Biometric bro. (AP Photo/Aijaz Rahi)
WRITTEN BY
April 13, 2017 Quartz India
Aadhaar, India’s 12-digit unique identification number, has lately been at the centre of a debate over data protection and privacy as the Narendra Modi government attempts to make the biometric platform mandatory for more and more schemes and services.
In a long chat with Quartz, Nandan Nilekani, the first chairman of the Unique Identification Authority of India (UIDAI), which implemented the Aadhaar project, vigorously rejects the criticism of the platform. And although he’s clear about the need for a modern data protection and privacy law in India to create a more secure digital ecosystem, the former Infosys CEO also seems a bit frustrated by Aadhaar being singled out for scrutiny. Nonetheless, the billionaire-technocrat is sure that he wouldn’t have done it any other way.
Here are edited excerpts from the interview:
Quartz: How do you feel about the Modi government’s push to make Aadhaar mandatory for a number of things, including now for filing income tax returns?
Nilekani: The Aadhaar ID always was meant to be a platform and, obviously, reducing wastage and fraud in benefits was a key part of that. But it was also meant for other applications.
So I think there are two parts to this. One is the extension of Aadhaar-based DBT (direct benefit transfer) to more and more programmes. So that is really linked to the original thing, which is that in many of programmes there is a lot of fraud and wastage, a lot of duplicates. If you use Aadhaar to remove the duplicates, you save a lot of money and the government has said that it has saved around Rs49,000 crore so far. This is all related to efficiency of governance, making sure that the genuine people benefit.
We have to reduce tax evasion and using the Aadhaar numbers to remove duplicate PANs is a solid way of doing that.
And a good example of that is the savings they’ve made on LPG (liquefied petroleum gas cylinders). They were able to redirect that to provide LPG connections to the poor. And you know that more than 20 million people have got the Ujjwala LPG connection and that has been financed, in some sense, from the savings from the LPG programme.
The second part is the use of Aadhaar to make sure that another government document is not duplicated. Because in many of our government-issued documents, the issue of duplicates arises. It’s not an entitlement issue as such, it’s not about giving a benefit but it’s about government statutory documents.
There is some concern over the government’s push to make it mandatory.
You see, when you want to clean up PAN (Permanent Account Number), let’s say you have 250 million numbers. You want to make sure that an individual has only one PAN, (so) you have to make it (Aadhaar) mandatory. If you don’t, half the people give their Aadhaar numbers and half don’t, the duplicates still remain, no?
But doesn’t that create conflict with what the supreme court has reiterated often, which is not to make Aadhaar mandatory?
So, if you look at what was said in parliament three-four days back, the government passed the law, the Aadhaar bill. And in the government’s view that law is really what stands today. Similarly, making PAN mandatory has been done by making a change in the finance bill, so it has been done through a legal process.
So to your mind, it doesn’t create a conflict?
No, I don’t think so. I think we have to reduce tax evasion and using the Aadhaar numbers to remove duplicate PANs is a solid way of doing that.
No, I don’t think so. I think we have to reduce tax evasion and using the Aadhaar numbers to remove duplicate PANs is a solid way of doing that.
I don’t have an Aadhaar number, and I’d like to believe that I’m an honest tax payer. But essentially now there is no way that I can pay tax without getting an Aadhaar number.
Suppose you have to drive on the road, you have to get a driver’s licence. Do you feel that is an imposition of the state? Similarly, when you have to travel abroad, you have to get a passport. Do you see that as an imposition of the state?
But I already have a PAN for my tax.
See, if the government decides that there are a lot of duplicate PAN cards and many people are evading tax with that. And if they use the Aadhaar number to remove duplicate PAN cards, what about that is bothering you?
What we’ve seen in the last few weeks is the existence of databases online where the Aadhaar number and other identity details are freely available, perhaps because the data hasn’t been held securely by agencies other than the UIDAI.
Which is illegal, by the way. The law is very clear about this. The Aadhaar Act very clearly says that the Aadhaar number cannot be published or displayed.
So obviously, I think we have a larger issue in India and it’s not just linked to the Aadhaar database. I think there are many, many databases, both in the private and the public sector, which need to be secured and kept encrypted and so on. We need to ensure all databases—whether in the public or private sector, whether they have the Aadhaar number or don’t have the Aadhaar number—should be secure.
If information about me lies across multiple databases and I have an Aadhaar, then the Aadhaar becomes a digital, sort of, link that exists across these multiple databases. What security concerns does that create if these other databases are not secure?
These databases are still under the law of that department. Your banking data still comes under the Banking Secrecy Act, your PAN data comes under the Income Tax Act. So just the fact that the Aadhaar number is there in both databases, by itself, doesn’t mean anything, unless somebody shares across it. And there are laws to prevent that (sharing) from happening. Having Aadhaar alone doesn’t increase the probability of that happening. Every sub-activity has some confidentiality requirement.
Instead of having a larger conversation about creating a more secure digital ecosystem, you think Aadhaar is being demonised?
Absolutely. India needs a modern data protection and privacy law, because today there are many, many sources of digital data. You have your phone, when you move from a feature phone to a smartphone, there is a dramatic increase in the level of data that somebody is able to gather about you.
Absolutely. India needs a modern data protection and privacy law, because today there are many, many sources of digital data. You have your phone, when you move from a feature phone to a smartphone, there is a dramatic increase in the level of data that somebody is able to gather about you.
So the smartphone itself is a huge risk from a privacy point of view. When you use the internet, other people are reading your emails and parsing your emails to figure out what your interests are. Today, we have a proliferation of CCTV cameras in malls, ATMs, hotels, bars, and everywhere, all of which are recording your behaviour, your activities. When the drones come, they’ll be flying around, peeping in your bedrooms. And when you get the internet of things, you’ll have hundreds of sensors all over the place collecting data.
India needs a modern data protection and privacy law because today there are many, many sources of digital data.
The point is that, whether we like it or not, we’re entering a world where there is going to be massive data generation due to a whole lot of technological advances. So we definitely need a modern data protection and privacy law. In fact, I wrote to the prime minister (Manmohan Singh) in 2010, and I’ve worked on it. I actually worked with the government and came out with the first draft.
But to say that because of Aadhaar privacy is gone, as if there’s nothing else happening on the planet, is, I think, a bit disingenuous.
My understanding always was that this 12-digit number is something that people keep to themselves…
It’s not private, you do use it in different things.
When I go and ask for my pension, I give my Aadhaar number. When I get my LPG, I give my Aadhaar number. Obviously, it is the responsibility of the agency, to which you give it, to ensure that it’s not displayed or printed, which is in the Aadhaar law. But (nevertheless) you are using it in various ways.
…but my question is that when it’s almost used as a photo ID, perhaps at an airport, don’t you think that flies in the face of what it was designed to be? This wasn’t designed to be a photo ID, was it?
No. I mean, I use it all the time as a photo ID. The thing is that it’s also about convenience, right? See privacy and convenience go hand in hand. All of us give up a bit of privacy for convenience. When we use a smartphone, we’re giving up privacy for convenience. When we use an email account, we’re giving up privacy for convenience, and so on.
I mean, I can use any ID, for example, (while) entering the airport. I happen to use Aadhaar ID because it is convenient. What’s the issue?
That it’s not difficult to recreate what an Aadhaar ID looks like.
That’s true of all documents. Every document in India…If you heard Mr (Nitin) Gadkari’s statement that 30% of driver’s licences are fake. So, when a guy uses a driver’s licence to enter the airport, the same thing applies, no?
So you don’t feel that the use of Aadhaar as a photo ID is a problem?
We have always said that the proper use of Aadhaar for authentication should be online. I give it to you, if I just use a physical thing, you don’t know if it’s the real one or not. That’s why we’ve always said that the right use of Aadhaar authentication is online, where, like when you go and get a Reliance Jio SIM connection, it actually does an online authentication using your biometrics.
Speaking of authentication, you recently mentioned that if Aadhaar is used properly, typically there is a 5% error rate. At the same time, there have been numbers coming out of Telangana where the authentication failure rate is reportedly at some 36%.
I saw that. First of all, if somebody does three authentications and then it goes through, they count that as three (attempts) and not one. So there are some issues with the data itself. But I think a better example is what’s happening in Andhra Pradesh (for the public distribution system).
Andhra Pradesh has 100% inclusion because they’ve designed it properly. They, first of all, do an Aadhaar fingerprint authentication, which works most of the time. They also have an iris authentication as a backup. They have OTP (one-time password) authentication on the phone as a second backup. And finally, if none of these goes through, they have a village ration officer who overrides the technology. So if you’ve designed it properly, you can ensure 100% inclusion.
So this 36% number that has come out of Telangana doesn’t particularly concern you, or do you feel the system hasn’t been implemented properly?
The way people are deliberately misusing that data is to say that 36% of the people were denied (benefits). That’s not what it is. Suppose somebody does an authentication three times, and gets it on the third attempt, they’re counting that as three attempts. That’s not the same as how many people went through.
I just wanted to pick up on the 95% figure (authentication success rate) that you’d mentioned in a previous interview. If you look at it at scale, even the 5% of people who can’t be authenticated adds up to a rather larger number?
I said 5% in cases where only, say, fingerprint (authentication) is used. But any good system will use more than one method of authentication.
Therefore, the probability of denial is quite low?
Yes, in Andhra Pradesh it is absolutely low and for that (possibility of online authentication not working) they have a manual override. They have a ration officer who goes and checks.
Yes, in Andhra Pradesh it is absolutely low and for that (possibility of online authentication not working) they have a manual override. They have a ration officer who goes and checks.
Finally, it comes down to designing the system, and today the beauty of this (platform) is that iris authentication is even cheaper than fingerprint authentication. In a phone, the cost of putting a fingerprint reader is about $25. The cost of putting an iris reader is about $6. And technology makes it cheaper and cheaper.
Speaking of devices, say I go to a third-party that uses the Aadhaar e-KYC (electronic know-your-customer) verification system. How easy or difficult is it for that third-party to cache and store the biometric information on the device where I provide my fingerprint?
First of all, there should be no reason for them (a third-party) to do it because if they do it and they’re caught, then they can’t use the service anymore.
Today, the beauty of this platform is that iris authentication is even cheaper than fingerprint authentication.
But anyway, there is now a whole set of devices coming called registered devices, which essentially provide a whole new level of security with both hardware and software. So while today, yes, there are examples of people having tried to do biometric replay and having been caught in doing that. But once the registered devices come in the next few months, even that risk goes away.
And these are devices registered with?
Each device is individually encrypted and registered with the UID system. So you cannot fake all this.
But currently, as the system exists today, there is still some risk?
Again, as I said, what is the incentive for someone to do it? Because if he does it and the system is able to catch the fraud analytics, then that fellow’s licence to use the KYC itself will go away. So there may be a stray guy who does it, but not organisationally. Also, whenever an authentication happens of mine, I will get a SMS or an email, like when you do a credit card transaction. You can also lock and unlock your biometric. So I’m saying there are a lot of checks and balances in the system to prevent your biometrics (from) being used by somebody else.
Do you have any concerns over the regulations for data protection and privacy within and outside the UIDAI ecosystem?
No, if you look at the Aadhaar bill (now Act), it’s probably one of the strongest bills for privacy. For example, biometric data cannot be shared under any circumstances. The only thing you can do with this ID system is authentication and KYC, (and) KYC only of your own data. You cannot add more fields like religion or caste to the database. So there are lots of checks that have been put into the law. Is there scope for improving things over time? Possibly. We have to see how it all evolves.
The UID system has been more open and transparent than anything I’ve seen.
There seems to be some lack of clarity on how well the de-duplication (i.e. eliminating duplicate data) process works, and questions have been raised about it.
We published a very exhaustive report two-three years back, which gave all the data on de-duplication and showed that de-duplication at scale will work.
We published a very exhaustive report two-three years back, which gave all the data on de-duplication and showed that de-duplication at scale will work.
Since that report, there hasn’t been much more that has come out?
No. But that (report) basically took a database of 72 million records. So, it basically shows with a lot of logic and a lot of math that it was working. Seventy-two million isn’t a small number for showing something works.
But don’t you feel the UIDAI should be more open?
I’ll tell you one thing. The UID system has been more open and transparent than anything I’ve seen. Because right from day one, we would publish our documents, we would publish architecture, we would publish FAQs. We would reach out to everybody.
So, I don’t feel at all defensive that UID has been less than open about what it does. And in fact, it is getting penalised because it has been so open.
So, say I get an Aadhaar and I provide my biometric details. Why is it effectively impossible for me to delist from Aadhaar?
You can lock it. You can lock it permanently if you want. So it’s not used for authentication.
But if someone doesn’t want the state to retain the data, at the moment there seems to be no such option.
No. But there’s no such option anywhere else. Why are you holding a higher bar here when it doesn’t apply anywhere else?
Was there a conversation you had about this when the platform was being designed?
The platform, I think, would allow the ability to delete a (Aadhaar) number, but I don’t think there was a specific conversation about somebody saying I want my data to be deleted. But it could be done.
Lastly, now that there’s been so much criticism against the Aadhaar platform, do you think you would’ve done anything differently when you were leading the project?
Not at all. I think a lot of thought went into the platform. The simplicity, the minimalism, specifically ensuring that the UIDAI did not collect (certain) data on a person, that the data remained in the respective databases, limiting it to only authentication and KYC. These were all very conscious decisions precisely to derive the full benefit of the architecture (and) at the same time, keep it highly minimal.
Not at all. I think a lot of thought went into the platform. The simplicity, the minimalism, specifically ensuring that the UIDAI did not collect (certain) data on a person, that the data remained in the respective databases, limiting it to only authentication and KYC. These were all very conscious decisions precisely to derive the full benefit of the architecture (and) at the same time, keep it highly minimal.
