The state, sovereignty and strategic decision-making

The state and its data: why can a state that cannot see itself not secure itself?

By Ali Zuweid · Article date: 27 October 2026 · 9 min read

English translation published 31 October 2026. Read the Arabic original.

In February 2025, Iraq’s Ministry of Planning announced that the 2024 census had counted 46,118,793 people. This is the population benchmark for that census, not an estimate for October 2026. The distinction may appear minor, yet it exposes a major problem in using data: a number can be correct while the conclusion built on it is wrong because its time or scope has changed. The state cannot plan a school, hospital or crisis response merely by retaining a large national total. It needs to know where people are and what has changed since the information was collected. Ministry of Planning: basic census results.

In November 2025, the ministry announced a workshop with the United Nations Population Fund to develop a roadmap for the integrated national register, Sanad, as part of a move towards register-based statistics. This was an announcement about developing a methodology, not proof that a complete integrated register was already operating. The distance between conducting a census and possessing connected, updated information is a security issue as well as an administrative one. How can the state recognise changing needs and verify its information? Who should be entitled to consult it without making citizens subjects of permanent surveillance? Ministry of Planning: Sanad roadmap.

A correct number can answer the wrong question

A census measures people at a reference point using defined concepts. Institutions record different events: school enrolment, document issuance, benefit entitlement or service use. Adding the totals of these registers does not produce a population count. The same person may appear repeatedly, while another may be absent because they have not dealt with the institution. A discrepancy between two totals is consequently not automatic evidence of corruption or census error. It may arise from different units of measurement, update dates or registration criteria. Serious work begins by defining what each register counts before asking software to match it with another.

Consider school enrolment as an analytical example, not a documented finding about a particular governorate. A falling count may indicate families moving away, pupils transferring to another school, dropping out or delays in entering information. Deciding to build additional classrooms before distinguishing these explanations could allocate money to the wrong place. The same logic applies when interpreting service pressures after displacement or economic change. Data’s security value lies in reducing the time needed to recognise a problem and correct its interpretation, rather than claiming that every social change can be predicted precisely.

Comparisons also require stable geographical boundaries or a record of their changes. Redrawing an administrative boundary may increase its recorded population without anyone moving. If two agencies define unemployment or eligibility differently, connecting their systems does not remove the difference; it may conceal it beneath a precise-looking result. A dictionary of definitions, a history of revisions and responsibility for record correction are therefore elements of strategic state capacity. They attract less attention than launching a new platform, but determine whether an official is observing genuine change or a side effect of registration practices.

Integration does not require moving everything into one place

Estonia’s Information System Authority describes X-tee as a technical and organisational environment for exchanging data between bodies that retain control over their information, with authentication, authorisation and logging. It uses X-Road technology. Connectivity does not mean all information becomes one central database accessible to every official. The relevant lesson for Iraq is that data storage can be separated from permission to consult a defined part of it for a legitimate purpose. Describing this architecture does not, by itself, establish its suitability in identical form for every country or show that it prevents all errors. Estonian Information System Authority: X-tee.

A narrow administrative question illustrates what can be transferred: does a service provider need a full copy of a citizen’s file, or only a verified answer about one eligibility condition? Limiting the information exchanged reduces opportunities for use beyond the original purpose, but requires legal agreement on what an answer means and who is responsible when it is wrong. If an application is refused because of another body’s data, the citizen must not be left travelling between two offices, neither accepting responsibility. From the citizen’s perspective, successful integration means prompt correction and an understandable reason for a decision, not the number of technically connected agencies.

The comparison with Estonia has important limits. Connecting a technical product cannot be assumed to resolve accumulated Iraqi procedures, divided responsibilities or uneven institutional readiness. Dependence on a single supplier may also leave the state able to use a system but unable to maintain it or change its terms. Interoperability, documentation, ownership of records and local training should therefore take precedence over interface appearances. Exporting data in intelligible formats and maintaining a reliable revision history remain part of independent decision-making, even where contracting an external company is appropriate.

Knowing society does not require exposing its private lives

Article 17 of Iraq’s Constitution protects personal privacy, while Article 110 makes general statistics and the census an exclusive federal competence. Taken together, these provisions mean that the state’s need for knowledge does not give every agency unlimited authority over every item of information. Government can obtain a statistical picture of inadequate services without giving every planning participant access to individual files. Access to specific information for other purposes requires a legal basis, bounded powers and appropriate oversight. A general invocation of ‘security’ is insufficient. Iraq’s Constitution: privacy and statistics.

Excessive collection also carries a cost for knowledge. Citizens who fear that information requested by a service provider will be used against them outside its stated purpose may be less willing to supply accurate information. I offer no statistical estimate of this effect in Iraq; it is a behavioural risk that service design should test. The safeguard is not a lengthy notice nobody reads, but a clear explanation of what is collected, why, who can correct it and when retaining it is no longer necessary. On this reasoning, protecting privacy can support the quality of knowledge the state needs rather than obstruct administration.

Publishing statistics must also be distinguished from publishing raw files. Differences in service access can be reported at an appropriate geographical level. Highly detailed information about a small area, however, may reveal individuals even after names have been removed. A person can still be identified from a combination of characteristics. Public release therefore requires an assessment of re-identification risks, while sensitive information needs restricted permissions and an access record. Transparency is compatible with these limits. Useful transparency explains how a decision was reached and how it can be challenged; it does not expose private lives to public curiosity.

What should Iraq test?

I propose beginning practical register integration with a declared and bounded service problem, such as improving estimates of school-building needs in a defined area, rather than promising to collect all government data. Census information, education registers and population changes would be compared using shared definitions, followed by a field sample to investigate discrepancies. The purpose would be to measure improvement in decisions, not to prove the platform’s superiority in advance. If information fails to improve resource allocation or shorten verification, connecting more registers is insufficient grounds for declaring success.

Correction should remain the responsibility of the body producing the information, with a clearly identified authority to resolve disagreements lawfully, rather than creating competing copies updated at different times. Measurement should cover completeness of essential fields, information age, cases requiring human intervention and the time taken to resolve an appeal. These indicators are closer to decision quality than login counts. Earlier values and reasons for amendments should remain auditable. A correction that entirely erases the trace of an error may prevent administrators from recognising repeated problems at the same source.

In security-related matters, an administrative mismatch must not become a judgment about a person. Similar names, an incorrect birth date or a delayed update require verification, not an automated presumption of bad faith. This constraint becomes more important as connectivity increases, because one error can affect several decisions. The threshold for verification should rise with the seriousness of the potential impact on rights. This is not an argument for obstructing decisions. It directs scrutiny towards high-cost errors instead of imposing an identical procedure on every transaction.

Officials also need to understand the limits of the screen they consult. A system can show the last update, coverage, the indicator’s definition and whether a value was observed or estimated. Missing information about an area should appear as a knowledge gap, not zero need or zero risk. I propose that periodic reports state what an institution does not know alongside what it knows. Openly incomplete information supports decisions better than an apparently comprehensive figure that conceals an absence. Such methodological restraint protects resources and trust together.

The 2024 census gave Iraq an important benchmark. Discussion of integrated registers opens the question of how knowledge should be updated and used. A state that sees itself is not the one holding the greatest number of data fields. It knows which questions its information can answer, where verification is necessary and when it must refrain from a conclusion affecting rights. At that point, digitisation moves beyond purchasing systems and becomes a public capacity on which society can rely.

Ali Zuweid — Researcher in strategic affairs and national security