The Secured Digitally-Signed QR Code Issued By UIDAI Has Now User’s Image Too, Along With The Demographic Details
April 12, 2018 10 min read
INC42 STAFF
In legal purview, the merits of Aadhaar can’t be used as a defence against the demerits of it.
While Union Minister Ravi Shankar Prasad terms Aadhaar a ‘digital identity’ that supplements one’s ‘physical identity’ the Supreme Court of India, hearing AG KK Venugopal and ASG Tushar Mehta’s arguments observed that several legal loopholes present in the Aadhaar Act.
Hearing the Aadhaar case on a day-to-day basis, the five-member constitution bench headed by CJI Dipak Misra noticed that the UIDAI had already validated biometric enrolments even before the law was enacted with retrospective effect.
Some of the major observations and responses are:
- SC: There is no doubt that money laundering is a problem. The only question that needs to be answered is how will Aadhaar prevent money laundering.
- SC To AG Venugopal: You have said that it was voluntary and with minimal invasion. We can’t hold that the fundamental rights can be waived off or compromised.
- AG: In pre-2016 Aadhaar era, people gave their biometric data voluntarily and at that point of time, it did not violate the privacy as the right to privacy was not a fundamental right.
- AG: The state has no interest in the collection of biometrics except for the benefit of the individual himself. We want to link Aadhaar not because we see people as criminals, but to protect them from crime.
Hearing a batch of petitions by the former Karnataka High Court Judge K.S. Puttuswamy, Magsaysay awardee Shanta Sinha, feminist researcher Kalyani Sen Menon, social activist Aruna Roy, Nikhil De, Nachiket Udupa, the SC has already countered many of the tall claims presented by the AG.
Countering the counted merits by the AG, the constitution bench commented, “Bank frauds don’t happen because of multiple identities. Banks do due diligence every time they give out loans. Frauds can’t happen unless bank employees are hand in glove.”
Similarly, “Terrorists don’t apply for Aadhaar. They don’t apply for SIMs. They acquire them.”
Aadhaar: Outside Courtroom
While the SC has been hearing the Aadhaar case since January 18, 2018, on a daily basis, Aadhaar developments outside the courtroom are equally engaging. The government has refused to withdraw the FIR filed against journalist Rachna Khaira while maintaining that there was no Aadhaar data leak or breach from the UIDAI-end. On January 3, 2018, Rachna in The Tribune had reported how Aadhaar logins and passwords are being sold along with the Aadhaar software that could pass potential information to wrong hands.
RELATED STORIES:
In an email conversation with Inc42 last month, Vivek Wadhwa, a Distinguished Fellow at Carnegie Mellon University had then commented, “This is just plain wrong. India’s greatest strength is its democracy and free press. Without this, the country will rapidly descend into darkness. The government should be thanking the people who have found the problems with the system, not punishing them. It should be offering rewards to people who can identify the weaknesses just as the tech companies offer bounties for hackers who find and report weaknesses in their systems.”
Meanwhile, to enable and boost offline Aadhaar verification process, the UIDAI has also replaced the existing QR code on eAadhaar having resident’s demographic details now with a secured digitally-signed QR Code which contains demographics along with the photograph of the Aadhaar holder.
As per UIDAI Chief Ajay Bhushan Pandey, this is a simple offline mechanism to quickly verify the genuineness of the Aadhaar card. However, to ensure that a person is a bona fide owner of the Aadhaar card, there has to be a manual check of the photo with the individual’s face or through use of agency-specific authentication scheme.
Amid Aadhaar biometric leaks exposed by a 28-year old French Security Researcher Batiste Robert alias Elliot Alderson, Aadhaar parent organisation UIDAI has recently added another layer of security as virtual IDs.
As per UIDAI, there will be now no need to share the real Aadhaar number at the time of authentication. Instead, a randomly generated 16-digit code will be shared with the agency every time. A user can generate multiple virtual IDs as per the need. The older IDs will get cancelled once a fresh ID is issued to the user. Since the virtual ID would get mapped to the individual’s Aadhaar number, the need to share the original Aadhaar number would be done away.
Aadhaar: Legal Loopholes
Aadhaar right from the UPA to the NDA time, has moved from strength to strength, from merely being notification or circular to a full-fledged Act now.
However, as indicated by the SC, Aadhaar has its own flaws which are legal and more. While Clause 32 of the Aadhaar Act rightly says, “It also provides that the Authority shall not, either by itself or through any entity under its control, collect, keep or maintain any information about the purpose of authentication,” Section 59 tries to justify Aadhaar by saying, “…anything is done or any action taken by the Central Government under the Resolution of the Government of India, Planning Commission bearing notification number A-43011/02/2009-Admin. I, dated the 28th January, 2009, or by the Department of Electronics and Information Technology under the Cabinet Secretariat Notification bearing notification number S.O. 2492(E), dated the 12th September, 2015, as the case may be, shall be deemed to have been validly done or taken under this Act.”
The SC is still not convinced with implementing an Act like Aadhaar retrospectively.
BDT Acharya, former secretary of Lok Sabha in an IE column had pointed out that as per Article 110(1), a bill that contains only provisions dealing with the following qualifies as a money bill:
- one – the imposition, abolition, remission, alteration or regulation of any tax;
- two – regulation of borrowing or the giving of any guarantee by the government of India, or undertaking financial obligation by the government;
- three – the custody of the Consolidated Fund of India (CFI) or the Contingency Fund of India, the payment of moneys into or withdrawal from them;
- four – the appropriation of money out of the CFI;
- five – declaring any expenditure as a charged expenditure on the CFI;
- six – the receipt of money on account of the CFI or the public account of India or the ambit of accounts of the Union or of a state;
- seven – any matter incidental to the above issues.
He further went on to say, “Let’s examine the Aadhaar bill in light of the above definition. The bill does not deal with imposition, abolition, alteration, etc. of tax; nor does it deal with the regulation of borrowing or giving a guarantee by the government or an amendment in respect of any financial obligation to be undertaken by the government. This bill also does not deal with the custody of the CFI, etc. The money paid into or withdrawn from such funds are incidental.”
Further, the Clause 4(3) which enables Aadhaar to be accepted as proof for “any purpose”, not merely for the payment of subsidy or other monetary benefits make Aadhaar Act to fall beyond the ambit of a Money bill.
While the Data (Privacy And Protection) Bill has been introduced in the Lok Sabha, the discussion and further proceeding could not occur, as the Parliament has not been allowed to function by the parties.
In a chat with Inc42, Robert alias Elliot averred, “Well, yes having a data protection policy is probably a good idea. It will force the companies, apps or agencies to care about it and to make the correct implementation.”
Thus, what started with a mere notification, the Aadhaar Act still has enough loopholes to be questioned. And, this can’t be compared with the merits of the Aadhaar, as merits can’t complement Aadhaar demerits which must be dealt separately.
Besides, Elliot is not the first or last to point out the Aadhaar data leak. India Today, The Tribune, The Quint, and other media portals have already published a number of investigative reports suggesting the Aadhaar leak right from the data mining to data processing.
So far, the UIDAI has blacklisted more than 49,000 centres for Aadhaar data leak and not implementing the suggested standards. Most of the centres were shut down after complaint and the UIDAI never had its internal inspection unit in place, as part of its own preventive mechanism. Similar is the case of Aadhaar-data leak by various government organisations. There is no double check of these websites, their data storage and applications are in place, which the UIDAI has denied, as expected.
Angel Investor Mohandas Pai in an email conversation with Inc42 last month clarified, “All the incidents of any concern on Aadhaar data is because public authorities have not kept Data confidential, nothing to do with Aadhaar. The recent media issue was caused by theft of an administrator password and illegal hacking. If UIDAI and government had underestimated the scale would it be possible to have 119 cr registrations?”
There Is No Question Of Going Back!
The Aadhaar issue is still in the Court, and it is difficult to say which way it will land. However, the questions and issues raised by the five-member constitutional bench headed by CJI Dipak Misra have appeared so far constructive and the Judges have nowhere rejected the idea of having Aadhaar and its basic merits of social welfare. The Judges have, however, objected to the other USPs that the UIDAI wants to propagate such as, Aadhaar will stop money laundering or terrorist activities.
While the SC has clearly drawn a line between where Aadhaar must be linked and where it should be voluntary, the Indian government along with the UIDAI has not implemented the decision with the same enthusiasm it showed while linking.
As per the BBC, a dozen deaths have been registered pertaining to Aadhaar issues. Questioning the Aadhaar priority set by the Indian government, Santosh Min, a petitioner in the SC told CJI in person, “In imposing the Aadhaar, the government of the day wanted to keep track of every single paise earned by the citizen and on another hand, political parties can receive funds anonymously through electoral bonds.”
Santosh has complained that he could not withdraw his father’s hard-earned PF after his death, as the authorities have asked to provide the Aadhaar fingerprints for the same. Yet, another example of Aadhaar loophole.
Many hospitals still have the signboards that state, “Aadhaar is essential for the treatment”. As told by Mohandas Pai, most of the Aadhaar issues are implementational issues. Can’t the government just accept the issues and shut the loopholes once and for all?
