The Humanitarian Beta-Test

How the world’s most vulnerable populations became the training data for the global AI industry

The Ritual of the Iris

In Jordan, the heat at the Za’atari distribution center feels like a physical weight, yet the line moves with surprising speed. There is no fumbling for plastic identity cards, no paper ledger to sign. When a mother who was displaced by a conflict reaches the front, she does not reach for her wallet. Instead, she leans forward with her face inches from a high-definition lens and waits. In a fraction of a second, her iris is mapped, encrypted, and cross-referenced against a global database, likely the Biometric Identity Management System (BIMS). Once verified, her information is stored on a centralized blockchain known as PRIMES.[1] Transaction successful. She receives her milk.

Engineers see this as a triumph of frictionless efficiency. But if you look closer, this Ritual of the Iris reveals a fundamental trade of human sovereignty. For the displaced, whose national protections have long since dissolved, the body is the final remaining asset. In the refugee camps of 2026, that asset is being traded for survival. A new form of digital statelessness is taking shape where a person’s data profile (the aggregate of their biometric, behavioral, and demographic records) holds more legal weight than their physical self.[2] Researchers writing for the International Journal of Refugee Law highlight that this “humanitarian tech” experiments with subjects in a way that blurs the lines between care and control, often turning the camp into an opaque space for unregulated testing.[3]

This friction is removed not through true consent, but through a binary ultimatum. Over 90 percent of those residing in Za’atari have been “forcibly registered” into these systems as a strict precondition for receiving food, healthcare, and the right to apply for asylum.[4] In mid-2025, 400 Rohingya families in the Kutupalong and Nayapara camps in Bangladesh saw their food rations and cooking fuel cut off after they refused a mandatory biometric update. To these families, saying “no” was an act of digital self-defense. Yet, under the logic of the humanitarian lab, the system is absolute: those who decline the scanner cease to exist on the list of eligible recipients.[5]

This is not just a story about surveillance. It is a story about a structural change where the human subject is being converted into a data asset. This is the defining legal and philosophical crisis of the mid-2020s, and it is happening in plain sight under the banner of aid.

The Biometric Cage: A Decade in the Digital Shadow

To understand what is really at stake, you have to look away from the sleek scanners in Jordan. Drive instead to the dusty border towns of Northern Kenya. Here, the consequences of biometric registration are not a theory. They are an “open prison.”[6]

In 2013, during a time of brutal drought and instability, thousands of Kenyan citizens did what any parent would do. They walked into camps like Dadaab and Kakuma to register for aid. Giving a fingerprint felt like a small price for a bag of maize. They could not have known they were signing away their futures to an unchangeable record.

By 2025, those fingerprints had become a life sentence. A generation of young Kenyans in their twenties found themselves registered twice. Because their biometrics were in the United Nations High Commissioner for Refugees (UNHCR)’s database, the government flagged them as foreigners. When they applied for national identity cards, they were treated as anomalies. Imagine being twenty-five years old, born on Kenyan soil to Kenyan parents, yet unable to open a bank account or pass a security checkpoint because a record from thirteen years ago says you are a suspect subject.[7]

The January 2025 High Court victory in Garissa was supposed to end this.[8] The court ruled that this algorithmic branding was unconstitutional and an affront to human dignity.[9] Specifically, the court ordered the government to deregister the more than 40,000 individuals whose lives had been stalled by the database.[10] This process was mandated to occur within sixty days.[11] The language was stark and it should have reverberated far beyond Kenya’s borders.

Yet even a landmark legal victory struggles against the inertia of a digital record. This is the core problem of algorithmic identity: the presumption of innocence is effectively reversed by the architecture itself. When a human right meets an immutable database, the “truth” of the record often proves more resilient than the law of the land.

This reversal of the presumption of innocence is structural. Unlike a password, an iris or a fingerprint cannot be reset. When the system fails, there is no simple override. Digital data was originally supposed to help refugees prove their claims, but it has since morphed into a wall. If the record is wrong, the person is left with a desperate task: they have to try and out-argue a machine that is already treated as an infallible witness.[12] The Kenyan High Court pushed back further in August 2025 by blocking a proposed mass International Mobile Equipment Identity (IMEI) registration scheme and ruling that collecting device identifiers for surveillance purposes was unconstitutional.[13] The resistance is real but the architecture it is fighting was built to last.

The Living Laboratory: From Identity to Prediction

But the biometric cage is evolving. By 2026, the humanitarian sector has moved from asking who you are to predicting what you will do. The President and Chief Executive Officer of the International Rescue Committee describes this as the “humanitarian efficiency revolution,” a shift triggered by a world in which global funding has been cut by more than half.[14] The era of the single iris scan is giving way to something far more invasive: continuous, passive, physiological monitoring.

Under the stated rationale of preventing fraudulent handoffs in cash-transfer programs, agencies have begun testing behavioral biometrics. The smartphone a refugee carries is now a sensor. Using the device’s internal tools, artificial intelligence (AI) systems now track the rhythm of a person’s walk and the speed of their typing. A 2025 World Intellectual Property Organization (WIPO) report describes these biometric innovations as continuous identifiers used to verify a claimant’s identity on an ongoing basis.[15]

The logic sounds neutral: ensure that the person receiving a cash transfer today is the same person who enrolled last year. But the human costs are anything but. Under a regime of “technosolutionism,” the nuanced reality of human suffering is reduced to a data problem. If a father develops a limp from an injury, the algorithm sees an anomaly. If a mother has tremors from trauma that slow her typing, the system flags a mismatch. In both cases, the AI engages in “proxy discrimination.” According to legal scholars at the University of Copenhagen’s Center for Global Mobility Law, AI misinterprets these neutral physical traits as red flags for fraud, which can lead to food or funds being frozen instantly. When this happens, there is no human being required to step in and explain why.[16]

The World Food Programme (WFP)’s AI-driven systems, including SCOUT and Anomaly Detection for Assistance Delivery (ADAD), are the architects of this new reality. One saves millions in supply chain costs[17] while the other scans transactions for statistical deviations.[18] The goal is fairness and fraud prevention, but the result is a layer of surveillance where survival depends on conforming to a computer’s model of a standard recipient. The refugee camp has become a behavioral laboratory for technologies that sit at the “borderline of legality,” testing models of aid that would be too politically and ethically contentious to deploy first in Western democracies.[19]

The Data Harvest: The Camp as Raw Material

The shift from identification to prediction is only one dimension of this transformation. The camp is not just a laboratory for surveillance; it has become a site of production. In early 2025, Microsoft’s AI for Good Lab released the KakumaAerial dataset. This collection of detailed drone imagery from the Kakuma-Kalobeyei camps in Kenya was annotated to identify buildings, solar panels, and sanitation facilities. Residents of the camps actually participated in the process, using their knowledge of the terrain to make the data more accurate. The technical results were impressive. AI models reached nearly 98 percent accuracy in identifying makeshift toilets and achieved a building segmentation score of 0.848.[20]

Taking a charitable view, this is exactly what it claims to be: a humanitarian effort to improve mapping and resource allocation. However, from a structural perspective, there is more to the story. The authors describe the Kakuma-Kalobeyei camps as having “irregular layouts, diverse building sizes, and varied materials.”[21] This is precisely the kind of unpredictable environment that makes AI models more robust. By training on the infrastructure of refugee camps, developers can produce systems that are better equipped to handle informal settlements anywhere in the world. What residents were never consulted on is how this open-source dataset would be used outside of its humanitarian framing. It is now freely available to any firm that wants to benchmark a model before deploying it in a Western city.

This extraction extends beyond physical infrastructure to the people within the system. A 2025 UNIDO feasibility study conducted with the data firm BAOBAB assessed whether Ukrainian refugees in Romania were ready for AI data labeling work.[22] The study found a population of highly qualified professionals whose credentials went unrecognized in their host country, leaving them structurally available for remote digital piecework. This represents the kind of invisible labor that researchers describe as the hidden foundation of AI systems marketed as autonomous.[23]

The framework developed by Iwuoha and Doevenspeck makes this logic explicit. [24] Data becomes “a means of capitalist accumulation by dispossession,” as quoted in their analysis of digital coloniality in Africa.[25] The crises of the Global South are essentially harvested as raw material to build profitable AI for the Global North. In this cycle, the displaced do not benefit from the technology their circumstances helped train. They simply remain subject to it.

The Paradox of Protection: A Legal Wall with a Gap

This extraction operates largely without consequence, not because it goes unnoticed but because the legal frameworks designed to prevent it were never built to reach this far. While the European Union (EU) AI Act was originally slated for general application in August 2026, a landmark vote on 26 March 2026 has pushed the compliance deadline for high-risk systems to 2 December 2027.[26] Despite this delay, the legal boundary remains firm. Inside the EU, AI used for migration, border management, and asylum processing is classified as high risk[27] and requires transparency and oversight.[28] If an algorithm affects your access to rights or services, you are entitled to an explanation.[29]

But these protections stop at the edge of the humanitarian sandbox. International organizations like the UNHCR and WFP often claim functional immunity from local regulations.[30] This creates a gap where practices banned in Brussels, including harmful behavioral manipulation and real-time biometric categorization, are piloted in the camps of Jordan and Kenya under the banner of humanitarian innovation. This asymmetry creates a risk: a European citizen whose credit application is rejected by an algorithm has a legally enforceable right to ask why, but a refugee in Za’atari whose food access is frozen by ADAD has no equivalent right.

The humanitarian organization is simultaneously the service provider, the regulator, and the adjudicator. This is a structural design that concentrates power among the most vulnerable populations, creating a scenario where local practitioners fear that data centralization in UN databases removes any possibility of access or recourse due to functional immunity.[31]

The Resistance: From Inclusion to Sovereignty

The biometric cage is not without its cracks. In the camps of Northern Kenya, resistance is growing from the inside. Groups like Haki na Sheria, which spearheaded the 2025 Garissa High Court victory, have shifted their focus. They are no longer just fighting to be included in national systems. They are demanding data sovereignty, which is the right of communities to determine how their digital identities are created and used.[32]

There is no formal declaration yet, but there is a groundswell of movement. Displaced youths in camps across Northern Kenya are repurposing the very digital tools designed to monitor them, using connected technologies for community-led identity formation and political organizing. And they are asking a question that the humanitarian industry has not yet been forced to answer: why does data generated through their lives produce value for AI firms, while they remain in a state of digital dispossession?[33]

Supported by research from Caribou’s 2026 report on digital identity and migration, refugee-led organizations in Kenya are now demanding decentralized identity systems, community-hosted data infrastructure, and a say in the technology that governs them. This moves the conversation beyond privacy toward sovereignty, which is the right to determine the terms on which you are known.[34] Whether that sovereignty can be enforced is the question the international legal order can no longer defer.

Conclusion: Toward a Digital Habeas Corpus

The Ritual of the Iris was sold as a solution to a human crisis. Making the displaced “legible” to a world that would otherwise ignore them seemed, at first, like an act of dignity. A name in a database meant food, healthcare, a path toward resettlement. That logic was not entirely wrong, but it was incomplete. Legibility is a form of power, and power without accountability becomes control. The digital twin of a refugee, once created, takes on a life of its own. It outlasts the crisis that created it, survives the individual’s departure from the camp, and continues shaping their life in ways they cannot escape.

We now have enough evidence to see the risks. The biometric cage in Kenya shows that data collected for survival can exclude a person for decades. Behavioral systems of the WFP show that aid can become a reward for algorithmic compliance. The data harvest shows that the infrastructure of displacement is being converted into raw material for the AI industry. And the jurisdictional gap at the heart of global AI regulation shows that those most affected by these systems have the least recourse against them.

We need a new legal concept for this reality. The term Digital Habeas Corpus, developed in legal scholarship to describe a framework of substantive and procedural rights enforceable against algorithmic power, is starting to gain ground.[35] Just as the historical habeas corpus limited the arbitrary detention of the physical body,[36] this would limit the arbitrary authority of the database. It requires three non-negotiable principles.

First, the right to procedural integrity, ensuring that any deployment of AI includes “independent validation” and claimants have access to “meaningful reasons and effective remedies” when a system flags them.[37] Second, the right to digital autonomy, which advocates “privacy by design” to ensure that individuals maintain “meaningful control over their personal data,” so that access to survival is no longer conditioned on the surrender of behavioral data.[38] And third, the right to erasure, empowering individuals to “manage attestations and deletions” of their own identity information, ensuring that once their crisis is resolved, the data shadow it created does not follow them indefinitely into the future.[39]

These are not radical demands. They are fundamental human rights adapted to a context that existing legal frameworks were not designed to address. The EU AI Act has shown that this kind of regulation is possible. What remains is the political will to extend it to the camps where the consequences of unaccountable AI are not a policy debate but a daily fact of life. The displaced in Kenya and Jordan are proving they are not just data assets to be managed. They have a memory that the code cannot overwrite and a future the algorithm cannot predict. The struggle for data rights in the refugee camps of 2026 is not a niche concern for human rights lawyers. It is the front line of a global reckoning with what it means to be a person in a world that prefers the “more manageable” version of you that lives in the database.

[1]S Abboud, 'Artificial Humanitarianism—The Data-Driven Future of Refugee Responses' (Middle East Research and Information Project, 29 January 2025) <https://www.merip.org/2025/01/artificial-humanitarianism-313/> accessed 1 September 2026.

[2]ibid.

[3]N Kinchin, D Mougouei, 'What Can Artificial Intelligence Do for Refugee Status Determination? A Proposal for Removing Subjective Fear' (2022) 34(3-4) International Journal of Refugee Law 373.

[4]Abboud (n 1).

[5]C Burt, 'UNHCR biometric verification standoff leaves 400 refugee families off food aid list' (Biometric Update, 13 June 2025) <https://www.biometricupdate.com/202506/unhcr-biometric-verification-standoff-leaves-400-refugee-families-off-food-aid-list> accessed 1 September 2026.

[6]Haki na Sheria, 'Press Statement on the Double Registration Court Judgment' (Citizenship Rights in Africa Initiative, 21 January 2025) <https://citizenshiprightsafrica.org/haki-na-sheria-press-statement-on-the-double-registration-court-judgment/> accessed 1 September 2026.

[7]M Cheesman, 'Digital Identity and Migration: Struggles for Equitable Technology Governance' (Caribou, 2 March 2026) <https://caribou.global/publications/digital-identity-and-migration-struggles-for-equitable-technology-governance/> accessed 1 September 2026.

[8]Haki Na Sheria and others v Attorney General and others, Petition No E008 of 2021 (Constitutional and Human Rights Division of the High Court of Kenya at Garissa, 21 January 2025).

[9]ibid, para 66(a).

[10]Haki na Sheria (n 6).

[11]Haki Na Sheria and others (n 8) para 66(f).

[12]Kinchin and Mougouei (n 3).

[13]Daniel & Kenneth Advocates, 'High Court Blocks IMEI Registration Scheme as Unconstitutional and Invasive' (The Lawyer Africa, 19 August 2025) <https://thelawyer.africa/2025/08/19/high-court-blocks-imei-registration-scheme-as-unconstitutional-and-invasive/> accessed 1 September 2026.

[14]D Miliband, 'It's time for a humanitarian efficiency revolution. Here's how' (World Economic Forum, 19 January 2026) <https://www.weforum.org/stories/2026/01/humanitarian-efficiency-revolution-irc/> accessed 1 September 2026.

[15]WIPO, Green Technology Book: Solutions for Confronting Climate Disasters (2025) 255.

[16]ME Hertz, WH Byrne, T Gammeltoft-Hansen, 'What "Real Risk" Means For AI-Assisted Refugee Status Determination' (Verfassungsblog, 2025) <https://doi.org/10.17176/20251128-172222-0> accessed 1 September 2026.

[17]WFP USA, 'Food Security and Innovation Take Center Stage in Munich Security Conference Side Event at the World Food Program Innovation Accelerator' (World Food Program USA, 25 February 2026) <https://wfpusa.org/news/innovation-takes-stage-at-wfp-innovation-accelerator/> accessed 1 September 2026.

[18]WFP Innovation, 'Anomaly Detection for Assistance Delivery' (World Food Program Innovation, 13 February 2026) <https://innovation.wfp.org/project/anomaly-detection-assistance-delivery> accessed 1 September 2026.

[19]Hertz, Byrne and Gammeltoft-Hansen (n 16).

[20]A Gupta and others, 'Mapping Refugee Camps with AI: A Benchmark Dataset and Baseline Models for Humanitarian Applications' (Microsoft Research, January 2025) <https://openaccess.thecvf.com/content/WACV2025W/GeoCV/papers/Gupta_Mapping_Refugee_Camps_with_AI_A_Benchmark_Dataset_and_Baseline_WACVW_2025_paper.pdf> accessed 1 September 2026, 1.

[21]Gupta and others (n 20) 1.

[22]UNIDO, 'Assessing AI data training needs of Ukrainian refugees' (United Nations Industrial Development Organization, 10 December 2025) <https://www.unido.org/news/assessing-ai-data-training-needs-ukrainian-refugees> accessed 1 September 2026.

[23]S Banerjee, M Hamza, 'The invisible labour behind "intelligent" machines' (The Loop, 26 March 2026) <https://theloop.ecpr.eu/the-invisible-labour-behind-intelligent-machines/> accessed 1 September 2026.

[24]VC Iwuoha, M Doevenspeck, 'Biometric coloniality: digital consensus and the biometric state in Africa' (2025) 46(12) Third World Quarterly 1413, 16 (quoting Thatcher and others, 2016 — full reference to be verified against the original source).

[25]J Thatcher, D O'Sullivan and M Dillon, 'Data Colonialism through Accumulation by Dispossession: New Metaphors for Daily Data' (2016) 34(6) Environment and Planning D: Society and Space 990, 991 (discussing 'capitalist accumulation by dispossession' in the section titled 'Introduction: The Shape of "Big Data"').

[26]M Borak, 'EU Parliament backs delaying AI Act deadlines for biometrics, high-risk applications' (Biometric Update, 27 March 2026) <https://www.biometricupdate.com/202603/eu-parliament-backs-delaying-ai-act-deadlines-for-biometrics-high-risk-applications> accessed 1 September 2026.

[27]Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L (hereafter EU AI Act), annex III, pt 7.

[28]EU AI Act (n 26) art 14.

[29]EU AI Act (n 26) art 86.

[30]A Reinisch, 'Convention on the Privileges and Immunities of the United Nations' (United Nations Audiovisual Library of International Law, October 2008) <https://legal.un.org/avl/ha/cpiun-cpisa/cpiun-cpisa.html> accessed 1 September 2026.

[31]Cheesman (n 7).

[32]Cheesman (n 7).

[33]Cheesman (n 7).

[34]Cheesman (n 7).

[35]O Pollicino, G De Gregorio, 'Constitutional Law in the Algorithmic Society' in H-W Micklitz and others (eds), Constitutional Challenges in the Algorithmic Society (CUP 2021).

[36]C Collins, 'Habeas Corpus – You Shall Have The Body!' (Leo Cussen Centre for Law, 2 September 2021) <https://www.leocussen.edu.au/habeas-corpus-you-shall-have-the-body/> accessed 1 September 2026.

[37]Hertz, Byrne and Gammeltoft-Hansen (n 16).

[38]Cheesman (n 7).

[39]Cheesman (n 7).