Defenders of Aadhaar have called opposition to it an organised campaign stemming from paranoia. But a look at the petitioners proves it is anything but.
Why this Blog ? News articles in the Wide World of Web, quite often disappear with time, when they are relocated as archives with a different url. Archives in this blog serve as a library for those who are interested in doing Research on Aadhaar Related Topics. Articles are published with details of original publication date and the url.
Aadhaar
The UIDAI has taken two successive governments in India and the entire world for a ride. It identifies nothing. It is not unique. The entire UID data has never been verified and audited. The UID cannot be used for governance, financial databases or anything. It’s use is the biggest threat to national security since independence. – Anupam Saraph 2018
When I opposed Aadhaar in 2010 , I was called a BJP stooge. In 2016 I am still opposing Aadhaar for the same reasons and I am told I am a Congress die hard. No one wants to see why I oppose Aadhaar as it is too difficult. Plus Aadhaar is FREE so why not get one ? Ram Krishnaswamy
First they ignore you, then they laugh at you, then they fight you, then you win.-Mahatma Gandhi
In matters of conscience, the law of the majority has no place.Mahatma Gandhi
“The invasion of privacy is of no consequence because privacy is not a fundamental right and has no meaning under Article 21. The right to privacy is not a guaranteed under the constitution, because privacy is not a fundamental right.” Article 21 of the Indian constitution refers to the right to life and liberty -Attorney General Mukul Rohatgi
“There is merit in the complaints. You are unwittingly allowing snooping, harassment and commercial exploitation. The information about an individual obtained by the UIDAI while issuing an Aadhaar card shall not be used for any other purpose, save as above, except as may be directed by a court for the purpose of criminal investigation.”-A three judge bench headed by Justice J Chelameswar said in an interim order.
Legal scholar Usha Ramanathan describes UID as an inverse of sunshine laws like the Right to Information. While the RTI makes the state transparent to the citizen, the UID does the inverse: it makes the citizen transparent to the state, she says.
Good idea gone bad
I have written earlier that UID/Aadhaar was a poorly designed, unreliable and expensive solution to the really good idea of providing national identification for over a billion Indians. My petition contends that UID in its current form violates the right to privacy of a citizen, guaranteed under Article 21 of the Constitution. This is because sensitive biometric and demographic information of citizens are with enrolment agencies, registrars and sub-registrars who have no legal liability for any misuse of this data. This petition has opened up the larger discussion on privacy rights for Indians. The current Article 21 interpretation by the Supreme Court was done decades ago, before the advent of internet and today’s technology and all the new privacy challenges that have arisen as a consequence.
Rajeev Chandrasekhar, MP Rajya Sabha
“What is Aadhaar? There is enormous confusion. That Aadhaar will identify people who are entitled for subsidy. No. Aadhaar doesn’t determine who is eligible and who isn’t,” Jairam Ramesh
But Aadhaar has been mythologised during the previous government by its creators into some technology super force that will transform governance in a miraculous manner. I even read an article recently that compared Aadhaar to some revolution and quoted a 1930s historian, Will Durant.Rajeev Chandrasekhar, Rajya Sabha MP
“I know you will say that it is not mandatory. But, it is compulsorily mandatorily voluntary,” Jairam Ramesh, Rajya Saba April 2017.
August 24, 2017: The nine-judge Constitution Bench rules that right to privacy is “intrinsic to life and liberty”and is inherently protected under the various fundamental freedoms enshrined under Part III of the Indian Constitution
"Never doubt that a small group of thoughtful, committed citizens can change the World; indeed it's the only thing that ever has"
“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” -Edward Snowden
In the Supreme Court, Meenakshi Arora, one of the senior counsel in the case, compared it to living under a general, perpetual, nation-wide criminal warrant.
Had never thought of it that way, but living in the Aadhaar universe is like living in a prison. All of us are treated like criminals with barely any rights or recourse and gatekeepers have absolute power on you and your life.
Announcing the launch of the # BreakAadhaarChainscampaign, culminating with events in multiple cities on 12th Jan. This is the last opportunity to make your voice heard before the Supreme Court hearings start on 17th Jan 2018. In collaboration with @no2uidand@rozi_roti.
UIDAI's security seems to be founded on four time tested pillars of security idiocy
1) Denial
2) Issue fiats and point finger
3) Shoot messenger
4) Bury head in sand.
God Save India
Saturday, January 20, 2018
12693 - Who Is Running the ‘Orchestrated Wine And Cheese Campaign’ Against Aadhaar in the SC? - The Wire
Defenders of Aadhaar have called opposition to it an organised campaign stemming from paranoia. But a look at the petitioners proves it is anything but.
Sunday, February 3, 2013
2928 - Is UID Anti People - Money Life
Is UID anti-people?-Part 3: Tall claims and tomfoolery of UID by Mathew Thomas
Is UID anti-people?-Part 4: Does the implementation smack of corruption and negligence? by Mathew Thomas
Tuesday, May 1, 2012
2550 - Aadhar or Aandhar? - by Samir Kelekar
Saturday, December 31, 2011
2160 - Aadhaar Ya Niraadhaar? Bumblebee - Fundamatics - IITBAA
When Nandan Nilekani took charge of the Unique Identification Authority of India he was feted for his business-like approach, his stewardship of a project to give identity numbers to millions of Indians, an exercise unprecedented in its scale across the globe. While most accept the need for creating a systematic database of our citizenry, the path to be taken for this has become the subject matter of a viral attack from many quarters—cabinet ministers and bureaucrats, policy experts and activists, even a few state governments.
Everything, from Nilekani’s procedures for data collection and the potential errors therein, to concerns over privacy, is being questioned.
UIDAI is also a subject very close to the IIT Bombay family. Nandan and many of his aides are from within the alumni community as are several detractors who question its “security” and “developmental” dimensions of they scheme. They claim that the former leads to an invasive state; the latter leaves us with a retreating state.
Bumblebee felt that it was time some of that rumpus in the national stage was brought within the pages of Fundamatics in an unbiased point-counterpoint debate straight from the proverbial horse’s mouth.
Bumblebee
Raj Mashruwala
and authenticated in an online, cost-effective manner, which is robust enough to eliminate duplicate and fake identities.”
Hardly a day passes without the press reporting on Nandan or UIDAI, with headings like ‘Declare Aadhaar Illegal’, or, ‘Chidambaram wants Nilekani to log out’. Tabloids and bloggers have a field day speculating, insinuating and dispensing free advice on the matter. Interestingly, the ground-level reality is different. The reality is that Aadhaar has become the largest and fastest growing identity database in the world in less than 14 months. Is Aadhaar the first sign of a brave new world, the next stage of people empowerment?
Before we begin a discussion on the future of Aadhaar, let us first take stock of where it is today.
1. Just the numbers: Over 140M enrolled; 3⁄4 million new enrollments per day; active enrollment camps (16) in every populous state. In short, Aadhaar is growing faster than the mobile phone subscription rate, the most successful private initiative in recent times.
2. The system is working. In a year, it has scaled up to become the world’s largest biometric system, doing 100 trillion biometric comparisons per day while exceeding target accuracy. The reality: Indians will receive a unique ID. Built in the system is a portal for transparency, a toll-free call centre for assistance, an online appointment system, an online enrollment status query, a developer portal and more technical documents than one can read. Let us face it: despite IIT alumni running the show, something real and functional has emerged.
3.Aadhaar was sold to the public to facilitate delivery of public service. Whether this means direct payment for a NREGA recipient, delivery of subsidised LPG cylinders, KYC validation for the SIM card or opening of bank accounts for the unbanked, our babus are discussing, defining, building and testing new apps rapidly. We will see them in 2012.
4- Innovation — new ideas of UID’s uses are in the air. Once you assume a reliable verifiable unique ID, you can dramatically simplify banking and payments, healthcare and education monitoring, and identity fraud detection. People are building such systems right now. Our very own IITB professors are changing their 30-year curriculum and giving assignments to students to envision uses of Aadhaar. Admittedly, one application — the biometric student attendance system — is not in the best interest of junta.
6- Residents— do they want it? At the moment, enrollments lines don’t seem to be getting shorter. We must love standing in lines for no benefits. Wait, maybe people do need verifiable IDs.
7- What is the problem then? The civil society is deeply concerned. Their objections — privacy, reliance on unproven biometric technology, run-away costs and using the information for security instead of development — ought not to be dismissed summarily. Where do we, the armchair democratic activists, go from here? We could:
- Support the continuation of Aadhaar. This is what the government would want us to do.
- Raise our voice to scrap the programme. This is what some in the civil society would want.
- Find ways to help improve the vision of Aadhaar. This is what the idealist in us would want.
1. Privacy: Civil society leaders discuss a number of subtopics -
a. Need for a strong personal privacy law that India lacks. Aadhaar is too dangerous without a personal privacy law in place. No one disagrees on the need for such a law. The question is, do we put infrastructure projects on hold until such a law is passed?
b. Use of Aadhaar data for security, including national ID card. National ID card and building the National Population Registry (NPR) are in an act passed by parliament in 2004. Enrollment in NPR is mandatory and would occur regardless of Aadhaar. Would it make sense to build a chinese wall between Aadhaar and NPR?
c. Operational issues, such as data sharing among agencies Privacy is a topic that every country must find its own balance of. It can’t be borrowed from the US or China. Do we put Aadhaar project on hold until we find acceptable answer to privacy? Do we believe we can achieve a national consensus on privacy any time in the near future?
(a) it is inherently probabilistic and hence fal- lible,
(b) it can easily be faked, and
(c) it is not workable with India’s large and diverse population.
I am absolutely amazed at the speed at which India has produced biometric experts (albeit self-proclaimed) in the last two years. You- Tube is now overflowing with these experts. Having spent a considerable amount of time getting entertained by them, I can safely say that
- These experts have zero understanding of the probability theory. For them, Heisen- berg’s theory of uncertainty would be deeply disturbing. Any verification system has a certain probability of error. We need to characterise it, model it to predict error rates, and include additional verification factors if higher accuracy rates are required. Biometric verification is simply one factor.
- Faking. A four-digit PIN has 1 in a 10,000 chance of getting faked. Credit cards can be spoofed en masse at a negligible cost. We use both daily. We need to under- stand the cost benefits of each verification method and use whichever method is economically acceptable. Biometric identification has many good uses just like other methods such as tokens and passwords.
- Self-proclaimed experts conveniently disregard empirical data analysis on Indian population, which concluded that UIDAI can establish individual uniqueness with desired accuracy (> 99%). Current enroll- ment accuracy results seem to validate the original proof of conceptual results.
The crux of the issue is
a. Do we have a severe leakage problem in public benefits schemes due to duplicate and fake identities?
b. Do we want to provide services to people who need them the most, but lack identity proof?
c. Do we want to continue wasting umpteen hours at the bank, at the mobile shop and at the government office, trying to prove our identity over and over again?
Then we need Aadhaar. Aadhaar is necessary, but it may not be sufficient. Scrapping it is definitely not a solution. Can I challenge the IIT community to suggest ways to improve it?
Raj Mashruwala
The author Raj (Mashru) Mashruwala, 1975, Mechanical Engineering, has painstakingly researched the questions. The same thing can’t be claimed for the answers. He refused to provide his bio(metric) to the editors for verification due to privacy reasons.
But instead, he answered saying that if it does happen, it can only happen in small proportions. As a security professional, I don’t really know whether to laugh or cry at such an answer. It is like saying, yes, our backdoor doesn’t have a latch and is open. But there is little chance that anyone will notice it, or for that matter even if someone does notice it, let us hope that they are not tempted to take anything.
To put it bluntly, we are spending — by various estimates — right from Rs5,000 crores to Rs1,50,000 crores on the UIDAI project. The exact estimate of the project is unknown — so much for its transparency.
But it takes just Rs 30 — a little bit of wax and fevicol — to fake a fingerprint and fool a fin- gerprint scanner. It would take a bit more to
Fraudsters everywhere are a determined lot, and when such a process to steal and fake fingerprints can be scaled to millions and billions, it makes ‘business’-sense for fraudsters to invest their time and money in the scam.
To top it all, there are various news reports which say that banking will be solely based on one's fingerprints after the UID comes in full swing. This is indeed what the fraudsters would want.
The UIDAI project is meant to give an identity to all Indians. However, it is not just the security aspects, but also other aspects that don’t seem to have been thought of thoroughly. For instance, the iris scan was not present in the originally proposed plan. But when it was commonly known that fingerprints by themselves may not be enough for de-duplication —and that they can be faked easily — the iris scan was introduced.
There is no cost benefit analysis or feasibility study of any kind available in the public domain. No full life-cycle pilot study of any size for this project has been done and results studied, before launching such a huge and costly project nation wide. Privacy considerations haven’t been looked into either.
Interestingly, a recent report by a US research entity — the research was commissioned by the US government itself — bursts the myth of the usefulness of biometrics. It recommends that especially in remote areas where no direct supervision is possible, biometrics by itself should not be used for any authentication. If it must be used, there has to be another factor of authentication. Two-factor authentication is not proposed by UIDAI, and cannot be easily introduced in a country like India where due to lack of literacy, things such as passwords cannot be easily used.
Another big problem with biometrics is that unlike a password or a PIN which banks use, biometric information once lost, is irreplaceable. Once you have lost your biometric identity, you have lost it for good. Passwords or PIN numbers on the other hand, can be easily replaced. In a recently reported incident from Mumbai, it was found that fakesters picked up biometrics of people in order to issue them UIDs. These fakesters now have the biometric data of those people, and now, they are forever excluded from the UIDAI project.
Other issues include the fact that the National Identification Authority of India bill has not been passed by the Parliament. Thus, the legality itself of this project is suspicious. Foreign companies have been given control or access to biometric data of our country’s citizens. There is no concept of a security clearance to bid for projects from UIDAI — a fact which puts our national security itself at risk.
All in all, this project is a white elephant in its current form. The earlier it is stopped or at least seriously relooked at, the better it will be for all of us concerned.
Samir has a B.Tech in Electrical Engineering (1983) from IIT Bombay, an MS from Clemson University, South Carolina (1987) and a PhD from Columbia University, New York (1994). He has worked for several companies including Motorola and Alcatel. Currently, he runs a startup called Teknotrends Software Pvt. Ltd. that does cutting-edge work in the area of network security. He is based in Bangalore.
Monday, January 10, 2011
1018 - UIDAI chairman leaves simple questions unanswered at lecture for students_Samir Kelekar - Money Life
Students at the Indian Institute of Science in Bangalore raised questions on the huge cost of the newly-launched unique identification project, the security of the system and what was being done to prevent its possible misuse, but they got no clear answer
In the Indian Institute of Technology (IIT) that I graduated from way back in 1983, dialogue and debate were the essence of true talent. Those who were revered most by the janta (as we used to call the crowd) were not just the toppers and gold medalists of the class-of course they had their special place too-but those who excelled in debating. In all the talks and public functions that we attended at IIT, the speaker would be booed if he shied away from the debate or the questions-and-answers session. It was okay if he gave the wrong answers, but it was important that he stuck on to face the music.
I am told that the IITs have changed a lot now, and the most revered are those who are best at playing computer games and not debates. But let me leave that topic for another day.
Among technical institutes in India and especially in fields such as computer science, IISc was one of the best at the time I graduated. Perhaps, it still is, but I don't know of the latest ratings. Admission to the school of automation programme for MTech at the Indian Institute of Science (IISc) was much sought after.
Memories of my IIT days came back a couple of days ago, when I attended a lecture by the chairman of the Unique Identification Authority of India (UIDAI) at the National Institute of Advanced Studies at IISc in Bangalore. The hall was jam-packed with thick-glassed, nerdy-looking students. The vociferous among them asked several tough questions on the UID project. But, sadly, the answers by Nandan Nilekani, the UIDAI chairman, were more evasive and less direct. Mr Nilekani focused on the role of 'Aadhaar', the 12-digit unique identification number, in the transformation of public services.
One youngster asked whether the Rs1,50,000 crore to be spent on the UID project would be worth it. The UIDAI chairman asked where he had got the number from. When the student mentioned the name of Professor Ramkumar and The Hindu newspaper, the chairman told him not to believe what newspapers write. Sadly, the chairman did not say what the UIDAI's actual budget is.
To another question about whether UID might give excessive information to the states, enabling them to target minorities, the answer was again evasive and academic. The chairman thought that it was up to the state governments to legislate against this possibility. Indeed, when the custodians of the law themselves target minorities (like we have seen in the case of Gujarat), how does the answer square up?
It doesn't require an investigator to see that the fair implementation of the law is the biggest problem in our country. While a Binayak Sen is condemned to jail, we know well how Suresh Kalmadi, at the centre of the Commonwealth Games scandal, and A Raja, who is alleged to have manipulated 2G spectrum allocation that is responsible for the telecom scam, are roaming scot-free. Surely, the UIDAI chairman is not unaware about this.
In answer to another question, the chairman said that even in the US the state has the power to gather data of its citizens, for purposes of national security. Again, what was left unsaid was that in the US, the real ID project, which gathers the biometrics of citizens has been stalled and has been struck down by a number of states.
To a third question about whether there was no better, cheaper way to stop the leakage from government departments, the UIDAI chairman asked the student to come up with a better solution. He did not explain what other options had been considered before arriving at the UID proposal. Surely, there could be a better solution, but it's not an issue that can be resolved on the spur of the moment.
The chairman did not say whether there was a systematic study undertaken on the various options open, their pluses and minuses, before deciding on spending a huge amount from the taxpayers' money on UID. And by the way, it has been conclusively proved that the major leakage of government aid is not due to a lack of proof of identity that UIDAI claims.
The chairman mentioned that 600 million rural people do not have a bank account. But what he did not say was that 1,400 people who have been given bank accounts in Nandurbar district in Maharashtra where the UID project was inaugurated, have zero deposits in their accounts and that they have never operated the bank accounts. Of what use is the bank account if there is no money to deposit in the account? How viable will the economics of such bank accounts be for the banks? Will banks now start charging a commission to account holders?
A couple of weeks ago, at a public function held in Bangalore, an information technology security expert, J T Desouza, demonstrated in full view of the people, how fingerprints could be faked to fool a fingerprint scanner. At the demonstration was none other than Karnataka IT secretary Vidyashankar who works with the UIDAI very closely. He promised to arrange this demonstration before the UIDAI's technical people. Like many other promises by UIDAI, this is also unfulfilled.
At the end of the day, I came out feeling that the young IISc students, on the threshold of a career, required mentoring, rather than an exercise in half-truths. But my biggest take-away from the programme was the sight of a couple of boys and girls from IISc demonstrating silently at the gate of the auditorium. A placard that one of them held, read: 'Happy New Fear'. I am happy to see that a new generation of young students, concerned about their country, is emerging.
(The author has a B Tech from IIT Bombay and a PhD from Columbia University, New York. He runs Teknotrends Software Pvt Ltd, a start-up that does cutting-edge work in the area of network security.)
Wednesday, December 8, 2010
Thursday, November 25, 2010
864 - UID - Another big scam -Watch out for CIA & FBI Agents Involvement - Sangh Parivar
Is the UID system a potential threat to national security and sovereignty?
November 18, 2010 05:42 PM |
Samir Kelekar
A recent deal for the purchase of biometric scanners from a US-based company, which has worked closely with American intelligence agencies, raises serious questions on the security of data in the Aadhaar project
Could the Aadhaar project, touted as a critical requirement for development, turn into a threat to the country's national security and sovereignty?
It was recently reported that L-1 Identity Solutions, a US-based company which is now being bought by a French company, has been given a $25 million order for biometric scanners. This was among the deals announced by the White House during the visit of president Barak Obama to India a fortnight ago. In fact, president Obama, for the same reason, also blessed the Unique Identification Authority of India (UIDAI) with a visit to the innovation forum event in Mumbai where he even had a chat with UIDAI's tech head.
In the case of any other commercial deal this would not have raised eyebrows. But it is the background of L-1 Identity Solutions that raises questions. L-1 has close ties with US intelligence agencies. Read what a report says about L-1: "I will start by mentioning that Louis Freeh (former director of the US Federal Bureau of Investigation), Admiral Loy (former head of the Transportation Security Agency), George Tenet (former director of the Central Intelligence Agency), Frank Moss (former program manager for the State Department's E-Passport program), and many others who previously held key positions in the federal government, all joined Viisage/L-1 as members of the Board of Directors or as paid employees of Viisage/L-1. It must be really sweet to sign off on contracts worth millions of dollars, tens of millions or more in fact, and then turn right around and go on the payroll of the same company that you awarded the contracts to. Sure, Tenet, Freeh and the others may not have had to sign the actual contracts but certainly they are responsible for knowing who the contracts went to when they were in charge of their respective agencies and departments.
"L-1 dominates the state driver's license business. L-1 also produces all passport cards, involved in the production of all passports, provides identification documents for the Department of Defense and has contracts with nearly every intelligence agency in our government. To a large extent it is fair to say that your personal information is L-1's information. L-1 is the same company that thinks our political party affiliation should be on our driver's license along with our race. L-1 has a long history starting with its taking over Viisage Technology. It was a great sleight of hand, Viisage morphing into L-1 while Viisage was under investigation by our government," the report said. Tenet, the former CIA director who was later on the board of L-1, was accused of passing on false information concerning Iraq's WMD (weapons of mass destruction) capabilities which led to the Iraq war. In the new world of surveillance that is emerging, L-1 is turning out to be very powerful, a multi-national giant which can potentially have control over countries. How, some skeptics might ask. Is this one more bogey by the activist lobby? Recently, L-1 has bagged orders from France as well as China.
UIDAI has been professing open standards. But the contract to L-1 is a slap in the face of its professed policy. By now, it is clear that UIDAI does not keep the promises it makes, so this does won't surprise anyone.In the absence of a thorough audit of source code-the only way in which one can be sure-a backdoor can be easily inserted in any of the biometric scanners. This backdoor can not only transfer biometrics data to the vendor's database and to UIDAI's database, but it can also shut down the scanner at will. So, if the UIDAI project goes through and the biometric scanners and UIDAI's infrastructure becomes ubiquitous to the point that every financial transaction in the country requires a biometric scanner, it doesn't require a scientist to tell us that this is equivalent to handling the nation's economy in the hands of foreign companies. The danger posed to the nation's economy is no less than that from foreign companies controlling our telecom infrastructure.
In the case of telecom, after a lot of noise, some action is being taken. It is another matter whether the action taken is good enough or not. But no amount of charisma on the part of the UIDAI chairman can fix this problem which could affect the sovereignty of the nation. The only way out is to ask all vendors of biometric equipment to open their source code and subject it to thorough audit by experts. That is how countries such as China would handle similar situations. Recently, China asked Microsoft to reveal its source code and Microsoft complied. The US too secures its own nationalistic interests properly. Sometime back the US stopped the sale of Tipping Point, a US security company, to a Chinese firm on the grounds of securing national interests.
Further, there could well be a vendor lock-in. L-1 has been on a buying spree, taking over smaller biometric companies. It is quite possible that it buys off other biometric vendors of UIDAI, resulting in a virtual monopoly, which could lead it to hike the prices for upgrades. What checks and balances has UIDAI got to ensure that this does not happen? More important, will the checks and balances, if any, stay or will they be dropped as time passes, for UIDAI's statements cannot be trusted as evidenced from its past actions. Coming to the Unique Identification Number (UID), there has been misinformation by UIDAI that the social security number (SSN) of the US is equivalent to the UID in India. This is not the truth. The SSN does not have your biometrics, it is just a number.
The US is trying to introduce something called the Real ID, which has biometrics, and this is being stiffly resisted by Americans. As of 2008, over 20 legislatures in the US had passed resolutions (or legislation) opposing the implementation of the Real ID Act. Eleven of those legislatures had gone further, by passing laws specifically prohibiting compliance with Real ID. What is sauce for the goose may not be sauce for the gander. Will the Indian authorities wake up and investigate this critical aspect before it is too late?
(The author has a B Tech from IIT Bombay, and a PhD from Columbia University, New York. He currently runs a start-up, Teknotrends Software Pvt Ltd that does cutting-edge work in the area of network security).
Friday, November 19, 2010
853 - Is the UID system a potential threat to national security and sovereignty? - Money Life
Samir Kelekar
Could the Aadhaar project, touted as a critical requirement for development, turn into a threat to the country's national security and sovereignty?
It was recently reported that L-1 Identity Solutions, a US-based company which is now being bought by a French company, has been given a $25 million order for biometric scanners. This was among the deals announced by the White House during the visit of president Barak Obama to India a fortnight ago. In fact, president Obama, for the same reason, also blessed the Unique Identification Authority of India (UIDAI) with a visit to the innovation forum event in Mumbai where he even had a chat with UIDAI's tech head.
In the case of any other commercial deal this would not have raised eyebrows. But it is the background of L-1 Identity Solutions that raises questions. L-1 has close ties with US intelligence agencies. Read what a report says about L-1: "I will start by mentioning that Louis Freeh (former director of the US Federal Bureau of Investigation), Admiral Loy (former head of the Transportation Security Agency), George Tenet (former director of the Central Intelligence Agency), Frank Moss (former program manager for the State Department's E-Passport program), and many others who previously held key positions in the federal government, all
joined Viisage/L-1 as members of the Board of Directors or as paid employees of Viisage/L-1. It must be really sweet to sign off on contracts worth millions of dollars, tens of millions or more in fact, and then turn right around and go on the payroll of the same company that you awarded the contracts to. Sure, Tenet, Freeh and the others may not have had to sign the actual contracts but certainly they are responsible for knowing who the contracts went to when they were in charge of their respective agencies and departments.
"L-1 dominates the state driver's license business. L-1 also produces all passport cards, involved in the production of all passports, provides identification documents for the Department of Defense and has contracts with nearly every intelligence agency in our government. To a large extent it is fair to say that your personal information is L-1's information. L-1 is the same company that thinks our political party affiliation should be on our driver's license along with our race. L-1 has a long history starting with its taking over Viisage Technology. It was a great sleight of hand, Viisage morphing into L-1 while Viisage was under investigation by our government," the report said.
Tenet, the former CIA director who was later on the board of L-1, was accused of passing on false information concerning Iraq's WMD (weapons of mass destruction) capabilities which led to the Iraq war. In the new world of surveillance that is emerging, L-1 is turning out to be very powerful, a multi-national giant which can potentially have control over countries. How, some skeptics might ask. Is this one more bogey by the activist lobby? Recently, L-1 has bagged orders from France as well as China.
UIDAI has been professing open standards. But the contract to L-1 is a slap in the face of its professed policy. By now, it is clear that UIDAI does not keep the promises it makes, so this does won't surprise anyone.
In the absence of a thorough audit of source code-the only way in which one can be sure-a backdoor can be easily inserted in any of the biometric scanners. This backdoor can not only transfer biometrics data to the vendor's database and to UIDAI's database, but it can also shut down the scanner at will. So, if the UIDAI project goes through and the biometric scanners and UIDAI's infrastructure becomes ubiquitous to the point that every financial transaction in the country requires a biometric scanner, it doesn't require a scientist to tell us that this is equivalent to handling the nation's economy in the hands of foreign companies. The danger posed to the nation's economy is no less than that from foreign companies controlling our telecom infrastructure.
In the case of telecom, after a lot of noise, some action is being taken. It is another matter whether the action taken is good enough or not. But no amount of charisma on the part of the UIDAI chairman can fix this problem which could affect the sovereignty of the nation.
The only way out is to ask all vendors of biometric equipment to open their source code and subject it to thorough audit by experts. That is how countries such as China would handle similar situations. Recently, China asked Microsoft to reveal its source code and Microsoft complied. The US too secures its own nationalistic interests properly. Sometime back the US stopped the sale of Tipping Point, a US security company, to a Chinese firm on the grounds of securing national interests.
Further, there could well be a vendor lock-in. L-1 has been on a buying spree, taking over smaller biometric companies. It is quite possible that it buys off other biometric vendors of UIDAI, resulting in a virtual monopoly, which could lead it to hike the prices for upgrades. What checks and balances has UIDAI got to ensure that this does not happen? More important, will the checks and balances, if any, stay or will they be dropped as time passes, for UIDAI's statements cannot be trusted as evidenced from its past actions.
Coming to the Unique Identification Number (UID), there has been misinformation by UIDAI that the social security number (SSN) of the US is equivalent to the UID in India. This is not the truth. The SSN does not have your biometrics, it is just a number.
The US is trying to introduce something called the Real ID, which has biometrics, and this is being stiffly resisted by Americans. As of 2008, over 20 legislatures in the US had passed resolutions (or legislation) opposing the implementation of the Real ID Act. Eleven of those legislatures had gone further, by passing laws specifically prohibiting compliance with Real ID. What is sauce for the goose may not be sauce for the gander. Will the Indian authorities wake up and investigate this critical aspect before it is too late?
(The author has a B Tech from IIT Bombay, and a PhD from Columbia University, New York. He currently runs a start-up, Teknotrends Software Pvt Ltd that does cutting-edge work in the area of network security).
Thursday, October 28, 2010
769 - Letters to the Editor - Mumbai Mirror
UIDAI says that UID is not a fallout of 26/11. True indeed! It originates from the Kargil War. The Kargil war committee of Subramanyam recommended the issuing of ID cards to people in border areas to prevent such infiltration and extend it to the whole country to combat terrorism. This is ridiculous, since militants do not come with ID cards, but with AK-47s, and possession of ID cards or citizenship does not prevent one from becoming a terrorist.
— Mathew Thomas
The UIDAI chairman, Nandan Nilekani, has misinformed people about the UID in the interview (Mumbai Mirror, Oct 10).One of the points was: Discussions with civil society organizations. It is unfortunate that UIDAI does not know the meaning of discussions. An invited-only meeting was called by UIDAI on May 6. There were so many issues that came up, that probably because of that, UIDAI just gave up on further civil society meetings.
— Dr Samir Kelekar
With reference to your interview with the chairman of UID, Nandan Nilekeni, I wish to highlight a few points on the subject of human rights and privacy etc,.
1. Mobile numbers (private operators mostly) are available at a throw away price.
2. The details of all private clubs, hotel memberships are also available at a premium price.
— Srikant S
