13890 - Fingerprints, Aadhaar and Law Enforcement – A Deadly Cocktail Is in the Making - The Wire

TECH

Fingerprints, Aadhaar and Law Enforcement – A Deadly Cocktail Is in the Making

Why does the National Crime Records Bureau want to amend the Aadhaar Act?

UIDAI CEO has asked schools not to deny admission to students who do not have Aadhaar cards. Illustration by The Wire

Anand Venkatanarayanan

GOVERNMENTTECH

16/AUG/2018

In June 2018, the National Crime Records Bureau (NCRB) sparked public outrage when its director Ish Kumar made a strong pitch for giving India’s police “limited access” to Aadhaar data for the purposes of investigating crime and tracing unidentified bodies.

This request, reportedly widely, was predictably met with a swift public denial by the Aadhaar authority, with the Unique Identification Authority of India (UIDAI) stating that Aadhaar data had never been shared with any crime investigating agency.

How credible is this denial, though? After all, there is evidence from as far back as 2013, before the enactment of the Aadhaar Act, to show that the police already had limited access to the Aadhaar database (often through court orders) and that the UIDAI had helped state police on a number of occasions.

In the last two years, there is more recent evidence to show how police departments across the country want to use Aadhaar. But before we get to that, it is important to understand why NCRB wants to access the Aadhaar database and how it would be able to do so.

Why does the NCRB need the UIDAI’s fingerprints?

India’s central fingerprint bureau is the nodal agency for setting standards, tools and processes for the collection, storage and analysis for fingerprints.

As fingerprint matching is considered crucial for nabbing repeat-offenders, standardisation of fingerprint images and allowing officials to search through them using an automated fingerprint identity system (AFIS) is important. The bureau’s 2015 report traces the trend towards automated searches and less reliance on manual processes. As of 2015, it holds 28 lakh fingerprints of arrested and convicted persons. 

What bothers the NCRB the most, however, are first-time offenders because their fingerprints are not available in the AFIS. This is where the UIDAI comes in, because these fingerprints are very likely to be available in the Aadhaar database, considering how big it is.

NCRB’s Ish Kumar explains it the best:

“There is need for access to Aadhaar data to police for the purpose of investigation. This is essential because 80% to 85% of the criminals every year are first-time offenders with no records [of them available] with the police. But they also leave their fingerprints while committing crime. There is need for limited access to Aadhaar, so that we can catch them.”

How would this work though? From the NCRB’s point of view, access to biometric data available in the Aadhaar database through a simultaneous search will likely work as shown in the diagram below.

For this type of simultaneous search to work seamlessly, the fingerprint capture image formats must match with the stored image formats and must be standardised across both organisations.

This was done by NCRB in 2013 and were published as shown below:

Biometric captured	Explanation	Standard used
Finger image	The raw image of the fingerprints	ISO/IEC 19794-4
Minutiae images	The patterns in every fingerprint that is used for comparison	ISO/IEC 19794-2
Mug shots	Facial photographs used	ITL – 1- 2011 (JPEG)

Crucially, the UIDAI has also used these same standards from its inception (Page 15, Section 9) for finger and minutiae images. The standardisation thus allows fingerprint capture by all existing devices used in Aadhaar authentication and enrollment.

Two types of search

The NCRB’s fingerprint bureau holds annual conferences, which almost always have discussions on Aadhaar because of the sheer possibilities that a potential integration would offer. 

With the imminent roll out of facial authentication by UIDAI, and the presence of a large fingerprint database, NCRB believes, in theory at least, that it can tap into the Aadhaar database in order to identify potential suspects (their demographic details and Aadhaar number) if they have latent fingerprints and CCTV mugshots of the perpetrators.

The process by which law enforcement searches for a list of potential suspects is usually referred to as a ‘1:N search’, meaning given a mugshot and fingerprint, the system could provide many potential suspects and their Aadhaar numbers.

These Aadhaar numbers can then be used to query various databases to obtain a detailed profile of the potential suspects, which can then be used to further narrow down potential suspects (often referred to as ‘1:1 search’).

The NCRB’s interest to “limited access” to the Aadhaar database can be understood from the minutes of meeting available from each of its annual conferences.

• The 15th conference on 2013, was attended by the UIDAI deputy director general Ashok Dalwai, in which it was told that “UIDAI would eventually converge with the police department over time”.
• The 16th conference on 2014 requested access to UIDAI database for identification of dead bodies.
• The 17th conference (2015) requested amendments to the Identification of Prisoner Act, 1920 to add other biometrics. It reiterated the request to access UIDAI database for identification of dead bodies and also made the crucial observation that the removal of non-convicts post their acquittal from the fingerprint database must be prioritised.
• The 18th conference (2017) reiterated the amendment to the Identification of Prisoner Act and said, “Aadhaar may be linked to identify dead bodies”.
• The 19th conference, (2018) discussed the need to amend the Aadhaar Act and the Prisoner Act for “identifying first time offenders and also for identifying dead bodies”.

The 1:1 search

India’s state police departments do not have to depend upon the UIDAI at all when it comes 1:1 search. There are already various state and central databases which are seeded with Aadhaar numbers. Hence once the suspect’s Aadhaar number is known, the local enforcement agencies can simply ask the various public entities that own or operate these numerous databases to provide them with the required information.

For instance, India’s state police can merely ask local banks to provide all information associated with a particular Aadhaar number, including linked phone numbers. 

This is how seeding Aadhaar numbers into various databases, referred to as “cross-seeding”, makes it easier to create 360-degree profiles, that are available on request for the law enforcement agencies without even needing a warrant.

Hidden backdoors for 1:1 search already exist

In October 30, 2017, the Times of India reported that a missing woman was identified from her half charred body using Aadhaar.

How could the police identify the woman from just a fingerprint? The back-door that allows this functionality is the “name/UID search” feature, which allows printing of an Aadhaar card, for those who have misplaced their Aadhaar number, using their fingerprints.

It is also obvious that a “fingerprint mould” was used by the police, since the woman was already dead. To know the identity of the missing woman, the police department obtained the names of all missing persons as reported in the district, during a specific time. It then used the “name search” feature along with their fingerprint mould to print their e-Aadhaar.

Screenshot of name/UIDAI feature. Credit: The Wire

Automating the 1:1 search

The southern state of Andhra Pradesh, has already created a vast fully interlinked resident database that has merged the crime and civilian aspects.

For instance the local state hub, has information about all its residents, the GPS coordinates of their homes, medicines they use, food rations they eat, what they say about their chief minister on their social media accounts, their caste, bank accounts on which they receive scholarships, pensions and their Aadhaar numbers.

This design allows the state police or any state official to know everything about an Aadhaar number holder by just typing their Aadhaar numbers.

A very similar exercise is under progress in the state of Telangana. The state hub hosts both the crime data and the Aadhaar data of the residents in one single entity called “Integrated Information Hub” and is also managed by the Hyderabad police.

Since the state police runs the state data hub, it also allows them full unlimited access to all the schemes that every family is enrolled into, along with access to authentication logs, thereby allowing real time tracking of the population, if need arises.

Telangana also offers an ongoing lesson on how a civil database (Aadhaar) and a crime database (used by NCRB and the various states) can converge. For instance, not only are the Aadhaar numbers of drunken drivers were seeded into the crime database, their family members’ Aadhaar numbers were also seeded.

Even those who are acquitted would continue to reside in the crime databases, and would be forced to share their Aadhaar numbers and their biometrics and also their family members’ details, until the courts directs them to stop doing so.

Purpose limitation is futile after a certain scale

Media reports over the last two years also indicate that the various crime databases maintained by the state and central bureaus are being cross-seeded with Aadhaar numbers and demographics, thereby converging the civilian and the crime database via a staged approach as described below:

• Madhya Pradesh police mull Aadhaar linking with the crime database.
• Home ministry directs prison authorities to link Aadhaar for tracking inmates and their visitors.
• Hyderabad police seek Aadhaar of those who are arrested, even before their conviction.
• Gwalior police seek Aadhaar of listed criminals in Madhya Pradesh.
• Tamil Nadu police demand Aadhaar from those who protest against bus fare hike.
• Rajasthan police plans to use Aadhaar for fetching data about suspects, victims and also complainants.

The cross-seeding of Aadhaar numbers with digital police systems such as the CCTNS (crime and criminal tracking network system) was something shunned by the initial team behind the biometric authentication programme.

“Nandan [Nilekani] told us that if they allowed us to do it, the people would never trust Aadhaar,” a former director-general of prisons of a large north Indian state told The Wire.

And yet, an early version of the software behind the Integrated Criminal Justice System (ICJS) – a programme that seeks to link the police’s criminal tracking system (CCTNS) with the digital information-technology systems for India’s courts and prisons – shows that Aadhaar was meant to serve as a crucial component of the overall ecosystem.

A screenshot of an initial version of how ICJS would look. Credit: The Wire

The image above is from 2016, showing that the NCRB, which implements the CCTNS and ICJS projects, had hoped to have the Aadhaar Act amended by now.

Parsing the UIDAI’s denial

The UIDAI in its denial asserted that “use of Aadhaar biometric data for criminal investigation is not allowed under the Aadhaar Act” and quoted Section 29 of the Aadhaar Act as corroboration.

The denial thus is limited to access to the biometric data (1:N search) and does not cover other cases like automated 1:1 access or request-based access to other entities. Furthermore, it also does not explicitly deny the creation of parallel biometric databases.

For instance, both the Hyderabad police (Entry 105) and the Chandigarh police (Entry 125) are on the list of Authentication User Agencies (AUA) and KYC User agencies (KUA) AUAs and KUAs are entities that are given access to the central Aadhaar database (CIDR) for authenticating Aadhaar holders.

This KUA access is sufficient for the police of both states to forcefully authenticate any arrestees to obtain their demographic information from the Aadhaar database.

Once KYC authentication fetches the demographic information, the police can use the Identification of Prisoners act, 1920 to obtain their fingerprints in the same standardised form used by the UIDAI to create a parallel database which mirrors the CIDR. The only catch is that unless the Aadhar Act is amended, the police cannot legally store other biometric parameters such as IRIS scans and vein prints. This is why successive NCRB conferences have recommended amending the Aadhaar Act.

UIDAI’s denial might look like a principled opposition, but it is also a reflexive mechanism to ensure that NCRB or other agencies don’t catch onto the fact that there are serious quality issues that plague the Aadhaar biometric database. For instance, biometric mixups affect (officially) nearly 2 crore Aadhaar holders and while the image formats are compatible, the minimum quality of capture for Aadhaar is a mere 52%.

Parallel biometric datbases

While Section 29 of the Aadhaar Act only deals with sharing of biometrics, it does allow limited access to the demographic data by allowing police to become KUA/AUAs and through other means.

The limited access to demographic data also allows the state police to build their own parallel fingerprint databases – something that is currently happening in at least three states. What’s worse is that entries are typically not deleted, as mandated by the Identification of Prisoner act, if an arrestee is acquitted later.

This allows convergence of the crime and civilian databases, as indicated by the-then deputy director general of the UIDAI, Ashok Dalwai, way back in 2013, leading to the implication that this had always been the original design.

A vast database that allows other entities (including states) to build their own parallel (and bigger) databases with parallel biometrics, by design, is exactly the architecture that an all encompassing surveillance state would need. Such an architecture makes the legal construct of “consent and purpose limitation”, as enunciated by the nine-judge privacy bench, impractical and unimplementable by design.

This is why the Srikrishna committee, while recommending amendments to the Act, has kept Aadhaar out of the purview of the proposed data protection bill. 

The typical response of the Supreme Court is to issue guidelines that needs to be followed by the state (PUCL vs Union of India, 1996), when it encounters complex questions, such as balancing the right to privacy and the requirements of law enforcement agencies.

But what if such an approach would meet nothing but failure, because the architecture of the project is designed to make guidelines based on “consent and purpose limitation” irrelevant?

While the software revolution sweeps by and eats the world, will it also end up eating the law and weaken constitutional rights? With the Supreme Court set to rule on the Aadhaar case, we will know soon enough.

(With inputs from Anuj Srivas)

13604 - At the mercy of ‘fingerprint gods’: How rural Karnataka struggles for food due to Aadhaar - News Minute

Aadhaar

At the mercy of ‘fingerprint gods’: How rural Karnataka struggles for food due to Aadhaar

With their ration linked to Aadhaar, residents say they’ve had to forego their monthly staples – the fingerprints don’t match or there isn’t enough connectivity to process their biometrics.

• Prajwal Bhat
  Follow @prajwalmanipal
  
  Saturday, May 26, 2018 - 18:10

Doddamma at her residence in Arabala in Chikkamagaluru district

The road through Chikkamagaluru district, located in the foothills of the Western Ghats in the Malenadu region of Karnataka, is unrecognisable but for the sight of mountains of varying sizes around you. Parched fields and dried up streams paint an ominous picture of a region reeling under severe water shortage. “It has been like this for the last two years. Usually, there would be onion cultivation around March but farmers have given up on cultivating until the rains come again in June,” says Rajappa (45), a resident of Arabala, a tiny village in Tarikere taluk of the district.

Inside their cramped house, Rajappa sits across from Doddamma who simply smiles when she is asked how old she is. “Some say I am over 90 but the truth is we never kept track of birthdays in my time,” she says. Doddamma is entitled to seven kilograms of rice as per the government’s Public Distribution System (PDS) scheme, but ever since the scheme was linked to Aadhaar, the biometrics-based database that assigns a unique 12-digit number to every resident of India, Doddamma says that she leaves the fate of her monthly ration up to the ‘fingerprint gods’. 

For almost a year now, Doddammaa has had to go to the PDS shop in Bhoothanahalli, around 4 kms away, to match her fingerprint against the biometric data stored in the Aadhaar database before she is given subsidised food grains. “It does not match sometimes and there have been months when I have not received ration because of it,” she says with exasperation. 

In search of stable internet

Jagadisha Shenoy, who manages the PDS shop in Bhoothanahalli, echoes Doddamma’s words and lays the blame on the biometric-based authentication system for denying ration to several people who are entitled to it. “The internet never connects here and we have tried several ways to solve this issue. Last year, we did the biometric authentication on our roof where we got connectivity through mobile hotspot on Reliance Jio. But when it stopped working abruptly, we had to go all the way up the hill and do the authentication near the Garagadahalli temple,” laments Jagadisha.

PDS Shop at Bhoothanahalli in Chikkamagaluru district.

In their attempts to find a stable and secure internet connection, Jagadisha and his aides have toured several places in and around Bhoothanahalli, setting up shop at odd spots on the side of the road or on top of a hill, to do the biometric authentication process. “We have toured all the places around our village – Arsinaghatta, Garagadahalli and even Antargatte which is 7 kms away - with the laptop and biometric authentication device in-hand in search of stable internet. It is not just the people receiving ration who are troubled but even I am facing difficulties,” adds Jagadisha

Residents in Arabala remember the days when they had to trek for a few kilometres up the Arsinaghatta hill at the end of their day’s work to complete their biometric authentication and avail subsidized food grains. “PDS shops usually start fingerprint authentication in the evening around 6 pm, but due to the lack of internet connectivity, we sometimes had to wait till midnight or 1 am to give our fingerprint. We would climb the hill after work and it would be a problem for women to venture out late,” says Shivamurthy, a coolie and resident of Arabala.

Arshinaghatta hill in Chikkamagaluru district. PDS Sellers climbed the hill in search of stable internet.

Shivamurthy, and many others like him in Arabala and its neighbouring villages, have sometimes had to set aside 3-4 days of the month for a process that took “a few hours at most” in the past. It also meant a loss of Rs 700 to 800 every month while they stood in line to avail their ration. "Often, the internet never works or there is a power cut and we have to come again the next day. There are times I have gone 3-4 days and waited to give my fingerprint," Shivamurthy adds.  

The race to get ration

Around 40 kilometres away in Neeladanahalli, Parvathi had not received ration in the last few months. She stopped receiving ration as she had not linked her Aadhaar card to her ration card and in spite of repeated attempts to make an Aadhaar card, she was unsuccessful as officials could not record her biometric data.

While two other members of her family receive ration, Parvathi and Chandana, her 7-year-old niece, have to make do with the money they make from coolie work during the month. “All the money I earn is spent on food. I cannot buy anything else,” she says with a tone of resignation.

Parvathi, a resident of Neeladanahalli, has not received her monthly ration due to a lack of an Aadhaar link.

While Aadhaar linkage is the stumbling block for Parvathi, other residents of the village also complain that the nearest ration shop in Jodi Lingadanahalli was open on only 3 or 4 days of the month, leading to a ‘race’ between residents to take their cut of the ration every month. 

“Ration used to be distributed by Ramdas Anna before but since the biometric system started, new people have started distributing the ration. They come only on select days in a month without informing in advance and people from six villages have to rely on word-of-mouth to know that ration is being distributed,” says Hegappa (62), a resident of Neeladanahalli

Heggappa’s claims are supported by data from the state’s Food and Civil Supplies Department’s comprehensive state-wide data on ration distribution which shows that ration was distributed in Jodi Lingadanahalli on only four days in March and April 2018. When TNM visited the shop in March, it was closed.

PDS Shop at Jodi Lingadanahalli. It was closed when TNM visited it in March

Led by Heggappa, residents of Neeladanahalli are currently fighting a case in the Chikkamagaluru district court against the PDS sellers in Jodi Lingadanahalli accusing them of illegally denying ration.

'No Aadhaar, no ration'

Ration is often denied for three predominant reasons – beneficiaries don’t have Aadhaar cards, they have not linked their Aadhaar cards to ration cards, or their biometric verification fails. “For some, it is the lack of an Aadhaar card link, for some others the biometric fails but ultimately, it is the elderly and the poorest that are facing exclusion. Many of those affected need the subsidised ration to simply put food on their table,” says Umesh, an activist who has led several struggles against denial of essential services due to lack of an Aadhaar link.

“You have to identify yourself by fingerprint recognition or you don’t get ration. PDS sellers are bound to maintain exemption lists for the elderly and for those who have not linked their Aadhaar cards to ration cards but on the ground, it has always been ‘No Aadhaar, no ration’,” he adds.

Data released by the Food and Civil Services Department of the Karnataka government too revealed that the system is not functioning smoothly. Of the 1.2 crore ration cards linked with the biometrics database in Karnataka, nearly 99 lakh cards recorded transactions in February 2018. Of these, fingerprint authentication did not work for over 18.6 lakh cards, almost one in five families in the state. 

The weighing machine at the PDS Shop in Bhoothanahalli has been left unused for weeks.

'Solving internet connectivity is the way to go'

Despite its problems, the Food Department is adamant about continuing the use of fingerprint authentication at all ration shops, except those in areas without any connectivity, as authorities believe that it has reduced pilferage of food grains and ‘saved costs’ for the state.

"It has encouraged transparency because now we can keep track of every PDS seller in the state. Before this, there were no state-wide records available," says says MC Gangadhar, Deputy Director of the Public Distribution System in Karnataka.

However, officials confirmed that Aadhaar is not mandatory for availing ration. “Aadhaar has not been made mandatory for availing ration. People can link it to their ration cards and then avail ration by identifying themselves through their fingerprint, but there is also an exemption category for those who have not linked their Aadhaar cards,” he added.

Even though the government mandates an ‘exemption’ list for people like Parvathi to avail ration without an Aadhaar card, activists in many parts of the state allege that PDS sellers in rural areas do not maintain exemption lists at all. Conversations with several PDS sellers across the state reaffirmed that the working principle remained ‘No Aadhaar, no ration’ on the ground.

The issue gained some attention when forty Dalit families in Chowdadenahalli in Chikballapur took the extreme step of spreading out mats and eating raw vegetables, protesting denial of ration for one-and-a-half years, for not linking their Aadhaar cards. They were compensated with all one-and-a-half years’ worth of ration when the issue came to the notice of officials at the Food and Civil Supplies Department in Bengaluru.

Residents of Chowdadenahalli in Chikballapur district protest against denial of ration due to lack of an Aadhaar link in January 2018.

Gangadhar however defended the system and said that incidents like the one in Chowdadenhahalli were a ‘one-off’. "What we should be doing is solving the internet connectivity issues in rural areas," he said.

The Karnataka government appears to be in favour of continuing its drive to administer ration via Aadhaar based biometric authentication. In February 2017, it passed a bill titled ‘The Karnataka Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Bill 2018’ making “proof of Aadhaar number necessary for receipt of certain subsidies, benefits and services”. The bill was passed by voice vote and gained support from both Congress and BJP in the state, even though the Centre had retracted its earlier order and instructed state governments in October 2017 to not deny ration to those who do not have an Aadhaar card or have not linked their ration cards to Aadhaar.

In repeated orders since 2013, the Supreme Court too has stressed that an Aadhaar card link cannot be made compulsory to avail government welfare benefits. The Aadhaar Act, specifically section 7, which allows the use of Aadhaar to deliver government services does not specify that it is a mandatory requirement.

The Right to Food campaign, a network of individuals and organisations working to implement the right to food in the country, has filed 300 affidavits and over 1000 petitions from Karnataka in the Supreme Court, highlighting the struggles of residents in availing essential services. The Supreme Court is currently hearing a case that challenges the constitutional validity of Aadhaar. The verdict in the case will affect all other Aadhaar related cases in courts across the country including the one being fought by Heggappa.  

Residents of Neeladanahalli huddled in a discussion. Hegappa (seated centre) is leading the villagers' struggle for ration in the Chikkamagaluru district court

'Only widespread protests will help bring change'

The fine-print of the rules however has never affected the situation on the ground in Bhoothanahalli and several other villages in the state, as residents have had to toil for their monthly ration ever since the biometric based authentication system was put in place in early 2017. 

Activists say that a lack of awareness among residents in rural areas about their individual rights, and apathy of civic officials and PDS sellers, has contributed to the systemic problem denying ration to citizens. "Only widespread protests in rural areas like the one in Chowdadenahalli can help bring about change, " says Umesh.  

Residents of Begur Gram panchayat to which Bhoothanahalli and Arabala belong, held a protest on January 12, 2018, over the issue of denial of ration and also sent a letter to the then Karnataka Food and Civil Supplies Minister UT Khader. Their pleas however fell on deaf ears and are now banking on the new government to change their stance on the issue and ensure that ration is given to every resident in the state as promised. 

10745 - Gujarat matches the fingerprints of the poor before giving them food. Does the system work? - Scroll.In

Gujarat matches the fingerprints of the poor before giving them food. Does the system work?

Nearly one in three transactions fail.

Image credit:  Anumeha Yadav

Dec 16, 2016 · 09:00 am  

Updated Jan 03, 2017 · 02:59 pm

Anumeha Yadav

Sixty kilometres from Ahmedabad in Gujarat, in a village called Hebatpur in Dholera, 78-year-old Gaguben Zala made five unsuccessful attempts to enrol in Aadhaar, the biometrics-based database that assigns a unique 12-digit number to every resident of India.

“Each time I tried, the machine would fail to capture my fingerprints and the staff sent me back home,” recalled the gaunt and feisty Dalit woman, with deep wrinkles running through the dry skin of her hands that had hardened from years of farm work.

The sixth time, one of the boys working at the enrolment camp came to her help.

“He rubbed my dry fingertips against the hair-oil on his scalp for a few minutes,” she said. “After this, the scanner captured my fingerprints.”

India is introducing Aadhaar in ration shops. The fingerprints of people like Zala will be matched against their biometric data stored in the Aadhaar database before they are given subsidised foodgrains. This process is called ‘authentication’.

The public distribution system, which provides subsidised wheat and rice to 67% of India’s population, is one of the first social welfare delivery systems to use Aadhaar-based authentication. The Centre has asked states to move to the new system by March 2017.

In the government’s view, this will ensure only real beneficiaries are able to access the foodgrains, bringing an end to theft and pilferage in the system.

But evidence from an earlier experiment in Gujarat shows fingerprint authentication does not work for lakhs of people, particularly manual workers and the elderly like Zala.

Gaguben Zala enrolled in Aadhaar with difficulty because of fingerprint problems. Image credit: Anumeha Yadav

One in three transactions fails

Well before the Aadhaar database was created, in 2010, Gujarat introduced fingerprint authentication in the public distribution system. For this, the demographic details and biometrics of existing ration card-holders were collected and each was allotted a unique number.

Since then, anyone wanting to pick up monthly food rations must submit this unique number and provide her fingerprints at the village computer services centre called ‘e-gram’, which is connected through a statewide area network.

Once the fingerprints match, an “e-coupon” or a slip of paper bearing the person’s name and quantity of ration is issued. Beneficiaries can use the coupon to get their quota of foodgrains at the fair price shop.

In places with sufficient network connectivity, the beneficiary can provide their fingerprints directly at the ration shop, receive a coupon with details of their entitlements, and collect the foodgrains.

But Gujarat government data shows the system is not functioning smoothly.

Of the 1.2 crore ration cards linked with the state biometrics database, only 83.7 lakh cards recorded transactions in October 2016. Of these 83.7 lakh cards, fingerprint authentication failed for 24.6 lakh cards – nearly one in three families.

In the villages of Koli Adivasis in Panchmahal district, 125 kms east from Ahmedabad, such failures are common. Nearly 85% of the district’s population is rural. Infrastructure is weak in the area.

“On Tuesdays, there is a full-day power cut, and electricity is irregular on other days as well,” said Gangaben Fatesi, a Koli Adivasi. “When the power goes, the computer too stops working.” The residents had to make repeated trips to get their rations, she said.

Data shows that fingerprint authentication in Panchmahal did not work for 74,131 of the 234,702 ration beneficiaries who attempted it – a failure rate of nearly 32%.

In the state capital of Gandhinagar, officials gave two reasons for the failures. “One, there are network connectivity issues,” said Ronak Mehta, deputy secretary in the state department of food, civil supplies and consumer affairs. “Two, fingerprint authentication often does not work for those who do hard work with their hands, like farm workers, construction workers.”

Sumi Kapadia, an official in the project management unit of the department, said nearly 15%- 20% of all transactions failed solely because fingerprints did not match on account of skin abrasions, and in the case of the elderly, because of unclear fingerprints.

“The fingerprint problems magnify in winter months as the skin becomes rough and dry,” she said. “But the villagers are impatient. They are not willing to wait even an hour to get their fingerprints authenticated.”

For those whose fingerprints do not match, the state has asked ration shop owners to dispense foodgrains by noting down their details in a register. Called “open” transactions, such cases amount to more than 40% in some districts, showing the new biometrics-based system is not working.

District-wise data for October 2016.

Mehta, deputy secretary in the food and civil supplies department said they provide an additional check through a one-time password sent on mobile phones of beneficiaries, so that they know if their transaction went through or not, and do not depend on this for the ration dealer’s whims. He said the department has tried to reduce the fingerprint failures to “5 to 10%.” But as shown above, government data show in October, more than 29% of the fingerprint transactions failed. No transactions were recorded under the “with mobile” category in October.

An old experiment

Despite its problems with the use of fingerprints, Gujarat’s food department is introducing Aadhaar-based authentication in all ration shops, with just a few exceptions. “At 200 spots in Dangs, Panchmahal and forest villages where there is no connectivity at all at the ration shops, we will use an alternative method of authenticating,” said Kapadia.

Reetika Khera, a professor of economics at IIT-Delhi who has researched social schemes such as the public distribution system, questioned the use of fingerprint authentication despite such high rates of failure.

“There has been no rigorous study of Aadhaar’s feasibility and suitability before its use in welfare systems,” she said. “The Gujarat biometrics schemes in food rations could have shown crucial evidence on the use of biometrics authentication in welfare schemes. Then why did the government not study this or take it into account?”

After the introduction of Aadhaar in the public distribution system, similar figures of failure in fingerprint authentication have been recorded in states such as Rajasthan and Jharkhand, she pointed out.

In Rajasthan, which is the second state to adopt Aadhaar in ration shops, only about 63.5 lakh of 99.7 lakh people were able to get their foodgrains in August through the use of biometrics.

The state food department records show Aadhaar authentication does not work for 20%-30% beneficiaries in most districts, even 11 months after Rajasthan government introduced the new system.

Said Nikhil Dey of Mazdoor Kisan Shakti Sangathan, a grassroots campaign in Rajasthan, “Despite such a high failure rate, the Government of Rajasthan continues to deny the extraordinary rates of exclusion by stating that this was “weeding out” of bogus beneficiaries from the system.”

Frequent data entry errors

In Dholera’s Hebatpura, for Gaguben Zala, the prospect of using her fingerprints to collect food rations remains a distant one. “The dealer said I do not have clear fingerprints, so my name cannot be linked for grains,” she said, as she sat in the courtyard examining her chapped thumbs.

The state food department needs to link people’s Aadhaar data to the ration database – a process called “seeding” – before fingerprint authentication can take place.

In Zala’s family of seven, only the Aadhaar data of her son, Gobarbhai Zala, has been linked or “seeded” to the ration database. The family gets 25 kg of wheat and 10 kg of rice every month under the Antodyaya category for the poorest of poor families. Earlier, anyone from the family could pick up the monthly rations. Now, only Gobarbhai can.

In Panchmahal, several families are worse off – their details were incorrectly entered in the ration database which has now been linked to the Aadhaar database.

Jayniben who lives in Sanyal village, Ghoghamba block, is wrongly recorded as a resident of “Ranipada, Ghoghamba village”. Madhu Bhopat, another resident, is wrongly recorded as Madhu “Dalphat.” Balliben, a local worker complained that her daughter in law’s name is recorded as “Labita”, when actually it is Lalita.

Fair price shop owner Ashwinbhai Patel said though he appreciated the computerisation of records, but in the biometrics-based ration system, there were frequent data errors. “Of over 800 ration cards, there is hardly one card which does not contain errors,” he said for the neighbouring villages of Shaniada and Vangarva, that are registered at his ration shop.

Ganpatbhai Narsi, whose wife Madhu Bhopat’s name had been entered incorrectly as Madhu “Dalphat”, travelled four times to the block office in Ghoghamba, 40 km away. Each trip costs Rs 100 and led to the loss of a day’s wages.

Officials in Ghoghamba said the block had just two data-entry operators and nearly 100 to 150 people came to the office for data entry corrections every day. “At first, we had designated Wednesday as the day for corrections,” said KP Parmar, a block official. “But the numbers were so high, we had to open it on all days of the week.”

A similar rush prevailed in Godhra district. At the office of the mamltadar, Navinbhai Marwari stood waiting to get the names of four of his family members corrected in the records. He was weighed down with anxiety and a thick application containing the photocopies of each family member’s Aadhaar card, the family’s new ration card, a copy of the bank account passbook of the head of the household, and an attested proof of their address from the patwari, a local revenue official.

After putting in all the effort – first to get an Aadhaar card made, then to link it with the ration card, and finally, to get the database errors corrected – a villager still had no guarantee of fingerprints matching at the ration shop.

But Gujarat officials emphasised that the system had benefits.

“Most people are able to get corrections done in two visits,” said a block official in Godhra. “But the main thing is that we are very strict on corruption in the ration system.”

Has fingerprint authentication in Gujarat reduced leakages in the public distribution system, as officials claim?

The next story in this series finds out.

We welcome your comments at letters@scroll.in.

10628 - In Ambala, Aadhaar 'disconnects' 1.16L families from ration = TNN

In Ambala, Aadhaar 'disconnects' 1.16L families from ration

TNN | Updated: Nov 21, 2016, 06.04 AM IST

AMBALA: Failure of biometric system for ration disbursement at government fair price shops in Ambala has led to resentment among people and they protested in various colonies of the city on Sunday. 

The ambitious scheme to sell ration at fair price shops through Aadhaar linked internet access system was launched in Haryana from November 1 under which the beneficiary can avail ration at government fair price shops after authentication of their thumb impression. This was done to stop misuse of ration.

In Ambala, 1.16 lakh households are without ration due to technical failure as hardly any beneficiary's thumb impression matched with the biometric data in various fair price shops. The harassed people protested at ward number 5, Babyal, Mahesh Nagar, Vashisht Nagar and Dayal Bagh of cantonment.

"We are failing to understand why the system did not work properly. We have intimated the higher authorities strongly recommending to streamline things," said district food supply officer of Ambala. 

According to the departmental sources, fingerprint of not even a single family member matched at ward number 5, Babyal and Dayal Bagh. Notably, fingerprint was taken from five members of each family.

"We got nothing except harassment. The system proved 100% flop," said Saroj from Babyal. "People are really facing hardships. This is worrisome that in most of the cases, thumb impression of not even a single family member matched. We are talking to the authorities to ease the situation," said Rajan Guglani, municipal councilor.

10157 - Trust at your fingertips Narayanan Krishnaswami | TNN

Trust at your fingertips

Narayanan Krishnaswami | TNN | Jun 19, 2016, 07.01 PM

Aadhaar's use of biometrics might not allay the fears of privacy activists but Anil K Jain, the 68-year-old computer scientist who helped build the system, says it offers more privacy than what is in the US. 

Jain, an award winning professor from the Michigan State University, holds several patents in fingerprint recognition. The IIT Kanpur alumnus, who was in the city recently, talks about how security concerns have led to the rise of biometrics. 

How did you get into biometrics? 

I was doing my PhD at Ohio State University in 1973. I was working on pattern recognition and image quality. One of the research projects that my advisor had was funded by the United States Air Force. The USAF wanted to use computers to distinguish between three kinds of aircraft: MiG, Mirage and Phantom based on features extracted from their photographs. You've got to remember that this was when we were using punch cards to communicate with mainframes. It was a cumbersome process. We bought model airplanes and photographed them from a variety of angles. 

Later on, in 2001, we got a call from another federal agency, which had funded the development of a new powerful computer processor, called FPGA (Field Programmable Gate Array), one that could be reconfigured for specific tasks. The object was pattern recognition again, and my students and I conceived that fingerprint recognition would be a good way of using this processor's capabilities. 

How did you get involved with the Aadhaar programme? 

I got involved during the planning stages, around 2008. At that time, Nandan Nilekani had recruited Raj Mashruwala, an entrepreneur from the Silicon Valley, for it. Mashruwala contacted me because he believed the project could use my experience with biometrics, in particular fingerprint recognition. 

I began as an advisor, and my main job was to assist in the biometric deduplications system design (avoiding redundant information) and technical specifications for the vendors. I also roped in other people - experts, and my ex-students to help with this massive task. 

Why has biometric identification taken off in a big way? 

In the 60s if you said that your fingerprints had been taken, it meant that you were suspected of a crime. In other words, the word "fingerprinting" had the connotation of "criminality". Then, fingerprints began to be used by various government agencies to conduct "background check" for people working in sensitive jobs. Before, when people stayed and worked in the same locality, and everyone knew everyone else, you could settle things with a handshake. But now, especially with the increase of security threats, there has been a decline in trust. All of this has led to the necessity and acceptance of biometrics. 

How does computerized fingerprint identification work? 

If you take a look at your finger, you will see it is a series of ridges and valleys. Sometimes, a ridge will end at a point - or will branch out. Now these points are distinctive, and are called minutiae. When you give your fingerprints to the Aadhaar programme - or elsewhere, the images are stored as 512x512 pixels. At that resolution, you will be able to get anything between 60 to 100 minutiae points for each fingerprint, and these are stored in the database. Now, when you give your fingerprints say when you are entering the US, and they check to see whether you are on file, what happens is that these points are matched. If there are 20-25 matches of these points, we can state that the same finger made both prints. 

It's a similar principle to what Apple or Samsung use when they use your fingerprint to allow you to access your phone. But those fingerprints are stored at 90x90 pixels, and therefore the number of points stored is fewer. So even six matches would mean a fingerprint match, so the manufacturers have to use additional methods to bolster security. 

But that leads to other problems. At my lab, we've been able to use a special kind of paper to generate fingerprints that can be used to open phones. The printer prints out fingerprints on the paper, and you can use the printed fingerprint on your phone's detector to unlock the phone. 

What are the misconceptions about biometrics? 

The most common problem that I have seen is that people think that biometrics is foolproof. Every security system is prone to error. What we need to ask is 'What is the error rate?' Another problem is that sometimes people expect too much. A good biometrics system costs a lot of money, and one of the first questions people ask is 'What is the ROI'. But the problem is most current systems are inadequate as far as security is concerned. 

And that's something I've heard as far as Aadhaar is concerned. What you have to remember is that Aadhaar is not a security system. It is for giving the underprivileged access to services. Now, if you remember, after 911, the 911 commission found that while all the US security had some information about the impending attacks, they were not able to prevent them because they didn't talk to each other. Now, after implementing the recommendations, the FBI can do a search and match a face from an image in a CCTV feed to driving licence database. 

The Aadhaar programme provides more privacy than that. The only thing that you can do is query the database - 'Do these fingerprints belong to this person?' and the only answers are yes or no.

9560 - Can You Lose Your Fingerprints? - Scientific American

Can You Lose Your Fingerprints?

A 62-year-old man from Singapore was traveling to the U.S. to see relatives last December and was detained after a routine fingerprint scan showed that he actually had none. So how did this happen?

The man, identified in a medical journal case report only as "Mr. S," had been on chemotherapy to keep his head and neck cancer in check. As it turns out, the drug, capecitabine (brand name, Xeloda) had given him a moderate case of something known as hand–foot syndrome (aka chemotherapy-induced acral erythema), which can cause swelling, pain and peeling on the palms and soles of the feet—and apparently, loss of fingerprints.

Mr. S's doctor, Eng-Huat Tan, a senior oncology consultant at the National Cancer Center in Singapore, described the incident in a letter published earlier this week in Annals of Oncology and recommended patients on that drug obtain letters from their doctors before traveling to the U.S.

Officials allowed Mr. S to enter the country following a few hours' detainment when they were "satisfied that he was not a security threat," Tan noted in his letter. Mr. S says he had not noticed that his fingerprints had vanished before he set out on his trip, and his doctor found informal online mentions of other chemo patients complaining of lost fingerprints.

Forensics expert Edward Richards, director of the Program in Law, Science and Public Health at Louisiana State University, explains that "other diseases, rashes and the like can cause vesicular breakdown of the skin on your fingers—just a good case of poison ivy would do it." But, he notes, "Left alone, your skin replaces at a fairly good rate, so unless you've done permanent damage to the tissue, it will regenerate."

As fingerprint scanning and other biometrics become more common (visitors seeking entry into the U.S. must have their prints scanned to ensure they do not currently hold a visa under another name), scanning technology is also advancing. But cases such as this point out that you actually need fingerprints for identification. So how effective are current scanners, and how else have people—accidentally or intentionally—altered their fingerprints?

To find out, we spoke with fingerprint expert Kasey Wertheim, president of Complete Consultants Worldwide, LLC, which provides fingerprint examination expertise to government clients and has done forensic and biometric work for the U.S. Department of Defense and Lockheed Martin.

[An edited transcript of the interview follows.]

Are all fingerprints truly unique?
Yes. It has to do with how the fingerprints form in the womb. During the first trimester, the fingerprints have already established their permanence and uniqueness.

Aside from forensics and travel, what else are fingerprint scans being used for these days?
More and more, fingerprints are being used in biometric devices to permit secure log-on, to open locks, and for access control in general. The biggest users of biometrics are corporate and private users, but fingerprints also have a long history in the forensics world for criminal identification dating back over a century.

Are current scanners pretty reliable?
The exact rate of print rejection [those that can't be read] depends on the scanner. Ultrasound devices go beyond just the outer layer and capture part of the root system. On average, the rejection rate for [scanned] fingerprints is about 1 to 2 percent.

The patient who was detained for lacking prints had hand–foot syndrome that was caused by his chemotherapy drug. What are some other ways that fingerprints can disappear?
The most prominent of those problems involve bricklayers—who wear down ridges on their prints handling heavy, rough materials frequently—or people who work with lime [calcium oxide], because it's really basic and dissolves the top layers of the skin. The fingerprints tend to grow back over time. And, surprisingly, secretaries, because they deal with paper all day. The constant handling of paper tends to wear down the ridge detail.

Also, the elasticity of skin decreases with age, so a lot of senior citizens have prints that are difficult to capture. The ridges get thicker; the height between the top of the ridge and the bottom of the furrow gets narrow, so there's less prominence. So if there's any pressure at all [on the scanner], the print just tends to smear.

How have people intentionally changed or "disappeared" their fingerprints?
There are many documented cases of intentional fingerprint mutilation, but generally those involve pretty severe damage to the skin—more specifically between the generating layer, where the template of the fingerprint survives, and the upper layer, the epidermis.

Pretty much any cut or burn that goes deeper than the outer layer of the skin can affect the fingerprint pattern in a permanent way. But even with permanent scarring, the new scar becomes a unique aspect of that person's fingerprint.

The first case of documented fingerprint mutilation was in 1934, by Theodore "Handsome Jack" Klutis, who led a gang called the College Kidnappers. When the police finally caught up with him, Klutis went for his gun and the police returned fire, killing him. When they compared his postmortem fingerprints, police found that each of his prints had been cut by a knife, resulting in semicircular scars around each fingerprint. Although it was glorified in the media, it was an amateur job; the procedure left more than enough ridge detail to identify him.

9559 - Fingerprints Change Over the Course of a Person’s Life - Discover Magazine

Fingerprints Change Over the Course of a Person’s Life

Fingerprints may not be the permanent biological signatures we’ve built them up to be.

Since the 1920s, fingerprints have been accepted as evidence in courtrooms due to their uniqueness and permanence. And their uniqueness has been scientifically validated. But what of their permanence? Do those ridges and swirls remain the same from birth to death? According to a new study, our fingerprints do slightly change as time progresses — which could have implications for everything from law enforcement to unlocking your iPhone.

Deepening the Science

Belief in the permanence of human fingerprints largely hinges on evidence gleaned from a handful of case studies. Soweon Yoon and Anil Jain wanted to provide deeper scientific context.

They began by examining 10-print fingerprint records generated from 15,500 repeat offenders in a Michigan State Police database. In case you aren’t familiar, 10-print records are created in a controlled setting by dipping all 10 fingers in ink, and rolling each finger onto a card. Each criminal included in the study had five or more of these records spanning five years to 12 years, which allowed researchers to examine changes in prints over time.

Researchers ran the prints through two off-the-shelf fingerprint matching machines, looking for two separate measures: how well the machines paired different prints from the same person (genuine match scores), and if they could differentiate one person’s prints from another (imposter scores). Then, to investigate what factors influenced the machines’ judgments, they created a statistical model to mimic the machines’ output. The model took into account time between prints, fingerprint image quality, and the subject’s age, sex and race.

Fingerprint Fluidity

It turns out that a person’s age and the time interval between prints significantly affected the machines’ accuracy. Genuine match scores, comparing two prints from the same person, decreased as the time gap between prints grew. In other words, your fingerprints don’t look the same to machines as they did 12 years ago.

However, at 12 years (the longest this study investigated), the error rate was still within the normal margins of error for such machines in real-life, unless one of the prints was of poor quality. And regardless of age or elapsed time, the machines didn’t confuse one person’s prints with another person’s — kind of a big deal if you’re standing trial. The study was published Monday in Proceedings of the National Academy of Sciences.

This study seems to indicate that, yes, our fingerprints do morph over time. But those slight changes aren’t enough to befuddle the machines in use today, for the most part. More research will need to be done to answer the question of how many years must elapse between prints for the machines to miss the match. For forensic scientists at least, the study is certainly food for thought.

Photo credit: viicha/Shutterstock