13798 - Aadhaar authority wants to monitor social media to identify ‘top detractors’ and fix ‘sentiments’ - Scroll.In

Aadhaar authority wants to monitor social media to identify ‘top detractors’ and fix ‘sentiments’

After I&B ministry, now Aadhaar authority wants to watch your social media conversations

Pixabay

Yesterday · 09:00 am

Kumar Sambhav Shrivasta

The Unique Identification Authority of India, which manages the Aadhaar database of more than one billion Indians, not only wants to monitor the coverage of Aadhaar in the news media, it also wants to trawl through social media conversations to gauge sentiments about the biometrics-based 12-digit identification number. It hopes to use this information to identify “detractors” and “influencers” and run campaigns to “neutralise” the “negative sentiments” on the social media.

The Authority issued a bid document on July 18, seeking to hire a social media agency that will employ “online reputation management” and “social listening” tools to monitor and influence conversations related to Aadhaar on platforms like Facebook and Twitter. This is separate from the bid document issued on July 19 to hire a media monitoring agency, which will track all national and regional newspapers, news channels and websites for Aadhaar-related coverage, as reported in Business Standard on Friday.

The scope of the social media agency, as described in the July 18 document, is wider than the media monitoring agency when it comes to monitoring social media. It will segregate Aadhaar-related conversations into “problematic and non-problematic” categories and highlight the “incidences” that may have a “negative impact on the Aadhaar brand”. The agency will provide weekly “Online Reputation Management Reports” to UIDAI, which will have details of “top detractors, top influencers and the net sentiment related to Aadhaar.”

Excerpt from the request for proposal for social media agency floated by the UIDAI on July 18.

“This monitoring activity shall extend to social media platforms, websites (news and others), blogs/ forums, etc. so that issues related to Aadhaar can be understood,” the tender document states. “The tools shall be capable of doing a sentiment analysis of all such conversations and flag any discrepancy in sentiments’ trend. Additionally, the Service Provider will draft a plan to work out and neutralise negative sentiments.”

Excerpt from the request for proposal for social media agency floated by the UIDAI on July 18.

Challenge in Supreme Court

The revelation of UIDAI’s interest in monitoring social media conversations with the intent of influencing user sentiments comes at a time when the Information and Broadcasting Ministry’s plan to create a social media monitoring hub faces a challenge in the Supreme Court on the grounds of privacy violation.

Through the Social Media Monitoring hub, the government wanted to monitor the social media accounts of individuals to gauge their opinions about government policies, create “360 degree profiles” of them and target them with personalised messages to alter their opinions. A public interest litigation in the Supreme Court has challenged this on the ground that the government cannot do so without obtaining the consent of the user whose data it would use.

UIDAI did not respond to Scroll.in’s specific query on whether the authority would be monitoring individual accounts and how this would be done without compromising their privacy.Unlike the Information and Broadcasting Ministry’s tender, the UIDAI’s bid document for hiring a social media agency does not specifically mention the monitoring of individual accounts, but it is not clear how an agency would identify “detractors” or “influencers” without tracking individual accounts.

Concerns over the misuse of social media data have acquired momentum globally over the past few months, ever since it was discovered that the UK-based political consulting firm Cambridge Analytica had mined through the social media data of individuals, without their informed consent, to use it for political campaigning. The company is alleged to have analysed the social media posts of individuals to create their psychological profiles, which it used for targeted messaging to influence their voting patterns.

Is monitoring already taking place?

This is not the first time the UIDAI has sought to hire a social media agency. It invited bids in 2016 for an agency that would “monitor individual social media user/account” and categorise sentiments related to Aadhaar into “positive, neutral or negative.” The outcome of the 2016 exercise is not known. The 2016 document explicitly mentioned the monitoring of individual accounts.

However, responding to Scroll.in’s email queries earlier, UIDAI said it has employed a media monitoring agency since 2011. “By monitoring all kinds of media, be it print, electronic or social media, UIDAI keeps abreast the problems and grievances of people with respect to Aadhaar and takes necessary and appropriate remedial measures for redressal and resolution,” it said.AB Pandey, the chief executive officer of UIDAI did not respond to Scroll.in’s calls and text messages, seeking a clarification on whether a social media agency had been hired in the past and whether such monitoring was already taking place.

It added: “(In) media monitoring it monitors only the information which is already in public domain and no private information is being collected or monitored.”

Apar Gupta, a lawyer in Delhi who works on digital privacy, however, pointed out that the hard distinction between the concepts of public and private had been negated by a nine-judge bench of the Supreme Court in a judgement on the right to privacy on August 24, 2017.

Justice K Kaul, one of the nine judges, said in the judgement: “Thus, for e.g., if the posting on social media websites is meant only for a certain audience, which is possible as per tools available, then it cannot be said that all and sundry in public have a right to somehow access that information and make use of it.”

Gupta argued: “For the government to scrape information from a person’s Twitter and Facebook accounts, even if they are public, conflicts with their autonomy that such information will be catalogued by the government and placed within a database. Most immediately it will make people self-censor themselves out of fear.”

The 2018 bid document is silent on whether the consent of social media users will be taken before monitoring their conversations. It is also not clear on how the misuse of such data can be prevented.

India does not yet have a law to ensure data protection or to define the process of obtaining consent from individuals before using their data. A government-appointed committee made recommendations on Friday, which some legal experts decried as a blow to the idea of consent and the right to privacy.

Support our journalism by subscribing to Scroll+ here. We welcome your comments at letters@scroll.in.

13679 - Surveillance is the Anti Thesis of Freedom

Sunday Spotlight: 'Surveillance is the anti-thesis of freedom' 

Shemin Joy, DH News Service, JUN 10 2018, 00:23AM IST UPDATED: JUN 10 2018, 09:16AM IST   

The fear of India becoming a surveillance state is growing in the country. Privacy of a ci...

Read more at: https://www.deccanherald.com/national/sunday-spotlight/surveillance-anti-thesis-freedom-674184.html

13291 - Aadhaar hearing: Senior counsel calls surveillance possibilities as mere rhetoric, says fingerprint data is only relevant for palmistry - First Post

Aadhaar hearing: Senior counsel calls surveillance possibilities as mere rhetoric, says fingerprint data is only relevant for palmistry

News-Analysis Asheeta Regidi Apr 13, 2018 17:44 PM IST

On Day 28 of the Aadhaar hearing, Additional Solicitor General Tushar Mehta concluded his arguments on the Aadhaar-PAN and the Aadhaar-Bank account linkages. The Bench also questioned the counsels extensively on the justification of these linkages, noting that the freezing of accounts thereby was a deprivation of the constitutional right to property.

Senior counsel Rakesh Dwivedi then commenced his arguments, arguing that the surveillance possibilities discussed by the petitioners were ridiculous and mere rhetoric. The purpose of Aadhaar, he argued, was authentication alone.

Aadhaar as a compulsory document for bank accounts

First, the Additional Solicitor General continued his arguments, that the amendments to the Prevention of Money Laundering (Maintenance of Records) Rules (PML), on Aadhaar-bank account linkage were for the benefit of the public. These rules, he stated were neither ultra vires the Aadhaar Act nor the RBI Rules.

The Bench, here, first observed that the challenge to the PMLA Rules was proportionality and on why there was a need to make Aadhaar compulsory when the RBI KYC Master Directions recognised six forms of Officially Valid Documents. To this, it was argued that the purpose was to prevent impersonation. Aadhaar, further, is one of the most robust IDs which cannot be faked, unlike others which are not based on biometrics.

On rendering bank accounts non-operational

The Bench, here, asked the Additional Solicitor General to specifically address Arvind Datar’s arguments for the petitioners, that the PMLA Rules are ultra vires the PML Act, and that no provision of the PMLA allowed validly opened bank accounts to be rendered non-operational. Further, the rationale behind linking with insurance as well as mutual funds was questioned.

To this, it was argued that the freezing of accounts in this manner was not permanent. The Bench, here, further observed that such freezing of accounts could amount to a violation of Article 300A of the Constitution, or the constitutional right to property. To this, it was argued that the freezing would only amount to a reasonable restriction on this right.

Is freezing of accounts a valid, penal consequence?

The Bench, further questioned if the penal consequence of freezing accounts was authorised by the PML Act. The Act, they said, only discussed the verification of bank accounts. To this, it was argued first that this was not a penalty but a mere consequence. Secondly, the rules were part of the Act.

The Bench, however, did not agree with this, observing that the prescription of penalties via rule-making powers had not been sanctioned by the Aadhaar Act. Further, freezing of accounts did amount to a penalty, since it amounted to a deprivation of property under Article 300A. The Bench further stated that their question was on whether the freezing of accounts was authorised under the law, or was it a case of judicial overreach.

Can penal consequences be prescribed via rule-making power

The Bench directed the Additional Solicitor General to show how rules may prescribe such drastic consequences when the Act did not allow it. The Additional Solicitor General cited judgments that rules once issued are effectively part of the Act. The Bench, however, observed that this cannot apply to rules made outside of rule-making power.

Senior counsel Rakesh Dwivedi, arguing for the State, intervened here, arguing that Aadhaar was a just a condition for opening and continuing a bank account, to meet the need to re-verify bank accounts. The Bench here, again questioned how a validly opened bank account could be frozen under the PMLA.

The Additional Solicitor General then summed up his arguments, discussing the threat from terror financing and also of cross-border offences. He argued that the purpose behind the PMLA Rules is threefold: zero tolerance to money laundering, curbing black money and reaching beneficiaries.

The Bench stated that the poor had an equal right to privacy. Reuters.

Petitioners are using rhetoric to rubbish Aadhaar

Senior counsel Rakesh Dwivedi then commenced his arguments for the State, arguing that he never felt that he was under surveillance while using Aadhaar, and further, that Aadhaar was voluntary. He argued that it was ridiculous to consider that the government would surveil people like a farmer and that the government had ample means of conducting surveillance if it needed to, without the need for Aadhaar. The petitioners, he argued, were using rhetoric to rubbish Aadhaar.

Technology as an enabler of mass surveillance

The Bench, here, observed that technology was a very powerful enabler of mass surveillance, with even elections being swayed using it. To this, it was argued that the technology in use by Facebook and Google could not be compared to that in use by the UIDAI. For instance, there were no learning algorithms in use by the UIDAI.

The Bench, to this, observed that the Aadhaar Act does not preclude the UIDAI from acquiring that kind of technology, to which Dwivedi responded that this would amount to an offence under Section 33 of the Aadhaar Act.

Authentication metadata reveals very little

Further, he argued that the only purpose behind Aadhaar was authentication, and there was no authorisation under the Aadhaar Act to analyse the data. The Bench questioned the collection of metadata, to which it was argued that the metadata collected was limited to that related to authentication, i.e., of the authentication request, the result, and the time of the authentication. The Bench, here, observed that even this data could reveal a lot about a person.

To this, it was argued that this was not possible unless such data is sought in collusion with the CBI, which is far-fetched. For a specific authentication, it was argued that the authentication request would reveal the place where the request arose from (such as Apollo Hospitals), but not specific location (such as which Apollo hospital).

The Bench here observed that the requesting entity itself may store data, and that surveillance need not be interpreted in the traditional sense only. The prevalence of commercial surveillance, and also the absence of a data protection law to protect the data was also pointed to.

Most people are not concerned with privacy

Dwivedi further argued that individual information is of no value. Further, most people were unconcerned about privacy. The Bench, here stated that the issue was not of whether 1.9 billion people are concerned with privacy. Regarding the information being available, he further argued that fingerprints were only of interest to palmists and for palmistry. To this, the Bench observed that the question was not of fingerprints per se, such as their use for a limited purpose. The issue, instead, was of storing them in a central database, followed by their use for authentication.

To this, it was argued that biometrics are encrypted, and the data is not shared with anyone. It was argued that it was understandable if the people had a problem with the implementation and enforcement of the Aadhaar Act, but there is no issue with the law itself and the technology.

Sharing of data under Aadhaar Act

A discussion then ensued on Section 29 of the Aadhaar Act, which permits the sharing of data. The Bench here observed that Section 29(3)(b) of the Aadhaar Act allowed the sharing of data with requesting entities to third parties. Further, Section 29 read with 57 allowed the information to be shared with third parties even under contracts.

To this, it was argued that this section should be read in context with Section 29(1), which completely bars the sharing of biometric data. The Bench, here, observed that the issue was not only about Section 7 or the UIDAI but goes far beyond that. Further, Section 29(3) uses the word ‘identity information’, which indicates that biometric data can also be transferred. To this, it was suggested that the Court read this provision down to prevent the sharing of biometric data.

The arguments will continue on 17 April.

Sources of arguments include live-tweeting of the case by SFLC.in, Prasanna S, and  Gautam Bhatia.

You can read out coverage of the Aadhaar Supreme Court case below.

Why SC needs to look into technical evidence of Aadhaar’s surveillance capabilities

Lack of governmental ownership of CIDR’s source code can have serious consequences

Will State give citizens rights only if they agree to be tracked forever, asks lawyer Shyam Divan

Coalition for Aadhaar: A collective of private companies wants to ensure that Aadhaar ID and related services continue to be offered

Petitioners argue on centralisation of data and challenge Aadhaar’s claims on savings

Petitioners argue for a voluntary ID card system that does not collect user data

Petitioners argue that receipt of govt benefits cannot be at the cost of compromising fundamental rights

Aadhaar is architecturally unconstitutional, argue the petitioners

Petitioners argue that Aadhaar violates dignity by objectifying and depersonalizing an individual

Petitioners seek compensation for starvation deaths and extension of March 31st deadline

Section 7 exception in Supreme Court’s interim order greatly affects people’s constitutional rights

Entire Aadhaar project is beyond the stated objectives of Aadhaar Act, argue petitioners

Petitioners conclude their arguments on 'the number of the beast' Aadhaar, highlighting various issues

Aadhaar hearing: Political liberties cannot be foregone for economic and social justice, states the Bench

Aadhaar hearing: UIDAI’s presentation discusses Aadhaar enrolment, updation and authentication processes in detail

Aadhaar hearing: Supreme Court expresses concerns with data breaches, Aadhaar security and profiling

Aadhaar hearing: Petitioners question UIDAI on verification of residency requirement, de-duplication rejections and authentication failures

Aadhaar hearing: Attorney General argues that pervasive collection of fingerprints meets proportionality requirements

Aadhaar hearing: Bench criticises the argument that Aadhaar can prevent bank frauds and terrorists from acquiring mobile numbers

Aadhaar hearing: Additional Solicitor General argues Aadhaar-PAN linkage enables deduplication, prevents fraud and widens the tax base

Aadhaar hearing: Not necessary to prove least possible invasion of privacy, argues Additional Solicitor General

The author is a lawyer and author specialising in technology laws. She is also a certified information privacy professional.

Updated Date: Apr 13, 2018 17:44 PM

13034 - Aadhaar is surveillance technology masquerading as secure authentication technology - Daily O

Aadhaar is surveillance technology masquerading as secure authentication technology

The results are not going to be pretty.

Politics

09-01-2018

JAVED ANWER

@brijwaasi

Aadhaar didn't start as surveillance technology. While the concept of a unique ID for all was fuzzy even in the beginning — around 2009 — it was meant to be an authentication technology that would plug leaks in India's welfare schemes. The idea behind Aadhaar seemed well-meaning, but the way it was designed and hurriedly pushed made it evident to keen observers that it was not going to end up well. There were many problems with it, but of particular note was the way Aadhaar would give the government and bureaucrats unnecessary power over individual citizens. 

Instead of being a tool of inclusion, Aadhaar would be a tool of exclusion.

Even in the early stages, it was difficult to imagine that one day the Aadhaar would turn into Frankenstein's monster. In 2018, it has become a tool that has the potential to put every citizen in this country under surveillance. The argument that Aadhaar is a tool to end corruption in India surfaced earlier this decade.

After 2012, and exceedingly after 2014, Aadhaar grew in ways it was not meant to when it was conceived. This has happened as the UIDAI — the agency in charge of the Aadhaar programme — acquired unaccountable power over the people of India, and made its operations as secretive and opaque as it can.

Fun fact 1: Do you know that under Aadhaar Act 2016, the UIDAI has virtually no accountability, but has provisions that stop Aadhaar users, that is ordinary Indians, from filing any complaint against it in court for the misuse of the UID?

Aadhaar: Arguably the world's biggest surveillance apparatus that a country has built to keep an eye on its citizens.

Fun fact 2: Do you know Aadhaar was never meant to be an ID card? In the initial days, Aadhaar was linked to government's welfare schemes. For instance, it was made mandatory for issuing ration to all those who held a ration card. This despite the fact that the Supreme Court, in its interim order, told the government that having the Aadhaar card cannot be made mandatory in any way.

Post-2015, all hell broke loose. By now, Aadhaar is no longer just technology to authenticate the identity of those entitled to benefits under government welfare schemes. It transformed into an authentication technology for almost everything Indians do. In 2018, if you go by the directives issued by the government, you have to link your Aadhaar to almost everything you own or do. Aadhaar is no longer required only for welfare schemes, like obtaining a ration card, but also if you want to continue using your phone.

It is “required”, although not yet mandatory, for availing banking services until March 31 because Supreme Court is hearing a challenge to it. Aadhaar is required for registering births in many parts of India, and even deaths. Aadhaar is required if you want an LPG connection, even if you don't intend to take subsidies.

And Aadhaar is required if you want to send your children to school or if you want your degree, and for treatment at many hospitals — even if you are an accident victim and are brought to the emergency with severe head trauma! This is just the beginning. If the Supreme Court dismisses the current challenge to link Aadhaar with every aspect of our lives, be ready to see more Aadhaar in your life.

Even simple tasks like buying airline tickets or making hotel reservations or renting homes will soon necessitate Aadhaar authentication.

It is important to understand why Aadhaar has become so pervasive. By linking the UID with children’s admissions in private schools, or by linking it with private data, such as your phone number, the government is not saving any money. It is not curbing or cracking down on corruption. It is just putting in place an infrastructure: arguably the world's biggest surveillance apparatus that a country has built to keep an eye on its citizens.

Sure, the United States’ NSA will still be bigger, but then NSA for now watches only non-Americans.

In the recent years, Aadhaar has metamorphosed into the perfect surveillance tool. It allows the government to collect and record every piece of data that Indians generate as they go about their lives. By storing this data in one place, with Aadhaar as its key, the government will be able to theoretically track and build profiles of every Indian with the UID.

There is the argument that we already leave a digital trail whenever we use a phone, carry out a banking transaction, book an air or train ticket or get an LPG connection, and so it doesn't matter that Aadhaar is linked with the service. That is true. But by linking every detail of our existence with Aadhaar, the government puts all of this data in one place and makes it incredibly easy to monitor, record and use.

Across the world, governments seek to gain more control over citizens. When they have achieved some level of control, they also abuse it, as history tells us. Even if the original intent is benign, never in the history has a government built surveillance apparatus and not abused it.

If we allow Aadhaar to grow unchecked, controlled and managed by an agency with no accountability — and it is the UIDAI that filed an FIR to go after people who pointed out Aadhaar flaws — the results are not going to be pretty.

PS: The headline of this article has been taken from a tweet often used by some Indian Twitter users to highlight the perils of Aadhaar. The full tweet is: "Repeat after me: Aadhaar is surveillance technology masquerading as secure authentication technology."

Also read: Why UIDAI's FIR against The Tribune journalist is a kick in the teeth of investigative journalism

12750 - Aadhaar surveillance chant is just silly scare tactic By R Sriram, ET Bureau|

Aadhaar surveillance chant is just silly scare tactic

By R Sriram, ET Bureau|

Updated: Jan 14, 2018, 01.07 PM IST

The biometric data is not accessible through the internet. It can only be physically accessed and even then it is difficult to link the biometrics with a particular individual. 

Hollywood may be worried over sexual harassment scandals these days but seven years ago, it was caught bang in the middle of a hacking scandal. Few may remember now, but a hacker spent many months taking down and controlling email accounts of celebrities like actor Scarlett Johansson and singer Christina Aguilera. 

He ferreted out private photographs, copied them to a folder on his computer and released them widely online, causing acute embarrassment, outrage and pain to the victims. It was caused by a simple hack because the victims had been foolish enough to leave enough personal information on social media websites which the hacker used to generate passwords and enter their accounts. 

This was in 2011. It is 2018 now and two things have happened simultaneously as far as online privacy debate is concerned. One, hacking has become increasingly sophisticated and effective. Two, the amount of personal, individual information available publicly has risen manifold. Not only are personal details widely available on social media networks, basic information about an individual can be accessed easily. Scour the internet for voters' list and you will come up with all the information you want: name, address etc.

No Access 

It is important to keep all this in mind amidst the raging debate over Aadhaar, which has been dubbed a fascist tool, a surveillance mechanism to enslave Indians and a project that leaks like a sieve and cannot be trusted. The fact that the Supreme Court will begin final hearings on January 17 on the validity of Aadhaar may just be a coincidence as to why we are having this debate now. Or, it may not be. Needless to say, there is a lot at stake 

The key issue about Aadhaar has always been the safety and security of its biometric data. Remember, the debate is not about public data like name, date of birth, address etc. It is the biometric fingerprint scan and iris scan that is the focus of everybody's attention. This is the personal data, which if hacked or violated, would be a very serious issue. 

Anti-Aadhaar activists say this is a surveillance state mechanism and should not be trusted. They allege that it is a tool to keep track of your financial dealings and movements. Having spent some time in understanding how Aadhaar architecture and security works with experts, I can categorically say that this is bunkum! 

Aadhaar has got nothing to do with surveillance or snooping. It is not a spy software or system that reads your emails, conversations or extracts your financial data from banks. It is not designed to track an individual's movements or personal or financial transactions. Calling it a surveillance state is a deliberate scare tactic, a mischievous and malicious propaganda, one that Dr Joseph Goebbels would have been very proud of! 

Aadhaar also does not store any financial or personal information. It is not designed that way at all. The linking of my bank account to Aadhaar does not in any way give UIDAI or its officials access to my financial records. They don't know what I do in my bank account, what products I buy or what services I use. 

The second aspect of Aadhaar, not widely discussed or widely known, is that the biometric data is not accessible through the internet. It can only be physically accessed and even then it is difficult to link the biometrics with a particular individual. The UIDAI system has compartmentalised data storage which would make it very difficult for a hacker or a raider to accurately identify individuals with just one set of information. 

For instance, in order to link the biometrics with an Aadhaar number, you not only need to have the Aadhaar number, but also the peference/registration number given at the time of enrollment. The job of the hacker, needless to say, becomes very difficult. 

UIDAI Vaults 

The physical-only access to biometric database is buttressed by the limited communication between the identification interface and the service provider. A bank, which sends request for identification to UIDAI database, gets only a yes or no answer. There is no transfer of images or data back to the service provider. Nor can the service provider get full access to the image stored deep in the UIDAI vaults. 

Only a sample of the image is used for identification purposes while the full image is stored in a place without internet access. No system is free from glitches or troubles. A big negative side effect of Aadhaar has been the tragic tales of denial of service in hospitals or of food grains to the needy. Governments and local bodies across the country must work together to ensure that such tragedies are not repeated. 

There surely must be a method to ensure that identities other than Aadhaar are used in emergency cases and that service is provided to the needy. Goebbels said that if you tell a lie big enough and keep repeating it people will eventually come to believe it. The anti-Aadhaar crowd with its alarmist propaganda of state surveillance seems to have taken the Nazi leader's advice to heart. Time to call their bluff. 

Read more at:

//economictimes.indiatimes.com/articleshow/62490444.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

12683 - Aadhaar is surveillance technology masquerading as secure authentication technology - Daily O

Aadhaar is surveillance technology masquerading as secure authentication technology

The results are not going to be pretty.

POLITICS

 |  5-minute read |   09-01-2018

Aadhaar is surveillance technology masquerading as secure authentication technology

The results are not going to be pretty.

JAVED ANWER

 @brijwaasi

• 173

  Total Shares

Aadhaar didn't start as surveillance technology. While the concept of a unique ID for all was fuzzy even in the beginning — around 2009 — it was meant to be an authentication technology that would plug leaks in India's welfare schemes. The idea behind Aadhaar seemed well-meaning, but the way it was designed and hurriedly pushed made it evident to keen observers that it was not going to end up well. There were many problems with it, but of particular note was the way Aadhaar would give the government and bureaucrats unnecessary power over individual citizens. Instead of being a tool of inclusion, Aadhaar would be a tool of exclusion.

Even in the early stages, it was difficult to imagine that one day the Aadhaar would turn into Frankenstein's monster. In 2018, it has become a tool that has the potential to put every citizen in this country under surveillance. The argument that Aadhaar is a tool to end corruption in India surfaced earlier this decade.

After 2012, and exceedingly after 2014, Aadhaar grew in ways it was not meant to when it was conceived. This has happened as the UIDAI — the agency in charge of the Aadhaar programme — acquired unaccountable power over the people of India, and made its operations as secretive and opaque as it can.

Fun fact 1: Do you know that under Aadhaar Act 2016, the UIDAI has virtually no accountability, but has provisions that stop Aadhaar users, that is ordinary Indians, from filing any complaint against it in court for the misuse of the UID?

Aadhaar: Arguably the world's biggest surveillance apparatus that a country has built to keep an eye on its citizens.

Fun fact 2: Do you know Aadhaar was never meant to be an ID card? In the initial days, Aadhaar was linked to government's welfare schemes. For instance, it was made mandatory for issuing ration to all those who held a ration card. This despite the fact that the Supreme Court, in its interim order, told the government that having the Aadhaar card cannot be made mandatory in any way.

Post-2015, all hell broke loose. By now, Aadhaar is no longer just technology to authenticate the identity of those entitled to benefits under government welfare schemes. It transformed into an authentication technology for almost everything Indians do. In 2018, if you go by the directives issued by the government, you have to link your Aadhaar to almost everything you own or do. Aadhaar is no longer required only for welfare schemes, like obtaining a ration card, but also if you want to continue using your phone.

It is “required”, although not yet mandatory, for availing banking services until March 31 because Supreme Court is hearing a challenge to it. Aadhaar is required for registering births in many parts of India, and even deaths. Aadhaar is required if you want an LPG connection, even if you don't intend to take subsidies.

And Aadhaar is required if you want to send your children to school or if you want your degree, and for treatment at many hospitals — even if you are an accident victim and are brought to the emergency with severe head trauma! This is just the beginning. If the Supreme Court dismisses the current challenge to link Aadhaar with every aspect of our lives, be ready to see more Aadhaar in your life.

Even simple tasks like buying airline tickets or making hotel reservations or renting homes will soon necessitate Aadhaar authentication.

It is important to understand why Aadhaar has become so pervasive. By linking the UID with children’s admissions in private schools, or by linking it with private data, such as your phone number, the government is not saving any money. It is not curbing or cracking down on corruption. It is just putting in place an infrastructure: arguably the world's biggest surveillance apparatus that a country has built to keep an eye on its citizens.

Sure, the United States’ NSA will still be bigger, but then NSA for now watches only non-Americans.

In the recent years, Aadhaar has metamorphosed into the perfect surveillance tool. It allows the government to collect and record every piece of data that Indians generate as they go about their lives. By storing this data in one place, with Aadhaar as its key, the government will be able to theoretically track and build profiles of every Indian with the UID.

There is the argument that we already leave a digital trail whenever we use a phone, carry out a banking transaction, book an air or train ticket or get an LPG connection, and so it doesn't matter that Aadhaar is linked with the service. That is true. But by linking every detail of our existence with Aadhaar, the government puts all of this data in one place and makes it incredibly easy to monitor, record and use.

Across the world, governments seek to gain more control over citizens. When they have achieved some level of control, they also abuse it, as history tells us. Even if the original intent is benign, never in the history has a government built surveillance apparatus and not abused it.

If we allow Aadhaar to grow unchecked, controlled and managed by an agency with no accountability — and it is the UIDAI that filed an FIR to go after people who pointed out Aadhaar flaws — the results are not going to be pretty.

PS: The headline of this article has been taken from a tweet often used by some Indian Twitter users to highlight the perils of Aadhaar. The full tweet is: "Repeat after me: Aadhaar is surveillance technology masquerading as secure authentication technology."

Also read: Why UIDAI's FIR against The Tribune journalist is a kick in the teeth of investigative journalism

12499 - Indian Govt postpones linking bank accounts to digital ID - Asia Times

The announcement on December 12 reverses the requirement for Indians to link their bank accounts to the Aadhaar system. Photo: AFP

INDIAAADHAAR

Indian Govt postpones linking bank accounts to digital ID

A day before the case came up in the Supreme Court, the government postponed the linking of the Aadhaar digital identity scheme to bank accounts

By SAIKAT DATTA DECEMBER 13, 2017 8:17 PM (UTC+8

A public outcry has forced the Indian government to delay plans to roll out a digital identity program on every citizen, linking bank accounts and other financial data.

The mandatory linking of the controversial Aadhaar system with bank accounts and mutual funds has been postponed, according to an announcement issued on December 12 by the Department of Revenue under the Ministry of Finance.

The announcement stated that a new date will be announced later. However, adding to the confusion, the Ministry of Finance issued a press release stating that bank accounts have to be linked by March 31, 2018. It is not clear if this rule applies only to new accounts or existing ones as well.

The Aadhaar project has become one of the most controversial issues in India, raising massive concerns about the government’s ability to carry out surveillance of citizens. While it was started as a “welfare” project to ensure better targeted deliveries of government subsidies, it was essentially a surveillance tool, predicated on the ability to track citizens and profile them.The notification by the federal government came just a day ahead of a hearing in the Supreme Court, challenging the mandatory linking of the digital identity system to bank accounts and other financial products. On June 1, the government of India had issued a notification modifying the Prevention of Money laundering Act (PMLA) mandating that all citizens link their unique digital identity number, also known as Aadhaar, to their bank accounts. A similar order has been issued by the Department of Telecommunications asking citizens to link their Aadhaar number to cell phone numbers.

Avoiding Judicial Scrutiny?

“One thing is clear. The hearing was slated to start from tomorrow and the government doesn’t want the court to look into this. That explains this last minute notification postponing the bank linking indefinitely,” Dr Usha Ramanathan, a legal researcher and one of the country’s biggest privacy advocates, told Asia Times. Ramanathan has been spearheading the move to scrap the Aadhaar project for over seven years and was instrumental in pointing out the various flaws in the project.

Pune-based Dr Anupam Saraph, a noted expert and designer of complex system has been another campaigner who has repeatedly raised concerns about the project over the last year. “The June 1 notification asking citizens to link their bank accounts was clearly illegal since the PMLA has no legal basis to freeze accounts of citizens. The government was aware of this and wanted to scare people into linking their accounts before the case came up for hearing,” he told Asia Times.

Reliable government sources said there was considerable concern over a “backlash from the public” if their bank accounts were frozen after December 31. Officials were worried that if the deadline was not postponed, many citizens would be denied access to their savings, which could lead to financial chaos.

The Indian Government issued a notification on December 12, 2017 postponing the mandatory linking of bank accounts to the Aadhaar number.

Worried over the growing implications of the project, the Supreme Court was asked earlier this year to also examine whether privacy is a fundamental right. A rare, nine-judge bench of the Supreme Court unanimously ruled that privacy is a fundamental right as enshrined in various clauses of the Constitution. “It has been four months since the landmark privacy judgment came out. The government has not done anything and was possibly waiting for the last minute, so that more people signed up, before issuing this notification,” Ramanathan said.

Ironically, the Unique Identification Authority of India (UIDAI) had issued a press release last week stating that the linking was mandatory. The press release was issued in response to a viral video by a lawyer, Aishwarya Bhati, who had pointed out that the linking could not be mandatory since the interim orders of the Supreme Court had specifically mandated it to be used for a few welfare schemes. While UIDAI argued that the law had overtaken the judgment, skeptics like Saraph are not convinced. “If the circumstances have changed, then the UIDAI should have gone to court and sought a clarification. Why did they push it through by threatening citizens?”

A Surveillance Regime

Started by the Congress-led UPA government nearly eight years ago, the plan had seen massive opposition from the Bharatiya Janta Party (BJP). During that phase, the then Chief Minister of Gujarat, Narendra Modi, publicly tweeted that he had met up with the Aadhaar team and expressed his concerns about the security of sensitive personal data. The team was unable to come up with convincing answers to his queries.

However, some time between the meeting and his election as Prime Minister in May 2014, Modi seems to have had a change of heart about the project. It was revealed that Modi, as the Chief Minister had not only required that his state join the project, but also collected data that was not even mandated by the project.

As the BJP-led NDA government took over in May 2014, many had hoped for a roll back of the project. However, the government went ahead and began to promote the project by virtually threatening citizens with disruption of basic services, such as the ability to file income taxes.

Earlier, petitioners to the Supreme Court had challenged the project, by pointing out the massive potential for misuse. As a German diplomat posted in India recently told this correspondent: “Such a scheme is prohibited by law in Germany. We have seen how such a database of citizens’ data can be misused and German law explicitly prohibits it.”

The Supreme Court passed two interim orders. One prohibited the government from expanding the scope of the project while the other specified particular welfare schemes where the project could be deployed. But the Modi government pushed through a ‘Money Bill’ in Parliament in 2016, and did not allow the Opposition an opportunity to block it. It has also  failed to deliver welfare schemes in a targeted manner and has instead excluded thousands of people from marginalized communities from getting their mandatory benefits.

The move ensured that concerns expressed by law makers were not taken into consideration and the government managed to push through the law, enabling surveillance clauses on the grounds of “national security.” This gives the government unfettered access to sensitive personal data for profiling citizens. Due to the lack of privacy laws, this opens up citizens to manipulations by the government, that undermines democratic principles enshrined by the Constitution of India.

11914 - The inexplicable U-turn on Aadhaar - Kashmir Monitor

The inexplicable U-turn on Aadhaar

By Aakar Patel - Published at: Aug 28, 2017

About 15 years ago, the newspaper I was editing carried the transcript of a conversation between Salman Khan and Aishwarya Rai. This had been published also by another English daily. Its reporter J. Dey (who was later murdered) had sourced it from the Mumbai police.

The transcript carried a mention of Preity Zinta in a vulgar comment on her by Salman. Zinta was offended and filed a defamation case against me.

The case carried on for a few years till she dropped it. However, what was interesting was that the police claimed that they had not done the phone-tapping. The voices were clearly those of the actors and so the tape was authentic. So who had tapped them? 

We still don’t know. There are many other instances like this. Like the Tata tapes, about 20 years ago, in which an English daily claimed that the corporate organisation was being forced to pay extortion money to separatists in Assam. The private conversations of Nusli Wadia, Keshub Mahindra, Gen. Sam Manekshaw and Ratan Tata were recorded and leaked. By whom? We don’t know.

All of these instances show that surveillance of Indian citizens by the government happens illegally without authorisation or supervision. Though these crimes became public, no official was charged with wrongdoing for the illegal surveillance.

Even the scale of legal surveillance in India is very large. A recent right to information application filed by A newspaper showed that the Union home secretary approved 10,000 phone taps a month. What is all this data being collected for? We are not told.

We do not have the safeguards and checks like other democracies. In the United States, the police must show evidence to a judge who has to authorise phone tapping, and that also is done with rigid conditions. That is lacking in India.

The lobbyist Niira Radia’s phones were tapped for months, and then, criminally, the conversations were leaked to the press. Even if there was no suggestion of a crime, people were smeared.

In India, the government can tap citizens and then deny it has done so, as in the cases mentioned above. Because of a lack of institutional process, the government has no control over the material gathered in surveillance, even if it is gathered legally (like in the Radia tapes). And there is no accountability.

This is the background to the judgment by the Supreme Court on the right to privacy. I have not got an Aadhaar card because I know the history of surveillance in India. Why should the government force me to hand over my biometric details to it? It is absurd.

As proof of identity, I have already a passport, a driver’s licence, a PAN card, my landline telephone bill, my electricity bill, the documents of my house, and my voter identity card.
These are all valid forms of identity issued by the government. How many other things does it want from me and why? 

I have received noticed from Airtel and HDFC bank that my mobile phone and my bank account must be linked to Aadhaar. 

There are horror stories of children in school being forced to get Aadhaar before they are allowed to appear for exams.

Aadhaar has already been made compulsory for filing tax returns (I filed mine early to avoid this silly rule).

The government’s supporters argue that if one has nothing to hide why resist registering under Aadhaar? My answer is that I don’t want to because the government’s safeguards are weak.

If the issue is that linking Aadhaar with bank accounts and PAN numbers can catch tax thieves better then I object. The civilised form of democracy assumes that people are innocent. Forcing everyone to link their biometric identity to their finances assumes everyone is guilty. This is unacceptable to me.

On April 8, 2014, Narendra Modi was campaigning in Bengaluru for the general election. He said he would scrap Aadhaar after winning.

Attacking Nandan Nilekani (who came up with the idea of Aadhaar) Mr Modi said: “I want to ask him what crime you have committed that the Supreme Court had to rap your Aadhaar project?”

Mr Modi added: “For the first time, I want to tell publicly. I asked several questions on Aadhaar project. I asked them questions relating to illegal migrants and national security. They (the UPA government) did not have any answer.”

From his position Mr Modi has totally reversed himself and forcing Aadhaar even on those who do not want it. Should he not explain why this reversal has happened? Of course he will not.

I met someone from an intelligence agency a few days ago. He said that there was a file on me which would have many details, much of which was gathered illegally. There must be thousands if not lakhs of such people the government is illegally spying on. Why should we enable this criminal activity by volunteering our details?

We must not, and the Supreme Court judgment has given hope that this compulsory enrolment of Aadhaar, linking our biometric identity to all aspects of our lives, will be stopped.

10551 - Intelligence agencies will not have open access to Aadhaar data: UIDAI chief - Hindustan Times

Intelligence agencies will not have open access to Aadhaar data: UIDAI chief

INDIA Updated: Oct 20, 2016 20:21 Ist

Aloke Tikku  Hindustan Times

Intelligence agencies will not have free access to Aadhaar data, a top government official said on Thursday, looking to assuage fears of abuse of personal information.

The Unique Identification Authority of India (UIDAI), which issued identity cards to 1.07 billion Indians, last month decided to retain data related to the verification of Aadhaar-enabled transactions for seven years, leading to security concerns over data safety.

As reported by HT on Monday, privacy experts expressed concerns that transaction data retained for so long could be accessed by the security establishment for surveillance on individuals without sufficient grounds.

“This fear is completely misplaced,” ABP Pandey, UIDAI’s chief executive officer told HT in an interview.

Security agencies can access the data only in case of national security after they get the nod of an oversight committee headed by the cabinet secretary. This committee has to clear every order made by the designated joint secretary-level officer before the information is shared, he said.

“You cannot have any legal protection stronger than this,” Pandey added.

Aadhaar transaction data is not only protected by the most powerful, contemporary law to restrict access but also by strong cryptography.

“Even if someone attempts, the 2048-bit encryption is so strong that it will take them millions of computers and billions of years to decrypt the data,” he said.

A vocal critic of Aadhaar’s design, Sunil Abraham of the Centre for Internet and Society (CIS) suggested he wouldn’t rely too much on the legal framework. “You cannot put a legal band-aid on a broken technological solution. You need to get privacy and security right by design,” the director of the Bengaluru-based research body said.

Abraham said the problem could have been averted if the UIDAI did not store the data in a centralised form. Instead, it could have used its digital signature to sign proof of authentication that could be stored by the authenticating agency and the citizen on a smart card.

10541 - Here’s Why Critics Are Against The Govt Decision Of Saving Aadhaar Records For 7 Yrs - Scoop Whoop

Here’s Why Critics Are Against The Govt Decision Of Saving Aadhaar Records For 7 Yrs

by Rakhi Bose

In a controversial new move, the Indian government will now be storing Aadhaar card records and data of users for seven years. The decision has provoked several familiar questions about state surveillance using the Aadhaar system.

What does this mean?

The Unique Identification Authority of India (UIAI) is the institution that gives out the 12-digit Aadhaar card number to applicants. This unique biometric identity (fingerprints and iris prints or retina scans are recorded along with the number) is used every time the Aadhaar card is used by a holder.  

UIAI will now be required to store records of all transactions and services completed using the Aadhaar card by holders. These include applying for licenses, getting LPG subsidies, applying for passports, bank accounts and government schemes.

How will it work? 

Services acquired through the Aadhaar card will require the Aadhaar number and fingerprints of the particular card holder. Every time a holder uses the card number and inputs their fingerprints, the information will be sent to the UIAI database by the agency in question. 

A particular card holder's records will be maintained two years on the online UIAI database, after which it will be transferred to the offline archives of the institution. 

Card holders can check up on the records within the first two years while it is up on the online database, but after that, the records will not be available for public viewing. 

There are provisions for security agencies to go through the records at any time, given they can procure a district judge's permission.

According to Hindustan Times, however, even some high-level officers at the Centre may be granted access to the records, on asking, on grounds of national security. 

Why it might be a problem

Most government files are saved for a maximum of five years. Many critics are claiming that storing the data for seven years is a new way for the government to practice surveillance on the citizens of India. 

“This is an unprecedented centralised data retention provision,” Sunil Abraham, director of Centre for Internet and Society, told HT. 

Coming in the backdrop of increasing data surveillance mechanisms, such as the ambitious NATGRID, a programme meant to counter terrorism and insurgency in real time by increasing data and intelligence analysis, many are seeing this as just another additional source of data for NATGRID. 

Abraham, who has been a previous opponent of the government's new Aadhar policies, opines that once Adhar becomes mandatory for all services, the database could easily used by people with criminal intent to run a '360 degree surveillance' on any individual card holder. 

Big Brother in the making? 

Earlier in March, the government of India announced that central government agencies can access the biometric Aadhaar database if it is a matter of national security. The move followed a series of student protests and country-wide student unrest.

Raman Jit Singh Chima, policy director of a leading digital rights organization, Access, had earlier criticised India's lack of safeguarding machinery in going forward with the Aadhar biometrics database scheme. He was referring to the US Foreign Intelligence Surveillance Court and Europe's data protection agencies, which oversee requests for access to user data, mechanisms which are missing in India. 

Implications in India

Fearing the possibility of India becoming a police state, with a surveillance grid even more close knit than the one maintained by NSA in US, uncovered by Edward Snowden in 2012, many ministers have also questioned the Aadhar bill. Odisha's Tathagata Satapathy, the chief whip of Biju Janata Dal, had questioned the government in March, as reported by Reuters: 

"Can the government ... assure us that this Aadhaar card and the data that will be collected under it – biometric, biological, iris scan, finger print, everything put together – will not be misused as has been done by the NSA in the U.S.?"

The BJP government maintains that the Aadhaar system, which was brought in place seven years ago to cut down on financial wastage and fraud during payments for services, has helped save the government an estimated 150 billion rupees in the 2014-15 financial year. 

Authorities at UIDI claim that the two year cap on public viewing of records is only to avoid a 'logistical nightmare', and that they would not be analyzing the 'purpose for which an authentication request' of data was sent, nut only the 'details of the agency that sent it'. 

However, the total surrender of all information to centralized government agencies has proved to be problematic internationally. With over a billion registered Aadhaar cards already in circulation in India, it is yet to be seen how the move will be accepted by citizens, opposition and the Supreme Court. 

Feature Image Source: PTI/Reuters 

10539 - Govt to keep Aadhaar records for 7 yrs, prompts fears of surveillance - Hindustan Times

Govt to keep Aadhaar records for 7 yrs, prompts fears of surveillance

INDIA Updated: Oct 17, 2016 08:56 Ist

Aloke Tikku  Hindustan Times

Women show their Aadhaar cards while standing in a queue at a poll booth in Ajmer. (PTI File Photo)

The government will keep a record of all the services and benefits availed using the Aadhaar number for seven years, say new rules, prompting fears that the database could be used for surveillance.

The Unique Identification Authority of India (UIDAI), which issues the 12-digit biometric identity to all Indian residents, will be required to preserve its record of verification of an Aadhaar number for the duration.

“This is an unprecedented centralised data retention provision,” said Sunil Abraham, director of the Bengaluru-based think tank, Centre for Internet and Society.

UIDAI chief executive officer ABP Pandey said the concerns were exaggerated. The agency was keeping records in case a dispute arose over a transaction.

Read | Aadhaar act kicks in as govt notifies rules

The information will be retained online for two years and another five years in the offline archives, say the rules notified in September.

Users will be able to check the records but only for two years.

This restriction won’t apply to security agencies. Pandey, however, said the records would not be available to them without a district judge’s permission.

But, Hindustan Times found that the rules allow designated joint secretary-level officers at the Centre to order access to information on the grounds of national security.

“Once Aadhaar becomes mandatory for all services, it can be used by benign and malignant actors to conduct a 360-degree surveillance on any individual,” Abraham said.

This is how the system, which will need millions of fingerprint-reading machines, works.

Every time a person fingerprints and quotes the Aadhaar number, the agency concerned sends the data to UIDAI to crosscheck the particulars.

The UIDAI authenticates about five million Aadhaar numbers, which are quoted to avail LPG subsidy, cheap ration and even passport, a day against a capacity to verify 100 million requests daily.

“You can think of it as Natgrid Plus,” Abraham said, a reference to the National Intelligence Grid being built by the government.

A one-stop database for counter-terrorism agencies, Natgrid will collate information real time from databases of various agencies such as bank, rail and airline networks.

“…we do not record the purpose for which an authentication request was received but only the details of the agency that sent it,” UIDAI’s Pandey said.

But seven years is a long time. Only a select category of government files are kept for longer than five years.

Asked about two-year deadline for users, Pandey said it would have been a logistic nightmare to let people access the records once the information was offline.

The Supreme Court has a ruled that Aadhaar is not a must for availing welfare schemes and is to decide if collecting biometric data for the 12-digit number infringed an individual’s privacy.

9857 - The Last Chance for a Welfare State Doesn’t Rest in the Aadhaar System - The Wire

The Last Chance for a Welfare State Doesn’t Rest in the Aadhaar System

BY SUMANDRO CHATTAPADHYAY ON 19/04/2016 • LEAVE A 

Boosting welfare is the message, which is how Aadhaar is being presented in India. The Aadhaar system as a medium, however, is one that enables tracking, surveillance, and data monetisation.

Rather than an identification regime, what we need is an opening up of India’s welfare bureaucracy. Credit: Matt Ridings, Flickr CC BY 2.0

Once upon a time, a king desired that his parrot should be taught all the ancient knowledge of the kingdom. The priests started feeding the pages of the great books to the parrot with much enthusiasm. One day, the king asked the priests if the parrot’s education has completed. The priests poked the belly of the parrot but it made no sound. Only the rustle of undigested pages inside the belly could be heard. The priests declared that the parrot is indeed a learned one now.

The fate of the welfare system in our country is quite similar to this parrot from Tagore’s parable. It has been forcefully fed identification cards and other official documents (often four copies of the same) for years, and always with the same justification of making it more effective and fixing the leaks. These identification regimes are in effect killing off the welfare system. And some may say that that has been the actual plan in any case.

The Aadhaar number has been recently offered as the ‘last chance’ for the ailing welfare system – a last identification regime that it needs to gulp down to survive. This argument wilfully overlooks the acute problems with the Aadhaar project.

Firstly, the ‘last chance’ for a welfare state in India is not provided by implementing a new and improved identification regime (Aadhaar numbers or otherwise), but by enabling citizens to effectively track, monitor, and ensure delivery of welfare, services, and benefits. 

This ‘opening up’ of the welfare bureaucracy has been most effectively initiated by the Right to Information Act. Instead of a centralised biometrics-linked identity verification platform, which gives the privilege of tracking and monitoring welfare flows only to a few expert groups, an effective welfare state requires the devolution of such privilege and responsibility.

We should harness the tracking capabilities of electronic financial systems to disclose how money belonging to the Consolidated Fund of India travel around state agencies and departmental levels. Instead, the Aadhaar system effectively stacks up a range of entry barriers to accessing welfare – from malfunctioning biometric scanners, to connectivity problems, to the burden of keeping one’s fingerprint digitally legible under all labouring and algorithmic circumstances.

Secondly, authentication of welfare recipients by Aadhaar number neither make the welfare delivery process free of techno-bureaucratic hurdles, nor does it exorcise away corruption. Anumeha Yadav has recently documented the emerging ‘unrest at the ration shop’ across Rajasthan, as authentication processes face technical and connectivity delays, people get ‘locked out’ of public services for not having or having Aadhaar number with incorrect demographic details, and no mechanisms exist to provide rapid and definitive recourse.

RTI activists at the Satark Nagrik Sangathan have highlighted that the Delhi ration shops, using Aadhaar-based authentication, maintain only two columns of data to describe people who have come to the shop – those who received their ration, and those who did not (without any indication of the reason). This leads to erasure-by-design of evidence of the number of welfare-seekers who are excluded from welfare services when the Aadhaar-based authentication process fails (for valid reasons, or otherwise).

Reetika Khera has made it very clear that using Aadhaar Payments Bridge to directly transfer cash to a beneficiary’s account, in the best case scenario, may only take care of one form of corruption: deception (a different person claiming to be the beneficiary). But it does not address the other two common forms of public corruption: collusion (government officials approving undue benefits and creating false beneficiaries) and extortion (forceful rent seeking after the cash has been transferred to the beneficiary’s account). Evidently, going after only deception does not make much sense in an environment where collusion and extortion are commonplace.

Thirdly, the ‘relevant privacy question’ for Aadhaar is not limited to how UIDAI protects the data collected by it, but expands to usage of Aadhaar numbers across the public and private sectors. The privacy problem created by the Aadhaar numbers does begin but surely not end with internal data management procedures and responsibilities of the UIDAI.

On one hand, the Aadhaar Bill 2016 has reduced the personal data sharing restrictions of the NIAI Bill 2010, and has allowed for sharing of all data except core biometrics (fingerprints and iris scan) with all agencies involved in authentication of a person through her/his Aadhaar number. These agencies have been asked to seek consent from the person who is being authenticated, and to inform her/him of the ways in which the provided data (by the person, and by UIDAI) will be used by the agency. In careful wording, the Bill only asks the agencies to inform the person about “alternatives to submission of identity information to the requesting entity” (Section 8.3) but not to provide any such alternatives. This facilitates and legalises a much wider collection of personal demographic data for offering of services by public agencies “or any body corporate or person” (Section 57), which is way beyond the scope of data management practices of UIDAI.

On the other hand, the Aadhaar number is being seeded to all government databases – from lists of HIV patients, of rural citizens being offered 100 days of work, of students getting scholarships meant for specific social groups, of people with a bank account. Now in some sectors, such as banking, inter-agency sharing of data about clients is strictly regulated. But we increasingly have non-financial agencies playing crucial roles in the financial sector – from mobile wallets to peer-to-peer transaction to innovative credit ratings. Seeding of Aadhaar into all government and private databases would allow for easy and direct joining up of these databases by anyone who has access to them, and not at all by security agencies only.

When it becomes publicly acceptable that the money bill route was a ‘remedial’ instrument to put the Rajya Sabha ‘back on track’, one cannot not wonder about what was being remedied by avoiding a public debate about the draft bill before it was presented in Lok Sabha. The answer is simple: welfare is the message, surveillance is the medium.

Acceptance and adoption of all medium requires a message, a content. The users are interested in the message. The message, however, is not the business. Think of Free Basics. Facebook wants people with none or limited access to internet to enjoy parts of the internet at zero data cost. Facebook does not provide the content that the users consume on such internet. The content is created by the users themselves, and also provided by other companies. Facebook own and control the medium, and makes money out of all content, including interactions, passing through it.

The UIDAI has set up a biometric data bank and related infrastructure to offer authentication-as-a-service. As the Bill clarifies, almost all agencies (public or private, national or global) can use this service to verify the identity of Indian residents. Unlike Facebook, the content of these services do not flow through the Aadhaar system. Nonetheless, Aadhaar keeps track of all ‘authentication records’, that is records of whose identity was authenticated by whom, when, and where. This database is gold (data) mine for security agencies in India, and elsewhere. Further, as more agencies use authentication based on Aadhaar numbers, it becomes easier for them to combine and compare databases with other agencies doing the same, by linking each line of transaction across databases using Aadhaar numbers.

Welfare is the message that the Aadhaar system is riding on. The message is only useful for the medium as far as it ensures that the majority of the user population are subscribing to it. Once the users are enrolled, or on-boarded, the medium enables flow of all kinds of messages, and tracking and monetisation (perhaps not so much in the case of UIDAI) of all those flows. It does not matter if the Aadhaar system is being introduced to remedy the broken parliamentary process, or the broken welfare distribution system. What matters is that the UIDAI is establishing the infrastructure for a universal surveillance system in India, and without a formal acknowledgement and legal framework for the same.

Sumandro Chattapadhyay works at the Centre for Internet and Society.