In the face of what has been described as one of the largest data breaches in India – if not the world’s history – the Indian Aadhaar database is now coming under the scrutiny of the Indian Courts who will decide on the scope of the implementation of the gigantic one billion person database. The Unique Identification Authority of India (UIDAI) has denied reports that the Aadhaar data breach has made masses of biometric data available to external players for a miniscule sum (INR 500 – under USD 8 at time of writing) paid via a digital wallet – in fact, much of the data could be accessed via a simple Google search.
And much of the data was incredibly sensitive.
That simple search would reveal thousands of databases along with demographic data including Aadhaar numbers, names, names of parents, PAN numbers, mobile numbers, religion, school results, the status of rejection of applications, bank account numbers, IFSC codes and other information.
The Indian government response to the Aadhaar data breach – to threaten the journalist who revealed the information with police charges and the very real possibility of serving time behind bars.
UIDAI denial
UIDAI was quick to label the issue a mere case of ‘unauthorized access’ to the Aadhaar website rather than an Aadhaar data breach and assured users that no biometric data was stolen. This may be a case of clever use of semantics – and it didn’t take long for confusion to spread among users, potential users and government agencies.
The UIDAI then issued a series of FAQs that addressed some of the concerns for the Aaaar data breach that were increasingly worrying.
One of the questions that the organization tried to answer was:
‘UIDAI has all my data including biometrics, bank account, PAN, etc. Will they be used to track my activities?’
The answer was unequivocal:
‘Absolutely false. UIDAI database has only the following information –
(a) Your name, address, gender, date of birth
(b) Ten finger prints, two IRIS scans, facial photograph
(c) mobile number and email ID.
(a) Your name, address, gender, date of birth
(b) Ten finger prints, two IRIS scans, facial photograph
(c) mobile number and email ID.
Related Posts
Rest assured, UIDAI does not have your information about family, caste, religion, education, bank accounts, shares, mutual funds, financial and property details, health records etc and will never have this information in its database.’
In other words – users should be very, very worried. This is some of the most sensitive information that could ever be stored in a database and is potentially extremely attractive to hackers – even with the exclusion of the other information that is mentioned.
Aadhaar data breach – A series of unfortunate events
How worried? Perhaps the word ‘very’ is not sufficient to describe what sort of damage this information can do in the wrong hands – and it is not as if the Aadhaar system has not experienced significant data breaches in the past.
Recently a French security researcher pointed out flaws in the Aadhaar app that is available on the Google Play Store. This is a government mobile app with flaws that can potentially allow attackers to access the Aadhaar database including demographic data.
An Indian IT graduate was arrested for illegally accessing the Aadhaar database in August 2017 between 1 Jan and 26 July without the relevant permissions. He developed an app called ‘Aadhaar eKYC’ by hacking into the servers related to an e-Hospital system that was created under the Digital India initiative. The eKYC app would then route all the data access requests through those servers.
In January 2017 in order to provide ‘more choice’ to citizens authenticating using Aadhaar, the UIDAI has introduced facial authentication along with fingerprints and iris recognition. This measure will be used in “fusion” OTP (one-time-password). It is scheduled to be fully implemented by July of 2017.
Is big government the right custodian?
Over the last year, there have been multiple instances of Aadhaar data breach involving data leaking online through government websites. Recently, a media query from the Tribune forced the UIDAI to reveal that about 210 government websites made the Aadhaar details public on the internet. No timeframe was revealed about how long it took for the problem to be remedied. Let’s be clear – that a security breach caused by government involving over 200 hundred government owned sites – not something that should give users even the smallest sense of comfort.
Once again it is important to know that this isn’t just password protected information – it’s a database that contains a huge wealth of information – including highly sensitive biometric info – and it touches the lives of a billion people. In addition, this isn’t ‘opt in’ – it’s mandatory. At the risk of belaboring the obvious, how much would the Indian government be faced with paying if a skilled team of hackers planted ransomware, preventing the government from accessing that database – the dangers beggar belief.
Given the abysmal track record of Aadhaar when it comes to protecting data it can only be seen as obvious that big government in India may simply have overreached itself as far as its vision for this database is concerned. The control of just how quickly it will be rolled out and the eventual scope is now firmly in the hands of a five-judge Constitution Bench in India – we can but hope they rule wisely.
