Home News Reports Aadhaar, the technology, and the privacy debate

Aadhaar, the technology, and the privacy debate

The Aadhaar project has long been criticised to have impinged upon our privacy. Whether right to privacy is absolute, is it a fundamental right, etc. are matter that are sub-juice with the honourable Supreme court of India, which has reserved its verdict as of now. This article discusses how, and if Aadhaar actually infringes upon our privacy. Let’s dissect between what government claims and reality on ground.

Privacy and Aadhaar

Your Personal Identifiable Information i.e. PII is an essential part of privacy. PII consists of your name, address and other identifiable information along with, but not necessarily, your biometrics i.e. your biological data. With Aadhaar enrollment, you have to submit this data to the Government of India. Does it mean your your privacy has been impinged upon? There are points supporting both sides of the debate.

Even before Aadhaar, there were quite a few government systems that mandated you to submit these details to access a service. For example, you need to submit your Name, Address, Date of birth, Photograph and fingerprints to get a Passport. You need to submit your blood group to get a driving license. All that Aadhaar has introduced for the 1st time is “Iris Scan”, this is because a majority of manual labourers have their fingerprint ridges not clearly recognisable and hence the authorities had to look for some other unique biometrics.

- Advertisement - - Article resumes -

Submitting your PII to government is not new. And Aadhaar is as much ‘mandatory’ as other such schemes. For example, you can refuse to have a Passport or a Driving license, but then you have to let go the privileges that comes with these. Similarly, you can refuse to have Aadhaar and forgo all benefits that comes with it.

One rider though, Aadhaar now seems to be tied up with everything or at least going to be tied up with almost everything. So giving up Aadhaar related benefits is not going to be ‘as easy’ as giving up on a driving license or passport.

What the government claims:

Let’s dissect the steps before you get an Aadhaar card and what happens after that:

Data Collection/ Enrollment

Information collected from you at an Offline centre is encrypted at source. Once your details are keyed in, the vendor collecting data can’t read it. He just has to submit this data to Central Identities Data Repository (CIDR). Also, these packets that are sent to CIDR for storage are biometrical signed by the vendor. In case of any dispute or controversy, the authorities know which vendor gave this data.

Data Storage

All your information along with biometrics are stored in encrypted form and decrypted only on demand. The packets are stored on Hadoop clusters, which provides distribution and high availability of large sets of data. For the searches, they use Mongo with Solr indexes. Because all these support clusters based storage and data is partitioned, there is no single point of failure.

Aadhaar Allocation

Once your data is stored, you are given a unique 12 digit Aadhaar number which is completely random. It doesn’t tell anything about yourself unlike your PAN where the fourth character tells the type of PAN holder, fifth character tells the first letter of your surname and so on.

Aadhaar Data Access

Who Can Access – There is a list of requesting entities known as eKYC User Agencies (KUA) and Authentication User Agency (AUA). They don’t have direct access to CIDR servers to authenticate you. There are Authentication Service Agencies (ASA) who have secured leased line connectivity with the CIDR, which is compliant with UIDAI’s (Unique Identification Authority of India) standards and specifications.

There is a formal set of procedures, guidelines and scrutiny before one becomes a AUA/KUA/ASA. For example, NPCI (National Payment Corp of India) is an ASA. Axis bank is a KUA. So, for the annual KYC activity, Axis bank can just tell you to give your biometrics on a device, it’s transmitted to NPCI which routes it to CIDR and CIDR responds with a Yes (Or No). There is no physical document submission.

Modes of Access – Aadhaar is a ID management system. It authenticates you and tells the authority “You are who you say you are”. Consider getting a SIM with Aadhaar validation as an example. The erstwhile procedure was to give a self attested copy of “Proof of Id” and “Proof of Residence” and upon validation, your SIM will be activated. Your self attested copies of your PAN card or Driving License stays with the company giving you the SIM.

With Aadhaar, when you give your finger print to a JIO SIM provider, it sends a packet to Aadhaar systems and the system authenticates your identity. The answer is boolean, just a Yes or No. It doesn’t tell anything else about you. The vendor in no way can impersonate you later as they don’t have any physical entity of your proof with them.

Biometrics in Aadhaar systems is matched using 3 vendor softwares. Vendor softwares are usually the gateway for vulnerability to creep in. However, there are several security perimeters here and the vendor software doesn’t have any detail of whose biometrics it is matching. It just has a [X,Y] matrix and certain templates to match them against.

Biometric Lock

If all these safeguards doesn’t sound convincing, you can go to UIDAI website, login using Aadhaar number and OTP, and lock your biometrics. What that means is, the biometric authentication is now not possible on your Aadhaar. You can turn it on when you want to avail a biometric authentication based service and turn it off back again.

Is it foolproof?

All these securities apart, chance of a data leak can’t be denied. Anything, that is connected to a computer network is hackable including your bank account. In fact, there was a large breach on 3.2 million debit cards of ICICI, Axis, HDFC, Yes bank and SBI. As usual, the malware originated from Hitachi Payment Systems ATMs and POS terminals, a 3rd party vendor software.

Does that mean we should stop electronic banking and go back to paper based system? And no, you not having an ATM card or having not applied for net banking doesn’t make your account safe. The bank still stores your financial data electronically. If there is a breach, there is a breach. It may make your account safer than those who use internet banking, but it doesn’t make it absolute safe. Nothing on computer networks is absolutely  safe.

Govt claims to have built adequate measures to safeguard our data. However, there are reports like this, which suggests, there was data leakage at ASA/AUA/KUA level. How did these agencies get the data in the first place is something the authorities should find out and answer.

The privacy debate

While we are at privacy, allow me to bring up something unrelated to Aadhaar but related to privacy. If you have a bank account, in all likelihood, your PII has been passed onto a private agency called CIBIL without even taking your consent.

Surprised? Request for CIBIL report and see all your PIIs  like name, all addresses where you have ever stayed, DoB, financial data (Loans, CC, A/cs) printed on sheets of paper right in front of you. The custodian of your data in case of Aadhaar is Government of India, who is bound by the Aadhaar act (pdf) unlike CIBIL.

Currently, the central govt has a long list of schemes for which it has made Aadhaar “sort of” necessary. Most of these are related to subsidies, which was the primary aim of Aadhaar — To de-dup the list of beneficiaries and check subsidy leak through DBT. Other schemes like PAN-Aadhaar or linking your bank a/c with Aadhaar is done to make the “Id management” easier and hassle free.

As per the MoS, Finance, Shri Gangwar’s answer in Rajya Sabha, with Aadhaar seeding, over 11 lakh duplicate and fake PANs have been deactivated:

Privacy is something people closely guard with. Hence, it’s natural to ask question about resilience of the system that stores and claims to safeguard our personal information. In fact, questioning the system should be encouraged. They help in finding flaws and make the system stronger and as much hack proof as it can be. However, a nation as diverse as ours definitely need a unique id and that is the only way forward.

Share This Post With Your Friends & Fans:
We need your support to survive in the media industry. Please consider paying us for the content we produce:

To know more about these payments, please click here.


Election 2019 Live Updates

Track all the updates on one page as the results and trends trickle in

IIT graduate and an IAS officer explains in detail why EVMs can’t be ‘hacked’ or ‘tampered’ with

Bhavesh Mishra, IAS 2015 batch, B.Tech IIT Delhi, on Quora gave a detailed explanation regarding why EVMs cannot be 'hacked' or 'tampered' with.

Barkha Dutt expresses deep anguish over the fact that the mainstream media can no longer influence elections

Barkha said it doesn't make her happy that mainstream media cannot influence the voters to vote in a particular way anymore.

‘Journalist sitting in a political party’s lap is calling others godi media’, Aaj Tak’s Rohit Sardana hits out at NDTV’s Ravish Kumar

Aaj Tak journalist Rohit Sardana said that earlier journalists used to decide ministry allocations.
Shehla Rashid calls upon United Nations to resolve the EVM allegations

‘Why don’t we invoke the UN?’ Shehla Rashid takes EVM row to a new level as exit polls predict Modi’s victory

Shehla Rashid bemoaned about the lack of clarity and purpose among the opposition parties while levelling serious allegations of EVM fraud and rigging

Hindustan Times journalist links Hindu festival to Nathuram Godse, gets slammed

Ayudh Puja, also known as Astra Puja in some parts of India, was linked to Mahatma Gandhi's assassin.
Rajdeep Sardesai rubbishes EVM hacking claims, says opposition parties should refrain from undermining the electoral process

Now, even Rajdeep Sardesai abandons opposition parties’ EVM clown car

In stark contrast to his natural disposition, Rajdeep Sardesai has slammed the opposition parties trying to create controversy over EVMs.

Live updates: EC official website shows BJP leading in 282 seats on their own, Congress leading in 51 seats

Latest results, trends, updates, and news about 2019 Lok Sabha election counting. Find out who will form the next government.
Sba Naqvi spreads already debunked fake news on 'Missing EVMs'

India has 90 crore eligible voters, ‘journalists’ and opposition claim votes of 400 crore voters are ‘missing’

Following the rejection of the claims by ECI and the clarification over the issue, Frontline magazine had accepted that their report is false and a rejoinder will be published. TV9 Bharatvarsh had removed the report from their website and YouTube channel.
HDFC Bank acknowledge dubious allegation of Islamophobia on their employee, promise action

HDFC Bank promises ‘appropriate action’ against employee for exercising his constitutional right, people threaten boycott

A journalist employed by AFP news agency, Uzair Hasan Rizvi, has implored HDFC Bank to act against one of its employees for views he calls 'Islamophobic' and 'Xenophobic'.
Subscribe to Day's Top Stories

Latest articles

Connect with us

164,213FansLike
141,017FollowersFollow
64,202SubscribersSubscribe
Share This Post With Your Friends & Fans: