Home News Reports Aadhaar, the technology, and the privacy debate

Aadhaar, the technology, and the privacy debate

The Aadhaar project has long been criticised to have impinged upon our privacy. Whether right to privacy is absolute, is it a fundamental right, etc. are matter that are sub-juice with the honourable Supreme court of India, which has reserved its verdict as of now. This article discusses how, and if Aadhaar actually infringes upon our privacy. Let’s dissect between what government claims and reality on ground.

Privacy and Aadhaar

Your Personal Identifiable Information i.e. PII is an essential part of privacy. PII consists of your name, address and other identifiable information along with, but not necessarily, your biometrics i.e. your biological data. With Aadhaar enrollment, you have to submit this data to the Government of India. Does it mean your your privacy has been impinged upon? There are points supporting both sides of the debate.

Even before Aadhaar, there were quite a few government systems that mandated you to submit these details to access a service. For example, you need to submit your Name, Address, Date of birth, Photograph and fingerprints to get a Passport. You need to submit your blood group to get a driving license. All that Aadhaar has introduced for the 1st time is “Iris Scan”, this is because a majority of manual labourers have their fingerprint ridges not clearly recognisable and hence the authorities had to look for some other unique biometrics.

- Ad - - article resumes -

Submitting your PII to government is not new. And Aadhaar is as much ‘mandatory’ as other such schemes. For example, you can refuse to have a Passport or a Driving license, but then you have to let go the privileges that comes with these. Similarly, you can refuse to have Aadhaar and forgo all benefits that comes with it.

One rider though, Aadhaar now seems to be tied up with everything or at least going to be tied up with almost everything. So giving up Aadhaar related benefits is not going to be ‘as easy’ as giving up on a driving license or passport.

What the government claims:

Let’s dissect the steps before you get an Aadhaar card and what happens after that:

Data Collection/ Enrollment

Information collected from you at an Offline centre is encrypted at source. Once your details are keyed in, the vendor collecting data can’t read it. He just has to submit this data to Central Identities Data Repository (CIDR). Also, these packets that are sent to CIDR for storage are biometrical signed by the vendor. In case of any dispute or controversy, the authorities know which vendor gave this data.

Data Storage

All your information along with biometrics are stored in encrypted form and decrypted only on demand. The packets are stored on Hadoop clusters, which provides distribution and high availability of large sets of data. For the searches, they use Mongo with Solr indexes. Because all these support clusters based storage and data is partitioned, there is no single point of failure.

Aadhaar Allocation

Once your data is stored, you are given a unique 12 digit Aadhaar number which is completely random. It doesn’t tell anything about yourself unlike your PAN where the fourth character tells the type of PAN holder, fifth character tells the first letter of your surname and so on.

Aadhaar Data Access

Who Can Access – There is a list of requesting entities known as eKYC User Agencies (KUA) and Authentication User Agency (AUA). They don’t have direct access to CIDR servers to authenticate you. There are Authentication Service Agencies (ASA) who have secured leased line connectivity with the CIDR, which is compliant with UIDAI’s (Unique Identification Authority of India) standards and specifications.

There is a formal set of procedures, guidelines and scrutiny before one becomes a AUA/KUA/ASA. For example, NPCI (National Payment Corp of India) is an ASA. Axis bank is a KUA. So, for the annual KYC activity, Axis bank can just tell you to give your biometrics on a device, it’s transmitted to NPCI which routes it to CIDR and CIDR responds with a Yes (Or No). There is no physical document submission.

Modes of Access – Aadhaar is a ID management system. It authenticates you and tells the authority “You are who you say you are”. Consider getting a SIM with Aadhaar validation as an example. The erstwhile procedure was to give a self attested copy of “Proof of Id” and “Proof of Residence” and upon validation, your SIM will be activated. Your self attested copies of your PAN card or Driving License stays with the company giving you the SIM.

With Aadhaar, when you give your finger print to a JIO SIM provider, it sends a packet to Aadhaar systems and the system authenticates your identity. The answer is boolean, just a Yes or No. It doesn’t tell anything else about you. The vendor in no way can impersonate you later as they don’t have any physical entity of your proof with them.

Biometrics in Aadhaar systems is matched using 3 vendor softwares. Vendor softwares are usually the gateway for vulnerability to creep in. However, there are several security perimeters here and the vendor software doesn’t have any detail of whose biometrics it is matching. It just has a [X,Y] matrix and certain templates to match them against.

Biometric Lock

If all these safeguards doesn’t sound convincing, you can go to UIDAI website, login using Aadhaar number and OTP, and lock your biometrics. What that means is, the biometric authentication is now not possible on your Aadhaar. You can turn it on when you want to avail a biometric authentication based service and turn it off back again.

Is it foolproof?

All these securities apart, chance of a data leak can’t be denied. Anything, that is connected to a computer network is hackable including your bank account. In fact, there was a large breach on 3.2 million debit cards of ICICI, Axis, HDFC, Yes bank and SBI. As usual, the malware originated from Hitachi Payment Systems ATMs and POS terminals, a 3rd party vendor software.

Does that mean we should stop electronic banking and go back to paper based system? And no, you not having an ATM card or having not applied for net banking doesn’t make your account safe. The bank still stores your financial data electronically. If there is a breach, there is a breach. It may make your account safer than those who use internet banking, but it doesn’t make it absolute safe. Nothing on computer networks is absolutely  safe.

Govt claims to have built adequate measures to safeguard our data. However, there are reports like this, which suggests, there was data leakage at ASA/AUA/KUA level. How did these agencies get the data in the first place is something the authorities should find out and answer.

The privacy debate

While we are at privacy, allow me to bring up something unrelated to Aadhaar but related to privacy. If you have a bank account, in all likelihood, your PII has been passed onto a private agency called CIBIL without even taking your consent.

Surprised? Request for CIBIL report and see all your PIIs  like name, all addresses where you have ever stayed, DoB, financial data (Loans, CC, A/cs) printed on sheets of paper right in front of you. The custodian of your data in case of Aadhaar is Government of India, who is bound by the Aadhaar act (pdf) unlike CIBIL.

Currently, the central govt has a long list of schemes for which it has made Aadhaar “sort of” necessary. Most of these are related to subsidies, which was the primary aim of Aadhaar — To de-dup the list of beneficiaries and check subsidy leak through DBT. Other schemes like PAN-Aadhaar or linking your bank a/c with Aadhaar is done to make the “Id management” easier and hassle free.

As per the MoS, Finance, Shri Gangwar’s answer in Rajya Sabha, with Aadhaar seeding, over 11 lakh duplicate and fake PANs have been deactivated:

Privacy is something people closely guard with. Hence, it’s natural to ask question about resilience of the system that stores and claims to safeguard our personal information. In fact, questioning the system should be encouraged. They help in finding flaws and make the system stronger and as much hack proof as it can be. However, a nation as diverse as ours definitely need a unique id and that is the only way forward.

Help Opindia Reach Every Indian. Share This Post
We need your support to survive in the media industry. Please consider paying us for the content we produce:

To know more about these payments, please click here.


Big Story

India has successfully launched its second mission to the moon, the Chandrayaan-2.

2019 World Cup Is Here!

Catch the latest on Cricket World Cup as it unfolds, special coverage by Opindia

Proud to be a brand - Made in India?
Now, Advertise on Opindia

Sushma Swaraj shuts down trolls

Former EAM Sushma Swaraj shuts down a troll, Irfan Khan, who wishes death upon her

Sushma Swaraj was condoling death of former Delhi BJP President when troll insinuated that she too will die soon.
Islamic extremism

Two youths, Shekhar and Basant forced to chant religious slogans by a mob that showed them Tabrez Ansari’s video, stabbed when refused

As Shekhar and Basant refused to raise religious slogans, the angry men reportedly stabbed them with knives.

Omar Abdullah comes in support of Imran Khan who was not given official welcome on arrival in US

Khan's humiliation seems to have affected former Jammu and Kashmir chief minister Omar Abdullah who sprung to his defence

Netizens ‘express concern’ over Priyanka Chopra’s asthma after a picture where she is smoking cigarette went viral on social media

Twitter users even dug up Chopra's own old tweet condemning smoking where she had claimed she does not smoke. While things could change with time so do personal preferences, the hypocrisy is quite baffling.

Hey, New York Times, F**k you, again

India successfully tested anti-satellite missile today, springing it into the elite space club.

Mangalore: Mohammad Ansari rapes a cow by tying its limbs, villagers catch him in the act, arrested

The villagers also made Ansari touch cow’s feet and ask for forgiveness for raping her. However, when Ansari approached the calf, the animal freaked out and started running.

Is there a concerted attempt to sow doubts against PM Modi among his most loyal base?

By now, everyone of us who is out there on social media is aware of this strange new phenomenon.

Mangaluru villagers caught Mohammad Ansari raping a calf, police arrests villagers for ‘hurting religious beliefs’

In the Kunjathbail village in Mangaluru, Mohammad Ansari was caught red-handed by the villagers while he was raping a calf.
Andrea sobs while pleading that her husband is innocent

Abusive actor Ajaz Khan who was arrested for inciting communal tension was ‘framed’, claims his wife, says he did nothing wrong

Khan was arrested by Mumbai Police on Wednesday last week for posting objectionable videos amounting to communal incitement on Tiktok and other social media websites

Class nine student beaten by senior students for protesting ‘Allah Hu Akbar’ during National Anthem singing in school

When a Hindu student protested allah hu akbar chants during national anthem in school, he was badly thrashed by Muslim students
Subscribe to Day's Top Stories
- Advertisment -

Latest articles

Connect with us

173,764FansLike
160,250FollowersFollow
74,909SubscribersSubscribe
Help Opindia Reach Every Indian. Share This Post