In Mexico, One Digital ID to Rule Them All

“Relying on the government to protect your privacy is like asking a Peeping Tom to install your window blinds.”

​- John Perry Barlow

​The ruling Morena party in Mexico is moving forward with plans to require a biometric identity document for all citizens, to be rolled out by February 2026. It’s an expansion of the existing CURP program (roughly equivalent to a Social Security number). The government justifies this surveillance saying it will help track 125,000 missing persons, while mass grave sites continue to proliferate.

Yet those deeply disturbing statistics say far more about the unabated power of Mexico’s cartels than anything else. And mandating a national biometric identity system – replete with fingerprints, iris scans, signatures, and facial photographs – will soon give anyone with real power in Mexico a national surveillance system. This chilling prospect is made even colder when one considers the ease by which the cartels have corrupted and used official resources. We recently reported on the blood the Sinaloa cartel shed when it used CCTV cameras and hacked phones to hunt and kill witnesses who helped expose El Chapo to the FBI.

Watchdogs everywhere are understandably alarmed. Beyond the obvious assault on the very idea of a right to privacy (according to Mexico’s own Supreme Court ruling in 2022), other concerns include:

• Irreparable damage: Kaspersky’s Isabel Manjarrez pointed out that biometric data is uniquely risky: “Unlike a password, once exposed, biometric data cannot be modified.” In other words, biometric data represents true identity whereas something like a number is merely an identifier. Such breaches are irreversible.

 

• One-stop shop: The most vulnerable system in any scenario is, by definition, one that has a single point of attack, which a mandatory system like this would appear to represent.

 

• Pay to play: Mandatory registration means essential services could be denied to anyone without it, or with a technical issue. It also increases the motivation for fraudulent actors and greatly increases the stakes when inevitable glitches occur. All three scenarios happened with Aadhaar, India’s version of biometric identity. Mexico’s program is intended to eventually be linked to most available services, including the National Health System Registry.

​

• Deepfake city: Biometric data is the AI hacker’s favorite data. Faces, voices, and fingerprints are exactly the raw material needed to convincingly impersonate anyone and manipulate everyone, especially with the help of AI.

And just to make extra sure that anything that can go wrong with the revised CURP system will go wrong, authorities plan to include a unique QR code associated with each individual’s identity. Because having a single point of entry, mass-surveillance system should be as easy as possible to access, right?
​
For an even more detailed critique of Mexico’s CURP reforms, we recommend this piece by the editorial board of La Derecha Diario. Read it as a cautionary tale for modern democracies, especially our own.

DONATE & HELP US PROTECT YOUR PRIVACY RIGHTS