11979 - AADHAAR, DATA SECURITY AND BREACH OF PRIVACY - DAILY PIONEER

AADHAAR, DATA SECURITY AND BREACH OF PRIVACY

Tuesday, 05 September 2017 | Sandhya Jain | in Edit

An RTI reply has punctured the UIDAI's assertion that no private entity had access to unencrypted Aadhaar data. While it is not clear who controls the data; certainly it is prone to misuse

A Right to Information (RTI) application filed by Bengaluru-based Col  Matthew Thomas, a petitioner in the right to privacy case before the Supreme Court, reveals that the Unique Identification Authority of India (UIDAI), custodian of Aadhaar data, signed contracts with foreign firms giving them “full access” to classified data and personal details of citizens, which they were allowed to store for seven years.

The Centre must direct the UIDAI to make a full disclosure of the project since its inception, including contracts signed, and who selected the firms recruited for the task. The then UIDAI chairman  Nandan Nilekani must explain why the technology (hardware and software) for collecting and storing the data was not created domestically when India is supposed to be the hub for information technology services.

The RTI reply punctures the UIDAI’s assertion that no private entity had access to unencrypted Aadhaar data. The contract with US-based biometric service provider, L-1 Identity Solutions Operating Company Private Limited (now owned by French transnational Safran Group), clearly says that the firm was given Aadhaar data access “as part of its job”. Other firms given identical contracts from 2010 to 2012 include Morpho and Accenture Services Private Limited.

In 2014, Prime Minister Narendra Modi was persuaded that Aadhaar could expand the reach of his social welfare programmes exponentially. But recently, when data breaches became glaring, Nilekani dismissed the problem saying data security is challenging in a digital age and ran back to his parent company. The unanimous verdict of the nine-judge bench of the Supreme Court, upholding right to privacy as a fundamental right, reportedly reflects this belated understanding at the top echelons of the Government.

The contract’s Clause 15.1, ‘Data and Hardware’, says the firm “may have access to personal data of the purchaser (UID), and/or a third party or any resident of India...” Clause 3, which deals with privacy, says the biometric service provider could “collect, use, transfer, store and process the data”. Also, the biometric service provider shall process all personal data in accordance with applicable law and regulation and should not disclose such information. The contract does not define ‘personal data’.

However, according to UIDAI, personal data includes biometric (fingerprints, iris) and demographic data (name, date of birth, address, mobile number), and could include bank details, licence number, PAN number, passport number and other information furnished as part of Know Your Customer (KYC). A clause in the contract says the firm should maintain the biometric template created by it and on termination or expiry of contract, “transfer all the proprietary templates to UIDAI”.

The UIDAI claimed it had purchased the software and hardware for the Aadhaar programme but the contracts show that the biometric service providers provided hardware for the first one crore enrollments. It is not known if the hardware was checked to ascertain if data could be stolen via a back door. UIDAI’s assertion that no data ever left its servers and premises cannot be trusted as the language of the contracts clearly shows that foreign firms had access to raw data.

But is this surprising? In a Forward to a Credit Suisse study (Ideas Engine Series, June 29, 2016), Nilekani wrote, “Once in a while a major disruption or discontinuity happens which has huge consequences. In 2007, the Internet and the mobile phone came together in a whole new product called the smartphone... (which) could support Over The Top applications. The messaging solution for the smartphone…came from WhatsApp, a start-up”.

Nilekani argued that Indian banking is experiencing a ‘WhatsApp’ moment, as smartphones could reach 700 million by 2020 and over one billion Indian residents have the online biometric identity, Aadhaar. Hence it is possible to “visualise a future where every adult Indian has an Aadhaar number, a smartphone and a bank account”.

More insidiously, Aadhaar provides on-line authentication using fingerprint or iris, which can be done from anywhere, making transactions ‘presence-less’. Aadhaar’s eKYC feature enables a bank account to be opened instantly by using one’s Aadhaar number and biometric; something prone to misuse. In Jammu & Kashmir, illegal immigrants (Rohingyas) have acquired Aadhaar and ration cards.

Extolling many facets of the new technology (the India Stack), Nilekani states, “as data becomes the new currency, financial institutions will be willing to forego transaction fees to get rich digital information on their customers (italics added)”. This would accelerate the move to a cashless economy as merchant payments will also become digital.

Commending Credit Suisse’s “insightful report”, Nilekani agrees that there is a $600 billion market capitalisation opportunity possible in the next 10 years, which will be shared between existing public and private banks, new banks and new age non-bank financial companies (NBFCs). “It may even go to non-banking platform players, which use the power of data to fine-tune credit risk and pricing, and make money from customer ownership and risk arbitrage”. He expects a serious challenge to public sector banks which currently enjoy a 70 per cent market share.

The Payment Bank (Paytm), launched in 2016 (Alibaba holds 40 per cent stake), and the Unified Payment Interface (UPI)-powered payment interfaces, hope to encash the shift towards digital transactions, and get their share of the coveted $ 600 billion pie. Credit Suisse anticipates that private banks, NBFCs’ and fin-tech players will be its prime beneficiaries.

Credit Suisse explains that financial providers will become data rich in just two or three years as they receive data via transactions made through their apps, digital footprints left by individuals, smartphone data and online tax information, as three  to five billion invoices go digital with the Goods and Services Tax. Forecasting consumer debt to rise to 25 per cent of the gross domestic product from the current 17 per cent on the back of new data availability, the SME lending market could grow from $620 billion to $3,020 billion over the next decade. Aadhaar seems tailored to benefit private bankers.

This writer was invited to enroll for the National Population Register vide acknowledgement slip 130, form number 02046115, household block no. 0021, household number 128, by Enumerator OP Singh, dated May 26, 2010. Aadhaar was supposedly for BPL beneficiaries. It turned out they were one and the same.

Now, it is not clear who controls the data; certainly it is prone to misuse. The Sonia Gandhi-led UPA regime unleashed this menace through lies and deception. The Modi-led Government must fix this treachery. No country in the world has allowed bankers and corporations such totalitarian access to intimate data about its citizens.

(The writer is a political analyst and an independent researcher)

6078 - Snowden’s exile a warning against UID scheme - Niti Central

Snowden’s exile a warning against UID scheme

AUG 10, 2013

SANDHYA JAIN

It is strange that no human rights activist or political party in India has demanded that the UPA Government immediately destroy the vast biometric data of citizens that it collected illegally, even after Edward Snowden exposed the mass surveillance programmes being run by the Governments of the United States and Britain, with at least one server planted on the territory of India.

Snowden escaped incarceration for life in some isolated Guantanamo-type facility by securing ‘temporary’ asylum in Russia, after Washington grounded him at Moscow airport by cancelling his passport. He is likely to remain in Russia for the rest of his life, an irony that could make Moscow the new destination of those fleeing from the repulsive intrusiveness that George Orwell foresaw would be the fate of Western democracies. Big Brother is indeed watching you — all of us, in fact.

Obama cancels meeting with Vladimir Putin amid row over Edward Snowden

But no country over which the Americans have planted their spy cameras and listening devices is as vulnerable as India, because none other has so brazenly collected the biometric data of its entire population. The unique identification (Aadhar) programme has been executed illegally without Parliamentary sanction, at the expense of the taxpayer. Congress regimes like the Delhi Government have illegally forced citizens to enroll under the programme by denying property registration and other civic rights without an Aadhar number.

Right-thinking citizens always had doubts about the intent of the project — which can cancel the citizenship, voting rights, even bank accounts, of citizens — with a single click on the delete button. This is the ultimate in totalitarian power that has always been sought by the security establishments of countries like America which are committed to world domination, which is why the resistance to these powerful technologies emanates from there.

Biometric data is prone to misuse. Its very safety is difficult to guarantee in a world full of accomplished hackers, not to mention compulsive snoops. A particular denomination that feels targeted when certain crimes take place would be especially vulnerable in this regard. This is a grave danger to the entire citizenry, and the Supreme Court would do well, even at this late stage, to order the scrapping of the project and the destruction of all data. It never had any genuine justification, and after the expose by Snowden — who worked for both the Central Intelligence Agency (CIA) and the National Security Agency (NSA) — there is no reason to believe that the data is safe.

So dogged is America in its pursuit of Snowden and all who helped him, even inadvertently, that an encrypted email service believed to have been used by him, shut down suddenly on August 8, after the US Government tried to gain access to customer information. The owner, Ladar Levison, explained to customers, “I have been forced to make a difficult decision: to become complicit in crimes against the American people, or walk away from nearly 10 years of hard work by shutting down Lavabit.”

Man who revealed US spy programme goes underground in Hong Kong

He further warned, “This experience has taught me one very important lesson: without Congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” This was a hint at Google Inc, Microsoft Corp and other large providers who, according to Snowden’s leaks, were forced to help intelligence authorities gather email and other data on their users. Soon afterwards, another famous service, Silent Mail, also closed down, seeing the writing on the wall.

The sheer scale of NSA intrusion is causing some misgivings even in the normally discreet mainstream media, with the New York Times editorially commenting on August 8, “Time and again, the NSA has pushed past the limits that lawmakers thought they had imposed to prevent it from invading basic privacy, as guaranteed by the Constitution.” The NSA, the newspaper noted, “copies virtually all overseas messages that Americans send or receive, then scans them to see if they contain any references to people or subjects the agency thinks might have a link to terrorists… data collection on this scale… clearly shreds a common-sense understanding of the Fourth Amendment.” It called for Congress to clamp down on snooping that is not connected to specific targets.

Meanwhile, in the Capital alone, the Delhi State Election Commission found during the course of a routine exercise to weed out bogus voters, that there are over 12 lakh fake names on the voters’ list. In one instance alone, 30 residents of Seelampur got voter identity cards on the basis of a single Aadhar Card (no. 229575371505).

This means that all 30 persons had the same address proof with the same serial number, but different names and photographs. This is not possible without official complicity. It is clearly intended to facilitate bogus voting at election time. It is likely that some of the persons thus given voter identity cards may not be genuine citizens of India. Indeed, this was one of the greatest objections to the Unique Identification Programme in the first place.

Imagine what a foreign Government could do with citizens’ biometric data. Imagine if a country known to sponsor terror got its hands on our biometric data — it could use it to implicate innocent Indians in crimes they did not commit, to forge citizenship cards for its operatives, or to clean out target bank accounts. The possibilities are endless.

Another interesting scam that has come to light in the capital is that against a population of 16.8 million (2011 Census), Delhi has 18 million people on its ration cards. Since the middle classes were made to surrender their ration cards after the voter identity cards were introduced some decades ago, this means that at least 50 per cent, if not more, of the names on the ration cards are bogus.

This is clearly a scam to benefit certain chosen food grain dealers under the guise of the Food Security Bill that Sonia Gandhi hopes to push through in the Parliament session, in order to win the next election.

The food and supplies department claims it will weed out bogus claimants via Aadhar, and the Election Commission has already shown us how that can be fudged. So we are going to have a scam of unprecedented numbers in the guise of rectifying the shortcomings of the old public distribution system (PDS).

Disclaimer: Opinions expressed in this article are the author's personal opinions. Information, facts or opinions shared by the Author do not reflect the views of Niti Central and Niti Central is not responsible or liable for the same. The Author is responsible for accuracy, completeness, suitability and validity of any information in this article.

ABOUT AUTHOR

Sandhya Jain

Sandhya Jain is a political analyst and independent researcher. She is the author of ‘Adi Deo Arya Devata- A Panoramic View of Tribal-Hindu Cultural Interface’ (Rupa & Co., 2004) and ‘Evangelical Intrusions. Tripura: A Case Study’ (Rupa & Co., 2009).

5309 - Nilekani’s Aadhaar a danger to our privacy - Sandhya Jain

Nilekani’s Aadhaar a danger to our privacy -- Sandhya Jain

Nilekani’s Aadhaar a danger to our privacy

Sandhya Jain March 13, 2014

Nandan Nilekani, who got the Congress ticket for the Bangalore South Lok Sabhaconstituency even before officially joining the party on March 9, continues to hold the post of Chairman, Unique Identification Authority of India (UIDAI), or Aadhaar. The project has been dogged by controversy since its inception in 2009 because of the cavalier fashion in which sensitive biometric data of citizens was collected by executive order, without Parliamentary mandate, and held by a private body with questionable links and shifting goals.

Now, in an interview to a television channel, Nandan Nilekani has revealed that the end goal of Aadhaar is very different from what was stated when it was being imposed upon the country by the UPA fiat. A leading economic daily has expressed concerns, first raised by a reader, that his election office may be using the data of his fully covered constituency to reach voters. While the Election Commission gives political parties copies of the list of registered voters in each constituency, the Infosys co-founders’ campaign office has been sending personalised letters to the heads of every household. The letter cover looks very much like the ones used to send the Aadhaar number cards to individuals and bears the name of the addressee and that of his/her father on it. Since Aadhaar has been executed with public funds, this may be akin to misuse of the Government symbols like the Ashok Chakra; the Election Commission should take a view on it.

The technocrat with a personal worth of $1.3 billion expressed gratitude to the Gandhi family for backing Aadhaar to the hilt, as a consequence of which 60 crore people have been enrolled despite lack of Parliamentary sanction to it. In a television interview, he claimed that it was “irreversible now”, possibly because so much public money has been spent. His interviewer did not ask the relevance of the project even after the Supreme Court declared it ‘non-mandatory’ and ordered delinking Aadhaar from the Government benefits and subsidies – making the project effectively a white elephant – but Nilekani confidently asserted that Aadhaar is the best “anti-corruption platform” and its end goal is a “cashless society”. This should ring warning bells in responsible quarters.

Why Mahatma Gandhi would have burnt Aadhar cards

Interestingly, the ‘unique identity’ can be manufactured by anyone with some equipment. On March 10, 2014, the Mumbai police busted a fake Aadhaar card and voter identity card racket in Byculla, which they believe is part of a much larger racket in creation of fake identities. Three persons were arrested for forgery of official records and their equipment including iris and fingerprint scanners were seized. Among the fake election cards seized, at least three had different names but a similar number (ZHS 4001377).

Rajya Sabha MP Rajeev Chandrasekhar had warned that Aadhaar is a colossal misuse of public funds. The very claim that Aadhaar gives an identity to all citizens is false, as the programme merely takes an existing ID (real or fake) of anybody (citizen, foreigner or illegal immigrant) and issues a number. Since there is no identity verification, there is no identity being issued. All that happens is that the fake or true ID information is linked to that ID holder’s iris or biometric information. Thus, there is no way to assess the number of fake entries in the Aadhaar database, and as the Mumbai police arrests show, both the fake voter ID and fake UID can be manufactured en masse without entering a Government office.

The issue of fraud in Aadhaar scheme can no longer be ducked. As the Mumbai arrests show, Aadhaar is a national security risk, and is being issued to non-citizens, illegal immigrants, and most likely even to terrorists in cities like Mumbai. Hence, the critical issue of citizenship must first be settled and the UPA diktat of forcing it on the citizenry for non-subsidy schemes like registration of property and opening of bank accounts must be discouraged forthwith. The Supreme Court has already directed (September 23, 2013) that the Aadhaar card cannot be given to illegal immigrants. The controversy over LPG cylinder subsidy has also proved that Aadhaar cannot prevent leakages or reach intended targets because it is fundamentally flawed.

 In Mumbai, Bangladeshis get Aadhar Cards for Rs 2500

The most serious concern regarding Aadhaar, which the Government of India admitted in the Supreme Court, is that the citizens’ biometric data is not secure, which is one reason why no European country has implemented such a scheme. In case of Aadhaar, the data is held by private operators, and hence is prone to dangerous misuse. One of the firms engaged in the project is the New York-based MongoDB, which is backed by the CIA and other intelligence agencies. It has access to the complete database. Former National Security Agency (NSA) employee turned whistle blower, Edward Snowden, has revealed that the US intelligence agencies routinely intercept communications in Europe and Asia, including India. This, as the Centre for Internet and Society has pointed out, means that secret courts and court orders can be used by the CIA to gain access to the UID data.

Aadhaar is an online database, which makes it vulnerable anyway. James Ball, Julian Borger and Glenn Greenwald have reported (The Guardian) that Edward Snowden’s leaked files show that the US NSA and its UK counterpart Government Communication Headquarters (GCHQ) have largely compromised the guarantees Internet companies give to consumers that their communications, online banking and medical records will be indecipherable to criminals or the Governments. Since then, the Union Ministry of Home Affairs has accused telecom operator Vodafone of secretly sharing subscriber data with the British GHCQ by giving secret unlimited access to its network of undersea cables, which carry much of the world’s phone calls and Internet traffic. Vodafone has denied the charges.

Aadhar programme a fraud, will review if voted to power, says BJP

The UID is dangerous and needs to be urgently dismantled to protect Indian citizens. Any database of citizens must be secure and offline, at the very least. As a beginning, the move to force banks to move to biometric ATMs must be thwarted without further ado, as it will increase the risk of the theft of biometric data of citizens which can by misused in various ways. It will also sharply escalate banking costs as the burden is passed on to consumers. The UID is part of the globalisation project of the World Bank, NATO and WTO, which will be used to intrusively micro-monitor citizens’ employment history, health profile, rental and credit card history, bank accounts and savings – the frightening scenario of mind-crushing control foreseen by George Orwell, who linked the totalitarian State to the western capitalist State.

Comment

kalyanaraman • a minute ago

Hold on, this is waiting to be approved by NitiCentral.

See: http://bharatkalyan97.blogspot...

If the report about Nilekani using aadhar official information (to canvass for his votes) is correct, he may be violating Official Secrets Act. Kalyan

http://www.niticentral.com/2014/03/13/nilekanis-aadhaar-a-danger-to-our-privacy-199690.html

Posted 19 hours ago by Srinivasan Kalyanaraman

4473 - Snowden’s exile warning against UID scheme by Sandhya Jain - Niti Central

Snowden’s exile warning against UID scheme

By Sandhya Jain on August 10, 2013

It is strange that no human rights activist or political party in India has demanded that the UPA Government immediately destroy the vast biometric data of citizens that it collected illegally, even after Edward Snowden exposed the mass surveillance programmes being run by the Governments of the United States and Britain, with at least one server planted on the territory of India.

Snowden escaped incarceration for life in some isolated Guantanamo-type facility by securing ‘temporary’ asylum in Russia, after Washington grounded him at Moscow airport by cancelling his passport. He is likely to remain in Russia for the rest of his life, an irony that could make Moscow the new destination of those fleeing from the repulsive intrusiveness that George Orwell foresaw would be the fate of Western democracies. Big Brother is indeed watching you — all of us, in fact.

But no country over which the Americans have planted their spy cameras and listening devices is as vulnerable as India, because none other has so brazenly collected the biometric data of its entire population. The unique identification (Aadhar) programme has been executed illegally without Parliamentary sanction, at the expense of the taxpayer. Congress regimes like the Delhi Government have illegally forced citizens to enroll under the programme by denying property registration and other civic rights without an Aadhar number.

Right-thinking citizens always had doubts about the intent of the project — which can cancel the citizenship, voting rights, even bank accounts, of citizens — with a single click on the delete button. This is the ultimate in totalitarian power that has always been sought by the security establishments of countries like America which are committed to world domination, which is why the resistance to these powerful technologies emanates from there.

Biometric data is prone to misuse. Its very safety is difficult to guarantee in a world full of accomplished hackers, not to mention compulsive snoops. A particular denomination that feels targeted when certain crimes take place would be especially vulnerable in this regard. This is a grave danger to the entire citizenry, and the Supreme Court would do well, even at this late stage, to order the scrapping of the project and the destruction of all data. It never had any genuine justification, and after the expose by Snowden — who worked for both the Central Intelligence Agency (CIA) and the National Security Agency (NSA) — there is no reason to believe that the data is safe.

So dogged is America in its pursuit of Snowden and all who helped him, even inadvertently, that an encrypted email service believed to have been used by him, shut down suddenly on August 8, after the US Government tried to gain access to customer information. The owner, Ladar Levison, explained to customers, “I have been forced to make a difficult decision: to become complicit in crimes against the American people, or walk away from nearly 10 years of hard work by shutting down Lavabit.”

He further warned, “This experience has taught me one very important lesson: without Congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” This was a hint at Google Inc, Microsoft Corp and other large providers who, according to Snowden’s leaks, were forced to help intelligence authorities gather email and other data on their users. Soon afterwards, another famous service, Silent Mail, also closed down, seeing the writing on the wall.

The sheer scale of NSA intrusion is causing some misgivings even in the normally discreet mainstream media, with the New York Times editorially commenting on August 8, “Time and again, the NSA has pushed past the limits that lawmakers thought they had imposed to prevent it from invading basic privacy, as guaranteed by the Constitution.” The NSA, the newspaper noted, “copies virtually all overseas messages that Americans send or receive, then scans them to see if they contain any references to people or subjects the agency thinks might have a link to terrorists… data collection on this scale… clearly shreds a common-sense understanding of the Fourth Amendment.” It called for Congress to clamp down on snooping that is not connected to specific targets.

Meanwhile, in the Capital alone, the Delhi State Election Commission found during the course of a routine exercise to weed out bogus voters, that there are over 12 lakh fake names on the voters’ list. In one instance alone, 30 residents of Seelampur got voter identity cards on the basis of a single Aadhar Card (no. 229575371505).

This means that all 30 persons had the same address proof with the same serial number, but different names and photographs. This is not possible without official complicity. It is clearly intended to facilitate bogus voting at election time. It is likely that some of the persons thus given voter identity cards may not be genuine citizens of India. Indeed, this was one of the greatest objections to the Unique Identification Programme in the first place.

Imagine what a foreign Government could do with citizens’ biometric data. Imagine if a country known to sponsor terror got its hands on our biometric data — it could use it to implicate innocent Indians in crimes they did not commit, to forge citizenship cards for its operatives, or to clean out target bank accounts. The possibilities are endless.

Another interesting scam that has come to light in the capital is that against a population of 16.8 million (2011 Census), Delhi has 18 million people on its ration cards. Since the middle classes were made to surrender their ration cards after the voter identity cards were introduced some decades ago, this means that at least 50 per cent, if not more, of the names on the ration cards are bogus.

This is clearly a scam to benefit certain chosen food grain dealers under the guise of the Food Security Bill that Sonia Gandhi hopes to push through in the Parliament session, in order to win the next election.

The food and supplies department claims it will weed out bogus claimants via Aadhar, and the Election Commission has already shown us how that can be fudged. So we are going to have a scam of unprecedented numbers in the guise of rectifying the shortcomings of the old public distribution system (PDS).