Governance, Openness and Security of Digital Public Infrastructure in India by the internet Research Lab (hereafter, the “GOSDPI paper”) provides new evidence into the organization and functioning of state promoted digital platforms in India. With its comparative approach, it allows us to identify patterns, divergences and blindspots that make up what we might call “actually existing DPI” (as distinct from widely circulating inflated and ungrounded claims about DPI). This essay responds in the form of an architectural critique rooted in political economy. It draws on the findings of the GOSDPI paper to theorize the architecture of DPI systems as flexible, distributed platforms that encode the structure of hegemony in Digital India. This architecture splits governance, ownership, deployment and profit to forge links between powerful interests (software, finance, state elites and sectoral interests, such as in construction). Seen thus, DPIs emerge as instruments that build and sustain elite coalitions, enabling the continuance and intensification of domination.
Actually Existing DPIs
A large and expanding body of grey literature prescribes the principles, architectures, and functions of something called “Digital Public Infrastructure”. Much of this literature is mobilized towards rapid policy diffusion, exporting certain idealized models as “best practices” whose supposed successes can be replicated around the world. As a result, mainstream DPI discourse often pays more attention to finessing how to promote “DPI” than to understanding what the systems given this name actually do.
What does it mean to look at “actually existing DPIs”? This means looking not at technical diagrams that assume end-users who are rational, literate, and empowered, nor unattributed factoids about the cost savings these systems will supposedly deliver, nor the smiling photographs of fictional user personas – farmers and street vendors are in vogue – that adorn dozens of report covers, nor even the elegant principles that promise openness, interoperability, and trust. Rather, actually existing DPIs refer to the opaque, imperfect, compromised, and negotiated systems that are actively reorganizing societies. Looking at actually existing DPIs also means being specific about how these systems work in different contexts; this article focusses on the Indian cases studied by the GOSDPI paper, while recognizing that systems elsewhere are similar and different.
DPI are worth studying in empirical detail because they form the operating system of contemporary life in many places. Small nuances in the structures of these systems have massive ripple effects affecting hundreds of millions of people. Since they are composed of several interlocking structures – legal, technical, economic, cultural – it is precisely the interplay of these various forces that this analysis unpacks.
The GOSDPI paper is primarily framed as an exercise in gathering evidence and evaluating whether six actually existing DPI live up to the claims made on their behalf. This is critically important for advocacy, as the answer on most counts is “no”. In the course of this exercise, the paper’s authors also begin to theorize actually existing DPI. The paper refers, for example, to DPI’s “highly networked public-private architecture”, its “distributed architecture”, its “selective openness”, “complex incentive structures across multiple actors” and “fragmented model of responsibility”. They write that in DPI, “regulatory authority is concentrated in central state bodies, while operational governance is delegated through layered frameworks of rules, guidelines, and bilateral agreements.” And: “when faced with security vulnerabilities and data breaches, DPIs defined their security perimeter narrowly. The security boundary was set to be at the core infrastructure, while responsibility for breaches occurring through third-party integrators and components was denied.” This essay picks up some of these threads to build a more systematic theorization of actually existing DPI.
The DPI Assemblage: From Imaginary to Platform to Extension
To understand DPIs’ broader social and economic effects they should be treated as assemblages: DPIs encompass not only core software platforms, but also ecosystems of private and public sector complementors, the hardware and infrastructural dependencies on which they run, the regulations that govern them, the imaginaries that shape them and the human intermediaries and social structures that provide last-mile interfaces. Across these dimensions, DPIs in India are characterized by a hyper-proliferation of roles and actors. They are structured in ways that “increase the surface area of a problem”, multiplying the sites in which different entities can enter the system and the functions they serve. These functions are operational, economic and regulatory, often at the same time. Importantly, as the GOSDPI paper reveals, though DPI are often described as “open”, in practice they are tightly permissioned, and the entities that occupy roles in the ecosystem often do so because they have significant economic and political power.
Here we draw on and extend the example of the FASTag highway toll collection DPI, which is explicated at length in the GOSDPI paper.
Common imaginaries of marketized development
It is clear from the GOSDPI paper that DPI is not simply a one-size-fits-all approach. There is significant room for variation between different DPIs. Yet at the same time, a shared “sociotechnical imaginary” motivates DPI more broadly. The notion of a broad-based move from “pipes to platforms” in the architecture of government services, for example, has been promoted by a relatively small set of actors over a decade. The Nilekani-led TAGUP report is a consistent touchstone in the distributed governance of DPI. An imperative to scale at all costs, likewise, accompanies all DPI rollouts.
The DPI imaginary frames not only the architecture of the DPI platform but also proposes a theory of change, claims about the kind of social and economic change these systems will bring about in the world. This theory of change – for which there exists little concrete evidence – links DPI deployment to increased government efficiency, private sector innovation and poverty alleviation. It is built on pre-existing imaginaries of marketized development, including CK Prahalad’s business school promise of the “fortune at the bottom of the pyramid” and a “financial inclusion assemblage” that claims that, once granted access to credit, the poor can entrepreneur their way out of poverty.
Entities that have promoted the DPI imaginary include, among others, the tech czar Nandan Nilekani, the industry body Indian Software Product Industry Roundtable (iSPIRT), and global funding agencies like Omidyar and the Gates Foundation. Broadly, these correspond to domestic software capital and US transnational capital. Their stakes are not only economic but also symbolic. With the proliferation of DPI, domestic software capital has today arguably become the hegemonic class fragment in India, playing an outsize role in shaping common-sense assumptions about what the future of the nation should look like.
Complex ownership structures
The agencies that own the core platforms of DPI are often composed of complex configurations of actors. In some DPI, ownership rests entirely with a technocratic state agency. This is especially the case for so-called “foundational DPI” like Aadhaar and Digilocker. But in domains with powerful incumbent sectoral interests, like finance or highways, ownership models tend to be more complex.
As the GOSDPI paper describes, FASTag is owned by the Indian Highways Management Company Limited (IHMCL), a special purpose vehicle, of which the public enterprise National Highways Corporation of India owns 41.38%, toll concessionaires (which include some of the largest infrastructure and construction companies in the country) hold 33.81% and financial institutions hold 24.81%. This fragmented ownership structure includes both finance and construction, with “L&T Finance, GMR Highways, Shapoorji Pallonji Roads, and Essel Infraprojects, each holding between 3–8% of total share capital”.
The National Payments Corporation of India (NPCI), which owns the Unified Payments Interface system, is one of the most prominent entities in the operation of DPI. It is structured as a non-profit company composed of a mix of public banks, private banks and fintechs. Over 51% of shares are held by public sector banks.
Such ownership structures mix public sector enterprises with commercial interests across various sectors. They should be understood as ways of carving up the pie that secure the consent of powerful fractions of capital to build and deploy large-scale projects.
Platform-ecosystems in operation
At the level of operation, each DPI is a platform-ecosystem composed of a two or three-layer stack: the core platform, occasionally a hidden routing layer, and an interface layer.
The core platform is usually operated by the entity that owns the DPI (NPCI operates UPI, UIDAI operates Aadhaar). Occasionally, the operating entity is distinct from the owning entity. The National Electronic Toll Collection (NETC) transactions that are at the centre of FASTag toll collection, for example, are operated by NPCI (which is involved in many DPIs that process financial transactions).
The routing layer, where it exists, is composed of incumbent sectoral interests, often but not always in finance, whose buy-in is necessary to operate the DPI. In the case of FASTag, these actors are the issuing and acquiring banks that facilitate the movement of data and money through the system. Access to this layer is controlled by licenses that often mandate technical specifications and/or turnover requirements, restricting them to large enterprises. These entities often earn guaranteed rents from occupying these privileged nodes in the ecosystem.
The interface layer is usually composed of user-facing apps or services. Organized to attain scale, this level is often characterized by entities that already have significant market access or have the resources to take on elevated risk to acquire customers. In FASTag, the interface layer is split between acquiring banks and fintech startups. Acquiring banks are responsible for registering new users into the FASTag system and providing them with a physical FASTag RFID to affix to their car. Fintech apps form the extended ecosystem, which are often used to top up one’s FASTag funds. In other DPI, such as UPI or Aadhaar, this layer is often occupied by fintech companies with speculative business models backed by venture capital.
Putting these three layers together: When a car passes through a toll plaza, data is transmitted to a toll plaza operator, whose infrastructure is configured by a system integrator, to an acquirer bank, to NPCI’s NETC mapper, to an issuing bank, from whose account money is deducted, and then back. A complex incentive structure follows: “Each toll transaction triggers a fixed percentage-based payout to the involved entities. The acquirer bank, issuer bank, NPCI, and IHMCL receive 0.13%, 1%, 0.15% and 0.25% of the transaction value respectively as programme management fee.”
Multiple dependencies
All DPIs depend on complex infrastructural stacks, which are usually excluded from most definitions of DPI. To continue with the FASTag example: “When users pass through a toll plaza, multiple devices generate and collect data: RFID readers capture the Tag ID, TID (transponder ID), and user memory; Automatic Vehicle Classification (AVC) systems determine the vehicle class; Weight-in-Motion (WIM) sensors record vehicle weight; and image capture systems photograph the vehicle.” A proliferation of hardware components, then, is what keeps DPI like FASTag running.
DPIs share infrastructural dependencies with cloud-based contemporary digital systems: data centres, undersea cables, mobile towers and more. These are largely supplied by Chinese hardware manufacturing and US hyperscalers. Yet DPI also have particular infrastructural dependencies that are unique to their uses and the situation of India. Smartphones and internet access, for example, are major dependencies of DPI in India, and India’s telcos – operated by conglomerate capital – entrench their importance with every use of DPI. Since biometrics have been foundational to Aadhaar, biometrics suppliers – which are often US and European contractors – have played a prominent role as well.
People are important dependencies in the functioning of DPI. Despite the nationwide rollout of FASTag, most toll plazas in India remain labour intensive, with human intermediaries helping users navigate systems that often don’t work as designed. A simple example familiar to most people who have travelled on an Indian highway: a user’s FASTag fails to scan when the car pulls up at the boom barrier; in response, a toll plaza operator pulls out an RFID reader affixed to a long stick and waves it closer to the tag in order to scan it. Without such improvisations, DPI would simply not work.
Fragmented regulation
DPI function within a regulatory regime that is organized towards maximizing the circulation of data. Thus, the structure of regulation in DPI often fragments authority. The ultimate regulatory authority often rests within central government ministries or central regulators, such as the Reserve Bank of India, but is enforced by a range of actors. In FASTag, the Ministry of Road Transport and Highways is the apex policy authority, while operational guidelines – fee structures, rules of participation and compliance – are managed by IHMCL.
Extension and interconnection
Because DPIs are structured as platform-ecosystems, they can often be extended. New actors can enter the ecosystem as complementors, usually via bilateral agreements and APIs. Thus, FASTag data is also accessed by government agencies for tax compliance and national security. Commercial entities offer a different kind of extension, integrating DPI with each other or with other services. In a commercial fintech app, the Bharat Connect DPI may be used to top up a FASTag account using UPI for payment. As they are extended and interconnected, DPIs become more entrenched.
Architectures of Hegemony
According to a classic paper on postcolonial politics, a ruling coalition “is always based on an explicit or implicit protocol, a network of policies, rights, immunities derived from both constitutional and ordinary law which sets out over a long period, the terms of this coalition and its manner of distribution of advantages”. With DPI, this article has shown, this protocol is not only legal and social but also technical and economic.
The DPI assemblage apportions specific roles to powerful entities suited to their particular interests. In most DPI, this creates a coalition between the state, the software capitalists that build and extend these systems, the financial capital that runs much of the financial plumbing, the conglomerate capital that operates the network infrastructure and sectoral capitals that vary with each DPI (construction in the case of FASTag), as well as important international actors upon which the entire structure is dependent: US hyperscalers and Chinese hardware manufacturers.
Entities with an economic stake in DPI may extract guaranteed rents from occupying a position in the routing layer. Or they may take more risky interface-level business models, often funded by venture capital. The stakes may also be symbolic – building prestige and the image of nation-building. They may be political, offering gains in national security or surveillance. Some entities are content with the status quo; others want to bend the architecture of the system further towards their interests.
DPIs should be understood not only, then, as technologies of service delivery but also as architectures of hegemony. The protocols of DPI encode the distribution of advantages between the divergent entities that compose the ruling bloc of the nation-state today.
Mila T. Samdub is a writer, designer, and curator who works on the aesthetics and political economy of digital infrastructures in India and the Global Majority world.