing more about about the risks because they are also collecting data and asking people in Gaza for their information. They've even been a bit, depending on the party, but they've not been very forthcoming even with donors, which is an interesting thing when we talk about accountability. You know, normally we think of humanitarian organisations as being mainly accountable to their funders, and we view that as a criticism, but in this case, it kind of suggests that even to some of their funders, they're not being fully accountable, and that's been problematic for some of the donors who I've spoken with.

 

Tammam Aloudat  

So, to sum up this part: WFP had a cyber-attack breach of data of 600,000 families, we know, or they said, that they have conducted an investigation. Am I right in that?

 

Irwin Loy 

They actually haven't said that. My understanding is that they have. That's from other sources, but they haven't really described that to me. But my understanding is they have conducted some sort of investigation.

 

Tammam Aloudat 

So we don't know from their sources officially what came out of the investigation. We don't even know if they know who conducted the attack.

 

Irwin Loy 

That's correct.

 

Tammam Aloudat

One more thing I want to clarify is when you say they went back to collecting data, they are using the same platform that actually was hacked, but supposedly with a certain something done to it, so it wouldn't be unsafe again.

 

Irwin Loy

My understanding: it is the same data collection platform. They say they have increased security for it. I'm not sure exactly what that means in terms of increased security. You know, again, we've asked them for more explanation on this, and obviously the cyber-attack and many other issues, but they've not been very forthcoming, other than to confirm that they have restarted data collection,

 

Tammam Aloudat

And in your recent reporting on WFP, you've been talking about their partnership with Palantir. Palantir is the firm, the AI data analytics firm with multiple interactions with the world that has been problematic. What's the connection? What are they doing with Palantir?

 

Irwin Loy 

I think it's important to report on these issues in tandem. When we're talking about the cyber-attack, we're talking about the general rush for AI solutions in the humanitarian sector, the pursuit of data. Data is becoming a commodity in humanitarian operations. WFP calls it its secret weapon to combat hunger. That suggests that responses and people are becoming scenes of experiment. Then you have these corporate tech partnerships with corporations like Palantir, which is obviously very controversial. Many see them as, essentially, an arms dealer, an AI arms dealer, because of their ability to harness data, and we see the overall trend that artificial intelligence and corporate technology are this sort of new power, this new frontier of power shaping crises and emergency response. And you pair that all together with the sector's issues with accountability, where they're not necessarily very accountable to people in crisis, and especially right now, people in Gaza. So, I think we see it as all related: who they choose to partner with, their very aggressive expansion of the pursuit of data, the rush for AI solutions and efficiency in the sector, especially with the aid cuts. And so, the cyber-attack is just one data point. It's just one signal. It's something that happened. Cyber-attacks are a real concern for everyone. WFP is a victim in this, they were targeted in this. But when you pair it with all the other trends and all their other actions, I think it's all something to watch in tandem.

 

Tammam Aloudat

What do we say when WFP, for example, would tell us like “Who doesn't get hacked? It's just another hack.” Why is it an important story, and what does it go beyond this particular hack?

 

Irwin Loy

I think the humanitarian sector is the target of cyber-attacks and hacks, and that's very correct. It's a very big target. And so again, the WFP was targeted here, they are not at fault for being targeted per se. But their reaction to it matters. And given the way in which data is used, given the way in which WFP is very intentionally and aggressively trying to control data from other organisations as well, and leverage data to to improve the efficiency of their operations, I think it really raises questions about the added risks that humanitarian organisations are putting on the people they are trying to serve. And so perhaps some of these risks are manageable or not, I think that's for experts to say, but when these cyber-attacks happen, I think you have to compare all an organisation's actions when it comes to data, and I think all of this context is quite related.

 

Tammam Aloudat

Yes, a lot of data platforms, wherever they are, might be hacked, but people often have the choice to opt in or out of their data being collected. My understanding is, if you're in Gaza and you don't register through this self-registration platform, you don't get food. Is that correct?

 

Irwin Loy

To me, that's talking about consent to give your data. I don't think that exists anywhere where humanitarian operations are present. If you're serving people humanitarian aid, it means they generally have no other choice. So what choice do you have other than to give your data when people ask you for it? So I'm not aware of other options that WFP provides to people who use their services if they don't want to give their data. I'm not aware of what is available to people who have already given their data to WFP if they want it not to be used. I'm thinking of a recent example in the UK where people who use the NHS, the National Health Services, petitioned the government not to have their data processed on any Palantir-related platform. I'm pretty sure that is not something available to anyone in Gaza. To answer your question, I think these sorts of levers don't really exist for people who use humanitarian aid anywhere.

 

[music break] 

 

Tammam Aloudat

We’ll be right back after this message.

 

[ad break]

 

When a crisis hits, children don’t give up on learning. Neither should we, says Education Cannot Wait. ECW is the global fund for education in crises within the United Nations. Join ECW in Geneva on 5 November for Hope Starts Here, their High Level Replenishment Conference to help match children’s determination with the support they deserve. Their ambition is to keep 10 million children learning through conflict, displacement and disaster. Be there to help ECW fund a faster response, strengthen local partnerships and reach those children and young people too often left behind. Find out more and register at www.educationcannotwait.org/hope-starts-here 

 

Tammam Aloudat

And now, to understand why the story matters beyond that one data breach, we are joined by Marwa Fatafta. Marwa leads Access Now's work on digital rights in the Middle East and North Africa region as the MENA Policy and Advocacy Director. Marwa, welcome to the show.

 

Marwa Fatafta  

Thank you for having me.

 

Tammam Aloudat 

Marwa, you've written extensively about the intersection of technology, digital rights, and occupation in Palestine. Can you put this WFP breach in context for us? Why is it so significant?

 

Marwa Fatafta 

Well, the most, I think, significant aspect about the whole story is the fact that the occupied Palestinian territories, and specifically Gaza, has been experimentation ground for the Israeli intelligence and military apparatus, where for decades the very infrastructure – that is the internet and telecommunications infrastructure that Palestinians use – has been controlled by by Israel. Which means that their communications are interceptable, or their data is collectible, and we have a long history of extremely, extremely invasive surveillance that I would dare and say that is pretty much unmatched elsewhere. In Gaza in particular, you know, there's been reporting about the fact that Israel has data about the entire population of Gaza, which has been used for accelerating and executing genocide, in addition to other international crimes. So, and we're talking also specifically since 2023 about crimes being committed through AI, and specifically AI targeting systems, which are data driven. And so when you, as a humanitarian organisation like WFP, go in with full force implementing digital solutions that also have collected such detailed information about, as Irwin said, potentially the entire population of Gaza, then we're talking about a huge honeypot that can be exploited, hacked, and used potentially even to kill people. Now, we know that you know WFP claims that they're not aware of any risks or harms that resulted from the hack, but I think that's a very, not only a superficial and irresponsible response, but also short-sighted because it's not a question of an immediate impact, but also how this data could be exploited in the future. It's, you know, again, in a context that, where [a] population is heavily surveilled, any collection of data by humanitarian actors, even under the pretext of delivering aid – you know, in a faster, in a more efficient manner – is a justification that requires a lot of scrutiny, as well as transparency and accountability. 

 

Tammam Aloudat 

You've mentioned that this is a long history, and I think it is worth talking about, for a minute, about technology and its exploitation. One of the recent examples is the Israeli occupation's use of tools like Azure from Microsoft, for example, as a way to surveil the population, which Microsoft pretended or claimed to not have had approved or agreed to. This is not new, the whole, you know, using the occupied territories as a place of experimentation, as you mentioned.

 

Marwa Fatafta 

Correct. And you know, if we take a couple of steps back, even before we talk about AI, and cloud computing, and cloud sites, etc. I mean, first of all, we have to reckon with the fact that Gaza, until today, because of the Israeli blockade, has a 2G network, where the world now is at 5G, which means that this communications is unencrypted, which means also that all phone calls, text messages is interceptable. And then we're also talking about all sorts of low tech and high tech ways of surveillance, whether it be hiring collaborators, using consensus, or the actual ID registration system of Palestinians; while it's managed by the Palestinian Authority, it is also controlled by Israel. So Israel does have the entire Palestinian registry, their ID numbers, their full names, their location. And then, you know, add to that the fact that specific, let's say, journalist or human human rights organisations are also susceptible to spyware attacks. And then on top of that, the use of AI to process the data for, you know, faster, and also to generate targets as fast as possible. So we're talking about an environment where pretty much everything about you, your person, your family links, your political ties, is heavily surveilled, and it's not just one technology that Israel relies on. I think it's about an ecosystem, right, that has been built from the very beginning to have the entire population under your thumb. You know, surveillance is essential for occupation, not only because you can control people, what they say, and what they do – and of course, all the chilling effect that comes with that – but also to segregate people, to grab their land. You know, when you use that information and the mapping of population in order to decide who goes where, whether you are in the West Bank or in Jerusalem or in Gaza. So it's a system of population control and suppression. And I think it's, I'm glad you asked that question because again, it's not about a specific technology; it's about building an ecosystem of surveillance and population control.

 

Tammam Aloudat 

We know a lot about what you're saying. It's not a secret. It has been studied. It has been communicated, and I want to reference a couple of sources that I found really useful, that humanitarian organisations and others working on the topic should know because before they use technology. One of them is a book by Anthony Lewinstein, the Palestine Laboratory: How Israel Exports Technology of Occupation Around the World. That is, the technology is used to enforce occupation and, as you say, oppress the population, but it's also made to experiment and prove that this is battle-tested, occupation-tested, and sell it, making money for Israel. The other is a book by Maya Wind called Towers of Ivory and Steel, where you know institutions of higher education in Israel are involved in this research on the population as well, that enforces occupation. There is another one called Terms of Servitude by Omar Zahzah about how platforms are collaborating and complicit in the enforcing [of] occupation. In The New Humanitarian, we've reported on companies like Google and Meta's continuing advertisement for illegal settlements. It's not an accident. The technology has been used as a tool of occupation for a long time.

 

Marwa Fatafta

I mean, I would argue that technology fits into a bigger project. In other words, surveillance of Palestinians is not a byproduct of technology itself. It's the other way around because if you look at the history of surveillance of Palestinians, it even starts before the creation of the state of Israel. In the past, before 1948, Zionist militias would go into Palestine and start recording, not only the fauna on flora of the Palestinian landscape, but also having, like, a full mapping of Palestinian cities. There was an expose a few years back about the surveillance of Palestinian cafes in the city of Haifa, where Zionist militias would go in and then start recording, like, who are the frequent goers? Who is it these cafes are owned by, by Muslim families or Christian? Do they serve alcohol? Who has extramarital affairs, etc. etc. And that understanding and mapping is also part of a long colonial tradition, going back to the British Empire and starting with population consensus. And the creation, the very creation of the ID, the identity card, was a result of colonial rule, that if you want to rule people, you need to know who they are, and where they live, and their whereabouts. And that's what was named by, I can't remember the name, of a scholar who called it ‘ruling by records’. So, from that perspective, it's an extension of settler colonialism in the case of, [in the] context of Palestine. And then when technology comes in, it comes in to enable and to accelerate that control and that surveillance. And so, you know, in recent years, we were talking about the use of biometric surveillance, the use of biometric identification systems at military checkpoints within the West Bank, and then after the invasion of Gaza, facial recognition cameras have also been used to register Gazans into Israel's biometric database, which some soldiers had dubbed as ‘the Facebook of Palestinians’. Also, cameras that capture license plates, and then the latest, you know, the culmination, is the AI tools. And I think to the point about Palestine being a society of experimentation, and also technology being exported as battle tested, I think we need to understand the political economy of tech-enabled, or occupation-produced and tested technology, because it's not only a tool to surveil and control Palestinians, but it's also a tool to strengthen Israelis' economy, as well as its political leverage. I mean, there’s been news about how spyware, for instance, and particularly Pegasus spyware manufactured by an Israeli company called NSO Group, has been used by Netanyahu as a kind of a carrot on his diplomatic missions in Africa, and India, and elsewhere, in order to cement Israel's influence and bilateral relations with these nations. So it's kind of a really vicious and violent cycle that, you know, is necessary for Israel's economic and political power as well.

 

Tammam Aloudat 

And we'll talk about another side of it in a minute about Palantir's role, but that is the political economy under which this breach has happened. Given what you've shared with us, what's your reaction when you first heard about the WFP data breach?

 

Marwa Fatafta

I mean, my first reaction is like, wow! It's as if Gazans needed that, you know. And on top of, on top of everything, you know: three years of genocide, tech-enabled genocide, data-driven genocide, then we have this breach that would expose them to further risk. Now, of course, the way that WFP – and Irwin touched on that – handled the issue and the breach is extremely problematic for a number of reasons. One, the way they inform people and how they informed them: it shows a deep level of responsibility and lack of accountability. You know, according to data protection best practices, when there is a data breach, there is a duty for the data processor, in this case WFP, to inform people within a short time frame, so people can take, as much as possible, steps to protect themselves and their personal information. Here, we're talking about people being informed on Telegram in a very generic message 17 days after the incident. That is an indication of how serious WFP itself has taken that data breach. The other part of the story – and this is where I disagree with Irwin – that, of course, WFP is not at fault for being hacked, you know, and we also need to condemn those malicious cyber-attacks, irrespective of WFP's shortcomings. But the bigger question to me is: when you, as a humanitarian organisation, go into a context that we just discussed, you know, is highly, highly risky and is also known for having adversaries with extremely sophisticated cyber and hacking capabilities, the question here is that, what additional risks you are creating? In other words, why are you collecting data in the first place? And does the justification for it really surpass the risks that you are creating. So while they're not at fault for being attacked, they are of course at fault of collecting this mass amount of personal data in an extremely risky environment. And I have not seen to date any risk assessments being conducted, any mitigation measures have been taken, any data protection assessments before the deployment of the People's Portal or the self-registration portal. And lastly, I think it does speak to the larger problem at hand, which is, you know, humanitarian organisations jumping right into the tech solutionism bandwagon, adopting solutions that are data hungry and data driven, without basic, basic risk assessments, and human rights due diligence and data protection impact assessments. And WFP is not the only one guilty of that. I mean, Access Now a few years back looked at the iris scanning technology deployed in Jordan in Syrian refugee camps, where UNHC, also WFP, [had] been using iris scanning to deliver cash assistance and aid. And, you know, you ask the basic question: do you really need to connect people's iris scans in order to give them cash and aid? And I'm not a humanitarian, but I am sorry, like, the humanitarian sector has been running before technology was up, so the answer is yes, of course.

 

Tammam Aloudat

So this is interesting. I've worked in the humanitarian sector for 25 years, and obviously there is technology that is useful, and, you know, sometimes it increases efficiency greatly. But you're incredibly right in saying that, you know, the consideration of the risk doesn't come across. If we assume best intention in the world, and WFP has done a risk assessment, this is not coming across. But you mentioned the techno-solutionism as like a bandwagon. What is pushing aid organisations like WFP to pursue these technological solutions at any cost?

 

Marwa Fatafta

I think there are a number of factors. I think one is driven by the sector itself, and the falling into the promise of technology, whether it be false or true. And, you know, I don't want to be sounding like a luddite – although, sometimes, I admit I can be one – but, you know, the adoption of technology with no questions asked. I think the other driver is the private sector itself. We've seen examples where the private sector positions itself as the silver bullet to complex political and economic problems, and you know the humanitarian sector is not the only victim of that narrative, but also governments themselves. So, to go back to the Jordan UNHCR example, the company that they've hired was a Jordanian-owned company called Iris Guard, and when we asked the question, like, “why did you procure that particular company per se, and, you know, what type of due diligence have you done?” The answer we received, well, you know, it was given to them pro bono by this company. And later on we found out that actually the office of the company is either on the – can't remember exactly – it's either in the same building or very close to UNHCR's building. So, like, and also I believe Palantir's initial contract with WFP was that type of contract, you know, where a company goes to an agency and says, you know, “we have these solutions”, probably there is a marketing presentation and slides, and you as a humanitarian organisation working under a lot of pressure, then you're like, “great, this is what we're looking for.” And so you adopt the technology. And finally, I think there's been push from donors themselves, not necessarily to adopt technology, but—

 

Tammam Aloudat  

The efficiency. Be more efficient.

 

Marwa Fatafta 

Precisely, yes. And for every dollar or euro you give a humanitarian organisation, you want to see the maximum impact. And so I think there are several levers or, like, push drivers that landed us where we are today, where, you know, technology is being used. And finally, I should say that, to the point about consent, you know, you're talking about humanitarian work, by its very nature, is done with extremely vulnerable populations that have no agency– I mean, they have agency, but given the circumstances, they are deprived of their agency, they're deprived of their rights, they're extremely vulnerable. And so, you know, they're not in a position to push back, or to say no, or even to co-design, or to have any say in all of this. So, it makes the digitisation of humanitarian aid a kind of an unquestionable process. 

 

Tammam Aloudat 

I mean, to give listeners a comparison framework, data collection by any entity is governed in the EU by something called the General Data Protection Regulation, or GDPR, which has jurisdiction over any data collected on anyone who is resident in the EU. People in the EU and, by extension in Switzerland, which has a very similar law, have the right to access their information. They have the right to erase their information. They have the right to transfer the data to another service, and there is a rectification or objection right. What stood out to me looking at GDPR details is that the breach notification, companies must report serious data breaches to supervisory authorities and affected users within 72 hours. That hasn't happened with WFP. They wouldn't have been able to do that if the operation affected was in the EU. If you are a company in the EU and a breach like that happens and you fail to comply, fines can be up to 20 million euros or 5% of an organisational global annual turnover. For WFP, that is much more than 20 million euros. 

 

Marwa Fatafta 

Even if you are operating in the EU and you are as a data subject protected by the GDPR, UN agencies are not subject to national regulation. So, you know, WFP and other UN agencies are not answerable to local, or national, or regional regulation. They're only answerable to themselves in this case. And even if you look at their data protection policies, they are not really at the standard where they should be. So that's one important point to highlight. 

 

[music break]

 

Tammam Aloudat

You've looked at WFP's People Portal. What did you find? What stood out to you when you looked at WFP's People Portal?

 

Marwa Fatafta

When I heard about the cyber-attack, I went to WFP's website to understand more what the self-registration portal [was], and of course, I did not find any information. I had to go and see some of their communications, like video messages where they urged Palestinians in Gaza to enroll in the platform, and also to continue updating it. And then I saw a video by a user that helps walk people through the registration process, and I saw, I was able to glimpse what the portal itself looks like and what information it’s collecting. It is really, I mean, it is really not only a honeypot; it's like a multi-million dollar prize for a malicious actor. It gives you a full mapping of the population in Gaza. Because one, it asks you, of course, for registration for your phone number, and your ID, and your full name. It also asks for all of your family members, their date of birth, their ID numbers, their health status. It also asks people about their location, even, you know, where they're from, but also where they've been displaced. And it also asks how many times they have been displaced. And in the video materials that I've seen from WFP urging people to use the platform, it again says, you know, if you move, if you get displaced – and again, we know that people in Gaza have been displaced multiple, multiple times – every time there is a status update regarding your location, your regarding your family members, if someone had died, you know, pregnancies, whatnot, you have to update that information. I think I've seen information being requested about, you know, whether there are disabilities, and so on and so forth. So, it’s very, very invasive and pretty much captures the presence and the essence of any human being in Gaza, you know. And all of that relational data has been very important for Israel's AI targeting machines.

 

Tammam Aloudat 

When you talk about the AI targeting machine of the Israeli forces, there is an implicit possibility, at least, because no one has talked about this explicitly. What's the worst case scenario of this data breach? When I fear for my data, sitting in Geneva, I'm afraid someone will sell it and I'll get spam, or someone might, you know, access my bank account or something. It's a different implication for people in Gaza. What could happen with that data?

 

Marwa Fatafta 

I mean, the risk is a question of life and death. It's a question of people being killed, targeted, now or in the future. Again, I think there is a big assumption. I mean, it's important to also highlight that, thanks to WFP's lack of transparency, we really don't know the nature of the cyber-attack and the people behind it. So the cyber-attack could have happened by private malicious actors. It could have happened by Israel. It could have– you know, there are multiple scenarios. But even if we park the question of who hacked WFP, the risk still stands, because it's based on facts. It's based on [the]fact that people's data – their names, their location, their address, where their family resides – all of that information has been used by Israel's AI targeting systems to identify target lists and then basically bombing people as they enter their family homes. And from an intelligence point of view, before October 7, you know, Israel already has that information, [it] doesn't need WFP to collect it. But you already know who is who, their ID numbers, and if you're of interest, then your communications is probably already surveilled. And we also know – you mentioned the example of the use of Microsoft's Azure – we know that the IDF and particularly their surveillance unit, Unit 8200, use Azure to store hundreds of millions of intercepted Palestinian phone calls recordings. So that gives you again another glimpse of the invasive level of surveillance. And then, of course, you know who lives in which building? Which families occupy where? Because also some of the attacks, when they are really, really targeted and precise, they can hit a particular apartment in a multi-story building. And then you have a situation after October 7 where people have been displaced multiple times. There's been a lot of killing, andagain we're making an assumption, but if that data was hacked in order to kind of update your intelligence, it's perfect because then first of all, you know if you've got a new phone number, or you know, because your family, a family member has been killed or deceased, or you know, whatever change of hands of devices and phone numbers. So you have an updated catalogue of who you are, because that again is tied to your ID number and your date of birth, your phone, the phone number that you're using, and then who is surviving from, you know, your surviving family members and their IDs. Again, like from an intelligence point of view, I would consider this to be a very important resource to understand, like, who is where, especially after like the whole chaos of the displacement. And again, you know, we're talking also about situation where tens of thousands, tens of thousands of people are missing. We don't know their whereabouts. In this chaotic environment, that information becomes really, really handy and valuable.

 

Tammam Aloudat 

Irwin talked about whether people have other choices, and you mentioned people being deprived of their agency. Is there anything that affected people in Gaza could have done to protect themselves and their data, as far as you know, without losing access to aid?

 

Marwa Fatafta 

I think consent, informed consent, in this particular context is just an outright fallacy. There is no way on earth that you would be able to have this as a legal and legitimate basis for data collection and processing. Because not only the alternative you face as a Gazan is starvation– I mean, we have seen situations where people have went to the front line, knowing that they might not return home. They might be killed in order to secure a bag of flour or some food for their family members. You know, whether it be, if you remember, the flour massacre, whether it be going to the GHF location sites, which looks very apocalyptic. I mean, people are being crowded and standing, or even sometimes ducking down under a rain of bullets showering down on them. So, you know, what kind of consent are we talking about here when people are willing to risk their own lives in order to eat, you know?

 

Tammam Aloudat 

Absolutely. And you mentioned GHF, the Gaza Humanitarian Foundation, the ill-fated effort by the Israelis and Americans where more than 1,000 people were killed trying to access aid. People knew that and kept going because the possibility of obtaining aid. And we, one of our investigations actually documented, not only GHF but other locations of aid distribution, [where] more than 3,000 civilians were killed in trying to seek aid in Gaza. And I ask that question because I want to be clear that, you know, you can't really blame Gazans then for providing their information. There isn't any other option that is available to them, and it shouldn't fall on people to choose between eating and data privacy.

 

Marwa Fatafta  

Absolutely, absolutely. Because you're basically telling them that “if you want to eat, you need to let go of your rights of privacy.” And any human being that is starving, of course, is going to accept that calculation. Now, does that mean that this is an informed consent? Absolutely not. Especially when you go to people and you aggressively promote this self-registration portal, aggressively saying that this is, you know, the way to receive cash or get food assistance. If you are, for instance, giving people the choice to say, look, there is this self-registration portal, but there's also this non-data collecting, you know, like, the old way of delivering aid, maybe then we could say that okay, people have a choice. But in that case, they really don't. And I see this pattern time and time again, whether it be WFP or other agencies, where, you know, you go into the, to the people and say “use this tool”, and so they use it. They're not given any information about, for instance, this is what we're going to collect from you, this is what's going to happen to the data, this is your rights as a data subject. This is the alternative. None of that happens. You just promote this tool, and people adopt it because, again, they have no choice.

 

[music break] 

 

Tammam Aloudat 

You've started answering what WFP could have done, to start with, under the current risks of surveillance and use of data. But after the breach has happened, what could have they done differently?

 

Marwa Fatafta

We mentioned the example of the ICRC data breach, and to me, that was the way that ICRC handled the data breach sets a really good example of what WFP could have done and should do, actually, still. I mean, first of all, the investigation into the data breach should have been made public. Of course, sometimes you can't publish everything, but to the extent you can, you should come clean and say, "This is what we know. This is what we don't know”. Second of all, people should have been informed much earlier, and I still believe that the self-registration portal should not have been re-enrolled, particularly because of the way that WFP handled the situation, and the fact that they said, “oh, we're not aware of any risks, therefore, we can continue.” And I'm not sure, you know, the steps that they've taken in terms of enhancing the cybersecurity of the system is sufficient. 

 

Tammam Aloudat

Because they said that they've had comprehensive update on security and privacy procedures, two months later when they opened it.

 

Marwa Fatafta

Yeah, and then again, you're asking people to trust you based on opaque information. Like, why would I trust an agency that had been just hacked to tell me that, you know, “we patched the hack and everything is good now”? So…

 

Tammam Aloudat

Well, they didn't even talk about the hack. They didn't talk about the investigation, and that is, if the investigation exists, it's an internal one, as far as we know. Let alone bringing an actual competent party, an external investigation that  puts the organisation accountable. This is hardly a recipe for accountability.

 

Marwa Fatafta

Precisely, and you know, also like going back to the example of ICRC, you know, they've published the full detail of the attack and what they know, and also the extent to which they have, or the ways in which they inform people, you know, by phone calls, text messages. They even said that in some cases we had to go to far communities in order to inform them in person. And so that is responsibility, and that is accountability, to say – and also, like even if they don't know the identity of the attackers, you know, they say, for instance, do we know if the data's been copied or stolen, or… they said “we must assume so.” So they even assumed the worst possible scenario because, from a risk and protection point of view, if you assume the worst case scenario, you're able to at least…

 

Tammam Aloudat 

Mitigate some of the effects at least.

 

Marwa Fatafta

Precisely, precisely, yes.

 

Tammam Aloudat

After the hack, and after the, you know, this whole issue with lack of transparency, lack of understanding of what's happening, not informing… What we've learned is, during summer afterwards, WFP has renewed its pre-existing partnership with Palantir. And I want to frame this, because Palantir is not just a run-of-the-mill evil tech company that cares about its stock prices and income more than anything else. It's a particularly poisonous one.

 

Marwa Fatafta

Evil, yes. [Laughs]

 

Tammam Aloudat

There are enough examples. Irwin mentioned the move in the UK to reject NHS involvement in, of Palantir in patient data. Switzerland has rejected partnerships with Palantir multiple times. In the US, Palantir provides data support to, like, ICE that are kidnapping people from the streets. And not only that; they're proud of it. I mean, their CEO Alex Karp wrote a whole book called The Technological Republic bragging about how this is the right thing to do, and that how AI should be fully in service of the dominance of the U.S. empire and its quote-unquote values. And this is the partner that WFP chose. Especially for Palestinians, this is a real problematic issue.

 

Marwa Fatafta  

You're absolutely right, it's not a question of profit only; it's ideological. Palantir was one of the first companies to speak publicly in support of Israel's military operations in Gaza. And even they held their first board meeting in Israel, in Tel Aviv, in particular, in support of Israel's military activities in Gaza. And then on top of that, they signed in November 2023 an official partnership with the Ministry of Defense explicitly to support its war efforts. And we know that part of Israel's AI kill chain relies also on Palantir for data analysis. So, and it's not like you know an opaque partnership similar to the partnership that the IDF and Israel has with Microsoft, Google, and Amazon, but it's one that is based on explicit ideology that we are, as a company, in support of Israel's war efforts, and we are providing them this technology. So, of course, we don't know the extent to which WFP is relying on Palantir specifically for handling Palestinians' data, and I would assume, if Palantir's technology is kind of furnishing the entire data management system of WFP, then I would assume that, of course, that includes Palestinians' data. But the same company that is helping you to feed people is also helping killing them. It's a basic question of also human rights due diligence, I mean, which the UN, by the way, has policies on private procurement and on human rights due diligence, and that you should not be partnering with a company that has a terrible human rights record or a questionable one. So…

 

Tammam Aloudat 

We used to have a point where, you know, we don't deal with companies that are in certain industries like weapons manufacturing and trading, like tobacco, like oil companies, like so…And my contention here, and I want to ask what you think, is that AI and tech companies are, for all intents and purposes, weapons manufacturers are now. 

 

Marwa Fatafta  

I fully agree. They have turned into arms dealers.

 

Tammam Aloudat 

And that applies to all of them, and to Palantir in particular. So whether they have a good or bad human rights record is even beside the point because they are arms dealers. There would b ea problem if your agency or a humanitarian organisation went and dealt with like Lockheed Martin, for example, or you know, another classic, traditional weapons manufacturer. Why is it not causing people to go up in arms that effectively there are partnerships…and here again, WFP is funded by taxpayer money. It is a public service. It's not a private company. And we don't know what's the content of their agreement with Palantir.

 

Marwa Fatafta

Yeah, I mean, you put your finger on the pulse because that's what I and a number of AI scholars and activists, for example, did last year at the UN AI for Good Summit. Again, you are not only partnering with questionable companies, but you're also normalising their conduct, because on the one hand, they are able to sell their technology increasingly to defense, you know, they're being defense contractors, and their technology is used in armed conflict and also to enable international crimes. And at the same time, they're poising themselves as actors for good, and they are, you know, on those UN panels and in these UN convenings talking about ‘AI for good’ or you know ‘AI for saving people from poverty and hunger’ and, and, and. So, in that last year's summit, not only we did not receive a response, you know, our letter was completely dismissed, but even the speaker, one of the keynote speakers – Abeba [Birhane], you know, she's a well-known, well-respected AI scholar – she was shut down when she brought up this this issue. You know, even the the attempt at pointing out this contradiction or even cognitive dissonance, if we assume best intentions, is being shut down because these organisations see themselves as good-doers in the story, and therefore any criticism from civil society or from scholars or the wider public just asking basic ethical questions, let alone asking them, you know, “don't you want to adhere to the the very system that is the guardian of international norms, and human rights law, and and and,” they're met with resistance and just arrogant dismissal.

 

Tammam Aloudat

I mean, the two, at least, WFP claims that the database of the self-registration database that was hacked is not the one that Palantir is managing – or that's the implication of what they are saying – but it's not an accident that all those things are happening.

 

Marwa Fatafta 

You know what? Even if. Even if. That does not absolve WFP from the implications of that partnership. You know, even if Palantir has nothing to do with the self-registration portal. You know, these stories are interconnected in the sense that it shows us the extent to which humanitarian agencies are swallowing big time the pill of techno-solutionism without any questions asked and the implications of that, especially when it comes to private partnerships where the procurement itself is non-transparent, let alone, of course, you know, whether the company is shady or not. There, at least, should be basic rules that govern those partnerships, starting from transparency about the contract, and the public procurement process, to the human rights due diligence, to the data protection assessments. And also the question of the level of data sharing, the level of access the company has, etc. etc. So, you know, just to come out and say, “well, you know, the Palantir is not managing Palestinian data in Gaza”. Sure, but that the list of questions and the requirements do not just simply drop. And especially because Palantir's story goes back, I believe, to 2017, if I remember correctly. So it's not a new story, you know. Civil society has been campaigning and asking WFP questions since that first partnership, and by then we have even more horrific evidence to the extent to which Palantir has been involved in serious human rights abuses, as well as international crimes, including genocide. And so that should raise all the red flags for WFP, but instead, it just went ahead and renewed the partnership. So I would dismiss this excuse entirely and demand, continue to demand accountability on both accounts: on the cyber-attack and on the Palantir partnership.

 

[music break]

 

Tammam Aloudat 

You know, between the aid cuts, this partnership that insists the WFP insists is absolutely necessary by renewing it without even taking stock publicly, and after a data breach, it's safe to say that aid organisations seem to be mostly insisting on continuing to increase their use of technology, as they say, to deliver aid more efficiently. What can they do, aid organisations, to mitigate the risks like the one we saw in Gaza?

 

Marwa Fatafta 

Before I answer your question, and there's a lot that they can and should do, we need to also interrogate and scrutinise a bit the efficiency argument. Because we're told time and time again that we're using this technology for better aid delivery to combat corruption, etc. etc., but there is no evidence. There is no evidence behind those decisions. I remember a few years back, there was a research into the problem of double registration by refugees, you know, where UNHCR uses biometric registration because that's the most effective, quote unquote, way of identifying a human being in order to combat double registration, meaning that a refugee can't come twice, claiming to be two different people in order to have more food, or more blankets, or whatever. And the study that was done – I think it was by The Engine Room in Ethiopia – it found the double registration was at such, it's such a low rate. So you are deploying a highly invasive way of identification, and biometric identification is the most invasive. You know, your iris scan, for instance, is something that cannot can never change until you die. So, if you are registering people at the age of five, that data, whatever happens to it now or in the future, will put you at risk until the last day of your life. So it's a question of, you kno,w if you want to take the right to privacy literally, and then say, okay: what are the justifications for a highly invasive, the use of highly invasive technology? Is it necessary? Is it proportional to the purpose you are deploying that technology? But also, like in the context of Gaza where shutdowns have been an ongoing issue. I mean, we as Access Now have done a study on internet connectivity levels on the first month of the war, where it dropped by 20%. And we know for a fact that there was also prolonged periods of communications blackouts. And then you're telling people to rely on an app to register. So even like from an efficiency point of view, I don't know the extent to which this has been actually efficient. You know, people don't have electricity to charge their devices. They find the most creative ways to – you know, from using cooking oil, to whatever solar panels that has been left, because also Israel destroyed those – in order to stay connected, and then you're telling them to rely on an app. And we're talking about also a geographical location that is so small, and people have been concentrated, especially in the central areas. You know, Gaza is really, really small, so do you really need an app in order to give cash assistance in delivery? I don't know. That answer, the onus of answering that question, is not on us. It is on WFP and any humanitarian organisation deploying…

 

Tammam Aloudat 

It's very difficult to think of examples where, you know, mass collection and mass surveillance has actually improved people's lives, and agency, and freedoms, and so on. It's not an innocent choice. It's either ignorant or problematic. And yet there is this mad rush to it. And I want to emphasize a point you mentioned: this is, you can't regret it. Once you collect data on people, this is stuck for life. This is not going to change. You can't say, "Oops, sorry, I will delete it.” First, nothing gets ever deleted. And second, you know, you're collecting data that doesn't change. People's biometric data is really problematic. Do we have any examples of aid organisations who are able to use these technologies responsibly that you can point to?

 

Marwa Fatafta 

Uh [laughs]. You're asking me a difficult question.

 

Tammam Aloudat  

I mean, that's telling. If that's the one question you have to think about all… [laughs]

 

Marwa Fatafta  

Well, I'm not in the humanitarian sector, so maybe there are technologies that are used in very limited scope or,you know, in a good way. But that actually brings me to another important point, which is: there is no system, there is no digital system or tool out there that is bulletproof. No matter how many cybersecurity protections you employ, no matter how many brilliant cybersecurity experts. Iit's just the fact that any system is susceptible and vulnerable to hacks or incidental data breaches. And now with the age of AI and the ability of these systems to identify vulnerability, that would only just increase the risk. And so, important to go back to the genesis of the problem, and that is, when you collect data, you have to ask yourself the question of “what are the risks? Am I able to mitigate them? If yes, what are my mitigation measures?” If no, then the technology should be out of question. And then the other thing is that, when we talk about people's agency, we're not only talking about their agency over their personal data, but also the agency in deciding or co-deciding the ways in which they need to, you know, they need or it's best to receive this data. Because again, like, we're talking about a top-down approach where a humanitarian organisation decides on its own, God knows why. Because of someone internally suggesting a tool, or a company coming to it pitching a tool, to then just deploy it. And I think here it's important to listen to people, not them as a beneficiary, because we're talking about people's lives, their dignity, and they should also have a say in the story. 

 

Tammam Aloudat  

There's too much “trust me, bro” kind of approach to it. We should trust people who are exactly in a situation of conflict of interest. You said there examples might exist. I'll give an example from a few years ago. I worked for a humanitarian organisation that treated patients. When we're talking about migration, there was a thought about: should we collect patients' data so if they go from one country to the other, we'd have their histories so physicians can treat them better. And I was on the side of “no”, because I couldn't find a scenario where that would be safe, including from lawful requests. In most humanitarian organisations, part of the due diligence is you only handle, hand over patient data if you are given a court order. The problem is, some of our patients were passing through Hungary, and I didn't think that under [Hungarian prime minister Victor] Orban and his stuffing the courts with right-wing supportive judges, that this wouldn't mean that we would get a court, that we wouldn't consider lawful or or appropriate and but we have to hand the data. So I'd rather not have it than actually hand it over in a suspected situation. And that was the decision.

 

Marwa Fatafta  

You're absolutely right, and we have also examples of governments increasingly asking– not actually asking, conditioning – the presence and the operations of these organisations on the submission of people's data. We've had that in Lebanon a few years back, where there were talks about submitting the people's personal data as a as a compliance request, and now with Israel and the new law that they enforced, which requires every international humanitarian organisation to submit a list of personal information of their Palestinian workers, and their family members, and their political affiliations, among others, as a condition for their, you know, to give them a license to operate. And a number of them refused, and as a result, were shut.

 

Tammam Aloudat 

Marwa I, to end, I mean, short of a massive scandal and a really problematic harm to the people they serve, what do you think could lead aid organisations to take those risks seriously, once and for all? What could happen that makes them actually do something serious, other than, as you mentioned, like AI for Good where everybody goes and loves everybody and pretends that there are no problematic connections with, you know, companies and surveillance providers. What needs to happen here?

 

Marwa Fatafta 

Excellent question. I think the scandal… well, clearly, that's not really leading to change, unfortunately. I think donors have a very key role to play here, and we've said this before. I think donors have a responsibility to mandate those requirements. So, to mandate data protection impact assessments, to mandate human rights due diligence, to mandate research into the deployment of technology before it's actually deployed, and also to ease that pressure driven by money scarcity that, you know, technology is replacing. It should be quite the opposite. I think, you know, if a humanitarian aid is running on an X system or digital tool, the data protection, impact assessments, and the due diligence, and and and, that should be also resourced or at least part of those proposals that they submit to the donors, and donors should also require and request those requirements. And the other thing I believe is that UN agencies, especially those that are, you know, involved in human rights, should configure or at least have some form of enforcement and accountability to ensure that those internal UN policies are being implemented. Particularly when, again we're talking about agencies that are operating in a paralegal space, so to speak. I wish there's a universe where people just boycott these tools, but as we said, that's not an option. So I think the responsibility lies squarely on the organisations, and the donors, and the civil society continues the pressure. And perhaps, I think, maybe WFP is hoping that the scandal goes away and everything goes back to normal until maybe the next scandal. But it's for civil society, you know, to continue, and for media organisations like The New Humanitarian, which I think has done an excellent job covering that story, to continue asking the question and demanding accountability and transparency.

 

Tammam Aloudat  

I have to admit, it's hard to imagine accountability happening. WFP again is not unique, but is an example. Since this happened, WFP has chosen the new executive director who replaces Cindy McCain, who is a U.S. appointment, as WFP executive directors have been since the early 90s, in a famous process where, you know, big countries have their entitled agencies. And the leader they chose for WFP is a MAGA guy who has explicitly in public talked about supporting the IDF in Israel. And I mean, there seems to be a infertile ground for accountability these days. The agencies are going more and more political, and are trying to satisfy their political, you know, sponsors and masters. And this is where I take exactly what you're saying: there is a role to be played in enforcing accountability by civil society and by donors. And we know that in this occasion – I think this is why it's momentous – in this occasion, WFP didn't even seem to bother with informing its donors properly, member states that support it or who are part of the governance system. I hope that there is a step towards accountability, because people deserve better. And what, part of what pains me more than anything else in this case: they wouldn't have gotten away with it if it was a European’s whose data was, you know, breached, or Americans or Westerners. They get away with it. And then it ends up playing a part in this continuous and insistent dehumanising of Palestinians, and of people who are receivers of aid, in a way that does them harm. And we have been told consistently that the ‘do no harm’ is the pillar of humanitarianism. It's not even ruffling feathers anymore. So…

 

Marwa Fatafta

I agree with you 100%, and I would add that we are really at a critical historical moment where the international order, as we know it, is unraveling before our eyes. And I fear and I believe that this capture of UN institutions, and even the privatisation of humanitarian aid, the UN is writing also its own death sentence. It's not only the powerful states that are messing up the system. But those types of appointments, and digitisations, and partnerships with shady private sector is also contributing to this big global moment we're all living through. And so, I also thank you for having me on this podcast, and also for asking very important questions, and giving me the space to speak freely and openly. So thank you again

 

Tammam Aloudat 

Thank you very much, Marwa. 

 

[music break]

 

Tammam Aloudat

Marwa Fatafta is the MENA Policy and Advocacy Director at Access Now, and Irwin Loy is The New Humanitarian’s senior policy editor. You can read his ongoing coverage of the WFP cyber-attack on our website – www.thenewhumanitarian.org  

 

Thank you for listening to Rethinking Humanitarianism. This episode was hosted by Tammam Aloudat, produced by Melissa Fundira, and mixed by Tevin Sudi. Editorial oversight by Irwin Loy. If you have any questions or comments you can email us at [email protected]. Please rate and subscribe to our show wherever you get your podcasts. Also consider becoming a member of The New Humanitarian to help us continue reporting from the hearts of crises. Go to www.thenewhumanitarian.org to find out more.