uid

When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy

First they ignore you, then they laugh at you, then they fight you, then you win. -Mahatma Gandhi

In matters of conscience, the law of the majority has no place. Mahatma Gandhi

“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi

“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.” -A three judge bench headed by Justice J Chelameswar said in an interim order.

Legal scholar Usha Ramanathan describes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.

Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.
Rajeev Chandrasekhar, MP Rajya Sabha

“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh

But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant. Rajeev Chandrasekhar, Rajya Sabha MP

“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017


Special

Here is what the Parliament Standing Committee on Finance, which examined the draft N I A Bill said.

1. There is no feasibility study of the project]

2. The project was approved in haste

3. The system has far-reaching consequences for national security

4. The project is directionless with no clarity of purpose

5. It is built on unreliable and untested technology

6. The exercise becomes futile in case the project does not continue beyond the present number of 200 million enrolments

7. There is lack of coordination and difference of views between various departments and ministries of government on the project

Quotes

What was said before the elections:

NPR & UID aiding Aliens – Narendra Modi

"I don't agree to Nandan Nilekeni and his madcap (UID) scheme which he is trying to promote," Senior BJP Leader Yashwant Sinha, Sept 2012

"All we have to show for the hundreds of thousands of crore spent on Aadhar is a Congress ticket for Nilekani" Yashwant Sinha.(27/02/2014)

TV Mohandas Pai, former chief financial officer and head of human resources, tweeted: "selling his soul for power; made his money in the company wedded to meritocracy." Money Life Article

Nilekani’s reporting structure is unprecedented in history; he reports directly to the Prime Minister, thus bypassing all checks and balances in government - Home Minister Chidambaram

To refer to Aadhaar as an anti corruption tool despite overwhelming evidence to the contrary is mystifying. That it is now officially a Rs.50,000 Crores solution searching for an explanation is also without any doubt. -- Statement by Rajeev Chandrasekhar, MP & Member, Standing Committee on Finance

Finance minister P Chidambaram’s statement, in an exit interview to this newspaper, that Aadhaar needs to be re-thought completely is probably the last nail in its coffin. :-) Financial Express

The Rural Development Ministry headed by Jairam Ramesh created a road Block and refused to make Aadhaar mandatory for making wage payment to people enrolled under the world’s largest social security scheme NRGA unless all residents are covered.


Search This Blog

Monday, January 16, 2017

10686 - Revisiting foundations of Aadhaar - Governance Now

Apart from being one of the most ambitious identity projects in the country, it has also been one of the most misunderstood

RS Sharma | December 6, 2016 | New Delhi

- See more at: http://www.governancenow.com/gov-next/egov/revisiting-foundations-aadhaar#sthash.Ap59rk0n.dpuf

(Illustration: Ashish Asthana)

1.1 The Unique Identity Project of India, now called Aadhaar, was started in July 2009. The first Aadhaar number was issued on September 29, 2010. As on date, Unique Identification Authority of India (UIDAI), the agency responsible for implementing this project, has issued more than 1 billion numbers and continues to inch towards universal coverage. However, there have been controversies and confusions about Aadhaar since the beginning and some of these continue even today. In the meanwhile, Aadhaar has become quite central to India’s public service delivery reforms agenda. 

1.2 It is true that many aspects of the unique identification (UID) project are at variance from the typical identity systems existing either in India or elsewhere in the world. It has also introduced some new paradigms, which have not yet become fashionable. It also breaks some long-established stereotypes about ID systems. It is largely due to these reasons that many of its design and operational aspects have come in for heavy criticism.

1.3 Right from the start, there were many who were questioning the basic design principles. As the implementation progressed, many of these criticisms have become somewhat muted. Nevertheless, there remain a few aspects that are not yet fully appreciated.

Why is it a number, not a card?

2.1 When UIDAI issued its strategy paper in August 2009, it declared that UID will issue only numbers and not cards. When this statement was made, many were surprised. Traditionally, identities are always issued in the form of ID cards; never heard of an identity number. Now, UIDAI is saying that it is a number and not a card. What is the significance and implication of this statement?

2.2 One of the most important reasons is that Aadhaar has been designed to be next-generation online identity platform. As against this, a card (which normally connotes a smart card) is an offline token. In an online and connected world, tokens lose their value.

This phenomenon is quite visible in many areas. Take airline tickets. We used to get tickets kept in very attractive jackets. Now you do not get any ticket. You can print it online. In fact, now you do not even need to print. You can just get it on your mobile. Hence, in a connected world, there was no need for a smart card. 2.3 You can authenticate online even if you just have the number. UIDAI issues a letter to communicate the number to the resident. This letter has a perforated portion which can be torn and laminated. It is true that these letters have durability issues, and plastic cards should have been better. (We later tried for a plastic card but the finance ministry told us: You said number and not card. Now why do you want a card! We could not convince them that a plastic card is different from a smart card. Anyway, that story some other time!) A plastic card should be differentiated from the smart card which has a chip embedded in it. Each smart card costs about '100, while the plastic card would cost less than five rupees. 2.3 Smart cards also have several lifecycle management issues. Cards can be lost. Update of demographic or biometric data will require issuance of new cards, etc. Smart cards will also need smart card readers. 2.4 Another reason is that if Aadhaar was proposed as a card, then it would have become another ID card like driving licence, ration card or the voter ID card. All these cards are essentially eligibility cards authorising one to drive, get ration or vote. Aadhaar has no eligibility attached with it. Hence by itself, the Aadhaar card would not have any value except probably enabling the holder of the card to enter airports or on trains or prove their identity for checking into a hotel. These things are already enabled by the existing ID cards. As this was meant to be an ID that could be combined with any transaction and could work as an ID proof for getting access into any formal system, it is best that it is promoted as a number which could be linked to existing systems like PDS, PAN cards, EPIC cards, MNREGA job cards, RSBY insurance cards, pensions and other databases. This could then work as a cleansing agent to eliminate duplicates and fakes from these databases. 2.5 Thus, Aadhaar has been developed as a tokenless digital identity number which can be embedded in any database and authentication could enable digital transactions. In other words, being a tokenless number with data residing on the cloud, it is possible for Aadhaar to work as a trusted and common ID authentication for any system, which requires ID authentication for transactions. Example of such systems are banking, proof of presence and lifting of ration from PDS shop and getting mobile SIMs, etc. 2.6 Now that Aadhaar has started being used for several transactions, people are realising that the Aadhaar system is working as a trusted third-party authenticator of identities in digital transactions and its utility as a number, and not a card, is being appreciated. Why is it a random number? 3.1 Another issue on which people ask questions is why the Aadhaar number should be a random number consisting of 12 digits. Why should it not be constructed so as to have some intelligence? It could have codes for states, gender and districts, etc. embedded into it so that the number itself makes some sense. For example, we could construct numbers like UP09/12345. This could be a number belonging to a person from Agra district of UP. 3.2 While having an alpha-numeric number may make the numbers small in length, as each alpha will be able to accommodate 26 values as against 10 for a digit, it was not found feasible for a multi-lingual society like ours that also has a high level of functional illiteracy. There are several other reasons why Aadhaar is designed as a digit-only number. Some of them are: a digit is something which everybody understands, arabic numerals are already there on the keypad of mobile phone, etc., and it is also there on all the keypads. Digit-only numbers are also easy to remember like phone numbers. 3.3 The UID numbering scheme was designed after a careful consideration of all the options and trade-offs. An internal report titled ‘A UID Numbering Scheme’ (Hemant Kanakia, 2010) became the basis of designing the structure of the Aadhaar number. Some of the findings of this report are summarised below. 3.4 The number should be large enough to accommodate future requirements. Internet address schemes in version 4 and Y2K are some of the examples which show that you may run out of space at some point of time in future and then will have to make changes at a substantial cost and time. Imposing a structure in the format also results in unnecessary waste of space (IPv4 is again a case in point). Hence 12 digits, with the 12th digit being a check digit, will be able to accommodate 100 billion numbers! Even with a few restrictions relating to use of the first digit, you are left with 80 billion numbers. 3.5 Embedding intelligence in a number was prevalent and useful in an unconnected world where you had no access to information relating to the number. However, Aadhaar is designed from the beginning itself as an online digital ID and therefore you have real-time online access to the information associated with the number. Hence, there is no need to embed intelligence in the number. 3.5 The UID number has also been designed not to disclose any personal information. Embedding some intelligence would violate this principle. US social security number (SSN) suffers from this problem wherein it is possible to guess information about a person from his/her SSN. Similarly, the patterns in the SSN enable a person to guess the number from the personal details of the concerned individual. Designing UID as a random number makes it impossible to guess the identity and it does not disclose any information about its holder. 3.6 Hence, a semantics-free 12-digit number where the last digit is check digit (to minimise data entry errors) and the first digit was reserved for denoting the number type was chosen. The rest of the digits are generated in a random manner. Considering that the space can accommodate 80 billion numbers and we will initially use only about a billion plus, the ‘density’ is just a little more than one percent. This also makes guessing almost impossible. 3.7 The number will also be extensible with backward compatibility to have more decimal digits should a need arise in future. We have reserved the first digit as ‘1’ for entity related UIDs, should such a need arise in future. Hence, excluding 0 and 1 in the first digit leaves a clear space of 80 billion numbers available for allocation as of now. 3.8 Aadhaar is for lifetime. Hence, once a number is assigned to a person, it will remain with him and will not be reused even after his death. This will avoid confusion regarding the ownership of the number at different times. Why did Aadhaar not collect more info? 4.1 One of the suggestions which have been around since the beginning is the need to collect all relevant details relating to a resident at the time of enrolment into the UID system. For example, why should we not collect details regarding a person’s driving licence number, PAN, EPIC number, BPL card number, ration card number, etc. at the time of enrolment itself, so that all these numbers could be linked then and there itself? 4.2 Firstly, the only function of UIDAI is to establish identity (uniquely, to be more specific). It is the world’s first identity without eligibility. Hence, UIDAI does not need these extra attributes for performance of its functions. However, UIDAI had no objections if this extra information was also collected by the registrars for their own usage. This extra information was called ‘know your resident plus’ (KYR+), the basic information for Aadhaar enrolment being called KYR. 4.3 Aadhaar registrars are typically state governments and they may find linking this information with Aadhaar relatively easy if they collect it at the time of enrolment itself. Many state governments also notified collection of many attributes under KYR+. However, the results were not very encouraging. The residents typically came with only minimal documents just sufficient to prove their identity and address for their enrolments. The result was that while the enrolment agencies were contracted for collecting KYR+ data also from the residents, effectively very little data was collected. In this work, enrolment agencies also did not cooperate. As they could not return the resident if he did not bring KYR+ documents at the time of enrolment, they did not capture the information even if the resident probably got the papers as they would have to do this extra data entry. Instead, they took the line that the residents do not bring in the extra papers and they could not refuse Aadhaar enrolments to them and hence no collection of KYR+ data. Of what use is Aadhaar without benefits? 5.1 One of the basic statements which UIDAI had put out in its strategy document was ‘UIDAI will only provide the identity number and this will not ensure any entitlements, rights or guarantees’. People often asked if Aadhaar does not provide anything, then what its use. Why should people enrol for it? 5.2 Aadhaar, from the beginning, was built as a digital identity platform. This is a fundamental shift from the traditional method of ID projects. In fact, this is also one of the misunderstood aspects of Aadhaar. 5.3 For the first time in India, and probably the world, a new paradigm was introduced: a pure identity without any eligibility attached with it. All existing documents which we normally use as identity documents (voter ID cards, driving licences, PAN cards, ration cards, etc.) are essentially eligibility documents and ID is an implicit attribute of these. Every eligibility attribute must have an eligible person and that person uses these eligibility documents as his/her ID proof. The voter ID card is a document whose primary purpose is to serve as a certificate that you are a voter. You use it as an ID proof for all other purposes since ID is an underlying attribute of this document. Similarly, a driving licence is an authorisation/certificate to the effect that you can drive a motor vehicle and a ration card makes you eligible for getting ration at subsidised rates. 5.4 As ID is a common, implicit and underlying attribute of all the existing eligibility documents, these can be used as de-facto ID documents. However, there are various problems associated with such documents. Some of these are: (i) There is no guarantee of their uniqueness. There are examples of people having multiple PAN cards and ration cards (it is advantageous to have many as it gives you more ration!). (ii) There is no guarantee of uniformity of information. As an example, you may have different age in different documents. Changing attributes suitably is advantageous to avail benefits from as many domains as possible – you become a senior citizen for railway travel and a young man for insurance purposes. (iii) These can be easily faked as there is no way to verify the authenticity of these documents without following a long and time-consuming procedure. (iv) These are not universal. For example, voter ID cards can be issued for people of 18 years of age or above. (iv) Some of these documents (eg., ration cards) are family documents as opposed to individual IDs.  5.5 Hence, UIDs were designed as basic ID documents which are just necessary (as also sufficient) to prove the ID of a person and which can be used by all the domains which issue eligibility documents. In other words, it can work as an ID platform on which eligibility applications can be built. Its availability on the digital platform makes it amenable and pluggable for use by various domains. 5.6 Pure identity which is online and digital gives it the flexibility to participate in any digital transaction. Various service delivery domains can now be absolved of the responsibility of identity verification and UIDAI can work as a trusted third-party authenticator. What is the use of authentication and eKYC? 6.1 Authentication is also one of the most misunderstood aspects of Aadhaar. It is only now that people have started understanding the usefulness of authentication in banking transactions, in PDS delivery mechanisms and, more trivially, in biometric attendance systems. Similarly, electronic KYC (‘know your customer’) is another product whose value is not fully understood. Not yet. 6.2 Aadhaar authentication, as specified by UIDAI, is the process wherein the Aadhaar number, along with other attributes (demographic/biometrics/OTP) is submitted to UIDAI’s central identities data repository (CIDR) for verification; the CIDR verifies whether the data submitted matches the data available in CIDR and responds with a ‘Yes/No’. No personal identity information is returned as part of the response [UIDAI, 2014]. Similarly, e-KYC is the process where UIDAI issues a digitally signed electronic ID document after biometric authentication and authorisation of the individual. 6.3 The purpose of authentication is to enable residents to prove their identity and for service providers to confirm that the residents are ‘who they say they are’ in order to deliver services and give access to benefits. 6.4 As UIDAI maintains only identity information about the residents, this information alone does not do anything much. However, every service delivery organisation needs to establish the identity of its customers before delivering the services. It is important so that the service intended to be provided to A is provide only to A and not to B. Now this work of establishing A’s identity is done by UIDAI. Hence, at the time of service delivery, UIDAI becomes the trusted third party to authenticate identities. This service can be combined in any digital transaction. In fact, it can also be used in a physical transaction also (like allowing access to somebody after proving his ID). However, it is very useful in digital transaction as it provides traceability and transparency of the transaction. 6.5 Let us take a typical example to illustrate the use-cases of authentication.  Public distribution system (PDS) is the largest distribution network in the world mandated to provide food grain and other items (ration) at subsidised rates – the level of subsidy varies with the income level of the beneficiary. The system is administered by about 5,00,000 fair-price shops (FPS) throughout the country. One of the complaints of the system is that the FPS dealers sell the ration items in the black-market and show it as having been distributed to the people. FPS dealers deny this allegation and people claim that they did not receive the ration, and when they had gone to the FPS they were turned back giving one excuse or the other. It becomes very difficult to objectively investigate in these situations and corruption prevails throughout the hierarchy of the officials of the PDS. There are also complaints of large-scale duplicates and ghost ration cards. 6.6 Uniqueness of Aadhaar helps in reducing the duplicates and ghost ration cards. If the entire database of ration cards is seeded with Aadhaar numbers, one can eliminate bogus ration cards. 6.7 Authentication helps in ensuring delivery of ration to the beneficiaries of PDS. The PDS shop owner has a biometric authentication device, which is connected to the entitlement database at the backend. Once a customer comes, he provides his ration card number. There may be many family members on the ration card. The shop owner selects the individual who has come. He fills in the items the individual would like to purchase and then the beneficiary authenticates his identity either through his fingerprint or iris. At the backend, the authentication packet is transmitted to UIDAI. UIDAI confirms the ID of the person and then the PDS backend allows the transaction of ration purchase to take place. In this scenario, there is a foolproof system where all the stakeholders, PDS shop owner, the beneficiary and the government are participating. The transaction is traceable and transparent. There will be fewer complaints now as there is a digital proof of this transaction. The most important advantage of this system is portability. Now a beneficiary should be able to go to any ration shop and get his entitlement. As the entitlements, identities and inventory of the ration at various FPS is online, one can manage things much more efficiently. 6.8 One can argue that such authentication systems could also be made by individual domains also. Yes, that is true. However, using the common ID infrastructure for doing a job (authentication), which is required by almost all the service delivery agencies, provides huge efficiencies and cost advantages. 6.9 More and more systems have now started using authentication services of UIDAI. Two of the most common examples are interoperable banking services and attendance systems. Aadhaar as a financial address is being leveraged for direct benefit transfer (DBT) in several domains such as DBT for LPG (‘PAHAL’) and scholarships and social security pensions (national social assistance programme – NSAP). Electronic KYC has also been used for opening bank accounts under Jan-Dhan and, more recently, for getting mobile SIMs. Digital life certificates (Jeevan Pramaan) for pensioners is another usage of authentication. Last year, the central government had also started online digital signature service e-Sign (CCA, 2015) and digital locker (DeitY, 2015) which uses Aadhaar authentication for ID verification before allowing access into the system. This is a part of the Digital India initiative which aims at transforming India as a digitally empowered society and knowledge economy. In fact, today India has a full suite of products based on Aadhaar authentication services for a paperless, cashless, presence-less, transparent and consent-based architecture what is commonly being described as India Stack. Summing up 7.1 Aadhaar has been one of the most ambitious ID projects in the world. But it has also been a controversial one. Many of its design aspects do not follow traditional concepts and have been misunderstood and criticised for several reasons. Now that Aadhaar has become central to the service delivery reforms in the country, a re-look at these aspects will help to clarify many of design principles which had appeared quite irrational and non-traditional in the beginning.   Sharma, chairman of TRAI, was the first director general and mission director (DG&MD) of Aadhaar project and held this position for about four years since the start of the mission. Citations and References Hemant Kanakia, S. N. (2010). A UID Numbering Scheme. New Delhi: Unique Identification Authority of India. Mahmood, T. (2008, December). http://www.sacw.net. Retrieved from South Asia Citizens Web: UIDAI. (2014). Authentication Overview. Retrieved from Unique Identification Authority of India: CCA. (2015, July). eSign – Online Digital Signature Service. Retrieved from Controller of Certifying Authorities: DeitY. (2015, July). Digital Locker. Retrieved from Digital Locker.   

- See more at: http://www.governancenow.com/gov-next/egov/revisiting-foundations-aadhaar#sthash.Ap59rk0n.dpuf