12934 - The questionable foundation of Aadhaar - Live Mint

The questionable foundation of Aadhaar

Mandatory linking of the public distribution system to Aadhaar has made access to some basic needs, especially ration, even more difficult for some

Last Published: Fri, Mar 02 2018. 01 43 AM IST

Osama Manzar

The fact that the Data Protection Bill is yet to become an Act is proof that there is no sense of urgency among government officials when it comes to keeping the data of citizens safe. Photo: Priyanka Parashar/Mint

When the idea of Aadhaar was being discussed and even when the law was approved by Parliament, Aadhaar was supposed to enable access to government schemes and entitlements for the rural and marginalised populations.

In the last two years we have seen that Aadhaar has only made access to schemes and entitlements more difficult.

In an interview to the Times of India last month, economist and social scientist Reetika Khera said, “I used to say Aadhaar is a remedy in search of a disease. Now, I say that the remedy is worse than the disease.”

I couldn’t agree more.

Our organization, Digital Empowerment Foundation, works at the grassroots level, usually in the poorest of poor districts. We see on a daily basis, how lack of information about government schemes and lack of access to the same is affecting lives. We also see how mandatory linking of the public distribution system to Aadhaar has made access to some basic needs, especially ration, even more difficult for some.

While Aadhaar was “supposed” to be a saviour, for many it has become a foe because the Aadhaar system could not accommodate for rough thumbprints or because the biometric machine could not identify them.

According to reports, by the end of October 2017, more than 500 million subscribers had already linked their phones to Aadhaar. However, if Aadhaar was supposed to facilitate access to government schemes and services, why is the government forcing linking of Aadhaar to private telcos? And who takes responsibility for this data? Are we dependent on the servers of the government or the servers of the telcos? In case of a data breach, will the government be held accountable, or the private service providers?

We must understand that the linking of Aadhaar to various personal details—including mobile number, bank account number and even health insurance—creates a digital profile of a person based on aggregated data, which can easily be misused.

Even though Section 28 of the Aadhaar Act promises to “protect” your data and “ensure confidentiality of identity information and authentication records of individuals”, this data is at great risk, especially in the absence of a proper data protection law.

The fact that the data protection bill is yet to become an Act is proof that there is no sense of urgency among government officials when it comes to keeping the data of citizens safe.

This lack of urgency can further be proved by the provision of the new e-Aadhaar password, which is a combination of the first four letters of a person’s name and his/her year of birth. Both of these are easily known by our friends, families, colleagues, acquaintances and often strangers or security guards who want to confirm our identity before letting us into an office, building, bar, theatre or the airport.

This means, anybody who knows my name and year of birth, can easily access my e-Aadhaar and even potentially misuse it.

With the citizens being forced to link their Aadhaar IDs to more and more public and private services, the government is only putting personal information of the citizens in jeopardy without a proper mechanism for either synchronization of data or protection of this aggregated data.

If Aadhaar is what it claims to be—a means “to provide for good governance, efficient, transparent and targeted delivery of subsidies, benefits and services”, why is the Unique Identification Authority of India (UIDAI) making citizens link it to private service providers? How does it help in the targeted delivery of government services and subsidies?

The government must realise that Aadhaar, in its current form—in which citizens are being left with little choice regarding whether or not they want an Aadhaar and whether or not they should link it to various public and private services—in the absence of proper digital infrastructure and security mechanisms, is a model that fails its citizens.

Osama Manzar is founder-director of Digital Empowerment Foundation and chair of Manthan and mBillionth awards. He is member, advisory board, at Alliance for Affordable Internet and has co-authored NetCh@kra–15 Years of Internet in India and Internet Economy of India. He tweets @osamamanzar.

First Published: Fri, Mar 02 2018. 01 43 AM IST

12923 - The questionable foundation of Aadhaar - Live Mint

The questionable foundation of Aadhaar

Mandatory linking of the public distribution system to Aadhaar has made access to some basic needs, especially ration, even more difficult for some

Last Published: Fri, Mar 02 2018. 01 43 AM IST

Osama Manzar

The fact that the Data Protection Bill is yet to become an Act is proof that there is no sense of urgency among government officials when it comes to keeping the data of citizens safe. Photo: Priyanka Parashar/Mint

When the idea of Aadhaar was being discussed and even when the law was approved by Parliament, Aadhaar was supposed to enable access to government schemes and entitlements for the rural and marginalised populations.

In the last two years we have seen that Aadhaar has only made access to schemes and entitlements more difficult.

In an interview to the Times of India last month, economist and social scientist Reetika Khera said, “I used to say Aadhaar is a remedy in search of a disease. Now, I say that the remedy is worse than the disease.”

I couldn’t agree more.

Our organization, Digital Empowerment Foundation, works at the grassroots level, usually in the poorest of poor districts. We see on a daily basis, how lack of information about government schemes and lack of access to the same is affecting lives. We also see how mandatory linking of the public distribution system to Aadhaar has made access to some basic needs, especially ration, even more difficult for some.

While Aadhaar was “supposed” to be a saviour, for many it has become a foe because the Aadhaar system could not accommodate for rough thumbprints or because the biometric machine could not identify them.

According to reports, by the end of October 2017, more than 500 million subscribers had already linked their phones to Aadhaar. However, if Aadhaar was supposed to facilitate access to government schemes and services, why is the government forcing linking of Aadhaar to private telcos? And who takes responsibility for this data? Are we dependent on the servers of the government or the servers of the telcos? In case of a data breach, will the government be held accountable, or the private service providers?

We must understand that the linking of Aadhaar to various personal details—including mobile number, bank account number and even health insurance—creates a digital profile of a person based on aggregated data, which can easily be misused.

Even though Section 28 of the Aadhaar Act promises to “protect” your data and “ensure confidentiality of identity information and authentication records of individuals”, this data is at great risk, especially in the absence of a proper data protection law.

The fact that the data protection bill is yet to become an Act is proof that there is no sense of urgency among government officials when it comes to keeping the data of citizens safe.

This lack of urgency can further be proved by the provision of the new e-Aadhaar password, which is a combination of the first four letters of a person’s name and his/her year of birth. Both of these are easily known by our friends, families, colleagues, acquaintances and often strangers or security guards who want to confirm our identity before letting us into an office, building, bar, theatre or the airport.

This means, anybody who knows my name and year of birth, can easily access my e-Aadhaar and even potentially misuse it.

With the citizens being forced to link their Aadhaar IDs to more and more public and private services, the government is only putting personal information of the citizens in jeopardy without a proper mechanism for either synchronization of data or protection of this aggregated data.

If Aadhaar is what it claims to be—a means “to provide for good governance, efficient, transparent and targeted delivery of subsidies, benefits and services”, why is the Unique Identification Authority of India (UIDAI) making citizens link it to private service providers? How does it help in the targeted delivery of government services and subsidies?

The government must realise that Aadhaar, in its current form—in which citizens are being left with little choice regarding whether or not they want an Aadhaar and whether or not they should link it to various public and private services—in the absence of proper digital infrastructure and security mechanisms, is a model that fails its citizens.

Osama Manzar is founder-director of Digital Empowerment Foundation and chair of Manthan and mBillionth awards. He is member, advisory board, at Alliance for Affordable Internet and has co-authored NetCh@kra–15 Years of Internet in India and Internet Economy of India. He tweets @osamamanzar.

12865 - Tech2 Talks: Osama Manzar discusses Aadhaar, Digital India and the importance of empowering women - - First Post

Tech2 Talks: Osama Manzar discusses Aadhaar, Digital India and the importance of empowering women

India has the second largest number of people connected to the internet globally along with the second biggest base on Facebook. But India is also the world's most unconnected country with respect to the internet. Only 20-30 percent of India's 1.3 billion population has internet access, which means that over a billion people have still been left on the sidelines. 

How do we realise the dream of Digital India? To better understand this digital divide, we spoke to the one and only Osama Manzar, Founder and Director of the Digital Empowerment Foundation.

Digital India.

The number of unconnected Indians in the country is a staggering 1 billion and most of these people reside in the rural places of India, says Osama Manzar. We have the second highest internet population, but also the world's largest unconnected population. "I'm not demanding or saying that digital should be there in every house. We just need something that could work functionally and legitimately in a proper manner," he says.

The way we are going digital, we are disempowering people, not empowering them, adds Manzar.

He believes that India is a country which communicates orally, which in turn requires audio or visual medium and this uses a lot more bandwidth. So it is of vital importance to have broadband connectivity, if not for every person, then at least for every institution such as schools, Panchayat, hospitals etc.

We also can't talk about Digital India without talking about Aadhaar, and Manzar's thoughts on that are also quite clear. He admits that he likes the idea of a common ID, but he thinks the implementation of the system is questionable. In his opinion, Aadhaar has become a tool of disempowerment and also a challenge for the common man.

To learn more about this "Digital Disconnect" and Manzar's views on the importance of empowering women, be sure to watch the complete interview above.

Published Date: Feb 20, 2018 16:22 PM | Updated Date: Feb 20, 2018 16:22 PM

12800 - Critics of Aadhaar Say They Are Under Surveillance, Allege Government Harassment - The Wire

Critics of Aadhaar Say They Are Under Surveillance, Allege Government Harassment

BY RAHUL BHATIA ON 14/02/2018 • LEAVE A COMMENT

Opponents of Aadhaar have said it could be used as an instrument of state surveillance while data security and privacy regulations are still to be framed.

A man goes through the process of eye scanning for the Unique Identification database system at a registration centre in New Delhi, India, January 17, 2018. Credit: Reuters/Saumya Khandelwal

Mumbai: Researchers and journalists who have identified loopholes in India’s massive national identity card project have said they have been slapped with criminal cases or harassed by government agencies because of their work.

Last month, the Unique Identification Authority of India (UIDAI) filed a criminal case against The Tribune for publishing a story that said access to the card’s database could be bought for 500 rupees.

Reuters spoke to eight additional researchers, activists and journalists who have complained of being harassed after writing about Aadhaar. They said UIDAI and other government agencies were extremely sensitive to criticism of the Aadhaar programme.

Aadhaar is becoming integral to the digitisation of India’s economy, with over 1.1 billion users and the world’s biggest database.

Indians have been asked to furnish their Aadhaar numbers for a host of transactions including accessing bank accounts, paying taxes, receiving subsidies, acquiring a mobile number, settling a property deal and registering a marriage.

The Tribune said one of its reporters purchased access to a portal that could provide data linked to any Aadhaar cardholder.

The UIDAI complaint, filed with the police cyber cell in New Delhi, accused the newspaper, the reporter and others of cheating by impersonation, forgery and unauthorised access to a computer network.

Media associations sharply criticised the action – the Editors Guild of India said UIDAI’s move was “clearly meant to browbeat a journalist whose story was of great public interest. It is unfair, unjustified and a direct attack on the freedom of the press.”

In response, the agency said “an impression was being created in media that UIDAI is targeting the media or whistleblowers or shooting the messenger.”

Also read: UIDAI’s Defensive Stance on Aadhaar Security Breaches Isn’t Helping Anybody but the Government

“That is not at all true. It is for the act of unauthorised access, criminal proceedings have been launched,” it said in a statement.

Osama Manzar, the director of the Digital Empowerment Foundation, a New Delhi-based NGO, called the government’s prickliness “a clear sign that rather than it wanting to learn how to make Aadhaar a tool of empowerment, it actually wants to use it as a coercive tool of disempowerment”.

Data leakage

Last May, the Centre for Internet and Society (CIS), an independent Indian advocacy group, published a report that government websites had inadvertently leaked several million identification numbers from the project.

UIDAI sent the CIS a legal notice within days, said Srinivas Kodali, one of the authors of the report.

The notice alleged that some of the data cited in the report would only be available if the site had been accessed illegally. The UIDAI wrote that the people involved had to be “brought to justice.”

Critics have warned Aadhaar could be used as an instrument of state surveillance while data security and privacy regulations are still to be framed. Credit: PTI

According to Kodali, two more notices followed, addressed to the group’s directors and two researchers, containing more accusations. “They said it was a criminal conspiracy, and demanded that we send individual responses,” he said.

CIS then received questions about its funding from the home ministry section that grants NGOs permission to receive foreign funding, said a source in the group who saw the letter. CIS viewed this as a threat to its funding, the source said.

CIS declined to comment on the notices or on the questions about funding.

UIDAI did not reply to multiple e-mails seeking comment on the accusations about CIS and similar complaints by other activists and journalists, and officials could not be reached by phone. Officials at the Ministry of Information Technology that supervises UIDAI were unreachable by phone.

In a column in the Economic Times in January, Ajay Pandey, the head of the UIDAI, wrote: “The data of all Aadhaar holders is safe and secure. One should not believe rumours or claims made on its so-called ‘breach’.”

R.S. Sharma, the head of India’s telecom regulatory body, said there was an “orchestrated campaign” against Aadhaar as it was against the interests of those who operated in the shadow economy with fictitious names, or were skimming off subsidies.

“It is going to clean up many systems,” Sharma told a television channel last month. “That’s probably one of the reasons why people realise that this is now becoming too difficult or too dangerous for them.”

“That trip to Turkey?”

A Bangalore researcher who contributed to the CIS report said scrutiny by police and government officials was a common occurrence, but harassment was stepped up after it was published.

“Sometimes people from the police station visit you. Other times from the home ministry. It was intimidating,” the researcher said.

The person, who asked not to be named for fear of reprisal, said police officers asked questions like “How was that trip to Turkey?’,” to make it clear the subjects were under surveillance.

Also read: As Security Violations Erupt, Operator of India’s Biometric Database Stands at Troubling Crossroad

When Sameer Kochhar, a social scientist and author of books on Aadhaar, demonstrated how the system’s biometrics safeguards could be bypassed last year, UIDAI filed a police report in New Delhi, a person familiar with the matter said.

Subsequently, Kochhar received at least three notices from the Delhi Police alleging that he had violated 14 sections under three separate laws, the person said.

Kochhar’s lawyer declined comment. Delhi Police officials declined comment.

Critics have warned Aadhaar could be used as an instrument of state surveillance while data security and privacy regulations are still to be framed.

Former central bank governor Raghuram Rajan said last month that the government needed to prove it would protect the privacy of Aadhaar.

“I do think that we have to assure the public that their data is safe,” Rajan said. “All these reports about easy availability of data are worrying and we have to ensure security. We cannot just say trust us, trust us, it’s all secure.”

(Reuters)

11815 - What is data colonisation and why it matters to us in India - Business Standard

What is data colonisation and why it matters to us in India

Colonising a country no longer requires its physical invasion with military strength

Osama Manzar 

August 17, 2017 Last Updated at 10:22 IST

Colony (n) is a country or area under the full or partial political control of another country and occupied by settlers from that country.

Colonisation (n) is a process by which a central system of power dominates the surrounding land and its components.

By those definitions, neither India nor any region of it is a colony of a dominant society, community or country anymore. However, India and its population is no longer a nation that is defined by its physical presence alone either. We are all living our lives within the geographical boundaries of India and within the virtual boundaries of Facebook, Twitter, Instagram, Google, Airbnb, Uber, and hundreds of other mobile apps. 

Our lives today are as much about our physical being as they are about our data. The only difference is that while we are conscious of our physical lives, we are seldom aware of how our data is being used by its custodians, which may not necessarily be a government but could very well be a multinational company based in a developed country.

When an individual lives within the territorial boundaries of a country, the latter is expected to safeguard the former’s identity, information, and privacy. However, who guarantees the same when lives (and their data) are no longer restricted to geographical boundaries but co-exist at multiple virtual locations in a 'connected world'? More importantly, how much control do they have over their identity and data? As more and more individuals go online and more and more information is turned digital, a strong race to compete for the ownership of data will be visible, if traces of it are not visible already. And the strength of the "coloniser" would be judged by the vastness of the data "colonised".

Let’s take the example of Facebook. Although it is not a country, the American company holds data, including personal and private information, of more than 150 million Indians. In this sense, India could very well be a colony of the popular social networking site, which not only holds our personal information but also tracks our daily routine, habits, behaviour, and communication. This extent of information about 150 million Indians is enough to help the social networking giant influence decisions, both democratic and consumerist, taken by individuals. All this is already visible today. Facebook is influencing individual choices when it comes to what product they are buying next or which party will they vote for.

So, it does not come as a surprise that five of the top 10 companies of the world, in terms of market share, are US tech giants. Further, all these companies are investing heavily in artificial intelligence, internet of things, and cloud computing. From your cars and weighing machines to mobile phones and wrist watches, almost every tech-enabled device or gadget we use is collecting massive amounts of data. In fact, technology is driving growth in almost every sector. Earlier this year, the Economist rightly said, "Data are to this century what oil was to the last one: a driver of growth and change. Flows of data have created new infrastructure, new businesses, new monopolies, new politics and—crucially—new economics." Governments in various parts of the world are already fighting battles with tech giants for fear of losing sovereignty over their people or jeopardising their security.

Let’s not forget that be it the British, Dutch, French, Portuguese or Spanish, they all initially entered the countries that they later colonised to do business. It was only gradually that they extended their business interests and started intervening in governance, eventually taking complete control over the countries. 

Colonising a country no longer requires its physical invasion with military strength but can simply be done by controlling activities through networks and databases with a single click.

The use of the internet has exponentially increased in the last decade, exposing individuals to thousands of benefits of a connected world, starting from making communication faster to accessing services easier. When we give our data to Google Maps, we know we’re giving our private information in exchange of a traffic-free route to our destination — and we do this without thinking how our personal data may be used by Google.

Let’s take the example of Aadhaar now. It is one of the largest databases of information about individuals and it is not restricted to data of connected people but extends beyond to those who are not connected, are poor, and are illiterate. There is a huge potential for this information being used to catch people in a virtual captivity.

Today our data is controlled as much by the Indian government as it is by Google. This dominance of data online is increasing the hegemony of multinational corporations over individuals all around the world. Gradually, borders will not decide control over people or their nationality. In stead, control over data will. The future of control over humanity will be decided by who owns how much of our data. 

Therefore, I completely agree with Infosys Co-Founder Nandan Nilekani when he says, "Time is running out and India needs to take a strategic view on data colonisation, privacy, and data dominance, it is a policy issue and not a technology issue that needs to be addressed soon."

Osama Manzar is founder-director of Digital Empowerment Foundation and chair of Manthan and mBillionth awards. He is member, advisory board, at Alliance for Affordable Internet and has co-authored NetCh@kra–15 Years of Internet in India and Internet Economy of India. He tweets @osamamanzar.

11324 - Taking Cognisance of the Deeply Flawed System That Is Aadhaar by Shreyashi Roy - The Wire

Taking Cognisance of the Deeply Flawed System That Is Aadhaar

BY SHREYASHI ROY ON 10/05/2017 • LEAVE A COMMENT

Aadhaar and its many connotations have grown to be among the most burning issues on the Indian fore today, that every citizen aware of their rights should be taking note of.

The panelists. From left to right: Usha Ramanathan, Prasanna S., Osama Manzar, Shyam Divan, Anupam Saraph, Anivar Aravind and Srinivas Kodali. Credit: Shreyashi Roy

New Delhi: With the leak of 130 million Aadhaar numbers recently coming to light, several activists, lawyers and ordinary citizens are up in arms about what is increasingly being viewed as a government surveillance system. Keeping this in mind, on Tuesday, May 9, Software Freedom Law Centre India (SFLC) hosted an event that brought together a panel to clearly articulate the dangers of Aadhaar and to discuss whether the biometric identification system is capable of being reformed.

SFLC is a donor-supported legal services organisation that calls itself a protector of civil liberties in the digital age.

Titled ‘Revisiting Aadhaar: Law, Tech and Beyond’, the discussion, with several eminent personalities who have in-depth knowledge of Aadhaar and its working, threw light on the various problems that have cropped up with regard to India’s unique identification system. The discussion was moderated by Saikat Datta, policy director at Centre for Internet and Society, which published the report that studied the third-party leaks of Aadhaar numbers and other personal data.

The leaks

The discussion took off from the point of the leaks, with Srinivas Kodali, a panelist and one of the authors of the report, explaining his methodology for the study that proved that the Aadhaar database lacked the security required when dealing with private information of people. He highlighted the fact that during the course of his research, he had noticed several leaks from government websites and notified the Unique Identification Authority of India (UIDAI) about the same. Yet, at every step, UIDAI continued to deny and reject the possibility of this happening. Kodali says, however, that he had noticed that the websites that were unknowingly leaking data were, in fact, fixing the leaks after being notified without acknowledging that the leak had happened in the first place. Kodali reiterated at the discussion, as in his report, that a simple tweaking of URL query parameters of the National Social Assistance Programme website could unmask and display private information. 

Unfortunately, UIDAI cannot be brought to task for unknowingly leaking information because there is no such provision.

He also addressed the question of the conflict of interest that existed in the entire system of building Aadhaar, which was created by developers who later left the UIDAI and built their own private companies, monetising the mine of private information that they were sitting on. Kodali blames UIDAI for this even being allowed, since the developers, though clearly lacking ethics, were in fact, merely volunteers.

The system

One of the glaring issues with the technology behind Aadhaar is that the software is not open source. Anivar Aravind, a panelist, called it “defected by design” and “bound to fail” because not only is the technology completely untested but there are very obvious leaks that are taking place. Moreover, UIDAI does not allow any third-party audits or any other persons to look at the technology. Datta pointed to the fact that this is unheard of in other nations, where software is routinely subjected to penetration testing and hacking experts are called upon to check how secure a database is.

Anupam Saraph, another panelist and future designer, illuminated the creation of the Aadhaar database, pointing out that this is a system less about identification and more about verification. All of the verification, moreover, has been done by private parties, making the database itself suspect and leaving everyone’s private information loose at the time of enrolment. In addition, Aadhaar was meant for all residents and not just citizens. But now there is a mix of both, creating confusion in many aspects. Saraph also brought up how one rogue agency with access to all this information could pose an actual national security threat, unlike all the requests for information on breaches that the government keeps pointing fingers at. Referring to Nandan Nilekani’s statement about Aadhaar not being like AIDS, Saraph pointed out that it was exactly like it because much like the body, which cannot distinguish between an invasion and itself, the Aadhaar system is not being able to distinguish between aliens and citizens and has begun denying the latter benefits.

The Supreme Court has declared time and again that Aadhaar cannot be made mandatory, but the government continues to – in complete disregard of the apex court’s judgment – insist on Aadhaar for a multitude of schemes. More and more schemes are being made unavailable without the existence of an Aadhaar number as the government continues to function in a complete lack of cognisance of the fact that the poor are losing out on something as basic as their food because of a number. Prasanna S., an advocate and a panelist, called it a “voluntary but mandatory” system that is becoming an evidence collection mechanism. Moreover, everything is connected through this one number, making many options like financial fraud, selective treatment of citizens and other horrors possible. The collection of all this information is not dangerous, screams the government. Maybe not in the hands of this one. But what of the next? What of rogues?

The legal aspect

One of the panelists was Shyam Divan, a senior advocate of the Supreme Court, who has represented petitioners fighting against Aadhaar. Divan spoke about how along with a group of advocates he has been trying to get the apex court to rule on the issue but has been met with long queues before a ruling can be procured. He addressed the right to privacy aspect of the system and the recent declaration that the citizen does not have the absolute right to the body. He emphasised that the government cannot own the body and that for a free and democratic society, a limited government, instead of an all-knowing and all-seeing government, is essential. Unfortunately for India, there is no express right to privacy in the constitution, but that does not mean that rights can be taken away in exchange for a fingerprint. It is the government’s duty to respect privacy. For him, Aadhaar has become an instrument of oppression and exclusion, a point that Prasanna also agreed with, calling it a “systematic attack on consent”.

There is complete agreement that there has been a railroading of consent in this entire matter if Aadhaar being passed forcibly through the Lok Sabha as a money bill is anything to go by. If parliament’s consent can be disregarded in that fashion, what is an ordinary citizen to do in the face of this complete imbalance of power in the state’s hand?

Usha Ramanathan, a legal researcher and a long-time critic of Aadhaar, spoke about how India has turned into a state where there are more restrictions than fundamental rights, rather than the other way around. She related how there was no clarity at the beginning of Aadhaar of how it would be a card or a number and was never a government project in the first place. This is a private sector ambition that the government has jumped on board with, without considering that the private sector does not concern itself with civil liberties. As other panelists also pointed out, the private sector cannot and will not protect public interest. This is the job of the government, especially in an age of digitisation. But Aadhaar compromises the ability of the state to stand up for its citizens.

With June 30 approaching fast, many of those who have so far abstained from enrolling in the system are considering giving up their rebellion and going like sheep to get themselves registered in the database. In the words of Divan, they will have to “volunteer compulsorily for an Aadhaar”. The government is probably counting on this. Turning to the Supreme Court has been of no help, although a verdict can be hoped for in a couple of weeks. But what can we do if they rule for the government?

Some of the panelists are on board with the idea of a civil disobedience movement, a kind of a rebellion against Aadhaar. Some suggested thinking of out-of-the-box ways to register one’s protest and dissent against what is clearly becoming the architecture of a surveillance state. Saraph was particularly vehement about the need to completely destroy the Aadhaar database – “shred it”.

What all the panelists emphasised repeatedly was that there can be no improvements to a system that is so deeply flawed and that has had so many “teething problems” that are making millions suffer. The main takeaway from the discussion was that Aadhaar must see a speedy demise because it cannot be saved and cannot persist in its current state.

11299 - Baseless Aadhaar and its many flaws: When the poor lose their thumb prints -Business Standard

Baseless Aadhaar and its many flaws: When the poor lose their thumb prints

When machines don't recognise their thumb prints, Aadhaar turns into a device of exclusion

Osama Manzar & Eshita Mukherjee 

May 9, 2017 Last Updated at 10:51 IST

Wardi Devi, a senior citizen, hails from a remote town of Rajasthan. She’s tried to enrol for the Aadhaar thrice and even paid Rs. 150 and Rs. 50 to agents while making the first two attempts. Tired of coughing out her hard earned money from her meagre wages, she refused to pay anything the third time. Despite having visited the Aadhaar centre on multiple occasions, she is yet to receive her UIDAI (Unique Identification Authority of India). Since she is not an Aadhaar Card holder, she is not entitled to subsidised food grains under the public distribution system (PDS). In the absence of an Aadhaar Card, she is also deprived of various other government entitlements, including the right to work under the Mahatma Gandhi National Rural Employment Guarantee Act (MGNREGA).

Ninety-year-old Fefi Devi and her husband Nathu Singh haven't received ration from the local Fair Price Shop (FPS) ever since Aadhaar-based biometric authentication was introduced in their village, Kukerkheda in Rajsamand district of Rajasthan, in 2014. The Point-of-Sale (PoS) machine doesn’t recognise their thumb impressions since the lines on their thumbs have disappeared due to rigorous manual labour — their source of daily wages.

UIDAI — more commonly known as Aadhaar — which was introduced in 2009 is “essentially a paperless online anytime-anywhere identity assigned to a resident to cover his/her entire lifetime”. The project “assures” inclusion of the entire Indian population into various government entitlements and programmes from which citizen were often “wrongly excluded”. The project aims at making the downtrodden and underserved independent by removing the middlemen, thereby reducing corruption and challenges related to implementation. However, as is evident from the cases above, a number of people are losing out on their basic rights such as food and work.

Citizens are still in search of their identity

The Constitution guarantees both Fefi Devi and Wardi Devi the Right to Life and, hence, right to be included in government welfare schemes. However, a mandate like Aadhaar, for accessing these schemes, does not. If we dig a little deeper, we realise that the project’s initial claims were based on a basic misunderstanding of the causes for exclusion. Worse, the experience of the past eight years of the project suggests that nothing has changed, except the project itself has become a source of exclusion from government programmes for thousands. 

Rajasthan, the second state to implement use of Aadhaar authentication at all ration shops or FPSs after Andhra Pradesh, is one such example. The state principal secretary of food and civil supplies department claimed last year that 63 per cent of beneficiaries were able to collect their grains after Aadhaar authentication, as per data from August 2016. This means that 37 per cent of the population were turned down ration because their thumb impressions weren’t recognised due to several possible reasons. In some cases, citizens were denied their right to subsided ration because they did not have the ‘mandatory’ Aadhaar Card. In some other cases, the individuals had an Aadhaar Card but the PoS machine was out of order. In yet other cases, the citizen had an Aadhaar Card and the PoS machine was functional but there was no Internet connectivity in the village. There were also cases where everything was in place — Aadhaar, PoS and Internet — but the machine refused to recognise the biometrics of a rugged thumb.

It has been repeatedly pointed out to the government agencies — supported by evidences from Rajasthan, Jharkhand and Delhi — that the most vulnerable groups, such as elderly and migrant workers who do manual labour, face difficulty in accessing benefits due to failed biometric authentication. Yet, there is no system in place to handle such cases. 

The FAQ section on the UIDAI website asks, “How will the biometric of the differently-abled and people with no finger prints or rugged hands e.g. beedi workers or people with no fingers be captured?” The answer to that question is listed as follows: “The policy will take into consideration these exceptions and the biometric standards prescribed will ensure that these groups are not excluded. In the case of people without hands/ fingers only photo will be used for identity determination and there will be markers to determine uniqueness.” However, as we know, no such mechanism has been put in place yet.

Clearly, not much has changed in the last eight years since UIDAI was introduced. Citizens are still in search of their identity. Jyothi Alamadamu (Gollaprolu Mandal), a tribal resident of the Sweeper Colony in Andhra Pradesh, works as a maid. In her blog, Reetika Khera had shared the story of this women whose three-year old twins were starving because the e-POS did not recognise her biometric or identify her ration card number. In her blog, Khera quotes an angry villager: “There is no point of giving Rs. 1 per kg rice and Rs. 2 per kg wheat if the poor has to forego Rs. 250 of their wage, excluding the cost of transportation, in the bargain.”

In another case story from Chendurthi village (Gollaprolu Mandal), Andhra Pradesh, villagers shared they had to travel at least 5-10 kilometres to reach the nearest Fair Price Shop and then stand in the queue for hours. As the day progresses, the queue becomes longer because it often takes more than one attempt for the POS machine to authenticate the biometric details.

There are numerous articles written on challenges that UIDAI faces. These are cultural, social and infrastructural challenges. We do not have roads, electricity or connectivity in place to execute such a mandate.

Today, Aadhaar has become an integral (read coerced) part of our lives. Initially introduced as a voluntary mechanism, it was clarified by the central government on May 2, 2017, that “Sections 7 and 54 of the Aadhaar Act made it mandatory for people to get enrolled [in the Aadhar scheme]”. And that citizens cannot claim “absolute right over their body parts and refuse to give digital samples of their fingerprints and iris for Aadhaar enrolment”.

Further, there is the challenge of data protection. Through UIDAI, the Indian government has tried to replicate the European e-citizenship model which assigns every citizen a unique identity number. For example, Estonia has nearly a population of nearly 1.3 million inhabitants — this is half of South Delhi’s population. Every ID-card owner gets an official e-mail address, which is intended for official communication with the State and is defined as an “official electronic residence” of the citizen. More than 300,000 private individuals and over 56,000 companies are using this opportunity today in that country (April 2017). The country maintains an elaborate database, which can only be accessed if the concerned government department — or anybody else — states their purpose. Further, when this data is accessed, the citizen gets an official communication, informing him/her who has accessed the data and for what purpose.

On the hind side, UIDAI has major privacy issues and has no such mechanism to either protect the data or inform the citizens of the consumption of their data unlike Estonia. Indian citizens have no say or information about how their personal information is being used and by whom. According to the Aadhaar Act (Targeted Delivery of Financial and other Subsidies, benefits and services) of 2016, in fact, “In the interest of national security, a Joint Secretary in the central government may issue a direction for revealing to concerned authorities (i) Aadhaar number, (ii) biometric information (iris scan, finger print and other biological attributes specified by regulations), (iii) demographic information, and (iv) photograph. Also on the order of a court, (i) an individual’s Aadhaar number, (ii) photograph, and (iii) demographic information.” This is despite the Human Rights 34th Resolution that states storing metadata is a human rights violation.

Instead of fighting court cases and wasting energy and public money, India should rather invest in developing robust infrastructure, putting in place strong data protection and privacy laws and conducting pilot studies before rolling out mandatory Aadhaar-based delivery of rights and entitlements for citizens across the nation.

Osama Manzar is founder & director of Digital Empowerment Foundation, that works across 200 villages in 22 states enabling citizens with digital resources to access information and entitlements. Tweet him @osamamanzar. Eshita Mukherjee works with DEF as research officer.