Kuldeep Singh, Nov 29 2017, 1:28 IST
In August 2017, Abhinav Srivastava, a Bengaluru-based IT professional, was arrested for stealing Aadhaar data. He piggybacked on the e-hospital server of National Informatics Centre to access Aadhaar data.
Earlier, in February, six employees of telecom service provider Reliance Jio acquired fingerprints from the Aadhaar Central Identities Data Repository to activate and sell SIM cards. These incidents clearly show that Aadhaar biometric and demographic data is vulnerable to electronic identity thefts. Clearly, the nation's capability to secure Aadhaar data amounts to an index of its cybersecurity status.
Evidently, Aadhaar data, due to its design, is vulnerable to identity theft and can be hacked. It appears the hackers acquired fingerprints and unique identification numbers from either the central database or database of other organisations and used it to assume identities and carry out fraudulent transactions. Hackers can digitally replay fingerprints for authentication purposes, or to even create a physical fingerprint with the use of a 3D printer.
The Department of Computer Science and Engineering, Michigan State University, US, conducted a study that established that replication of fingerprints was possible for under $500. With fingerprint replication being accessible so easily and at such low costs, making biometrics the universal access key will have severe repercussions, especially a rise in cybercrimes and identity theft.
While the government has made it easy for the common man to access services through Aadhaar, it may be too ambitious in its application. Clearly, Aadhaar lacks a security mechanism to uphold it. New Delhi should have looked at similar systems with unification of identity and authentication that the US follows to foresee cyber threats.
In 2008, the US Federal Regulator for Consumer Protection released a report on the correlation between identity theft and social security numbers which said that over 7% of the adult US population experienced identity theft, but also that it grossed over $100 billion in losses. The Aadhaar and the US social security numbers are different, but it is their dual use as identifier and authenticator that gives rise to the risk of identity theft.
Far from being a hypothetical prediction, the above statistics may well apply to India in the near future. In February, UIDAI filed a report against an employee of Suvidhaa Infoserve. This claim stated that 400 transactions were undertaken through replication of Aadhaar information saved on the Axis Bank gateway, which proves that the affliction of fraudulent transactions has achieved a head start on the legal and technical framework designed to prevent it.
The government launched the Aadhaar project in January 2009 to provide individuals and institutions a unified form of identification to eliminate the need for multiple identity documents. People, especially the underprivileged classes, seek services and benefits such as food coupons, pensions, insurance and apply to check their bank accounts; it is therefore necessary to ensure that only rightful recipients obtain the data associated with the new identification process.
Hot-zone for cyberattacks
Aadhaar is created on a central database that stores biometric information of citizens, called the Central Identities Data Repository - the treasure vault of an identity thief. Therefore, it is a hot-zone for cyberattacks from outside. Also, those who guard the vault have access to it, and have the potential to breach the database to make it susceptible to misuse and theft.
Aadhaar is also a prime target for hackers due to its dual role in identification and authentication of user credentials. Imagine that an individual's name is a password to access his valuables. People need to feed in their unique identification number and biometrics in order to verify their identity, and that identification alone gives them access to services and benefits.
Therefore, the remedial process that makes an excellent initiative also an efficient initiative is two-pronged. India requires the imposition of a legal framework that overcomes its current shortcomings and an improvement in its design to ensure it cannot be breached easily.
The shortcomings in the legal framework include the lack of a notification system that informs when a data breach does occur and a fee imposed upon individuals that request a log of their authentications. Additionally, a mechanism to reimburse losses incurred through identity theft is mandatory. Currently, all that an afflicted individual can access is a grievance centre, after which the law has no accountability to anybody to reimburse losses or process criminal charges.
Other measures to make Aadhaar a universal measure of identification and authentication must include steps to streng then the application infrastructure of Aadhaar. Towards this objective, encryption is the first step to secure a database of bio-metric records. It must also create another layer of security which strengthens the process through the use of a confidential element, such as a password or a PIN.
After hackers poach biometrics, it is imperative to acknowledge that this data cannot be reissued and becomes useless. A person's fingerprints in the hands of a hacker are useless to him/her. To store electronic identities in a barrel that can be ferreted out by hackers benefits cybercriminals more than it serves the entitled people.
(The writer is a Bengaluru-based cybersecurity professional and ethical hacker)
