The UIDAI has taken two successive governments in India and the entire world for a ride. It identifies nothing. It is not unique. The entire UID data has never been verified and audited. The UID cannot be used for governance, financial databases or anything. It’s use is the biggest threat to national security since independence. – Anupam Saraph 2018

When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy

First they ignore you, then they laugh at you, then they fight you, then you win.-Mahatma Gandhi

In matters of conscience, the law of the majority has no place.Mahatma Gandhi

“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi

“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.”-A three judge bench headed by Justice J Chelameswar said in an interim order.

Legal scholarUsha Ramanathandescribes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.

Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.Rajeev Chandrasekhar, MP Rajya Sabha

“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh

But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant.Rajeev Chandrasekhar, Rajya Sabha MP

“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017.

August 24, 2017: The nine-judge Constitution Bench rules that right to privacy is “intrinsic to life and liberty”and is inherently protected under the various fundamental freedoms enshrined under Part III of the Indian Constitution

"Never doubt that a small group of thoughtful, committed citizens can change the World; indeed it's the only thing that ever has"

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” -Edward Snowden

In the Supreme Court, Meenakshi Arora, one of the senior counsel in the case, compared it to living under a general, perpetual, nation-wide criminal warrant.

Had never thought of it that way, but living in the Aadhaar universe is like living in a prison. All of us are treated like criminals with barely any rights or recourse and gatekeepers have absolute power on you and your life.

Announcing the launch of the#BreakAadhaarChainscampaign, culminating with events in multiple cities on 12th Jan. This is the last opportunity to make your voice heard before the Supreme Court hearings start on 17th Jan 2018. In collaboration with @no2uidand@rozi_roti.

UIDAI's security seems to be founded on four time tested pillars of security idiocy

1) Denial

2) Issue fiats and point finger

3) Shoot messenger

4) Bury head in sand.

God Save India

Thursday, April 27, 2017

11135 - The Function Creep That Is Aadhaar - The Wire

The government seems to either not notice or not care about the many glitches in the Aadhaar system, as it enters more and more parts of our lives.

The evidence that is emerging in the Aadhaar project is damning. But does anyone with power care? Credit: Reuters

This is the second in a series of articles on the UID that Usha Ramanathan will be writing for The Wire. Read the first part here.

It’s called ‘function creep’ – except that it’s not creeping in, but stomping all over us.

What is function creep? It’s when a technology that is introduced for a certain purpose is expanded beyond its original intent. In the case of the unique identification (UID) project, it was promoted as providing the poor with an identity. Then, it was about de-duplicating the entire population, so that each person would have one unique number by which they could be identified. Then it was to get rid of ‘ghosts’ and ‘duplicates’ in welfare systems and to prevent ‘leakages’. Then it was to create businesses for private companies, so Section 57 of the Aadhaar Act was enacted as a money Bill. Then it became a means of enforcing the cashless economy. Then data as property and the exploitation of the UID number for making people leave detailed digital footprints became the game. Then it became a precondition for underserved and socio-economically vulnerable people to get any manner of state assistance. Then, from denial of entitlements if a person is not enrolled or does not seed their number, it has reached a point where not having a UID number will force you to commit an offence. Why? Because you want to pay your taxes, but you cannot, because the government will refuse to accept tax payment from you if you do not give them your UID number. And they will cancel your PAN card and then levy a penalty because you do not have a PAN card.

In anticipation that the UID number will make it possible to peer into people’s lives in ways that are both uncivilised and unconstitutional, a range of petitions reached the Supreme Court in 2012-13 asking the court to put a halt to it. The Parliamentary Standing Committee had already rejected the Bill and the project in December 2011, and asked the government to return to the drawing board. But the government of the day had chosen to ignore the recommendations. The court saw that there were serious concerns that had to be addressed before a decision could be made one way or the other about the project, which is why six orders were passed by the court. First, they asked that the government should not make the UID mandatory. And, when their orders were consistently disobeyed, they restricted the use of the UID number to six schemes, even here to be used voluntarily. The UPA government disregarded the orders of the court and now the present government is using its majority in the Lok Sabha to steamroll their way through court orders, evidence of biometric failure and exclusion, thousand of blacklisted applicants and an unaudited data base.

Uses of the function creep
Here’s an illustration of what function creep is producing:
  • Bonded labour will not get rehabilitated till their number is in the system.
  • Persons getting out of manual scavenging will have to have their number seeded.
  • Women rescued from prostitution are to put their numbers on the database to get rehabilitated.
  • Survivors of the Bhopal gas disasters have to seed their numbers if they are to continue getting state assistance.
  • Persons with disabilities who are given assistance and aid will have to get their numbers in or else be left out.
  • Children will not get their mid-day meals in schools unless their UID numbers are embedded in the system.
  • No adult education without UID.
  • No rations without UID.
  • No admission to schools without a UID. No hall ticket either.
  • No national award for technology innovation in petrochemicals and downstream plastics processing industry to incentivise meritorious innovations and inventions in the field of polymeric materials, products, processes… (No, this is not a figment introduced to exaggerate. It is true, every word. It is Notification No S.O 749(E) dated March 6, 2017. By the way, if you think you deserve a Padma Shri, you have to apply and your UID number is a mandatory field. )
The list just goes on and on, growing at a tremendous pace.
There is the story of a young man at an interview. We are testing you for word association, the interviewers told him. We will say a word and you respond immediately with what comes to your mind. Sunset, they said. Girls, said he. Rockets, they said. Girls, said he. Government, they said. Girls, said he. He saw them look puzzled, and explained: But girls are all I have in my head. Oh well…

This enthusiasm lies not only with the central government, but also in the states, which are hard at work threatening people with exclusion if they do not seed their UID number. For instance, Telengana has made seeding mandatory to get job cards under the Mahatma Gandhi Rural Employment Guarantee Scheme, adding: “Note: UID number once seeded cannot be modified.” That is, the consequence of errors are to be borne by the individual seeking work under the employment guarantee scheme.

How is this function creep explained? There is a parrot-like repetition of words and phrases in the first paragraph of many of these notifications:

“Whereas the use of aadhaar as identity document for delivery of services or benefits or subsidies simplifies the government delivery processes, brings in transparency and efficiency, and enables beneficiaries to get their entitlements directly in a convenient and seamless manner and aadhaar obviates the need for producing multiple documents to prove one’s identity.”

This is just repeated time after time, never mind the context or relevance. ‘Duplicates’ is used like a magic word, like ‘Open Sesame’ – remember Ali Baba and the 40 Thieves?

When the Finance Bill 2017 was turned into an Act in March this year and the finance minister said “Yes, we are” when asked if he was ‘forcing’ people to get a UID, he also said, “If the technology, which has a network of 108 crore people and all taxpaying households have it, and they give it along with their income tax returns, then the scope for fraud and tax evasion comes down.”

What has parliament been told about duplicate PAN cards? The Rajya Sabha was told on March 31, 2007, that 13.1 lakh people had duplicate PAN cards. Some years later, on April 22, 2016, parliament was informed that 11,56,894 PAN cards had been cancelled. Were these all fraudulent? The minister explained the different reasons for the duplicate PAN cards: incorrect data entry, multiple applications by the same person with different particulars and PAN cards being allotted both when income tax returns are filed as well as on the application for a PAN card. This means that there is a system in place that helps in the detection of duplicates that the UID de-duplication plan will dislodge. But the UID project has its own set of problems that are so significant that it is a wonder that the government has not thought to pause, consider whether it is delivering what its promoters said it would and then decide whether or not it is wise to keep on going with it.

Damning evidence
The evidence that is emerging in the UID project is damning:
  • There was no feasibility study done before the project was launched, so the project was promoted on an assumption – that poor people do not have any government-recognised identity. That was proven to be a self-serving assumption when it was found that only 0.03% of the first 80 crore people enrolled needed the assistance of an ‘introducer’ or a person who helps another without an acceptable identity to enrol. This is the figure that the government presented to the court and also gave in reply to an RTI asking how many people had been enrolled using the introducer system. The same kind of baseless assertions are being used to push the UID onto the PAN and income tax systems.
  • Biometrics do not work. The Economic Survey, at para 9.76, registers authentication failures as “49 percent failure rates for Jharkhand, 6 percent for Gujarat, 5 percent for Krishna District in Andhra Pradesh and 37 percent for Rajasthan. Failure to identify genuine beneficiaries results in exclusion errors.” That is based on articles in Scroll.in. Arvind Subramanian, the chief economic advisor, said to an audience at the Center for Global Development in Washington, on April 18, 2017: “On fidelity of Aadhaar, maybe we should probably have had Nandan [Nilekani] here. In the past two weeks or so I too have heard reports that the authentication rate is not as high as it should be. Because remember this was touted initially as getting a failure rate of less than 0.5%. I haven’t looked at the evidence coming out… So it is possible we may have to reassess that.”
  • When 80 crore numbers were issued, the government said in its affidavit to the court, eight crore enrolments had been rejected. Why? It is not known, because, as an insider told us at a meeting, some of them could be duplicates, some could be inadequate information, but there is no knowing precisely because there is no feedback loop and no follow up on those enrolments that are rejected.
[So, let me pause here to tell the story of A.S. and his son. He wanted that his ten-year-old son do the entrance exam to get into Navodaya School. Before he could apply, he needed a caste certificate. To get a caste certificate, he needed to have a UID number. Getting the number would take more time than he had, so he asked what else would do. The sub-divisional magistrate said passport (which not everyone has and I don’t think I need explain why), driver’s licence (which he did not have and may be this too needs no explaining), ration card (in Delhi you cannot be on a ration card without a UID number, which he did not have) or a UID number. So A.S. got his son to enrol in the UID programme. A few weeks passed. No letter, no number. He checked on the net. His application had been rejected – because his son was a ‘duplicate’, although he hadn’t ever enrolled before. That’s the end of that story. Except that A.S. has taken the matter to the Supreme Court; only, the court has not had the strength nor the time to hear and decide. This, by the way, is not an aberration. We hear these stories everywhere.]
  • The outsourcing has been so rampant that we have no idea what is happening with the data that we are parting with to an enroller. What we now know is what the law minister said in parliament, that in the past seven years, 34,000 agencies have been blacklisted by the UIDAI, which works out to a staggering 4,857 per year, over 13 a day and at least one every two-three hours! The UID project has been dogged by all kinds of problems relating to numbers, but these figures?
  • The evidence from the ground is that people who are excluded from entitlements, such as the public distribution system are being counted as ‘ghosts’ and ‘duplicates’, and what is not being given to them is counted as ‘savings’. The comptroller and auditor general has also spoken, to say that that which is being projected as savings from the seeding of the UID number is actually the reduction due to the fall in global oil prices.
  • In Jharkhand, a ‘glitch’ resulted in the exposure of the personally identifiable information – including names, addresses, UID numbers and bank account details of those drawing old age pensions. That is about 1.6 million people, of whom 1.4 million have seeded their UID numbers. In Kerala, sensitive personal information of 34 million people has been leaked in what is described as “one of the biggest data breaches in the world”. In Bihar, the name, address, bank account number, bank address, the ID of the parents and the UID number of students getting a post-matriculation scholarship was displayed on the net for anyone to see. The minister said he did not know that there was any law against it. Every day brings its share of ‘leaks’. Chandigarh, Manipur and the Union Ministry of Drinking Water and Sanitation in its Swacch Bharat Mission have all displayed information that they hold with them, including, of course, the UID number. In this midst, the CEO of the UIDAI, A.B. Pandey, asserts that there is no data breach, because nothing has been reported lost from the UIDAI database. These data exposures, which display the UID number, are not counted among data breaches. But these create public records and reveal personal information which can be used to profile and track. All the UIDAI says is that the public display of the UID number is against the law, so no one should do it. But they are. No wonder the government went to court to claim that there is no right to privacy for the people of this country!
  • The project proponents have indicated often enough that anyone asking for privacy must either be of the elite or be corrupt. A bonded labourer, a ‘rescued’ woman, a child getting a mid-day meal may not care to have their condition on public display. Privacy deniers may not admit it, but there is such a thing as dignity – and the poor and the vulnerable too are entitled to it. Convergence, profiling, data gathering for a variety of uses including identity fraud are par for the course and income tax payers are being invited in. “Will you walk into my parlour?” said the spider to the fly.
  • Disturbing stories have been heard of Sameer Kocchar being charged with “spreading false rumours” when he demonstrated the insecure system that allowed biometric ‘recall’ – a process which allows storing a biometric and recalling it for repeated use even when the person whose biometric it is isn’t present. Revealing fallacies in the system seems to invite the wrath of the agency; and, under the Aadhaar Act, 2016, it is the UIDAI that can decide whether to initiate prosecution. Among the charges against Kocchar is, according to one report, “spreading false rumour about the Aadhaar ecosystem” – as the UIDAI sees it.
Function creep has become function stampede and is overrunning our lives, even as evidence of the deep problems in the system is becoming manifest.
The scary thing is that the government seems to be in denial about all the problems that are showing up in the system. When you have a chief economic advisor who says, “Nandan told me” that all is well with the database and takes that as sufficient guarantee for changing entire systems, there is cause for concern. And when the court is too preoccupied with other matters, the possibility is of irreparable damage – to existing systems, and to the relationship that the citizen has with the state.
Usha Ramanathan is a legal researcher.