uid

When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy

First they ignore you, then they laugh at you, then they fight you, then you win. -Mahatma Gandhi

In matters of conscience, the law of the majority has no place. Mahatma Gandhi

“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi

“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.” -A three judge bench headed by Justice J Chelameswar said in an interim order.

Legal scholar Usha Ramanathan describes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.

Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.
Rajeev Chandrasekhar, MP Rajya Sabha

“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh

But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant. Rajeev Chandrasekhar, Rajya Sabha MP

“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017.

August 24, 2017: The nine-judge Constitution Bench rules that right to privacy is “intrinsic to life and liberty” and is inherently protected under the various fundamental freedoms enshrined under Part III of the Indian Constitution

"Never doubt that a small group of thoughtful, committed citizens can change the World; indeed it's the only thing that ever has"

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” - Edward Snowden

Special

Here is what the Parliament Standing Committee on Finance, which examined the draft N I A Bill said.

1. There is no feasibility study of the project]

2. The project was approved in haste

3. The system has far-reaching consequences for national security

4. The project is directionless with no clarity of purpose

5. It is built on unreliable and untested technology

6. The exercise becomes futile in case the project does not continue beyond the present number of 200 million enrolments

7. There is lack of coordination and difference of views between various departments and ministries of government on the project

Quotes

What was said before the elections:

NPR & UID aiding Aliens – Narendra Modi

"I don't agree to Nandan Nilekeni and his madcap (UID) scheme which he is trying to promote," Senior BJP Leader Yashwant Sinha, Sept 2012

"All we have to show for the hundreds of thousands of crore spent on Aadhar is a Congress ticket for Nilekani" Yashwant Sinha.(27/02/2014)

TV Mohandas Pai, former chief financial officer and head of human resources, tweeted: "selling his soul for power; made his money in the company wedded to meritocracy." Money Life Article

Nilekani’s reporting structure is unprecedented in history; he reports directly to the Prime Minister, thus bypassing all checks and balances in government - Home Minister Chidambaram

To refer to Aadhaar as an anti corruption tool despite overwhelming evidence to the contrary is mystifying. That it is now officially a Rs.50,000 Crores solution searching for an explanation is also without any doubt. -- Statement by Rajeev Chandrasekhar, MP & Member, Standing Committee on Finance

Finance minister P Chidambaram’s statement, in an exit interview to this newspaper, that Aadhaar needs to be re-thought completely is probably the last nail in its coffin. :-) Financial Express

The Rural Development Ministry headed by Jairam Ramesh created a road Block and refused to make Aadhaar mandatory for making wage payment to people enrolled under the world’s largest social security scheme NRGA unless all residents are covered.


Thursday, April 6, 2017

10968 - Explainer: Aadhaar is vulnerable to identity theft because of its design and the way it is used - Scroll.In

A centralised database, dual use as identifier and authenticator, and lack of sound legal framework are its main weaknesses.

Published Apr 02, 2017.  

Recent reports of the misuse of Aadhaar – the 12-digit unique identification number that the Indian government is pressuring all residents to obtain – have brought back concerns about the privacy and security of the project. In February, six employees of telecom service provider Reliance Jio were arrested for the fraudulent use of fingerprints to activate and sell SIM cards. There were also reports that month about Axis Bank and other entities storing and using biometric data without authorisation. Another report indicates that personal information, including Aadhaar numbers, can be freely obtained through a simple online search. In a society where Aadhaar is rapidly becoming the key for citizens to access every service, claims about its security merit more rigorous analysis.

Any robust identification mechanism must be able to prevent or adequately remedy identity theft. Identity theft occurs when someone’s identity is wrongfully appropriated, usually to commit crimes. In the case of Aadhaar, its design and application are likely to make identity theft easier. Unfortunately, even the legal framework seems inadequate to address these risks.

Flawed design
Aadhaar’s design is based on a centralised database called the Central Identities Data Repository that stores every individual’s demographic and biometric information. The aggregation of personal information in one centralised database makes it vulnerable to exploitation, making it a valuable target for hackers, states and identity thieves. Additionally, research suggests that in addition to external threats, centralised databases are also vulnerable to errors and misuse by custodians of the database themselves.

In 2005, researchers came out with a report examining a proposal for a unique, biometric ID in the United Kingdom. In the context of identity theft, the report stated that it was impossible to guarantee the security of such a vast database, which is likely to be accessed millions of times daily and be involved in the exchange of a large amount of valuable information. In 2010, the government there passed a legislation to repeal the project.

Problematic application
Besides structural vulnerabilities, the use of the Aadhaar number as a ubiquitous, universal identifier further heightens the risk of identity theft. The scheme of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, suggests that the number is only to be used to authenticate one’s identity – that is, to prove if a person is who she claims to be. However, an essential feature of the Aadhaar framework is seeding. Seeding allows organisations to feed Aadhaar numbers into their own databases, allowing them to uniquely identify beneficiaries or customers. The presence of one unique number for every individual across multiple public and private databases makes the convergence of this information easier. The legal framework does not prohibit this, and the safeguards for the security of these parallel databases are scant.

The dual use of Aadhaar as an identifier as well as an authenticator increases the probability of identity theft. An authenticator works well if it is confidential (for example, a password or PIN). Conversely, an identifier’s efficacy depends on it being openly available and widely used (for example, one’s name). In 2008, the United States federal regulator for consumer protection came out with a report on the correlation between the social security number and identity theft. Identity theft affects more than 7% of the adult American population, and has resulted in losses over $100 billion.

While there are several differences between the social security number and Aadhaar, the former has become the most common way for organisations in the United States to match individuals with their information. The report attributed the high rate of identity theft in America to the twin use of the social security number as an identifier as well as an authenticator. It stated that the social security number was not suitable for authentication because it was commonly used and easily accessible. Even in Australia, the extensive use of the tax file number has had a similar impact on identity theft.
Proponents of Aadhaar would argue that this comparison is unfair as neither of these identifiers use biometrics for authentication. However, it is well established that biometrics, too, are fallible. From creating gummy fingers – artificial fingers made of gelatin – to capturing fingerprints from photographs, biometric technology has been compromised even without sophisticated tools or methods. On the contrary, the use of biometrics raises the additional concern that in the event they are compromised, they cannot be re-issued like ordinary passwords or PINs. When biometrics are combined with a universal identifier like Aadhaar and subsequently compromised, an identity thief can instantly gain access to multiple services, while simultaneously preventing the individual from obtaining legitimate benefits she might be entitled to.

Inadequate legal framework
These design and application vulnerabilities are exacerbated in the absence of strong legal protections. The Aadhaar Act and its corresponding regulations reveal several weaknesses at multiple stages – at the time of enrolment itself, in detecting identity theft, and with respect to legal remedies after the crime has been detected.
The law allows an individual to enrol for Aadhaar without any document as proof of identity, through an introducer. An introducer can be any individual who vouches for the identity of the person in question, so long as she has an Aadhaar number herself. This makes it easy for individuals to enrol with a false or fraudulent identity. Reports indicate that a bank account can now be opened using Aadhaar, enabling individuals to take part in financial transactions with fraudulent credentials.
Further, if and when identity theft is committed, individuals may never come to know as the law does not require the Unique Identification Authority of India – the agency responsible for issuing Aadhaar numbers and managing the database – to inform citizens about a data breach.
Other impediments to discovering identity theft include the fact that the law imposes a fee for individuals to inspect their own authentication logs and this, too, is limited to a period of six months. The United States experience with identity theft suggests the crime can go undetected for years.
Even if an individual were to surpass these obstacles and discover such fraud, the law provides limited avenues for relief. While identity theft is a punishable offence under the Aadhaar Act, an individual has no power to initiate proceedings even if the crime has been detected. The Act only allows the Authority to initiate criminal proceedings. The individual’s only remedy is to register a complaint with the Authority’s grievance redressal centre, which has no accountability under the law. Most importantly, identity theft has been known to result in large financial losses or emotional distress. However, the provisions under the Aadhaar Act are criminal in nature, leaving individuals without an adequate remedy for compensation.
The poor drafting of the legislation only exacerbates the architectural vulnerabilities of Aadhaar. The law lacks effective checks to prevent identity theft and provide adequate redressal to victims of the crime. In the United States, proposals to combat identity theft have repeatedly emphasised on restricting the use of the social security number, especially by private companies. In light of the recent security breaches related to Aadhaar, the government must introspect on its use as a universal identifier.

Kritika Bhardwaj works as Programme Officer with the Centre for Communication Governance at the National Law University Delhi.
We welcome your comments at letters@scroll.in.