The UIDAI has taken two successive governments in India and the entire world for a ride. It identifies nothing. It is not unique. The entire UID data has never been verified and audited. The UID cannot be used for governance, financial databases or anything. It’s use is the biggest threat to national security since independence. – Anupam Saraph 2018

When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy

First they ignore you, then they laugh at you, then they fight you, then you win.-Mahatma Gandhi

In matters of conscience, the law of the majority has no place.Mahatma Gandhi

“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi

“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.”-A three judge bench headed by Justice J Chelameswar said in an interim order.

Legal scholarUsha Ramanathandescribes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.

Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.Rajeev Chandrasekhar, MP Rajya Sabha

“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh

But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant.Rajeev Chandrasekhar, Rajya Sabha MP

“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017.

August 24, 2017: The nine-judge Constitution Bench rules that right to privacy is “intrinsic to life and liberty”and is inherently protected under the various fundamental freedoms enshrined under Part III of the Indian Constitution

"Never doubt that a small group of thoughtful, committed citizens can change the World; indeed it's the only thing that ever has"

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” -Edward Snowden

In the Supreme Court, Meenakshi Arora, one of the senior counsel in the case, compared it to living under a general, perpetual, nation-wide criminal warrant.

Had never thought of it that way, but living in the Aadhaar universe is like living in a prison. All of us are treated like criminals with barely any rights or recourse and gatekeepers have absolute power on you and your life.

Announcing the launch of the#BreakAadhaarChainscampaign, culminating with events in multiple cities on 12th Jan. This is the last opportunity to make your voice heard before the Supreme Court hearings start on 17th Jan 2018. In collaboration with @no2uidand@rozi_roti.

UIDAI's security seems to be founded on four time tested pillars of security idiocy

1) Denial

2) Issue fiats and point finger

3) Shoot messenger

4) Bury head in sand.

God Save India

Friday, January 26, 2018

12787 - Aadhaar hearing: Lack of governmental ownership of CIDR’s source code can have serious consequences - First Post

India Asheeta Regidi Jan 26, 2018 12:48 PM IST

One of the key questions posed by the Supreme Court in yesterday’s hearings on the Aadhaar case was on the ownership of the source code behind the CIDR. Surprisingly, the response of the petitioners was that this was proprietary code, and neither the government nor the UIDAI owned it.

                               Representational image

Lacking ownership over this critical infrastructure can have serious consequences. One such consequence is that this affects the ability of the government to declare it as a ‘protected system’, a crucial factor for ensuring the safety of the CIDR. There is, however, a lack of clarity on the issue of ownership of the CIDR code, since information on the CIDR is not in the public domain for national security reasons.

Only government owned software can be a ‘protected system’

The question raised by the Supreme Court on the ownership of the source code behind the CIDR draws focus to the fact that this critical resource is fundamentally software, subject to the same laws that apply to non-critical software. The Kerala High Court, in the case of B.N. Firos v. State of Kerala, had issued this ruling- ‘Government cannot unilaterally declare any system as "protected" other than "Government work" … on which Govt.'s copyright is recognized…”. Given in 2006, this judgment ruled that unless the copyright on a software is owned by the Government, it cannot declare it to be a ‘protected system’ under the Information Technology Act, 2000.

The importance of being a ‘protected system’
The declaration of a computer resource - this may refer to a computer, a database, data, software, etc. – as a protected system, grants it a higher level of protection under Sections 66F, 70 and 70A of the IT Act. Being a support to a Critical Information Infrastructure or CII of the country, an attack on a protected system amounts to an act of cyberterrorism, which is punishable with life imprisonment. Mere unauthorized access to it also attracts a higher punishment of 10 years of imprisonment, as opposed to 3 years for accessing a non-critical resource. Moreover, this will also be protected by institutions like the NCIIPC, created specifically for the protection of CII.

The CIDR as a ‘protected system’
The declaration of the CIDR as a ‘protected system’ includes the CIDR’s ‘facilities, Information Assets, Logistics Infrastructure and Dependencies’ as a protected system. It isn’t clear if this includes the source code, either as an ‘information asset’, a ‘dependency’ or ‘facility’. It must be noted here that other resources that have been declared to be a protected system, such as the information assets in the form on people’s data stored in the CIDR, will continue to be protected.

What lack of ownership over the code implies
Lack of control over the software behind the CIDR, however, means that the code in use belongs to someone else, and that person has the freedom to reuse the code, license it to anyone else or even sell it. This means that maintaining the confidentiality of the code behind the CIDR, an essential factor for better security, is affected.

For instance, looking at software today, its development often involves the use of multiple components, which may be proprietary, open source or free, in combination with new code that is written by the developer. In the world of software, use of a tried and tested software component is normal, and in fact, good practice. This lowers the chance of unforeseen consequences in the form of a defect or vulnerability in the code, which is more likely when code is developed from scratch. Thus, developing a good, secure piece of software can often involve a trade-off between using a tested, secure component and retaining ownership of the software.

This use of multiple and varied components, thus, can lead to major issues with establishing ownership on the copyright over a piece of software. For example, open source software components sometimes require the derived product to be relicensed under the same open source license requirements.  A developer may use a component consisting of pre-written code on which he owns the copyright. These components, whether open source or proprietary, which form a part of the software, can be reused for other purposes.

A man goes through the process of eye scanning for Unique Identification (UID) database system. Reuters

The government doesn’t automatically own software developed for it
Thus, when considering a critical piece of software like the source code behind the CIDR, it is unknown how much of it is not under the control of the UIDAI, and possibly available for reuse. The terms under which the software was developed plays an important role. A ‘government work’ under the Copyright Act, refers to a work that is made under the direction or control of the Indian government. The copyright in such a work vests with the government under Section 17(d), but this is subject to an agreement to the contrary.

A software developed for the government, or a software in use by the government, thus does not automatically belong to the government. Thus, when the petitioners argue that the ownership of the code behind the CIDR does not vest with the government, this is very much possible.

The government must retain control over its critical software
One key consideration is that the BN Firos case was decided back in 2006, and with regards to a far less crucial software than the CIDR. The software in issue there was an e-government software, created for the payment of bills, taxes, etc. to the government and governmental authorities. It will have to be seen if a different stance will ensue in the Courts with a critical software like that behind the CIDR.
Despite this, the important issue is that the rule requiring that the government to own the software before it declares it as a protected system is crucial for the government to retain control over that resource. As far as the CIDR is concerned, more clarity on the extent of the government’s control over the code behind it may be obtained when the state presents its arguments before the Supreme Court. Looking at the ubiquitous use of technology today, computer resources are now increasingly critical to a nation’s security. It is very important that the government retain control over the code it uses in such crucial systems to ensure their security and avoid such issues.

The author is lawyer and author specializing in technology laws. She is also a certified information privacy professional.

Published Date: Jan 26, 2018 08:37 AM | Updated Date: Jan 26, 2018 12:48 PM