In 2009, I became extremely concerned with the concept of Unique Identity for various reasons. Connected with many like minded highly educated people who were all concerned.
On 18th May 2010, I started this Blog to capture anything and everything I came across on the topic. This blog with its million hits is a testament to my concerns about loss of privacy and fear of the ID being misused and possible Criminal activities it could lead to.
In 2017 the Supreme Court of India gave its verdict after one of the longest hearings on any issue. I did my bit and appealed to the Supreme Court Judges too through an On Line Petition.
In 2019 the Aadhaar Legislation has been revised and passed by the two houses of the Parliament of India making it Legal. I am no Legal Eagle so my Opinion carries no weight except with people opposed to the very concept.
In 2019, this Blog now just captures on a Daily Basis list of Articles Published on anything to do with Aadhaar as obtained from Daily Google Searches and nothing more. Cannot burn the midnight candle any longer.
"In Matters of Conscience, the Law of Majority has no place"- Mahatma Gandhi
Ram Krishnaswamy
Sydney, Australia.

Aadhaar

The UIDAI has taken two successive governments in India and the entire world for a ride. It identifies nothing. It is not unique. The entire UID data has never been verified and audited. The UID cannot be used for governance, financial databases or anything. It’s use is the biggest threat to national security since independence. – Anupam Saraph 2018

When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy

First they ignore you, then they laugh at you, then they fight you, then you win.-Mahatma Gandhi

In matters of conscience, the law of the majority has no place.Mahatma Gandhi

“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi

“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.”-A three judge bench headed by Justice J Chelameswar said in an interim order.

Legal scholar Usha Ramanathan describes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.

Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.

Rajeev Chandrasekhar, MP Rajya Sabha

“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh

But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant.Rajeev Chandrasekhar, Rajya Sabha MP

“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017.

August 24, 2017: The nine-judge Constitution Bench rules that right to privacy is “intrinsic to life and liberty”and is inherently protected under the various fundamental freedoms enshrined under Part III of the Indian Constitution

"Never doubt that a small group of thoughtful, committed citizens can change the World; indeed it's the only thing that ever has"

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” -Edward Snowden

In the Supreme Court, Meenakshi Arora, one of the senior counsel in the case, compared it to living under a general, perpetual, nation-wide criminal warrant.

Had never thought of it that way, but living in the Aadhaar universe is like living in a prison. All of us are treated like criminals with barely any rights or recourse and gatekeepers have absolute power on you and your life.

Announcing the launch of the # BreakAadhaarChainscampaign, culminating with events in multiple cities on 12th Jan. This is the last opportunity to make your voice heard before the Supreme Court hearings start on 17th Jan 2018. In collaboration with @no2uidand@rozi_roti.

UIDAI's security seems to be founded on four time tested pillars of security idiocy

1) Denial

2) Issue fiats and point finger

3) Shoot messenger

4) Bury head in sand.

God Save India

Showing posts with label Edward Snowden. Show all posts
Showing posts with label Edward Snowden. Show all posts

Saturday, April 28, 2018

13385 - Tale of two whistle-blowers


Tale of two whistle-blowers
Chris Wylie took on a corporation, Facebook, Edward Snowden took on the state. With Aadhaar, we are up against the combined might of both.
Written by Reetika Khera | Updated: April 28, 2018 1:20:31 am
Chris Wylie took on a corporation, Facebook, Edward Snowden took on the state. Chris Wylie, who helped set up Cambridge Analytica, is the whistle-blower who has revealed the questionable practices that emerged out of this nexus. (Representational photo)
Its not (just) about Facebook. Or Cambridge Analytica.
In the Facebook-Cambridge (FB-CA) saga the three important players so far are: First, Facebook, with the data of millions of people, couched in an architecture with dubious privacy permissions. Second, Aleksandr Kogan, a psychology professor at Cambridge, whose app “thisisyourdigitallife” harvested the data of the person who downloaded the app as well as the Facebook friends of that person. Third, Cambridge Analytica, a UK company to whom this data was sold by Kogan and which used it to create profiles of individuals, and micro-targeted messages to manipulate their voting behaviour. Chris Wylie, who helped set up Cambridge Analytica, is the whistle-blower who has revealed the questionable practices that emerged out of this nexus.
Zooming out from this specific case is important. One possible silver lining to the FB-CA scandal is that it will lift the halo around data analytics, artificial intelligence (AI) and machine learning (ML), allowing us to see them with all their warts. FB-CA are not the only ones to exploit these techniques, which have been projected over the past few years as “the future”.
AI, ML and data analytics are generally heralded as a force to “do good”. A clutch of studies using these techniques have led to instructive insights related to crime, traffic management, health, etc. What appears to have happened subsequently is that the seminal studies are repeatedly cited, even oversold at times. The dark side of these techniques, that algorithms and data can be “weaponised”, hurting rather than helping the weak, tends to be underplayed. It is this — ugly face of algorithms — that Cathy O’Neil’s book, Weapons of Math Destruction, documents. She makes two other important points: Some claims are overstated and sometimes, contrary to the claims, these techniques replicate — even exacerbate — inequalities and biases. She demonstrates how algorithms can be deployed against the weak in car insurance, pay-day loans, screening job candidates, etc.
It is one thing for data as the by-product of our activities to be used to understand, with the intent of improving, human life. Others such as Zeynep Tufecki and Bruce Schneier (author of Data and Goliath) warn of another alarming shift: To nudge, even push, us to increase our digital footprint. This is done with the sole purpose, they warn, of enhancing data mining opportunities for targeted advertising. The recent evangelising of digital payments is a good example. Cash expenditures do not log how we spend our money in as much detail as digital payments. Metadata (anonymised data, for example, frequency, timing, size of spending, rather than specific purchases) from digital wallets provide useful signals for advertising. Ditto with aggregator apps (food, taxis, etc). Insurance companies are becoming notorious for using such techniques to identify susceptible customers. In this sense, the emerging data economy poses new and serious challenges to privacy.
Schneier warns against the corporate and government surveillance potential of the digital economy. The main concern with the deployment of algorithms by corporations was targeted advertising. Wylie’s FB-CA expose shows businesses may not be squeamish about going further, undermining democratic practices through manipulation and coercion.
Edward Snowden’s revelations in 2013 about mass government surveillance also demonstrated the dark side of these techniques. With Glen Greenwald and others, they exposed the unprecedented mass surveillance power of the NSA’s programmes such as “prism”, “xkeyscore”, “mystic” etc.
One contrast between Wylie and Snowden, the two whistle-blowers is worth flagging. Snowden having exposed his own government has paid a heavy price: He had to leave the country and seek asylum elsewhere (where he remains). For Wylie, thankfully, such a situation has not arisen.
One key reason for this contrast is that Wylie was blowing the whistle against corporations, whereas Snowden spoke out against government surveillance. Though FB-CA are powerful corporations, we have seen some semblance of action by the government against them. Whether the corporations will be held to account remains to be seen, as they tend to have the resources and influence to have their own way. Tech giants have been spending record sums on lobbying the US government, especially against anti-trust and privacy regulations.
This has lessons for us in India too, where Aadhaar is seen as a drill to get the “new oil”, data. Recently, some businesses built on the Aadhaar platform intervened in the Supreme Court arguing that “access to the Aadhaar eco-system.is critical” and declaring Aadhaar illegal will cause them “grave and irreparable harm”.
Like Facebook, Aadhaar’s consent architecture is weak at best, non-existent at worst (remember how Airtel opened Airtel bank accounts when people linked their Aadhaar numbers). Even if we get a robust data privacy and data sharing policy, do we have the enforcement machinery to prevent abuse (there was no serious action against Airtel)? Furthermore, there are genuine anxieties about how many of us are adequately equipped to successfully navigate a world of privacy permissions and protections.
The UIDAI, of course, maintains that all is well. In the face of the exposes by hackers (for example, ZDNet and Robert Baptiste) and journalists (for example, The Tribune) this assertion is vacuous, even laughable. What is alarming is that the UIDAI initiated legal action against the whistle-blowers, not the offenders.
Without pushing the parallel too far, one could view the emerging Aadhaar eco-system as the foundation of a state-sanctioned mega-Facebook project or like China’s scary social crediting system. With Aadhaar we are not up against the might of corporations (as Wylie is) or that of the state (as Snowden is), but against the combined might of the state and corporations.
The writer is a development economist at the Indian Institute of Technology Delhi
For all the latest Opinion News, download Indian Express App
More From Reetika Khera
  • The real beneficiary
    Aadhaar doesn’t empower people, only the state ..
  • Evidence no bar
    Discussion on Universal Basic Income shows an ignorance of inconvenient facts in our experience with direct benefit transfer and Aadhaar..
  • Digging holes, filling them up
    As it completes 10 years, there is enough evidence to show that India needs the MGNREGA..

Tuesday, February 13, 2018

12947 - Bad Aadhaar cybersecurity tramples on the Right to Privacy -- Business Today



Sean O' Brien   New Delhi     Last Updated: February 11, 2018  | 18:01 IST

In a landmark ruling last August, the Right to Privacy became the seventh Fundamental Right guaranteed by the Constitution of India. Before the ink was dry on the decision, observers such as myself wondered how the new Aadhaar biometric identification system could possibly be recalibrated to align with it.

In fact, Aadhaar had been central to the discussion about privacy that led to the ruling, as had the Facebook-owned WhatsApp messenger. As Additional Solicitor-General P.S. Narasimha told the Supreme Court in July, "My individual personal data is intimate to me. It is an integral part of my right to lead a life with dignity."  By then, over a billion Indian residents had given their most individually-identifying information to government agency UIDAI.

Those who worried about WhatsApp and Aadhaar at the time were on the right track, but they could not have known the full depths of the problem. Who would have guessed that anyone's Aadhaar data would soon be bought and sold cheaply over WhatsApp? Last year, there were signs that Aadhaar data was being mishandled, and not necessarily by UIDAI. Parallel databases that stored Aadhaar data and used it for identification were recklessly publishing information.

It's well-known that UIDAI doesn't own up to its mistakes, instead threatening reporters who reveal vulnerabilities. UIDAI's web-based portal still has major problems, and it was just revealed this week that any administrator can give anyone else in the world full access to the database backend, often for a price. Not only are a variety of questionable third-party apps available through Google Play that request Aadhaar data, but UIDAI's official mAadhaar app has serious problems.

In an effort to understand these issues more thoroughly, I contacted Baptiste Robert, a French security researcher who goes by the Mr. Robot-inspired pseudonym - Elliot Alderson.  Though Baptiste's work exposing scary flaws in the mAadhaar app has prompted no official response, it has caught the attention of cyber- security superstars like Edward Snowden and Troy Hunt.

As Baptiste said in an e-mail, "UIDAI didn't contact me. The app is still not updated. Regarding how they used the Play store, I'm pretty sure they lost the release keys and so are unable to update the app."

Such incompetency by UIDAI is plausible, given the basic mistakes made in the mAadhaar app's design. Mobile apps are notoriously difficult to secure, and my own digging into app privacy continues to remind me that even 'anonymised' or 'masked' information may identify individuals when databases are correlated. mAadhaar sidesteps this issue with a bizarre twist: the local database on each phone is completely open to attack. This database, which contains a user ID, Aadhaar ID, name, date of birth, gender, address, and photo, supposedly uses a 'random' password. That database password is the exact same for everyone who installs the app, allowing anyone who has physical access (and, potentially, remote access) to your
phone to access the data within seconds. It doesn't stop there. The password to log into the mAadhaar app is also easily bypassed in a few seconds and there's more than one method to do it.

Once the app is running, the password prompt can even be bypassed by force quitting. The problems continue to mount the deeper you look. Baptiste warns users,"The best move is to not install this app. This app is pretty insecure and has not been designed to keep sensitive information."
Notably, there's a debug feature that was left turned on when mAadhaar was published in Google Play, allowing an attacker to repackage imposter versions of the app that keep unencrypted log files on the phone. Such logs could then be grabbed by an attacker with physical access to the device or even remotely through the Internet.
Scam versions of well-known apps propagate quickly, as we saw when Google Play was flooded with fakes of Snowden's Haven app. There doesn't seem to be any initiative on UIDAI's part to crack down on impersonators, and there's also a thriving market of advertising trackers inside third-party Aadhaar apps. Any massive database system will have security holes, and UIDAI's bold attempt to store the personal information and biometrics of 1.3 billion people is no different. On the surface, it might seem that strong centralized control of Aadhaar's systems might have avoided any data breaches or mishandling of information. Aadhaar's problems can't be blamed on government outsiders, however, while UIDAI cosies up so closely with private firms and has even formed a cottage industry of Aadhaar-linked start-ups.
Whenever a security researcher looks at an official government Aadhaar app, there are blatant privacy problems and sloppy cyber-security, such as sending data over the Internet unencrypted.
To compound this, web portals linked to Aadhaar are left open for exploitation. "I managed to have a total access to the website of aadhaarapi.com," says Baptiste, "due to a basic issue in their WordPress installation."
The official response to these problems is, consistently, misdirection or outright denial. Indians are supposed to take comfort that CEO of UIDAI Ajay Bhushan Pandey has 'sleepless nights' over hacking threats while Aadhaar data is 'fully safe and secure with highest encryption'.
Pandey was in full damage-control mode during a special question and answer session on Data Privacy Day, adding his voice to the government agency's long denials of any data breach.
Social media is increasingly a battleground for governments attempting to suppress the voice of their people. If the Indian government is engaged in automated campaigns to quiet criticism of Aadhaar, it is doing a clumsy job. A small army of automated bot accounts sends the exact same tweets under the hashtag #AadhaarMythBuster, though that tag may soon be hijacked by
Aadhaar's critics.
Legal debates about Aadhaar continue to hinge on national defence and public safety questions, and the Supreme Court has just stated that in the face of 'terrorism and money-laundering... a balance between state interest and citizens' privacy right has to be maintained.' Talk of such a 'balance' is a distraction from the legitimate grievances of Indians who have had their Right to Privacy violated by the invasive biometric identification program.
The first step toward justice is admitting UIDAI's cyber-security mistakes. Given the severity of Aadhaar's privacy problems, it's quite likely that mountains of Aadhaar data are circulating on black markets - whether that means thousands, millions, or billions of profiles is impossible to say. As experts have warned, "Thanks to Aadhaar, for the first time in the history of India, there is now a readily available single target for cyber criminals...attacking UIDAI data can potentially cripple Indian businesses and administration in ways that were inconceivable a few years ago. The loss to the economy and citizens in case of such an attack is bound to be incalculable."
Perhaps it's time to stop the bleeding, put an end to the massive identification project, and take the Constitution of India seriously.

Sean O'Brien is a cyber-security researcher and Visiting Fellow at YalePrivacyLab, an initiative of the Information Society Project at Yale Law School.

Tuesday, January 23, 2018

12761 - Snowden Adds Voice to Aadhaar Opposition - Find Biometrics

Posted on January 22, 2018

Edward Snowden, the famous CIA whistleblower and notorious American defector, has been lashing out at the Unique Identification Authority of India and the biometric ID database it oversees.

Snowdens complaints have come in the form of tweets, with the most recent prompted by two important developments in the debate around Aadhaar. One is the publication of an article by the former chief of Indian intelligence agency the Research and Analysis Wing, in which he laid out concerns about Aadhaar’s pervasiveness across Indian society; Snowden tweeted, “Rarely do former intel chiefs and I agree,” adding his endorsement of the piece.

The other is the UIDAI’s request for a formal investigation into The Tribune newspaper, which recently published an exposé asserting that access to the Aadhaar database could be purchased for less than $10. Snowden expressed outrage at the move, saying that if anyone should be arrested it’s the officials at UIDAI, who have “destroyed the privacy of a billion Indians.”
It isn’t clear that Snowden’s voice carries a lot of clout among Indian citizens, but he is far from alone in these criticisms. There have been numerous scandals pertaining to the relative security of the Aadhaar database, and its growing reach across various aspects of everyday life – consumers need to provide Aadhaar numbers even to track lost Amazon packages – appears to be causing some discomfort about privacy violations. Nevertheless, the UIDAI continues to press on with its mission, and has been making tweaks to the program that appear to be aimed at improving its security, such as adding support for facial recognition, in addition to fingerprint and iris recognition, to prevent fraud in Aadhaar authentication. Such measures do little to address Snowden’s deeper concerns, which seem to revolve around state surveillance the loss of privacy; but ultimately it’s going to be up to Indian citizens to decide how much of Aadhaar they can live with.

–
January 22, 2018 – by Alex Perala

Related News

12754 - Aadhaar spat: Snowden says ex-RAW chief backs claim - TNN

Aadhaar spat: Snowden says ex-RAW chief backs claim


Rachel Chitra | TNN | Jan 22, 2018, 05:37 IS

CHENNAI: Whistleblower Edward Snowden on Sunday got into a Twitter argument with UIDAI. When UIDAI tweeted that Aadhaar enabled identification and not profiling, Snowden responded that this was not the case. 

"#Aadhaar is an identifier, not a profiling tool. Aadhaar database does not keep any information about bank accounts, shares, mutual funds, property details, health records, family details, religion, caste, education etc. #AadhaarMythBuster," tweeted UIDAI. 

To this, Snowden responded, "That might be true if banks, landlords, hospitals, schools, telephone & internet companies were prohibited by law from asking for your #Aadhaar number." 

Aadhaar abused by banks, telcos and transport, says Snowden 

"But any Indian can tell you they're asked for their number by non-government entities — and those companies have databases too," Snowden responded. 

Snowden had on January 9 expressed support for a newspaper reporter who alleged that one could purchase Aadhaar data for as little as ₹500. 

On Sunday, he quoted an article by a former RAW chief (K C Verma, from an online news website from a day earlier), which stated: "Aadhaar every tuppenny bureaucrat has discovered a new instrument of harassment..

"Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity — an improper gate to service. Such demands must be criminalised," Snowden tweeted. 

Snowden also retweeted other posts about how "operators, banks were threatening users with disconnection of service if they fail to link their #Aadhaar... No SIM card, insurance, bank account or delivery of goods shopped online."

Snowden also retweeted Microsoft regional manager and Australian cybersecurity advisor Troy Hunt and French hacker and researcher Elliot Alderson's posts on how the Aadhaar database can be hacked. Alderson's account posted a screenshot-by-screenshot account — of another hacker's claim — of how, purportedly, it is possible to hack UIDAI's system.

12753 - Aadhaar an 'improper gate to service', says Snowden - TNN



TNN | Updated: Jan 22, 2018, 05:47 IST

NEW DELHI: American whistleblower-in-exile Edward Snowden on Sunday called Aadhaar "an improper gate to service" and said demands to link it to various services "must be criminalised." Snowden tweeted this while sharing an online article authored by former head of Research and Analysis Wing (RAW) K C Verma. This is the third time the former US National Security Agency contractor has tweeted about Aadhaar this month. 

"Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity-an improper gate to service. Such demands must be criminalized," Snowden tweeted on Sunday, posting a link to Verma's piece on a news website. 


Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity–an improper gate to service. Such demands must be criminalized. 


He later retweeted those who replied to him pointing out how banks and telecom companies in India are insistent on Aadhaar linkage. Later on Sunday evening, Snowden took an older tweet from the Unique Identification Authority of India (UIDAI) itself and responded to it, pointing out design flaws in information flow with Aadhaar. 

TOP COMMENT
Bhakts will be abusing Snowden now calling him anti-national, congress paid dalal terrorist. Someone will eventually abuse muslims too...
Dalit Panther


That might be true if banks, landlords, hospitals, schools, telephone & internet companies were prohibited by law from asking for your #Aadhaar number. But any Indian can tell you they're asked for their number by non-government entities––and those companies have databases too. 

The @UIDAI tweet from January 16 read: "#Aadhaar is an identifier, not a profiling tool. Aadhaar database does not keep any information about bank accounts, shares, mutual funds, property details, health records, family details, religion, caste, education etc. #AadhaarMythBuster." Snowden quoted this tweet and wrote: "That might be true if banks, landlords, hospitals, schools, telephone & internet companies were prohibited by law from asking for your #Aadhaar number. But any Indian can tell you they're asked for their number by non-government entities--and those companies have databases too."

12751 - ‘Demand to link Aadhaar to services must be criminalised’: Edward Snowden - News Minute

The whistleblower also endorsed former RAW chief KC Verma’s views about the fallacies in the Aadhaar card.


Screenshot from Praxis Films/Shot by Laura Poitras

With more questions being raised about the safety of the data stored by the Unique Identification Authority of India (UIDAI), whistleblower Edward Snowden reiterated his stand against the Aadhaar card on Sunday.
Linking a piece that KC Verma, former chief of the Research and Analysis Wing, wrote for The Wire about the fallacies of Aadhaar, Snowden said that demands to link Aadhaar to various services must be criminalised.
“Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity–an improper gate to service. Such demands must be criminalized,” Snowden tweeted.



Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity–an improper gate to service. Such demands must be criminalized. 
Snowden then went on to quote another tweet from the handle of the official account of Aadhaar from January 17, which claimed to ‘bust myths’ about Aadhaar. The @UIDAI handle said that Aadhaar was not a profiling tool, but an identifying one. The tweet said that Aadhaar does not keep any information about bank accounts, health records, etc.



#Aadhaar is an identifier, not a profiling tool.
Aadhaar database does not keep any information about bank accounts, shares, mutual funds, property details, health records, family details, religion, caste, education etc.  #AadhaarMythBuster
Snowden then went on to bust that myth instead, where he tweeted that it might be true if “banks, landlords, hospitals, schools, telephone & internet companies were prohibited by law from asking for your #Aadhaar number. But any Indian can tell you they're asked for their number by non-government entities–and those companies have databases too.”



That might be true if banks, landlords, hospitals, schools, telephone & internet companies were prohibited by law from asking for your #Aadhaar number. But any Indian can tell you they're asked for their number by non-government entities––and those companies have databases too. 
This is not the first time that Snowden has expressed his opinions on Aadhaar and its security loopholes. The Tribune had published a story early in January, where the reporter was able to purchase over 1 billion user’s Aadhaar data for a mere Rs 500. In response, the UIDAI denied that such a breach was possible and lodged an FIR against the reporter.
At that time, Snowden tweeted in support of the journalist and the publication, and said that the journalist deserved an award, not an FIR.
“The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI,” he tweeted.



The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI. 




×

12749 - Edward Snowden is campaigning against the world’s largest biometric ID programme - Quartz



WRITTEN BY
January 22, 2018 Quartz India

                Listen to me. (Reuters/Rafael Marchante)

American whistleblower and former Central Intelligence Agency employee Edward Snowden has joined the campaign against Aadhaar, India’s 12-digit unique identification number programme that has been under fire for its security and privacy systems.

On Sunday, Jan. 21, Snowden backed KC Verma, former head of India’s external intelligence agency, the Research and Analysis Wing (RAW), who had written about his experiences with Aadhaar. Snowden retweeted the article published in The Wire saying the act of organisations such as banks and telcos forcing individuals to produce their Aadhaar numbers should be “criminalized.”


Rarely do former intel chiefs and I agree, but the head of India's RAW writes #Aadhaar is being abused by banks, telcos, and transport not to police entitlements, but as a proxy for identity–an improper gate to service. Such demands must be criminalized. 


Snowden’s voice against the Aadhaar programme has been growing louder ever since he first made a reference to the scheme on Jan. 04 after tech journalist Zack Whittaker tweeted a Buzzfeed News piece on the alleged security breach of the Aadhaar database.


It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse. 
A couple of days later, he spoke up on Twitter against the state-run Unique Identification Authority of India (UIDAI) filing a first information report (FIR) against a journalist with The Tribune newspaper who wrote about security breaches of the Aadhaar database. The journalist, Rachna Khaira, described in an article how she paid just Rs500 ($7.84) to buy Aadhaar data from an anonymous seller over WhatsApp.

Snowden, currently under temporary asylum in Russia, also retweeted a statement posted on Twitter by the editor-in-chief of The Tribune.


The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI. 
In addition to openly pointing out flaws in the Aadhaar system, Snowden has also spent time retweeting multiple complaints from Indians about their experiences with Aadhaar.

For months now, Aadhaar has been under attack due to privacy concerns and criticisms of the flawed implementation of the programme, forcing the UIDAI to step up its security processes by introducing new features such as a Virtual ID to authenticate and verify the Aadhaar numbers. Ever since 2015, there have been a number of purported data breaches, including duplication of cards and fraudulent bank transactions made using leaked biometric data.

Meanwhile, the implementation of the Aadhaar scheme is currently being evaluated by a five-member bench in the supreme court of India, led by chief justice Dipak Misra. The perusal follows multiple petitions filed in the courts over the security and privacy being maintained by the UIDAI. This includes a case filed by a women’s rights activist claiming that linking Aadhaar data to mobile phone numbers violates privacy, and another filed by a group of bank employees stating they don’t have the wherewithal to provide Aadhaar-related services.
The hearing comes four months after the supreme court ruled that privacy is a fundamental right of all Indians, which immediately put a cloud over the aggressive linking of Aadhaar with other schemes and programmes under the Narendra Modi government.

Wednesday, January 10, 2018

12671 - Edward Snowden joins outcry against Aadhaar - Live Mint


Edward Snowden tweeted in support of an Indian journalist who faces police charges after she reported that personal details of over a billion citizens enrolled in Aadhaar could be illegally accessed
Last Published: Tue, Jan 09 2018. 11 14 PM IST



Edward Snowden joined critics of Aadhaar card as the Supreme Court is due to decide on its legality. Photo: HT

New Delhi: Former US intelligence-contractor-turned whistleblower Edward Snowden joined critics of Aadhaar card as the Supreme Court is due to decide on its legality.
Snowden on Tuesday tweeted in support of an Indian journalist who faces police charges after she reported that personal details of over a billion citizens enrolled in the program could be illegally accessed for just $8 paid through a digital wallet. Named Aadhaar, the program is backed by the world’s biggest biometric database, which its operator Unique Identification Authority of India (UIDAI), says wasn’t breached.
Snowden wasn’t the only one outraged. A public outcry against UIDAI’s action forced an intervention by technology minister Ravi Shankar Prasad, and pushed the UIDAI to issue a clarification.
This isn’t the first time Snowden has spoken against the Aadhaar. On 5 January, he tweeted: “It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse.”
Several Indian activists—among them those who beat Facebook Inc. in a hard-fought battle for net neutrality—allege the program provides legal sanction for the creation of a surveillance state.

Meanwhile, the Supreme Court is scheduled to start a final hearing on the legality of Aadhaar on 17 January. Bloomberg

First Published: Tue, Jan 09 2018. 05 18 PM IST

12663 - Arrest UIDAI, Says Edward Snowden After Aadhaar Case Against Journalist - NDTRV


Edward Snowden came out in support of the journalist who reported that she could access personal details of over a billion citizens.
All India | NDTV News Desk | Updated: January 09, 2018 14:05 IST

Edward Snowden criticised the government for "policies that destroyed the privacy of a billion Indians".

NEW DELHI:  American whistleblower Edward Snowden has tweeted his sharp disapproval of a police case against journalist who exposed gaps in the security of biometric details of millions of citizens recorded in the Aadhaar database.

In a post on Tuesday, the former US intelligence contractor came out in support of the journalist who reported that she could access personal details of over a billion citizens for just    Rs.500  paid through a digital wallet. Snowden also criticised the government for "policies that destroyed the privacy of a billion Indians".

He tweeted: "The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI."

Snowden has spoken against the Aadhaar earlier too. "It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse," he had tweeted last week.

UIDAI, which oversees the world's largest biometric identity card scheme, had gone to the police against the journalist from the Tribune newspaper and insisted there was no breach in its system.

Outrage over the case against the journalist forced an intervention by I-T minister Ravi Shankar Prasad and pushed the UIDAI to clarify that the case was not against any specific individual.

In a tweet, Mr Prasad asserted that the government supports freedom of press and that the newspaper and its reporter would be asked by the UIDAI to help investigate the alleged data breach.


"Govt. is fully committed to freedom of Press as well as to maintaining security & sanctity of #Aadhaar for India's development. FIR is against unknown. I've suggested @UIDAI to request Tribune & it's journalist to give all assistance to police in investigating real offenders," the minister posted.

In a separate case yesterday, the Supreme Court, which is hearing a petition challenging the validity of Aadhaar, made it clear that politicians should "allow freedom of expression"

RELATED

12662 - Snowden says programmes like Aadhaar result in abuse - The Hindu


JANUARY 09, 2018 15:10 IST


Former NSA analyst and whistleblower Edward Snowden referred to the Aadhaar programme stating that the natural tendency of any government is to desire perfect records of private lives. “History shows no matter the laws, the result is abuse,” tweeted Mr. Snowden

He said this in response to a tweet from a CBS Editor Zack Whittaker, and followed it up by saying that the journalists exposing the Aadhaar breach deserve an award, not an investigation. “If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI,” he stated.

It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse. 

Mr. Snowden fled the U.S. in 2013 after he exposed a secret government programme to monitor its citizens. He now lives in Russia after they granted him asylum later that year.


The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI. 

The Tribune newspaper had reported that there were intermediaries who could give access to the Aadhaar database for Rs. 500. The UIDAI's response to the report, including a police complaint, had generated criticism from the Editors Guild of India.

Later, Law Minister Ravi Shankar Prasad clarified that the FIR was against “unknown entities” and said the government was committed to the freedom of the press.


12661 - Aadhaar data leak: Edward Snowden backs India reporter over expose - BBC.Com


  • 9 January 2018
US whistleblower Edward Snowden has tweeted in support of an Indian journalist being investigated by police for a report on the controversial Aadhaar biometric identity scheme.

He said that Rachna Khaira, who said she was able to buy citizens' personal details for just 500 rupees ($8; £6), deserved an award.

Identification authorities say she committed a "criminal offence" by accessing the Aadhaar database.

The case has angered many Indians.
The editor of The Tribune newspaper, which employs Ms Khaira, defended the report, saying it had been published "in response to a very genuine concern among the citizens on a matter of great public interest".

The newspaper would explore all legal options in the case, Harish Khare added.


Twitter post by @Snowden: The journalists exposing the #Aadhaar breach deserve an award, not an investigation. If the government were truly concerned for justice, they would be reforming the policies that destroyed the privacy of a billion Indians. Want to arrest those responsible? They are called @UIDAI. Image Copyright @Snowden
The Editor's Guild of India also issued a statement expressing its "deep concern" over what it called an "unfair, unjustified and a direct attack on the freedom of the press".
Other media outlets have also taken up the story.
The Unique Identification Authority of India (UIDAI) police complaint named Ms Khaira, along with "agents" she said had offered her access to the database. It said that all of them had violated India's privacy laws and demanded police action against them.
Mr Snowden said Ms Khaira should be lauded for her reporting instead of being investigated.
His is the latest show of support for the journalist on social media.


Twitter post by @dhume: Dear @UIDAI Reporter who showed that Aadhaar numbers are for sale deserves award, not FIR. Image Copyright @dhume


Twitter post by @SitaramYechury: The BJP govt is filing an FIR against a journalist for bringing out the truth. Aadhaar is a compromised system which has been proven time and again. Is reporting about a serious breach and flaw in the system a crime now? Image Copyright @SitaramYechury
In the Tribune's investigative report, Ms Khaira said that once she paid an "agent", she was given a username and password that allowed her to enter any Aadhaar number into the UIDAI website and get access to user information including names, addresses, photos, phone numbers and email addresses.
Paying a further 300 rupees, she added, yielded "software" that allowed her to print out any Aadhaar card for which she had the number.
The UIDAI said the breach appeared to be exploit a scheme that allowed Aadhaar agents to rectify errors in user information such as outdated addresses or the inaccurate spelling of a person's name.
However, it added that agents could not access people's biometric details and stressed that these remained safe.

Aadhaar started out as a voluntary programme to help tackle benefit fraud, but was made mandatory last year for those accessing welfare schemes.
Critics have repeatedly warned that the system puts personal information at risk.
The government has always insisted that the biometric data is "safe and secure in encrypted form", and anybody found guilty of leaking data can be jailed and fined.

A case challenging the mandatory linking of a person's Aadhaar number to bank accounts and welfare schemes is pending before the Supreme Court.

12659 - Don't arrest journalists, reform Aadhaar if you're concerned: Edward Snowden to Modi govt - Economic Times

ET Online|
Updated: Jan 09, 2018, 05.07 PM IST


Read more at:

Saturday, January 6, 2018

12620 - India's Aadhaar open for abuse: Edward Snowden - Economic Times


By Surabhi Agarwal

It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse., Snowden tweeted. 

NEW DELHI: Whistleblower Edward Snowden has become the latest to raise alarm about the vulnerability of the Aadhaar database, a day after the Tribune newspaper reported that an administrator login ID and password to gain access to the UID portal could be acquired for as little as Rs 500. 

Retweeting CBS journalist Zack Whittaker's response on a BuzzFeed report on the breach of Aadhaar database in India, Snowden said, "It is the natural tendency of government to desire perfect records of private lives. History shows that no matter the laws, the result is abuse." 

Whittaker had earlier said, "ICYMI. India has a national ID database with the private information of nearly 1.2 billion nationals. It has reportedly been breached. Admin accounts can be made and access can be sold to the database, reports BuzzFeed." 

On Thursday, The Unique Identification Authority of India (UIDAI), which administers the Aadhaar project, defended the system's security protocols and rejected a report about the ease with which the system can be infiltrated and demographic data accessed. 

Claims of bypassing or duping the Aadhaar enrolment system are totally unfounded," UIDAI said in a press release. "Aadhaar data is fully safe and secure and has robust uncompromised security. The UIDAI data centres are infrastructure of critical importance and is protected accordingly with high technology conforming to the best standards of security and also by legal provisions." 

Snowden a former CIA contractor leaked classified government documents to expose the US National Security Agency's internet and phone surveillance in 2013. He has been since living in exile. 

According to the Tribune report, whoever had administrator login ID and password would get access to demographic details of Aadhaar holders. The report also alleged there were around 100,000 illegal users and that the racket might have started six months ago. ET has not been able to verify the authenticity of the report. 

The UIDAI said it had provided the search facility for the purpose of grievance redressal to designated personnel and state government officials to help Aadhaar holders by entering the ID or enrollment number, such as updating addresses. 

"UIDAI maintains complete log and traceability of the facility and any misuse can be traced and appropriate action taken," it said. "The reported case appears to be instance of misuse of the grievance redressal search facility. As UIDAI maintains complete log and traceability of the facility, the legal action including lodging of FIR against the persons involved in the instant case is being done." 

It also added that "mere display of demographic information cannot be misused without biometrics." 

Experts said that even though biometric details may not have been accessed, leaking of demographic details was a substantial breach in itself and have called for a review of the security practices of Aadhaar. 

(ANI contributed to this report.) 

Read more at:




Thursday, September 21, 2017

12087 - Can we have security and privacy in an age of mass surveillance?



August 29, 2017   Media contact: Gillian Kiley   401-863-7287

The intelligence community’s first deputy for civil liberties, now a senior fellow at Brown, describes how we can reform mass surveillance to protect privacy and human rights.

PROVIDENCE, R.I. [Brown University] — Before serving as an intelligence official in the Bush and Obama administrations, Timothy H. Edgar — a senior fellow at Brown University’s Watson Institute for International and Public Affairs — defended privacy rights as an American Civil Liberties Union lawyer.

A cybersecurity expert and leader in establishing Brown’s executive master in cybersecurity program, Edgar this week published a new book, “Beyond Snowden: Privacy, Mass Surveillance and the Struggle to Reform the NSA,” in which he describes his efforts to implement reforms from within America’s growing surveillance state.

The title refers to Edward Snowden, the former Central Intelligence Agency employee and National Security Agency (NSA) contractor who in 2013 leaked the existence of several mass surveillance programs, including the bulk collection of American telephone records, and revealed details of web surveillance programs. Congress is debating this year whether to renew the legal authority for these programs.

Here, Edgar shares specific recommendations for reforms and his thoughts on why America should become a leader in surveillance reform.

Q: Do you think most Americans understand what Snowden brought to light and what is at stake with the NSA’s mass surveillance programs?
I think on a broad level that people do, because they understand that their privacy is at risk in the digital age, but they are perplexed about how mass surveillance works. The U.S. has built a mass surveillance state that threatens the privacy of everyone in the world, but our surveillance laws are out of date. Long before Snowden came along, we were debating these issues inside the government. A major reason I wrote this book was to make that debate more accessible to the general public.

Q: What rules and laws guide intelligence agencies on communications and privacy? What makes them out of date?
Edgar said he wrote the book to make issues like transnational surveillance and metadata vs. content understandable to a non-expert audience.
The first and most important rule is the Constitution — mainly the Fourth Amendment, which protects us against unreasonable searches and seizures. Second are federal laws, like the Foreign Intelligence Surveillance Act, which are designed to implement those rights. And third are executive branch oversight rules that apply to NSA personnel.

The problem is that all these laws were originally based on analog technology and on a world before globalization. They provide little protection for metadata — when a call was made, to whom and how long it was, or the routing information that applies to digital communications like e-mail — as opposed to the content of calls or messages — what was said. They make it easy to scoop up the communications of foreigners outside the U.S. because the law is based on a faulty and outdated assumption that Americans’ privacy isn’t affected very much by “foreign” surveillance.

These kinds of distinctions really are relics from the 1970s. Today the world is both digital and transnational.  Drawing lines between different kinds of personal data and between Americans and foreigners is both more difficult and more arbitrary than it was 40 years ago.

Q: How does digital technology complicate distinguishing between domestic and foreign surveillance?
To talk about spying on foreigners or spying on Americans is too simplistic in the 21st century, when data may be in one country while the target of surveillance is in another. In the book, I describe this phenomenon as transnational surveillance. In these programs, the NSA uses a secret court order to compel communications providers inside the U.S. to get communications that it believes belong to foreigners outside the U.S.
I argue that those are not really foreign surveillance programs because the NSA is collecting data within the U.S., many communications of Americans are being swept in, and other agencies can query that database to find out about Americans. But these programs are not quite domestic surveillance either, because they are nothing like an FBI wiretap of somebody inside the country. Transnational surveillance looks at targets outside the country, but whose communications are flowing over the internet inside the U.S., or are being stored by American technology companies.

What I did in the government was to help design a new system of oversight for transnational surveillance. A big part of what I’m trying to figure out in the book is: How did we do? And the answer is very much still being debated. This year, Congress will consider renewing the legal authority for transnational surveillance of the content of communications.

Q: Do you think the objectives of civil liberties advocates and the national security establishment can be reconciled? 
As a civil liberties activist who went into the intelligence community and tried to reform the NSA’s mass surveillance programs and came out again, I would say the two groups have more in common than they sometimes realize. Civil liberties advocates and the intelligence community want to achieve the same broad goal: gather intelligence with safeguards and protections for privacy and civil liberties. But it’s difficult to have a real conversation about mass surveillance without the transparency we’ve had in the last few years.

Q: In the book, you credit President Barack Obama’s administration for launching a transparency drive. What did the administration do?
A lot of people don’t realize that the public learned as much if not more about NSA surveillance from the government’s own efforts than it did from Snowden. Under Obama, the intelligence community put a huge number of declassified documents on the public record, including thousands of pages of Foreign Intelligence Surveillance Court opinions, plus new details about surveillance in an annual transparency report and through its website, IC on the Record.

The transparency drive the Obama administration launched to defend itself is in many ways more important than the unauthorized transparency of the original Snowden leaks.

Q: In the book, you describe reforms to mass surveillance made by Obama and President George W. Bush. Are there specific reforms you’d like to see enacted?
I’d like to strengthen the Foreign Intelligence Surveillance Court. This secret court has done a pretty good job at what it was set up to do in 1978 — review wiretaps — but it isn’t well-equipped to review transnational surveillance and big programs of metadata collection. We should give individual federal judges technologists, magistrates and personnel with technological expertise that can help them oversee the complicated programs that they’re being asked to approve.
Also, technology can be used in partnership with the law to protect our privacy. The law punishes misuse of data, but cryptography can offer guarantees against misuse in the first place. We can require the NSA to use available, scalable encrypted search methods so it can extract from bulk databases just the particular pieces of information it can lawfully obtain, leaving everything else protected. Major advances in just the last few years makes this possible, but the public must demand that the NSA use them to achieve our broader goal.

Q: What is that broader goal?
The U.S. needs to go from being a leader in surveillance to a leader in surveillance reform. We have a strong tradition of protecting privacy through our institutions and founding documents, though right now our laws are too weak to protect our privacy in a digital, transnational age. A leadership role would help ensure a stronger and more robust intelligence capability across the democratic allies that the U.S. depends on. Because of Snowden, we now know about mass surveillance. The question is: What we going to do about it?  

“Beyond Snowden” is one attempt to answer that question.

Click here to hear Tim Edgar discuss these issues further with the Watson Institute's Sarah Baldwin for the"Trending Globally" series.