Advertisements
Sunday, May 31, 2020
Home News Reports Aadhaar, the technology, and the privacy debate

Aadhaar, the technology, and the privacy debate

Also Read

The Aadhaar project has long been criticised to have impinged upon our privacy. Whether right to privacy is absolute, is it a fundamental right, etc. are matter that are sub-juice with the honourable Supreme court of India, which has reserved its verdict as of now. This article discusses how, and if Aadhaar actually infringes upon our privacy. Let’s dissect between what government claims and reality on ground.

Privacy and Aadhaar

Your Personal Identifiable Information i.e. PII is an essential part of privacy. PII consists of your name, address and other identifiable information along with, but not necessarily, your biometrics i.e. your biological data. With Aadhaar enrollment, you have to submit this data to the Government of India. Does it mean your your privacy has been impinged upon? There are points supporting both sides of the debate.

Even before Aadhaar, there were quite a few government systems that mandated you to submit these details to access a service. For example, you need to submit your Name, Address, Date of birth, Photograph and fingerprints to get a Passport. You need to submit your blood group to get a driving license. All that Aadhaar has introduced for the 1st time is “Iris Scan”, this is because a majority of manual labourers have their fingerprint ridges not clearly recognisable and hence the authorities had to look for some other unique biometrics.

Submitting your PII to government is not new. And Aadhaar is as much ‘mandatory’ as other such schemes. For example, you can refuse to have a Passport or a Driving license, but then you have to let go the privileges that comes with these. Similarly, you can refuse to have Aadhaar and forgo all benefits that comes with it.

One rider though, Aadhaar now seems to be tied up with everything or at least going to be tied up with almost everything. So giving up Aadhaar related benefits is not going to be ‘as easy’ as giving up on a driving license or passport.

What the government claims:

Let’s dissect the steps before you get an Aadhaar card and what happens after that:

Data Collection/ Enrollment

Information collected from you at an Offline centre is encrypted at source. Once your details are keyed in, the vendor collecting data can’t read it. He just has to submit this data to Central Identities Data Repository (CIDR). Also, these packets that are sent to CIDR for storage are biometrical signed by the vendor. In case of any dispute or controversy, the authorities know which vendor gave this data.

Data Storage

All your information along with biometrics are stored in encrypted form and decrypted only on demand. The packets are stored on Hadoop clusters, which provides distribution and high availability of large sets of data. For the searches, they use Mongo with Solr indexes. Because all these support clusters based storage and data is partitioned, there is no single point of failure.

Aadhaar Allocation

Once your data is stored, you are given a unique 12 digit Aadhaar number which is completely random. It doesn’t tell anything about yourself unlike your PAN where the fourth character tells the type of PAN holder, fifth character tells the first letter of your surname and so on.

Aadhaar Data Access

Who Can Access – There is a list of requesting entities known as eKYC User Agencies (KUA) and Authentication User Agency (AUA). They don’t have direct access to CIDR servers to authenticate you. There are Authentication Service Agencies (ASA) who have secured leased line connectivity with the CIDR, which is compliant with UIDAI’s (Unique Identification Authority of India) standards and specifications.

There is a formal set of procedures, guidelines and scrutiny before one becomes a AUA/KUA/ASA. For example, NPCI (National Payment Corp of India) is an ASA. Axis bank is a KUA. So, for the annual KYC activity, Axis bank can just tell you to give your biometrics on a device, it’s transmitted to NPCI which routes it to CIDR and CIDR responds with a Yes (Or No). There is no physical document submission.

Modes of Access – Aadhaar is a ID management system. It authenticates you and tells the authority “You are who you say you are”. Consider getting a SIM with Aadhaar validation as an example. The erstwhile procedure was to give a self attested copy of “Proof of Id” and “Proof of Residence” and upon validation, your SIM will be activated. Your self attested copies of your PAN card or Driving License stays with the company giving you the SIM.

With Aadhaar, when you give your finger print to a JIO SIM provider, it sends a packet to Aadhaar systems and the system authenticates your identity. The answer is boolean, just a Yes or No. It doesn’t tell anything else about you. The vendor in no way can impersonate you later as they don’t have any physical entity of your proof with them.

Biometrics in Aadhaar systems is matched using 3 vendor softwares. Vendor softwares are usually the gateway for vulnerability to creep in. However, there are several security perimeters here and the vendor software doesn’t have any detail of whose biometrics it is matching. It just has a [X,Y] matrix and certain templates to match them against.

Biometric Lock

If all these safeguards doesn’t sound convincing, you can go to UIDAI website, login using Aadhaar number and OTP, and lock your biometrics. What that means is, the biometric authentication is now not possible on your Aadhaar. You can turn it on when you want to avail a biometric authentication based service and turn it off back again.

Is it foolproof?

All these securities apart, chance of a data leak can’t be denied. Anything, that is connected to a computer network is hackable including your bank account. In fact, there was a large breach on 3.2 million debit cards of ICICI, Axis, HDFC, Yes bank and SBI. As usual, the malware originated from Hitachi Payment Systems ATMs and POS terminals, a 3rd party vendor software.

Does that mean we should stop electronic banking and go back to paper based system? And no, you not having an ATM card or having not applied for net banking doesn’t make your account safe. The bank still stores your financial data electronically. If there is a breach, there is a breach. It may make your account safer than those who use internet banking, but it doesn’t make it absolute safe. Nothing on computer networks is absolutely  safe.

Govt claims to have built adequate measures to safeguard our data. However, there are reports like this, which suggests, there was data leakage at ASA/AUA/KUA level. How did these agencies get the data in the first place is something the authorities should find out and answer.

The privacy debate

While we are at privacy, allow me to bring up something unrelated to Aadhaar but related to privacy. If you have a bank account, in all likelihood, your PII has been passed onto a private agency called CIBIL without even taking your consent.

Surprised? Request for CIBIL report and see all your PIIs  like name, all addresses where you have ever stayed, DoB, financial data (Loans, CC, A/cs) printed on sheets of paper right in front of you. The custodian of your data in case of Aadhaar is Government of India, who is bound by the Aadhaar act (pdf) unlike CIBIL.

Currently, the central govt has a long list of schemes for which it has made Aadhaar “sort of” necessary. Most of these are related to subsidies, which was the primary aim of Aadhaar — To de-dup the list of beneficiaries and check subsidy leak through DBT. Other schemes like PAN-Aadhaar or linking your bank a/c with Aadhaar is done to make the “Id management” easier and hassle free.

As per the MoS, Finance, Shri Gangwar’s answer in Rajya Sabha, with Aadhaar seeding, over 11 lakh duplicate and fake PANs have been deactivated:

Privacy is something people closely guard with. Hence, it’s natural to ask question about resilience of the system that stores and claims to safeguard our personal information. In fact, questioning the system should be encouraged. They help in finding flaws and make the system stronger and as much hack proof as it can be. However, a nation as diverse as ours definitely need a unique id and that is the only way forward.

Advertisements

  Support Us  

Whether NDTV or 'The Wire', they never have to worry about funds. In name of saving democracy, they get money from various sources. We need your support to fight them. Please contribute whatever you can afford

Trending now

Latest updates and important links about COVID-19 coronavirus

Live statistics and tracking of news related to COVID-19 coronavirus with focus on India.

Unelected people think they can impose their will on the government through courts: Harish Salve

Harish Salve said that one may not agree with the judgment of the court but saying that the court does not stands with the people is wrong.

India emerges as fifth-largest hydropower producer in the world overtaking Japan

As per International Hydropower Association, India has a total installed base at 50 Gigawatt after Canada, the US, Brazil, and China.

UP Power Minister Shrikant Sharma orders to close all drains opening in Yamuna river till February

Expressing concern over the situation of Yamuna, UP power minister ordered to close all drains opening in the river till February

‘We want court and Govt to end Babri Masjid Demolition Case,’ says Ram Mandir dispute petitioner Iqbal Ansari after losing the case

Ansari further added that the Special CBI Court, overseeing the Babri Masjid Demolition case, must look to deliver speedy closure.

Unlock 1.0: MHA issues guidelines for phased reopening for all activities outside containment zones after the end of Lockdown 4.0

The Unlock 1:0 guidelines proposes a plan for gradual reopening of the restricted activities after the end of Lockdown 4.0

Recently Popular

ISKCON rejects Shemaroo Entertainment’s ‘apology’, to proceed with legal action against comedian Surleen Kaur for abusive, derogatory statements

A complaint had been filed by ISKCON organisation against comedian Ms Surleen Kaur and Shemaroo Entertainment Ltd for her abusive, derogatory remarks against the organisations, saints and Hindus.

ISKCON files complaint against comedian Surleen Kaur and Shemaroo Entertainment Ltd for a video where ISKCON devotees were called ‘harami porn-waley’

Surleen Kaur had said in the video published by Shemaroo ‘no doubt we are from ISKCON, but from inside we are all harami porn lovers’.

Woman raped by Moulvi Aslam, media gives it a ‘Hindu spin’ by using image of a saffron-clad Hindu priest and describing the perpetrator as...

A Muslim sorcerer claiming to relieve people of their miseries through his wizardry was depicted as a Hindu priest by media organisations

Dangal actress Zaira Wasim quits Twitter and Instagram after being criticised for ridiculous post insinuating locust attack is ‘Allah’s wrath’

Dangal actress Zaira Wasim has quit Twitter and Instagram after receiving criticism for her insensitive post.

Twist in the tale: ISKCON accepts apology of Shemaroo, says won’t pursue its case against the company for Surleen Kaur video that insulted ISKCON...

ISKCON further stated that it does not believe in vengeance and instead acts in accordance to moral, ethical and legal values.
Advertisements

Connect with us

228,708FansLike
356,427FollowersFollow
244,000SubscribersSubscribe
Advertisements