Friday, June 18, 2021
Home News Reports Aadhaar, the technology, and the privacy debate

Aadhaar, the technology, and the privacy debate

The Aadhaar project has long been criticised to have impinged upon our privacy. Whether right to privacy is absolute, is it a fundamental right, etc. are matter that are sub-juice with the honourable Supreme court of India, which has reserved its verdict as of now. This article discusses how, and if Aadhaar actually infringes upon our privacy. Let’s dissect between what government claims and reality on ground.

Privacy and Aadhaar

Your Personal Identifiable Information i.e. PII is an essential part of privacy. PII consists of your name, address and other identifiable information along with, but not necessarily, your biometrics i.e. your biological data. With Aadhaar enrollment, you have to submit this data to the Government of India. Does it mean your your privacy has been impinged upon? There are points supporting both sides of the debate.

Even before Aadhaar, there were quite a few government systems that mandated you to submit these details to access a service. For example, you need to submit your Name, Address, Date of birth, Photograph and fingerprints to get a Passport. You need to submit your blood group to get a driving license. All that Aadhaar has introduced for the 1st time is “Iris Scan”, this is because a majority of manual labourers have their fingerprint ridges not clearly recognisable and hence the authorities had to look for some other unique biometrics.

Submitting your PII to government is not new. And Aadhaar is as much ‘mandatory’ as other such schemes. For example, you can refuse to have a Passport or a Driving license, but then you have to let go the privileges that comes with these. Similarly, you can refuse to have Aadhaar and forgo all benefits that comes with it.

One rider though, Aadhaar now seems to be tied up with everything or at least going to be tied up with almost everything. So giving up Aadhaar related benefits is not going to be ‘as easy’ as giving up on a driving license or passport.

What the government claims:

Let’s dissect the steps before you get an Aadhaar card and what happens after that:

Data Collection/ Enrollment

Information collected from you at an Offline centre is encrypted at source. Once your details are keyed in, the vendor collecting data can’t read it. He just has to submit this data to Central Identities Data Repository (CIDR). Also, these packets that are sent to CIDR for storage are biometrical signed by the vendor. In case of any dispute or controversy, the authorities know which vendor gave this data.

Data Storage

All your information along with biometrics are stored in encrypted form and decrypted only on demand. The packets are stored on Hadoop clusters, which provides distribution and high availability of large sets of data. For the searches, they use Mongo with Solr indexes. Because all these support clusters based storage and data is partitioned, there is no single point of failure.

Aadhaar Allocation

Once your data is stored, you are given a unique 12 digit Aadhaar number which is completely random. It doesn’t tell anything about yourself unlike your PAN where the fourth character tells the type of PAN holder, fifth character tells the first letter of your surname and so on.

Aadhaar Data Access

Who Can Access – There is a list of requesting entities known as eKYC User Agencies (KUA) and Authentication User Agency (AUA). They don’t have direct access to CIDR servers to authenticate you. There are Authentication Service Agencies (ASA) who have secured leased line connectivity with the CIDR, which is compliant with UIDAI’s (Unique Identification Authority of India) standards and specifications.

There is a formal set of procedures, guidelines and scrutiny before one becomes a AUA/KUA/ASA. For example, NPCI (National Payment Corp of India) is an ASA. Axis bank is a KUA. So, for the annual KYC activity, Axis bank can just tell you to give your biometrics on a device, it’s transmitted to NPCI which routes it to CIDR and CIDR responds with a Yes (Or No). There is no physical document submission.

Modes of Access – Aadhaar is a ID management system. It authenticates you and tells the authority “You are who you say you are”. Consider getting a SIM with Aadhaar validation as an example. The erstwhile procedure was to give a self attested copy of “Proof of Id” and “Proof of Residence” and upon validation, your SIM will be activated. Your self attested copies of your PAN card or Driving License stays with the company giving you the SIM.

With Aadhaar, when you give your finger print to a JIO SIM provider, it sends a packet to Aadhaar systems and the system authenticates your identity. The answer is boolean, just a Yes or No. It doesn’t tell anything else about you. The vendor in no way can impersonate you later as they don’t have any physical entity of your proof with them.

Biometrics in Aadhaar systems is matched using 3 vendor softwares. Vendor softwares are usually the gateway for vulnerability to creep in. However, there are several security perimeters here and the vendor software doesn’t have any detail of whose biometrics it is matching. It just has a [X,Y] matrix and certain templates to match them against.

Biometric Lock

If all these safeguards doesn’t sound convincing, you can go to UIDAI website, login using Aadhaar number and OTP, and lock your biometrics. What that means is, the biometric authentication is now not possible on your Aadhaar. You can turn it on when you want to avail a biometric authentication based service and turn it off back again.

Is it foolproof?

All these securities apart, chance of a data leak can’t be denied. Anything, that is connected to a computer network is hackable including your bank account. In fact, there was a large breach on 3.2 million debit cards of ICICI, Axis, HDFC, Yes bank and SBI. As usual, the malware originated from Hitachi Payment Systems ATMs and POS terminals, a 3rd party vendor software.

Does that mean we should stop electronic banking and go back to paper based system? And no, you not having an ATM card or having not applied for net banking doesn’t make your account safe. The bank still stores your financial data electronically. If there is a breach, there is a breach. It may make your account safer than those who use internet banking, but it doesn’t make it absolute safe. Nothing on computer networks is absolutely  safe.

Govt claims to have built adequate measures to safeguard our data. However, there are reports like this, which suggests, there was data leakage at ASA/AUA/KUA level. How did these agencies get the data in the first place is something the authorities should find out and answer.

The privacy debate

While we are at privacy, allow me to bring up something unrelated to Aadhaar but related to privacy. If you have a bank account, in all likelihood, your PII has been passed onto a private agency called CIBIL without even taking your consent.

Surprised? Request for CIBIL report and see all your PIIs  like name, all addresses where you have ever stayed, DoB, financial data (Loans, CC, A/cs) printed on sheets of paper right in front of you. The custodian of your data in case of Aadhaar is Government of India, who is bound by the Aadhaar act (pdf) unlike CIBIL.

Currently, the central govt has a long list of schemes for which it has made Aadhaar “sort of” necessary. Most of these are related to subsidies, which was the primary aim of Aadhaar — To de-dup the list of beneficiaries and check subsidy leak through DBT. Other schemes like PAN-Aadhaar or linking your bank a/c with Aadhaar is done to make the “Id management” easier and hassle free.

As per the MoS, Finance, Shri Gangwar’s answer in Rajya Sabha, with Aadhaar seeding, over 11 lakh duplicate and fake PANs have been deactivated:

Privacy is something people closely guard with. Hence, it’s natural to ask question about resilience of the system that stores and claims to safeguard our personal information. In fact, questioning the system should be encouraged. They help in finding flaws and make the system stronger and as much hack proof as it can be. However, a nation as diverse as ours definitely need a unique id and that is the only way forward.

  Support Us  

Whether NDTV or 'The Wire', they never have to worry about funds. In name of saving democracy, they get money from various sources. We need your support to fight them. Please contribute whatever you can afford

Related Articles

Trending now

4 arrested in Hiranandani society fake vaccine scam, Tips Films, another production house were duped too: Reports

4 persons have been arrested by the Kandivali Police in the fake vaccination drive case. They have been sent to judicial custody till June 25.

Mukul Roy refuses to resign from assembly after defecting to TMC, Suvendu Adhikari petitions the speaker to disqualify him

Suvendu Adhilkari asks assembly speaker to disqualify Mukul Roy as per anti-defection law after Roy quite BJP to join TMC

‘Muslims must kill 4-6 persons before dying’: Congress’ new minority cell head Imran Pratapgarhi and his hate-filled ‘shayari’. Details

The newly appointed Congress minority cell head Imran Pratapgarhi is believed to be the favourite of Priyanka Gandhi Vadra.

FT refers to India as the ‘weakest link’ in the Quad. How their quoted expert denies conclusion and how they got it massively wrong

Quoting a few experts in foreign policy, FT declared that India is the 'weakest link' of the informal alliance as it had failed to provide necessary vaccines to the nations as it had agreed to in the Quad summit that was held in March.

UP: Woman alleges harassment, obscene messages by police officer in Sultanpur, SP orders investigation. Details of the case

After the case was highlighted on the social media, Sultanpur police have informed that they have suspended a constable involved in the case and the accused inspector has been ordered to report at the police lines.

Farmer org releases unclear video to claim man committed suicide at Tikri border, clearer video shows man accusing ‘farmer’ of setting him on fire

A man was burnt alive and succumbed to his injuries after visiting the Tikri border where farmers are protesting

Recently Popular

Pakistani audience go ballistic over Zee5 web series featuring Muslim girl-Indian Hindu boy love story, call it ‘haram’

The Pakistani web series features the love story between a Pakistani Muslim girl and Indian Hindu boy who have both lost their fathers to the conflict between the two nations.

Dhruv Rathee fans mark YouTuber Karolina Goswami for targeted harassment after she exposed his lies

After Karolina Goswami pointed out the factual errors and mistakes in the Dhruv Rathee video, Rathee's supporters have been harassing and abusing Goswami.

AAP celebrates Delhi’s new architectural marvel, the Moti Nagar speed breaker

AAP's Moti Nagar MLA has recently inaugurated a speed breaker, along with dozens of supporters flouting social distancing norms.

Ghaziabad fake hate crime case: Unmuted video of elderly man seconds before he was beaten up released. Watch

In the video, Abdul can be heard admitting that one Intezar sent some people to him to make the 'tabeez' (occult amulet) and put them in his spell as he had some work from them.

Twitter India MD told Delhi Police he does not know directors and owner of his company, details of his boss: Feigning ignorance or...

Twitter India MD Manish Maheshwari said he does know who owns Twitter India, and which company his boss Yu Sasamoto belongs to

Haryana: Man burnt alive to make him ‘martyr’ against farm laws, villagers demand security from ‘farmers’ at Tikri border

As per reports, casteist slurs were hurled towards Mukesh after which he was set on fire. A video of him being set on fire has gone viral on social media where one can hear casteist abuses being thrown at him before he was set ablaze.
- Advertisement -

 

Connect with us

255,564FansLike
554,292FollowersFollow
24,400SubscribersSubscribe