by Elonnai Hickok in Internet Governance Blog — Sep 08, 2010 06:50 PM
On Tuesday, 7 September 2010, Ashok Dalwai, the Deputy Director General of the Unique Identification of India (UIDAI), gave a lecture at the Indian Institute for Science in Bangalore. Representing the UID Authority, his presentation explained the vision of the project and focused on the challenges involved in demographic and biometric identification, the technology adopted, and the enrolment process. Elonnai Hickok gives a report of his presentation in this blog post.
The Project
Dalwai began his presentation by clarifying that the project is meant for residents and not just citizens. The justification for this distinction is that if the UID project applied to just citizens, the law could create possible constitutional conflicts. Though Dalwai did not specify what exactly the constitutional conflicts were, one can hypothesize that because foreigners are guaranteed the same rights to liberty, life, and due process as citizens of India under articles 14 (right to equality) and 21 (protection of life and personal liberty) of the Constitution of India, it would be problematic to set up a benefit-delivery mechanism that was available only to citizens. Additionally, he was clear that the number will give an individual an identity only; it does not guarantee benefits, and is instead meant to facilitate the receipt of benefits. He anticipates that benefits will be efficiently delivered to the poor once various databases such as passport, PAN, and the NREGA merge with the UID and agree to accept the UID number as a proof of identity. Dalwai also explained how the poor in particular are in desperate need of an identity, because in India a lack of identity results in exclusion of services. By providing a true biometric identity for each individual, the UID will be inclusive of the Indian population and will eliminate the use of bribes as a method of procuring an identity. The AADHAAR initiative will also work to clean up the existing database, remove duplicates and fake cards, and improve targeting and delivery of services.
UID as an Ecosystem
Dalwai explained how the project will be structured like an ecosystem. The UID Authority in itself is small and lacking in manpower (though he made it clear that funding was not an issue), but by building an ecosystem, the project will be able to be executed efficiently and effectively. The ecosystem will be developed by training supervisors, who will train enrollers, who will in turn train registrars, and so on. The process is circular and continuous, which makes the project sustainable. As of today, the project has moved forward from the initial stages of signing memorandums of understanding (MoUs) to the process of aligning technology, preparing for the enrolment of residents' data, and completing test runs of operations. In the future it will continue on to the actual enrolment and authentication process. Though Dalwai glazed over the fact that MoUs have been signed and the project initiated without parliamentary approvals, this is not a minute point. Since late spring the UIDA has been establishing MoUs with different key stakeholders across the country. As of this date they have signed approximately 50 MoUs among different states and services. Looking closely at the MoU agreement between the authority and the stakeholder it is important to note a few key points. Firstly, a memorandum of understanding is often used when two stakeholders reach an agreement that is dependent upon either another document or on the occurrence of certain things. The memorandum would be expected to be entered into with the intent of setting the standards and actions that will be taken if a Bill is passed and the critical terms remain the same and funding is approved as expected, but there would be no final contract until the passage, terms, and funding is certain. It is thus important for a MoU to be clear in establishing that the terms are subject to change if the Bill does not pass or its terms are changed. The MoUs that have been established between the Authority and other stakeholders have not made this essential fact very clear. The MoUs are for ‘pilot projects’, as the Authority calls them, but the Authority has not made clear as to what is to happen to the information after the Bill is passed, or if the terms are changed, or if the Bill is defeated. Is it the intent of the Authority simply to transition the data into the data that are collected if the Bill is approved in its current form?
Privacy and Security
In all these processes, Dalwai emphasized that the privacy of an individual is protected by the minimal collection of attributes and personal data. Security is assured by the fact that only the resident can see his or her personal details, and therefore, no one else can access those details; thus, it is in the power of the data holder alone to share the information with the institution. Unfortunately, both statements were made without adequate examples and explanation to provide assurance of the actual security and protection of one’s number and identity. Perhaps this is a reflection of the fact that the project appears to be severely lacking in actual data protection protocols. Though standards for how the data will be handled have been intermixed into technical documents, it is not clear how accountability and security at all levels will be maintained because there is no document clearly establishing essential privacy collection principles, such as: a collection limitation principle, a data quality principle, a purpose specification principle, a security safeguards principle, an openness principle, an individual participation principle, and an accountability principle. Nor amongst all the MoUs, technical papers, and terms of agreement are there policies concerning sensitive information, mandated nondisclosure and confidentiality agreements for employees involved in the project, consultants, and licensees to keep the information confidential.
The Story of Ram
To illustrate how an individual’s life can be changed through a UID number, Dalwai shared the story of Ram. Ram is a poor farmer who typically must lose a day of work, travel to the bank, wait in the line for the bank, spend money on transportation, and pay transaction fees simply to collect his paycheck. In theory, with a UID number Ram would simply have to go to a No Frills Shop, identify himself to the operator, and present his pay stub or cheque. The operator would send to the bank for authentication. Once authenticated funds are sent to the controller’s account, the operator would deliver the money to Ram. With the UID, Ram does not have to miss a day of work, spend money on transportation, or wait in long queues – theoretically speaking, that is. Ram's future with a UID can also take a different, less blissful path. Ram could go the operator, present his pay stub or cheque, go to authenticate himself and find that the machine does not read his fingerprints, so he must rely on manual authentication. Or Ram might find that the machine is broken, and he must come back tomorrow. Perhaps he is authenticated, but the operator does not want to give him the money, or, in the worst case scenario, the records show that Ram has already come and picked up his rations, and because his biometrics can theoretically only be used by him, he must go home without any ability to access any services or benefits until it is verified that his identity was stolen. Clearly, both scenarios have positive and negative sides, but it is important to consider the ramifications that each one presents.
Conclusion and Summary
Dalwai concluded that in summary the project is a partnership model, flexible in nature, inclusive of all its objectives, and technology-driven. After his presentation, questions were raised including:
What type of technologies will be used to protect privacy? There was no direct answer, but an assurance that there will be no leakages.
If you have a PAN number will you be able to still use it as your main form of identification?
How long will authentication take?
How can the authority say that it is a voluntary number if it is de-facto mandatory?
In response to the questions that were posed, Dalwai assured the audience that the technology would be foolproof, and no leakages in the system would take place. He also said that if different agencies and services such as the PAN card, or Passport become linked to the UID number, by default it will be necessary for a person to have a number and use it as the main form of identification. He also guaranteed that authentication of one's number would take five seconds or less. To conclude, Dalwai reasserted the benefits to the poor that the scheme would bring, and the opportunities that it would open up.
Document Actions
On Tuesday, 7 September 2010, Ashok Dalwai, the Deputy Director General of the Unique Identification of India (UIDAI), gave a lecture at the Indian Institute for Science in Bangalore. Representing the UID Authority, his presentation explained the vision of the project and focused on the challenges involved in demographic and biometric identification, the technology adopted, and the enrolment process. Elonnai Hickok gives a report of his presentation in this blog post.
The Project
Dalwai began his presentation by clarifying that the project is meant for residents and not just citizens. The justification for this distinction is that if the UID project applied to just citizens, the law could create possible constitutional conflicts. Though Dalwai did not specify what exactly the constitutional conflicts were, one can hypothesize that because foreigners are guaranteed the same rights to liberty, life, and due process as citizens of India under articles 14 (right to equality) and 21 (protection of life and personal liberty) of the Constitution of India, it would be problematic to set up a benefit-delivery mechanism that was available only to citizens. Additionally, he was clear that the number will give an individual an identity only; it does not guarantee benefits, and is instead meant to facilitate the receipt of benefits. He anticipates that benefits will be efficiently delivered to the poor once various databases such as passport, PAN, and the NREGA merge with the UID and agree to accept the UID number as a proof of identity. Dalwai also explained how the poor in particular are in desperate need of an identity, because in India a lack of identity results in exclusion of services. By providing a true biometric identity for each individual, the UID will be inclusive of the Indian population and will eliminate the use of bribes as a method of procuring an identity. The AADHAAR initiative will also work to clean up the existing database, remove duplicates and fake cards, and improve targeting and delivery of services.
UID as an Ecosystem
Dalwai explained how the project will be structured like an ecosystem. The UID Authority in itself is small and lacking in manpower (though he made it clear that funding was not an issue), but by building an ecosystem, the project will be able to be executed efficiently and effectively. The ecosystem will be developed by training supervisors, who will train enrollers, who will in turn train registrars, and so on. The process is circular and continuous, which makes the project sustainable. As of today, the project has moved forward from the initial stages of signing memorandums of understanding (MoUs) to the process of aligning technology, preparing for the enrolment of residents' data, and completing test runs of operations. In the future it will continue on to the actual enrolment and authentication process. Though Dalwai glazed over the fact that MoUs have been signed and the project initiated without parliamentary approvals, this is not a minute point. Since late spring the UIDA has been establishing MoUs with different key stakeholders across the country. As of this date they have signed approximately 50 MoUs among different states and services. Looking closely at the MoU agreement between the authority and the stakeholder it is important to note a few key points. Firstly, a memorandum of understanding is often used when two stakeholders reach an agreement that is dependent upon either another document or on the occurrence of certain things. The memorandum would be expected to be entered into with the intent of setting the standards and actions that will be taken if a Bill is passed and the critical terms remain the same and funding is approved as expected, but there would be no final contract until the passage, terms, and funding is certain. It is thus important for a MoU to be clear in establishing that the terms are subject to change if the Bill does not pass or its terms are changed. The MoUs that have been established between the Authority and other stakeholders have not made this essential fact very clear. The MoUs are for ‘pilot projects’, as the Authority calls them, but the Authority has not made clear as to what is to happen to the information after the Bill is passed, or if the terms are changed, or if the Bill is defeated. Is it the intent of the Authority simply to transition the data into the data that are collected if the Bill is approved in its current form?
Privacy and Security
In all these processes, Dalwai emphasized that the privacy of an individual is protected by the minimal collection of attributes and personal data. Security is assured by the fact that only the resident can see his or her personal details, and therefore, no one else can access those details; thus, it is in the power of the data holder alone to share the information with the institution. Unfortunately, both statements were made without adequate examples and explanation to provide assurance of the actual security and protection of one’s number and identity. Perhaps this is a reflection of the fact that the project appears to be severely lacking in actual data protection protocols. Though standards for how the data will be handled have been intermixed into technical documents, it is not clear how accountability and security at all levels will be maintained because there is no document clearly establishing essential privacy collection principles, such as: a collection limitation principle, a data quality principle, a purpose specification principle, a security safeguards principle, an openness principle, an individual participation principle, and an accountability principle. Nor amongst all the MoUs, technical papers, and terms of agreement are there policies concerning sensitive information, mandated nondisclosure and confidentiality agreements for employees involved in the project, consultants, and licensees to keep the information confidential.
The Story of Ram
To illustrate how an individual’s life can be changed through a UID number, Dalwai shared the story of Ram. Ram is a poor farmer who typically must lose a day of work, travel to the bank, wait in the line for the bank, spend money on transportation, and pay transaction fees simply to collect his paycheck. In theory, with a UID number Ram would simply have to go to a No Frills Shop, identify himself to the operator, and present his pay stub or cheque. The operator would send to the bank for authentication. Once authenticated funds are sent to the controller’s account, the operator would deliver the money to Ram. With the UID, Ram does not have to miss a day of work, spend money on transportation, or wait in long queues – theoretically speaking, that is. Ram's future with a UID can also take a different, less blissful path. Ram could go the operator, present his pay stub or cheque, go to authenticate himself and find that the machine does not read his fingerprints, so he must rely on manual authentication. Or Ram might find that the machine is broken, and he must come back tomorrow. Perhaps he is authenticated, but the operator does not want to give him the money, or, in the worst case scenario, the records show that Ram has already come and picked up his rations, and because his biometrics can theoretically only be used by him, he must go home without any ability to access any services or benefits until it is verified that his identity was stolen. Clearly, both scenarios have positive and negative sides, but it is important to consider the ramifications that each one presents.
Conclusion and Summary
Dalwai concluded that in summary the project is a partnership model, flexible in nature, inclusive of all its objectives, and technology-driven. After his presentation, questions were raised including:
What type of technologies will be used to protect privacy? There was no direct answer, but an assurance that there will be no leakages.
If you have a PAN number will you be able to still use it as your main form of identification?
How long will authentication take?
How can the authority say that it is a voluntary number if it is de-facto mandatory?
In response to the questions that were posed, Dalwai assured the audience that the technology would be foolproof, and no leakages in the system would take place. He also said that if different agencies and services such as the PAN card, or Passport become linked to the UID number, by default it will be necessary for a person to have a number and use it as the main form of identification. He also guaranteed that authentication of one's number would take five seconds or less. To conclude, Dalwai reasserted the benefits to the poor that the scheme would bring, and the opportunities that it would open up.
Document Actions
