13685 - Aadhaar Critics are not Ludites - National Herald

Aadhaar critics are not luddites


VIDYUT GORE

Published: Jun 14th 2018, 12.14 PM


              Photo courtesy: Twitter/@ceo_uidai
      File photo of UIDAI chief Ajay Bhushan Pandey

UIDAI chief writes that the fear of a threat to privacy because of the use of core biometrics in Aadhaar is exaggerated because biometrics are not secret information like PIN or password

The CEO of UIDAI, Ajay Bhushan Pandey, has written yet another opinion piece in a newspaper, which bravely argues against established tech security practices.

While Aadhaar FAIL generally tends to ignore individuals and their opinions, it is important to examine the claim and competence of a highly placed public servant, who arguably occupies one of the most important positions related to technology in India.

The UIDAI chief writes that the fear of a threat to privacy because of the use of core biometrics (fingerprints and iris) in Aadhaar is exaggerated because biometrics are not secret information like PIN or password. People, he went on to add, must know that even the theft of biometrics in a rare eventuality will not put one to the same level of risk as the leakage of a password.

A threat to privacy, however, is not about whether the information is secret or not. It is about having the choice of what information we grant and to whom. The residents of India are not criminals that their rights must be waived away and they be compelled to grant access to their biometrics, and that too, to an insecure system, because of a system whose compliance with the Constitution of the country itself has been questioned.

This, in fact, has been repeatedly brought up by the judges in the Supreme Court itself, and Pandey had the opportunity of being the only non-lawyer allowed to present his perspective directly to the judges themselves. The judges did not appear convinced and continued to see the invasion of privacy as an important issue left unanswered.

Perhaps Pandey means to call the judges Luddites as well? A Luddite, for those unaware of the term, is a person who is opposed to technological developments. Dr. Pandey calling those who oppose Aadhaar Luddites betrays knowledge of the meaning of the term, because the technological criticism of Aadhaar has been actually backed by technologically sound arguments and evidence. In contrast, the bombast of the "Aadhaar mafia" as the proponents of Aadhaar are increasingly being referred to, due to ongoing unethical practices, are yet to present any factual rebuttal.

It is worthwhile to take note of some of the Luddites, as Dr Pandey would prefer to call them, who have been critical of Aadhaar. Justice K.S. Puttaswamy, retired judge of the Karnataka High Court and the original petitioner in the landmark ‘privacy case’ is one.

It is an irony that while critics of Aadhaar seem to have impeccable technological credentials while the UIDAI chief, who has the gumption to call these critics Luddites, himself doesn’t seem to understand the difference between private information and secret keys despite repeated explanations

Vicram Crishna, one of the two Indians to help develop software to enable Stephen Hawkins to ‘talk’through his wheelchair, J.T. D’Souza, biometrics expert, Troy Hunt, a web security professional and regional director for Microsoft in Australia, French cyber security researcher Baptiste Robert who tweets as Elliot Alderson and Anupam Saraph, a respected inventor and advisor on governance, informatics and strategic planning are also among those who have publicly expressed their concern about Aadhaar.

Alderson in fact has compared unfavourably Aadhaar’s approach to security as a ‘school level project’. Mozilla, the organisation behind the Firefox browser, has come out publicly in criticism of Aadhaar. And in case more critics are to be named, one can cite the names of legal scholar Shamnad Basheer, Linux consultant Anivar Arvind and Samir Kelekar, who has a PhD in computer networking and holds three patents related to mobile security.

It is an irony that while critics of Aadhaar seem to have impeccable technological credentials while the UIDAI chief, who has the gumption to call these critics Luddites, himself doesn’t seem to understand the difference between private information and secret keys despite repeated explanations.

For his benefit, let me repeat the explanation. When you use a key to control access or authorisation, that key must be secret and not merely private. Just like guessing where you were on Saturday night or knowing the name of the street your home is on should not allow people to create a bank account in your name, lifting fingerprints off your glass of water shouldn't allow them to create a bank account and launder money in your name either.

A secret key must be one that is known only to the person who is the rightful owner of that access. In the event of a breach, it must be readily revoked and replaced. It must be unique. Just like you don't use the same password for your Twitter and netbanking, you should not use the same fingerprints for your PDS and money transfers either.

This is not very difficult to understand. If Dr. Pandey is not able to understand it with so many explanations provided repeatedly over years, perhaps he should undertake correcting the deficiencies first before holding a technology related job.
Till date there hasn't been a shred of factual explanation for why the criticism of Aadhaar is incorrect, while there have been various face saving measures because the UIDAI has no answers for valid criticism. Like the farce of "Virtual ID" to protect privacy after Aadhaar data has already been proliferated with little caution. If he has any factual explanation to show how Aadhaar does not violate privacy, he should not have kept it a secret from the Supreme Court.

While he is at it, Dr. Pandey should also name one private corporation that would pay the kind of money Aadhaar has cost the country for the quality of work on display. One corporation that deals with sensitive identity information or access to financial transactions that would be willing to risk access being protected by something as flimsy, as unrevokable, easily leaked, private information.

When public funds are used to subvert public interest, criticism is inevitable. Calling critics names cannot stop it.

Sorry, sir. "Fikar not, all is well" does not quite answer the mounting criticism.

Click here to subscribe to National Herald on WhatsApp & Facebook

13524 - Aadhaar: a project replete with tech glitches and errors - National Herald

https://www.nationalheraldindia.com/opinion/aadhaar-a-project-replete-with-tech-glitches-and-errors


Aadhaar: a project replete with tech glitches and errors

VIDYUT GORE

Published: May 13th 2018, 03.57 PM



                            Photo courtesy: PTI


Aadhaar is a project that shouldn’t have left the testing phase. It is a grand idea; an easy “solution” for a verifiable universal ID, but in practice, such an idea doesn’t coexist with reality
Among the measures taken to protect the Aadhaar database is a 13-feet-high wall that is 5 feet thick, KK Venugopal, Attorney General of India, told the five judge bench in the Supreme Court hearings on the constitutional challenge to Aadhaar. The UIDAI has told the Supreme Court that the Aadhaar Act had already been framed with privacy in mind. At another time, they have also argued that citizens did not have a right to privacy before the privacy judgment was passed.
The UIDAI CEO submitted before the Supreme Court the authentication log that made it clear that he has disabled biometric authentication for his own Aadhaar. Given that the UIDAI headquarters has AEBAS - Aadhaar Enabled Biometric Attendance System, the log also proves that the CEO of UIDAI bypasses the system to get to office. All government servants are required to mark attendance. The CEO of UIDAI doesn’t. The official Twitter handle of UIDAI has recommended people to keep their Aadhaar number secret as well as said that it could be freely shared as needed. Such contradictions are routine with Aadhaar. Having an Aadhaar is voluntary and mandatory at the same time.

Aadhaar is a project that should never have left the testing phase. It is a grand idea - an easy “solution” for a universal ID that is verifiable, indestructible and can be used “everywhere” to end “all” identification problems in one swoop, an ID that is secured by something unique to the person. In practice, such an idea does not coexist well with reality, as is seen from the self-contradictory statements from the UIDAI and the government over time.

The evolution of Aadhaar

Aadhaar began as a simple authentication of an individual that could be verified with biometrics. With official documents like a passport or election card that provided proof of identity as well as address, and PAN that was proof of identity, there was no reason for widespread adoption of Aadhaar which, at that point was neither a document nor had any basis in law. Aadhaar needed to become a one step answer to KYC, so on the fly, Aadhaar became a proof of address as well. UIDAI has no means to verify addresses provided when creating an Aadhaar and considers this to be the responsibility of enrolment agencies with no oversight, but the fees per enrolment do not appear to budget for verification of documents in person. Regardless of this serious flaw, Aadhaar was declared a proof of address and, when adoption was still reluctant, was made mandatory for the continued use of crucial services like rations, government pensions, school admissions, examination attendance, claiming life insurance, owning mobile SIMs and bank accounts. To give Aadhaar credibility, it was made acceptable as proof of address and identity for creating passports, opening a clear path for illegal immigrants and other foreign actors to assume de facto citizenship of India by holding an Indian passport. Foreigners who reside in India for six months are required to get an Aadhaar! This “ease” of verification using an unverified proof of identity has become a selling point that ‘saves’ services money spent on verification. Businesses profit from use of their services regardless of whether the use is legitimate or criminal. They can save money on compliance with KYC norms by adopting a cheap solution the government itself is promoting. The system STILL has serious vulnerabilities and data unreliability nine years later but that ubiquitous number is attached to every significant interaction with the government or large corporations, regardless.

CONVENIENT, BUT IMPRACTICAL SECURITY
Unlike a password, fingerprints or the iris cannot be revoked. Unlike most digital accounts, an Aadhaar number cannot be closed or changed. The use of biometrics to secure data associated with a number that also cannot be changed leaves the data attached to a compromised Aadhaar permanently insecure.

INAPPROPRIATE TECHNOLOGY

In a country the size of India, an “acceptable” identification success rate would still have to be above 99.9% for any technology to be considered reliable. One per cent of a country of a billion people is still 10 million people and bigger than many other countries. Even 0.1% would still be over a million! Failure rates as high as those in the use of Aadhaar haveno business being in live deployment.

INAPPROPRIATE METHOD OF AUTHENTICATION FOR PURPOSE
It is not the “fault” of the system. The system is operating as designed. The fault is in the design. For an application that must consistently identify a person and reject impersonation, a probabilistic method is not appropriate. The method of authentication should be one that cannot make mistakes in normal operation. Verification emails, passwords, two-factor authentications are pretty much the standard on the Internet. It is because they work consistently as long as the system is secure. When you see an official handle make a tweet, you know it is authentic, and if the handle gets hacked due to some lapse, there are immediate steps to secure it. There is no “probably” about it. The post is authentic or removed. In contrast, no two fingerprints are exactly alike, even when by thesame person, at the same time, one after the other. Whether two fingerprints are recognised to be the same will depend on how much difference between the two is accepted by the system. Too little and valid fingerprints will be rejected because of slight variations. Too much and invalid fingerprints will be accepted if they are similar enough. The result of biometric authentication is - “this is probably the person they claim to be” - not at all good when you consider that it is the basis to get bank accounts, PAN cards, passports, government welfare, and more. The opposite “this is probably not the person they claim to be” has proved catastrophic when desperately poor people have been denied welfare because of that “probably”.

IRRESPONSIBLE DEPLOYMENT

Way before Aadhaar was ready for deployment with sensitive data on a massive scale - it still isn’t - it was rolled out. Even as cases objecting to Aadhaar stagnated in the Supreme Court for years, the government openly flouted the Supreme Court’s orders that Aadhaar cannot be made mandatory, made false claims on behalf of the Supreme Court and access to an increasing number of necessities became conditional to Aadhaar.

One reason for this could be that the government realised too late that they had spent a lot of public funds on a project that could not be fixed without changing it fundamentally and the only way to evade accountability was to create an illusion of success by making the project too big to fail. Another reason could be that the big data business interests driving the project wanted the data of every Indian - willing or not. The citizens and the country will end up paying the cost of this reckless proliferation. When dying people and women about to deliver babies are unable to access medical attention in a hospital due to lack of an Aadhaar, you know there is something inherently inhuman about the project. Even outright enemies injured in war are to be given medical treatment according to the Geneva convention, but the government, under the pretext of preventing “leakages”, requires an Aadhaar to ensure medical treatment of its own people. What leakages are there in ill people needing medical assistance? Can an Aadhaar prove that a person claiming to be ill is really ill? Who is responsible for the endangered doctors and hospital staff at the hands of irate relatives if a patient dies due to treatment being refused for lack of Aadhaar? Fear is a powerful motivator. The more necessities are attached to Aadhaar, the more people are forced to adopt it. This is not a government representing the people’s interests, as implied by a democracy and elected representatives. This is a government intimidating the people in order to impose their preference.

INADEQUATE DATA SANITISATION

Test data is in the Aadhaar database. Data from accounts created in a time of blatant corruption of the enrolment process is there in the Aadhaar database. Aadhaars of fictional applicants like animals, plants and Lord Hanuman are there in the database, till they get publicly exposed and reactively removed by an embarrassed UIDAI. My personal favourite is one Mr Kothimeer (Coriander) with Aadhaar number 4991 1866 5246, who is the son of Mr Palav (Biryani), Mamidikaya Vuru (Village Raw Mango), of Jambuladinne in Anantapur district, as reported by the Deccan Herald. And of course the infamous Lord Hanuman, who not only had an Aadhaar, he also managed to link it to an LPG account for subsidies. CSC, with whom the UIDAI refused to renew the contract for Aadhaar enrolments for reasons of “corruption complaints and enrolment violations”, is responsible for a fifth of all Aadhaar enrolments, which continue to be in the Aadhaar database. Countless entries created by fraudulent means are there in the Aadhaar database. There are now 50,000 ex-operators who know how to use the system, being targeted by software pirates who have cracked the enrolment software that bypasses the security measures to allow anyone who buys it to update the Aadhaar database. Thousands of Aadhaar cards are dumped in wells and are stacked in post offices because they don’t have a real address, they exist as numbers that could be authenticated with biometrics and used as proof of that non-existent addresses by people who created them. Dead people’s numbers are there in the database. Immortal now, because an Aadhaar cannot be deleted, but could still be misused There is no telling how many of the Aadhaar numbers are authentic and of real living people, how many of dead people, how many are fake, but created without malice - plants, chairs and such pranks and how many are fraudulent Aadhaars created by criminals to enable ghost accounts for illegal activities.

LACK OF FAILSAFES

There is inadequate planning for what happens when Aadhaar fails. While the government claims in the Supreme Court that no one is denied their rights, researchers have conclusively established widespread exclusion due to Aadhaar failures. There are people denied an Aadhaar in spite of multiple applications, people who have Aadhaars, but can’t use them, because of operators making errors, there are queues of desperate people waiting to enrol or update their Aadhaars, because no one has bothered to ensure adequate facilities to accommodate for those willing to bow to the ruthless imposition.A simple example: Till recently, Aadhaar was mandatory for mobiles and banks. Verification can only be done in person. The aged and the disabled not only have to brave the queues at enrolment centres, they have to go to banks and mobile service centres in person, or lose both. Yet, these people would need both far more desperately than most of us - for monetary disability assistance and calling for aid in need.

IMPROPER UNDERSTANDING OF SECURITY
The UIDAI’s understanding of security appears to be largely political, where their primary focus is to maintain an perception of Aadhaar as invulnerable. However, Aadhaar is not a PR exercise and claims that sound successful cannot alter technological reality. Security in technological applications is a matter of impeccable processes to resolve problems and the UIDAI’s approach to it is embarrassingly childish, where it seems to think that if it denies problems, they will go away. A two year old with a face smeared with chocolate saying, “I didn’t eat the chocolate” is cute. An organisation responsible for sensitive data of over a billion people that is compromised over and over again, saying “Aadhaar is safe” is not. A requirement in tech security is that the developers are responsive to security issues and attentive to established communication channels so that any problems may be rapidly identified and resolved. Large scale implementations offer bug bounties, where skilled researchers volunteer their time testing a deployment and report any security issues for a reward to reduce likelihood of malicious hackers finding vulnerabilities. What the UIDAI does is the opposite. It actually files cases against those who show problems with the system publicly while ignoring them if they do it confidentially. This encourages people to at best do nothing about them, leaving them available for other malicious actors to exploit, or worse, to exploit the vulnerabilities themselves. This approach is not just poor on security, it is stubbornly insecure.

DENIALS PREVENT PROBLEM SOLVING

To date, the UIDAI has not admitted a single problem with Aadhaar publicly. If a problem cannot be accepted to exist, a solution cannot be found for it, because there is no problem. Worse, even if solutions present themselves, they cannot be allowed, because adopting them will imply that there was a problem.

THERE HAVE BEEN PROVEN COMPROMISES OF AADHAAR SYSTEM

The Aadhaar system has been reported to be compromised in many ways from the start. From dogs and trees and gods having Aadhaar cards, to reports of duplicated fingerprints being used to create Aadhaar cards. From Axis Bank, Suvidhaa Infoserve and eMudhra using a replay attack to test implementation of the Aadhaar system to Airtel Payments bank using authentication provided for validating SIM cards to create bank accounts and divert subsidy payments into accounts it held. There have been countless enrolment and fake Aadhaar frauds as well. From simple printing of bogus Aadhaar cards, to use of fake fingerprints and tampered software to bypass UIDAI’s security measures. The UIDAI’s response has been unfailingly monotonous. “Aadhaar is secure”.

LACK OF ABILITY TO PREVENT MISUSE OR TRACK IT
To date, there has been no news of those who sell illegal access to the Aadhaar database being found and arrested. Biometrics of a bank officer were sold to illegally allow access to the database. Software was tampered to bypass biometric checks in at least two scams. Illegal access to the database was sold on social media. All the sellers continue to be at large. People who have been shown to compromise Aadhaar security in sting operations have not been reported to be arrested. There is no end to this madness and it has proceeded so far, that the UIDAI admitting or not admitting vulnerabilities has become irrelevant. Aadhaar presents a threat to the privacy and security of citizens and makes them vulnerable to identity and monetary theft, surveillance and targeting. It presents a threat to the nation when it compromises its security by providing an insecure method of identification that allows extensive aspects to all necessities of life. It is a threat to international relations by providing international terrorists to easily get an Indian passport and conduct attacks that implicate our country. Aadhaar has gone beyond any point of recovery. It is irredeemably corrupted and unreliable, and the only “secure” solution for Aadhaar now is to completely suspend the project and set about destroying the data. This too is not going to be an easy task, given the reckless proliferation done in an attempt to make Aadhaar too big to fail. Aadhaar will fail sooner or later under the weight of its own incompetence and contradictions. The critical issue now is to ensure that it cannot do more harm to citizens and country. Destroy the Aadhaar, investigate its proliferation and prosecute its perpetrators.

(Vidyut Gore writes on Aadhaar for Medianama and also documents Aadhaar on aadhaar.fail)

13397 - Aadhaar numbers of 69,83,048 school children leaked, reports security researcher - Medianama

Aadhaar numbers of 69,83,048 school children leaked, reports security researcher

• Vidyut

By  Vidyut ( @Vidyut vidyut@medianama.com )     April 27, 2018   
Share This:            Share via Email   

Security researcher Srinivas Kodali has reported another leak of Aadhaar numbers, this time, of school going children, along with details of their school, class, medium (language) and date of birth.

View image on Twitter

Srinivas Kodali | శ్రీనివాస్ కొడాలి@digitaldutta

Around 69,83,048 children's #Aadhaar data is leaking online. Who is responsible to protect their privacy, Govt, parents, teachers or SC? The first leak I reported in Feb, 2017 was children's data. The UIDAI has never acknowledged this and continues to say, there is no problem.

12:43 PM - Apr 27, 2018

• 110
• 221 people are talking about this

Twitter Ads info and privacy

Security researcher Srinivas Kodali has reported several leaks of data in the past. Notably the leak of over 130 million Aadhaar linked details last year and the leaks of surveillance enabling data and data of MNREGA workers this week.

This isn’t the first time that government websites have leaked data of citizens. Srinivas Kodali has also reported a leak of 500,000 to 600,000 Aadhaar details of children by a Telangana Government website last year.

The government has repeatedly denied leaks and breaches of Aadhaar data, including in replies to direct questions in the Parliament:

As on date, no incident of data breach has been reported from Central Identities Data Repository (CIDR) of Unique Identification Authority of India (UIDAI).

MediaNama’s take

Children in India are legally not able to consent, and making the providing of Aadhaar mandatory in schools forces enrollment with the “consent” of the guardian. However, in reality the parent or guardian has no choice but to get the Aadhaar made, so the consent is illusory. This had been a point of argument by petitioners in the constitutional challenge to Aadhaarbeing heard by a 5 judge bench in the Supreme Court of India.

Leaks of information of this sort further compromise the privacy of children and can make them vulnerable to criminals who can use such information to gain their trust. Children, for example are usually taught to not trust strangers, but if the stranger knows their school, class, and even their birth date, perhaps the names of some friends and challenges them to recognize them?

There is increasing aggregation of data of children due to Aadhaar. An example is theGovernment of Haryana recording not just the names and Aadhaars of students, but their religions, castes, parents names and Aadhaar, their occupations, income and more.

Additionally, the usual problems with data leaks apply. Insecure websites making confidential data public, lack of appropriate reporting mechanisms and ongoing government denials and lack of engagement on the seriousness of breaches of privacy caused due to inefficient government websites as well as government policies that force citizens to give up their information.

13351 - New data leak allows targeting by religion, caste and locality and provides Aadhaar and bank details - MediaNama

https://www.medianama.com/2018/04/223-new-data-leak-allows-targeting-by-religion-caste-and-locality-and-provides-aadhaar-and-bank-details/

New data leak allows targeting by religion, caste and locality and provides Aadhaar and bank details

• Vidyut

By  Vidyut ( @Vidyut vidyut@medianama.com )     April 24, 2018   
Share This:            Share via Email   

Security researcher Srinivas Kodali has reported the leak of data of individuals on a website that includes the Aadhaar number, bank – branch, IFSC code and account number, father’s name, address, gram panchayat, mobile number, ration card number, occupation, religion and caste information. Due to the sensitive nature of the leak, the name of the Andhra Pradesh government website is being withheld till the data can be secured.

View image on Twitter

Srinivas Kodali | శ్రీనివాస్ కొడాలి@digitaldutta

It has always been said #Aadhaar is being linked to religion and caste information, apart from occupation. While UIDAI is not doing it, other government departments are. Here is proof that UIDAI has no idea what all is being linked to your unique id. Website reported early today.

12:33 PM - Apr 24, 2018

• 177
• 333 people are talking about this

Twitter Ads info and privacy

While the government and UIDAI have argued in the Supreme Court that Aadhaar cannot be used to profile individuals, Aadhaar numbers being linked to various sets of information allow aggregation of discrete sets of data into a pervasive whole. The information, as seen here clearly allows for targeting of individuals by religion, caste, locality and more. While the government claims that it does not have the capabilities to use Aadhaar in this manner, actual applications of such use refute their claims.

View image on Twitter

Srinivas Kodali | శ్రీనివాస్ కొడాలి@digitaldutta

Government says we will only track beneficiaries of govt programmes through #Aadhaar. In short they want to track everyone, how can you not use any government service in a country? #surveillance is being called e-governance these days.

2:44 PM - Apr 24, 2018

• 86
• 122 people are talking about this

Twitter Ads info and privacy

Kodali shared a heavily redacted screenshot of the kind of data publicly available on the site. The facility clearly allows for searching of individual information and returns lists that can be used by anyone to get targeted lists of people whose information is on the site. Kodali has stressed that this database is publicly available and that there is no unauthorized access or hacking involved to access it. It is published publicly.

The ability to generate lists of this sort is no minor data breach and has security implications for entire communities. Information of this sort can be used to frame people as well.

MediaNama spoke with Srinivas Kodali and he says that there continues to be no way to report these data leaks to the government and UIDAI. After he tweeted about the data leak, someone masked the Aadhaar numbers from the database. However the database with all the remaining information is still online and public.

The report of the Task Force on AI published last month makes specific mention of the potential of Aadhaaar in the creation of big data as well.

Earlier this month, we saw the Haryana government collecting detailed profiling informationfrom all students from schools in Uttar Pradesh.

MediaNama’s take

Privacy of Indians will continue to be compromised while the government does not take data security seriously and responds to reports of breaches and leaks with denials and persecution of the researchers reporting the leaks.

Needless to say, criminals who gain access to such information would not be reporting them, but exploiting the information.

The risk of data leaks is made worse due to the linking of Aadhaar with various sets of data. This allows data to be collated across multiple leaks into increasingly detailed profiles of people by matching Aadhaar numbers across unrelated data sets. Of course, such profiling is also possible without leaks, conducted intentionally, by the government or other private players with access to the data.

Storing of the Aadhaar number against individual data must be stopped immediately to prevent the risk of aggregation of such data. Additionally, the government needs to ensure that databases that collect information of individuals are secured appropriately.