Here are a few ideas and experiences from around the world that India can learn from to provide a strong security and privacy foundation to Aadhaar.
by Sanchari Pal
2 days ago
Amidst a raging debate on the validity and omnipresence of the Aadhaar program, the Unique Identification Authority of India (UIDAI) has revealed that more than 200 central and state government websites, including educational institutes, publicly displayed personal details such as names, addresses and Aadhaar numbers of some beneficiaries.
UIDAI said this in response to a Right to Information (RTI) query, adding that it had noted the breach and that the data had since been taken down. However, it did not specify when or how the breach took place as well as how long the data was exposed on these sites.
While UIDAI did add that the biometric information is never shared and kept secure with software encryption, its reply to RTI led to several Indians voicing serious security and privacy concerns about the Aadhaar system. After all, ever-evolving hackers have broken into the super-secure systems like the NSA (National Security Agency) in the US, and Britain’s NHS (National Health Service).
The world’s largest biometric database, India’s Aadhaar system holds billions of users’ sensitive and confidential details (including iris scans, fingerprints and a unique 12-digit number similar to Social Security Numbers in the US).
Aadhaar as an ID has been mandatory by the government for every Indian citizen to avail of various social welfare schemes and government services. Furthermore, the government has also asked all citizens to link their Aadhaar IDs to their bank accounts, mobile numbers, insurance policies, PAN (Permanent Account Number) and other services.
This fact — that its a single ID with multiple crucial linkages — makes Aadhaar users vulnerable to data leaks with dangerous consequences. Which is why India needs to address the considerable concerns of individual privacy and data protection in its Aadhaar system.
Globally, around 120 countries have data privacy laws. India could do well to learn from their experiences and use it as a guide to any future legislation.
For instance, Estonia and Austria. Both these countries have unique identification systems to provide greater control to individuals (as compared to India) at the point of authentication as well as in the way their personal data is shared across sectors.
Estonia uses a simple, unique ID methodology across all systems, from passports to bank records to government offices and hospitals. Each Estonian authenticates himself/herself against the card — to verify his identity or to sign documents electronically — by providing two user-selected, private PINs (that you know).
This multi-pronged authentication offers extra security as the individual gets control over the authentication process, ensuring a greater degree of privacy over government-warehoused information and reducing the chance of impersonation without his or her knowledge.
In Austria, advanced cryptography allows users to access multiple services with their single unique ID while ensuring that they are identified in different ways for different bases. This prevents their personal records from being matched across the different databases using a common number.
Austria’s citizen card system also uses SourcePINs (that are only generated when required and are deleted afterwards) for the unique identification of citizens. The virtual register of SourcePINs is managed by the SourcePIN Register Authority (or Data Protection Authority) which verifies and enables users to view (and revoke) the mandates online.
Malaysia’s MyKad, one of the world’s first national ID card programs, uses certified Solid Flash product that combines the advantages of a flexible Flash memory with a dedicated security concept. MyKad also uses a high-security technology for identification documents so that data is encrypted along its entire path during processing.
This allows the chip-enabled card to be used as the single point of authentication (at places like ATMs, toll booths, micro-payment kiosks), as the driving license and as a digital certificate at government offices. Similarly, Indonesia’s identity card, Karta Tanda Penduduk (KTP), also uses smart electronics.
The benefit of this approach is that all that information is in a chip-enabled card that you have complete control over as opposed to a centralised database where it can be used by a third party without your knowledge.
As for data protection regulations, the European Union stands out for its overarching and comprehensive approach. In principle, its stringent directives protect personal data — including a person’s address and their image — from unauthorized processing and use by public authorities of its constituent countries.
In Canada, the government’s Personal Information Protection and Electronic Documents Act (PIPEDA) regulates how organisations (regardless of agency, provinces or industry) may collect, use and disclose the personal information they gather. This also makes them accountable for the protection of the said data. It should be noted that states have the right to add their own rules and regulations as long as they are “substantially similar” to PIPEDA.
Similar but not as holistic is USA’s Social Security Number Protection Act of 2010. In a nutshell, the law prohibits Federal, state, and local agencies from displaying a Social Security number or part of a Social Security number on documents issued by that agency.
Also, USA also has federal rules designed to deal with specific risk scenarios (for example, Children’s Online Privacy Protection Act for child data, Health Insurance Portability and Accountability Act for health-related information and the Gramm-Leach-Bliley Act for financial information).
These are just a few examples of ideas and experiences that India can learn from to provide a strong security foundation to Aadhaar. However, doing this will also require a willingness on the part of everyone involved in the ongoing debate to come together for a common goal – protecting personal data and individual privacy while harnessing the power of technology for better governance.
