By Dr. Sanjana Hattotuwa
Overview
International actors funding Digital Public Infrastructure in post-conflict societies risk creating surveillance systems whilst pursuing economic inclusion. Drawing on evidence from Sri Lanka, UNDP analysis, and comparative cases, Sanjana Hattotuwa argues that donors must condition DPI support on verifiable rights protections, including trilingual communications, consultations, and legal safeguards, before disbursement, not as governance afterthoughts.
In January 2026, I spoke to around 60 local Government officials, teachers, civil society leaders, and A/L students in Moneragala. Not one person knew about the 30 billion rupee digitalisation programme proceeding towards unprecedented biometric data collection in the country. None had heard of the draconian Online Safety Act (OSA), passed in January 2024, granting sweeping state powers over expression. None understood that a national digital identity system was advancing without a single official document anywhere online in Sinhala or Tamil – the languages the majority in the country speak. To be clear, these weren’t disconnected or marginalised individuals. They were very active on social media platforms, and consuming news from online and offline sources. Yet they remained entirely unaware of draconian laws impacting their freedom of expression online, and digitalisation’s impact as an inflection point for citizenship, and rights in Sri Lanka.
This information vacuum, and significant knowledge gap signals a pattern emerging across the Global South. Development actors fund Digital Public Infrastructure (DPI) whilst accepting economic sequencing recommendations but ignoring rights prerequisites. The result risks what I have come to call ‘efficient authoritarianism’: technically sophisticated systems encoding discrimination, enabling surveillance, and excluding the populations they claim to serve.
Economic logic meets democratic deficit
Sri Lanka demonstrates why economic and rights dimensions can’t be separated. UNDP Country Economist Dr Vagisha Gunasekara documented an enduring digital divide threatening to significantly exacerbate socio-economic disparities: 39% of households remain offline, women face a 34% gap in internet use, only 7% of persons with disabilities have accessed the internet compared to 24% of the general population. Gunasekara argues for infrastructure investment before trade liberalisation to prevent gains concentrating amongst already-connected urban minorities. The Government appears responsive to economic sequencing whilst systematically ignoring rights protections. The 2026 budget acknowledged gradual tariff reforms but proceeded with biometric identity systems before establishing operational data protection authorities. This selective compliance creates a technically rational but democratically hollow infrastructure.
When silence becomes lethal
The consequences aren’t abstract. During Cyclone Ditwah in late 2025, I documented systematic exclusion of Tamil-speaking communities from disaster information. Over 640 people died. The Meteorological Department and Disaster Management Centre issued evacuation orders, landslide warnings, and mis/disinformation-debunking communications, but Tamil versions were delayed by twelve hours, entirely absent, or buried in Sinhala-only directives. Tamil-speaking fishing communities received weather forecasts twelve hours out of date during an active cyclone.
Brazil’s DPI experience offers a clear warning: Government communications failures enabled disinformation campaigns to undermine public trust, derailing digitalisation. Sri Lanka replicates these exact failures through a communications vacuum, English-only materials, and technocratic opacity. I’ve documented that Sri Lanka remains the first and only country attempting digital transformation without vernacular language discourse. This exclusive, and violently discriminatory structural design reveals intent. Digital identity becomes a vector for encoded discrimination when built upon foundations systematically excluding linguistic minorities.
International standards violated
Sri Lanka’s approach violates principles already established elsewhere. Sweden, a cashless pioneer, now mandates establishments accept cash after recognising cyber-vulnerabilities growing at pace. Sri Lanka proceeds with cashless initiatives despite catastrophic national grid failures.
27 countries, but not Sri Lanka, signed the Freedom Online Coalition’s principles for rights-respecting DPI, emphasising human rights prioritisation, meaningful access regardless of background, strong privacy protections, and collaborative approaches including civil society. Access Now’s rights-based framework for DPI stresses necessity assessments, voluntary participation with meaningful alternatives, explicit data minimisation, and accountability with redress mechanisms. Sri Lanka’s programme incorporates none of these safeguards, and no rights-based input to strengthen policymaking is encouraged or when provided through public writing, even remotely acknowledged.
The policy intervention
Development actors must condition DPI disbursements on verifiable rights protections as prerequisites. Conditioning support isn’t about adding governance layers but preventing economic failure. Dr Gunasekara’s infrastructure investment recommendations only succeed when populations trust the systems being built. In post-war societies like Sri Lanka, where Tamil-speaking communities in the North and East have lived under militarised surveillance for decades, trust doesn’t arrive easily or automatically with technocratic promises made only in English.
This means concrete benchmarks measured before funds flow, tied directly to disbursement schedules. Trilingual communications: all DPI documents, websites, alerts published simultaneously in Sinhala, and Tamil before biometric enrolment begins. Auditable through independent verification, not Government self-reporting. Meaningful consultations: documented public engagement in Northern and Eastern provinces conducted in Tamil, with civil society organisations holding formal oversight roles with enforcement authority. Documented, grounded, and comprehensive rights-based feedback become conditions for next tranche release. Legal safeguards operationalised, not promised. Data protection authorities staffed and funded with enforcement powers before any data collection begins. Contradictory legal frameworks, including the OSA, and proposed anti-terrorism legislation reconciled into rights-respective instruments, and coherent obligations enabling compliance before systems deploy. Voluntary participation and analogue alternatives legally guaranteed with penalties for non-compliance. Independent oversight bodies established with budgets, investigative powers, and ability to halt programmes violating standards.
Why act now
Without these fundamental foundations, development actors fund systems excluding intended beneficiaries, encoding historical discrimination into algorithmic infrastructure, creating turnkey surveillance capabilities for future governments, lacking the public trust necessary for adoption, and violating international human rights standards donors are bound to uphold.
Sri Lanka’s enduringly fragile democracy in a post-war context compounded by 2022’s catastrophic sovereign debt default makes these safeguards economically necessary, not just ethically required. Tamil-speaking communities have experienced decades of surveillance through telco-Ministry of Defence data sharing arrangements that persist today. When the Government proceeds with biometric databases linking revenue systems, police networks, immigration records, and financial transactions without consultation or legal protections, communities already suffering from militarisation recognise the architecture for what it is – surveillance by default if not by design. They won’t adopt systems designed to monitor them more efficiently. Economic development, and inclusion fail when large swathes of the population refuse participation around what Dr Gunasekara warns of as DPI leading to “hard-wire inequality”, linked to when economic efficiency arguments proceed whilst democratic legitimacy erodes.
The ignorance of those in Moneragala around what will fundamentally change citizenship, Tamil communities never receiving life-saving disaster information, a 30 billion rupee DPI framework proceeding without public consultation or a single word in Tamil or Sinhala, and related issues are all inter-connected, and aren’t isolated implementation failures. They are strategic, political, and design choices. The question for development actors is whether to condition support on rights protections now or fund an ‘efficient authoritarianism’ undermining the inclusive growth digitalisation promises to deliver.
(The author holds a doctorate in social media and politics, and his research practice centres on the confluence of influence operations, disinformation, truth decay, and information integrity)
Leave a comment