In May this year, Khalaf al-Romaithi flew from Turkey to Jordan to look for a new school for his son. But the Emirati dissident was detained there because of his eyes. Or, to be more exact, because of the biometric information his eyes held.

The 58-year-old had been travelling on a Turkish passport, but a scan of his irises at Amman's airport indicated he was the same Khalaf al-Romaithi previously sentenced to 15 years prison in the United Arab Emirates. That was as part of a mass trial of 94 critics of the UAE leadership in 2013, that human rights organizations have condemned as politically motivated.

"He was detained in Amman after an iris scan," confirmed Hamad al-Shamsi, director of the Emirates Detainees Advocacy Center, a nonprofit organization helping prisoners of conscience in UAE prisons. But, he adds, nobody is sure how the Jordanians got al-Romaithi's biometric data. It's possible the information was given to them by the UAE, he suggested.

Neither Jordanian nor Emirati representatives in Germany answered DW's requests for comment about the matter.

Al-Romaithi has been — illegally, according to lawyers — sent from Jordan to the UAE, where he is in prison.

Worrying signs

The al-Romaithi case is a worrying portent when it comes to how personal biometric information is being used in the Middle East, explained Yana Gorokhovskaia of the US-based democracy watchdog Freedom House.

"We are very concerned about the increasing use of biometric technology to enable closer cooperation between repressive governments, something we have seen in the Middle East and also in central Asia," she told DW.

Biometric information includes any unique markers that identify a person. Some aspects are not new: After all, it includes fingerprints, something police have been working with since the late 19th century. It also includes genetic material, or DNA, which has been used in criminal investigations since the late 1980s.

But today, biometric information is much more varied and includes everything from your palm prints, to the shape of your face and scans of your irises, to the look of your earlobes and even the way you breathe and walk. In the future, biometric information may also include the way you type, the way you sign your name, and voice and gesture recognition.

Of course, using biometric information to identify people isn't necessarily negative.

Many people are already familiar with what's known as biometric verification. This matches your unique data, like your fingerprints or irises, with data you've already supplied. It's called one-to-one verification. A common example is unlocking your mobile phone with a fingerprint scan.

Unlocking your phone's screen with facial recognition uses one-to-one matching of biometric data Deutsche Welle

The other use of this kind of data is called remote biometric identification, or RBI. This involves having software compare your unique features with a large database of many others' features. This is called one-to-many identification. It's the kind of thing one might see in a spy movie, where a roving digital camera spots the culprit in a crowd, having matched the person's eyes, earlobes, even their gait, and assumed that this is the individual they're looking for.

More dangerous, thanks to AI

It's RBI that worries human rights experts, especially as it is used in conjunction with advanced algorithms and artificial intelligence, or AI.

It has to do with the way the technology has developed over the last few years, said Ella Jakubowska, a senior policy advisor at the Brussels-based European Digital Rights network, or EDRi, who leads the group's work on facial recognition and biometrics.

"There are a couple of things that do seem like a real step change," she noted. "One would be the number of different ways that you can identify and track a person. The other would be that the software's potential to recognize patterns has increased exponentially over the past five or so years. Now, you can not only identify someone based on a picture, but also know the pattern of their legs and feet as they walk."

"These developments have lowered barriers; it's faster and cheaper than ever to have mass data storage and process it. All that adds up to the potential to be able to recognize a lot of people very quickly, at scale," she warned. "Which expands the potential for arbitrary mass surveillance."

The United Nation's refugee agency has collected biometric data from refugees in Lebanon and Jordan, to streamline registration and aid Deutsche Welle

This is the dark side to modern biometric identification, something that could become a bigger problem in authoritarian regimes such as those found in the Middle East.

"The widespread use of biometric ID systems, in conjunction with weak privacy laws and generally weak rule of law and human rights protections, opens the door to authoritarian abuses, which AI tools will likely aggravate," the authors of a 2022 policy study looking at artificial intelligence in the Middle East, published by the European Institute of the Mediterranean, confirmed.

Digital transformation underway

Wealthier nations in the region, such as the Gulf states, are already enthusiastic about biometric identification. "These technologies are central as the region — especially the Gulf countries — undergoes digital transformation," Mohammed Soliman, director of the strategic technologies and cyber security program at the Washington-based Middle East Institute, told DW.

Currently, almost all countries in the Middle East use biometric information for immigration purposes at airports and borders.

Recent success stories from Dubai saw airport law enforcement boasting about how they caught a fraudster, who'd used fake credit cards while in disguise by checking the shape of his ears. In another case, they arrested a man wearing a full-length women's gown and face veil because of the way he walked and his body measurements.

Biometric identification at the Middle East's airports includes everything from fingerprinting to motion analysis Deutsche Welle

Some countries, including Qatar, Saudi Arabia and the UAE, have gathered biometric information as part of citizenship registration that allows locals to access state services. Others, like Iraq and Yemen, have previously collected it for voter registration.

But all that information could also be used in a different, more malicious way, experts argue.

"Any government could amass a database of the biometrics of their entire population and allow that to be used with CCTV footage around a whole city," the EDRi's Jakubowska said. "Then you've got a live picture of the most intimate parts of people's lives. You can see who has met with a journalist, who has gone to a queer bar, who has fraternised with a political opponent or a dissident — and that can be very dangerous."

Amba Kak, the director of the New York-based AI Now Institute, agreed that the technology can enable governments' power over their citizens.

"These systems enable mass surveillance of a kind that seriously shifts the balance of power between those that surveil and those that are watched, with serious chilling effects on political and private lives of citizens," she said.

During the football World Cup in Qatar, authorities used remote biometric identification techniques, involving 15,000 cameras with facial recognition technology Deutsche Welle

Can it be stopped?

So how can this be prevented in the Middle East, where authoritarian regimes may not be misusing biometric information in an obvious way quite yet — but where they clearly have a vested interest in social control?

"There's very much this idea that processing people's biometric data is useful and beneficial," Jakubowska argued. "But actually, this data is so sensitive — it's not like a password that can be reset, it will identify you throughout your life — that we will always start with asking whether we really need to do this?"

The European Union is currently debating what will likely be the world's first law on artificial intelligence. Rules on how biometric information should be used, and whether it should be used at all, are likely to be one of the most contentious subjects.

"What I really worry about is that if the EU says that there are legitimate use cases for these technologies, that we are legitimizing it for other countries," said Jakubowska, who would like to see the EU take a tougher line. "There's definitely power in a whole jurisdiction saying, 'we don't think this thing is acceptable'."

The AI Now Institute wants a complete ban on remote biometric identification, Kak added.

"Nothing else makes sense," she told DW, adding that privacy laws and other rules won't help. "And not just in the Middle East, but here in the US and in Europe too. The problems with these systems aren't magically fixed in Western liberal democracies — even though the dystopia of what can go wrong is often immediately palpable under authoritarian regimes."