Passengers show their identity cards at the entrance to the airport.(Sonu Mehta/HT File Photo)
Passengers show their identity cards at the entrance to the airport.(Sonu Mehta/HT File Photo)

Aadhaar verification at airports raises need for stricter data privacy regulations

The absence of legislation is letting companies compile and deploy sensitive personal information without legal oversight.
By Aman Sethi | Hindustan Times, New Delhi
UPDATED ON NOV 27, 2017 11:39 AM IST

When Suvodeep Das, a 42-year-old marketing professional, took a Jet airways flight from Hyderabad to Mumbai in September, he said a software bug in the airline’s website wouldn’t let him check in online without first punching in his Aadhaar number.

“When I got my boarding pass, it had my Aadhaar number printed on it,” Das told HT, wondering, “Why do you need an Aadhaar number to take a flight, and why display it publicly?”

In October, another passenger found their Aadhaar number on the boarding pass: this time, it was barcoded.

HT has reviewed both boarding passes. Publishing Aadhaar numbers is an offence under the Aadhaar Act 2016.

Jet Airways did not respond to repeated requests for comment. Speaking off the record, airline executives said Jet encoded Aadhaar numbers to test the proposed Aadhaar Enabled Entry and Biometric Boarding System (AEEBBS): a complex Aadhaar-seeding project that aims to replace a passenger’s boarding pass with his/her fingerprint.

Bangalore International Airport (BIAL), which plans to install AEEBBS, says it will improve passenger security and reduce check-in time at the Kempegowda International, India’s third busiest airport.

Privacy advocates, however, say the system, which stores passenger biometrics and Aadhaar numbers on the servers of a private corporation, is an example of how the absence of a data protection law in India lets companies compile and deploy sensitive personal information without legal oversight.

Future uses of the AEEBBS, according to the BIAL website, include integrating the system with passenger blacklists, typically maintained by the ministry of home affairs, to determine who can and cannot board a flight.

“The unregulated proliferation of Aadhaar uses is compromising the digital identities of citizens and putting them at risk,” said Usha Ramanathan, a legal theorist who has written extensively on Aadhaar. ”There is a misconception that data protection is about data being at risk. It is actually about the rights of people being at risk.”

Pilot Project

In January, Bangalore International Airport Ltd (BIAL), the corporation that runs the Bengaluru terminal, and Jet Airways integrated their flight and passenger databases as part of a four-month pilot project to test the AEEBS.

“The pilot project incorporated the entire airport journey from entry right through to the boarding gate and included all security check points,” a BIAL spokesperson said in an email. “The project allowed for quicker processing time for a passenger from entry to security gate while simultaneously enabling fewer points of human interaction.”

Participation in the project was voluntary. BIAL said about 15% of passengers opted to use it. In October, BIAL called for bids for a full roll-out of the AEEBBS by December 2018.

The system, tender documents reveal, works in the following way:

First passengers enter their Aadhaar numbers when they book their flights. The airline turns this number into a QR code printed on the flight ticket. Once at the terminal, passengers bypass the standard practice of showing their ticket and ID to a security guard, and instead they enter the terminal by flashing the ticket at a QR code scanner while pressing their fingers against a biometric reader installed at the entrance.

The AEEBBS verifies the passenger’s identity by querying the UIDAI’s database, and then checks the airport’s flight information system to see if the passenger is booked to fly that day.

Thereafter, the system creates a “passenger dataset” that bundles the passenger’s biometrics and flight information into a single file unique to each passenger. This dataset is used to verify the identity of the passenger at each checkpoint, allowing the airport to track the passenger until she boards her plane.

The tender document states that the biometric data should be purged immediately after the passenger’s flight departs. If flights are rescheduled, the biometrics shall persist until the passenger finally departs.

Why Biometrics?

Bengaluru isn’t the only airport experimenting with systems like the AEEBBS.

“We have initiated trials on facial recognition, iris and finger-print scanning etc., to generate Aadhaar + Biometric enabled passenger data-sets,” said a spokesperson for the GMR Hyderabad International Airport. “We hope to complete these trials in the next two months and deploy them by June 2018 for all domestic passengers.”

Yet biometrics isn’t a fool-proof way of verifying someone’s identity. Biometric experts have maintained that fingerprints can be copied and printed onto “fake fingers” — a process known as spoofing.

At Michigan State University, biometric expert Anil Jain and his team have developed so-called fake fingers using 12 different materials, the most sophisticated of which mimics the physical properties of human skin.

“Many of the commercial systems may not have state-of-the-art spoof detection facilities,” Jain said, adding that he has advised the UIDAI on biometrics in the past.

Jain said it was important that a secured space like an airport have biometric readers that include “liveness” detection, a term that refers to a broad set of techniques that use a combination of advanced hardware and software to avoid spoof attacks.

However, it is not mandatory for UIDAI-certified biometric devices to have liveness detection features. Documents published by Standardisation Testing and Quality Certification (STQC), the agency tasked with certifying Aadhaar devices, make clear that “liveness detection” is “preferable” but not mandatory.

Some manufacturers of certified devices say their devices have liveness detection, but STQC does not include this specific feature in its testing.

Prof Jain said biometrics are harder to forge than the identity cards that are currently needed to gain access to airport terminals, suggesting that the AEEBBS could increase security only if the data that undergirds the system is properly secured.

Storage Concerns

Under regulations framed by the Unique Identification Authority of India (UIDAI), it is illegal to store biometric data captured for any Aadhaar-related transaction.

Also, UIDAI-certified biometric devices are prohibited from storing biometric data which casts a cloud over BIAL’s proposal to create passenger datasets to merge passenger flight data, biometric data and Aadhaar numbers, and store it on a local BIAL network.

While UIDAI did not respond to requests for comment on if these passenger data sets violated its regulations, BIAL said it would work around the system by capturing passenger biometric data twice — once to verify passenger identities in accordance with UIDAI regulations, and once for the purpose of creating the passenger data set.

“Our intent is to capture data and store a separate set of biometrics records (delinked from Aadhaar) that include face/iris/fingerprints for the purpose of authentication of passenger at various check points inside the airport,” the spokesperson said.

Some experts believe this may not be enough.

“The Aadhaar Act and Regulations are supposed to ensure that our biometric records are safe, and entities capturing biometrics for Aadhaar-related purposes cannot store the biometrics,” said Pranesh Prakash, policy director at the Centre for Internet and Society.

“If biometrics collected doesn’t need to follow the Aadhaar regulations because of a technicality, how strong are the regulations?” Prakash said.

Last year, 22.18 million passengers travelled through Bengaluru airport. Once the AEEBBS is installed, the airport’s servers shall become a temporary repository of millions of fingerprints, and a lucrative target for sophisticated hackers who could capture this data by implanting malicious software in the system.

Such software has become easier to access since August 2016, when a group calling itself the “Shadow Brokers” announced it had stolen some of the world’s most advanced cyber-weapons from the vaults of the Tailored Access Operations unit of National Security Agency, which manages the cyber-arsenal of the United States of America.

Designing the system to minimise the use of biometrics could alleviate these concerns, according to Rahul Matthan, a partner at law firm Trilegal.

“If data minimisation is the principle that we keep on top of mind, Aadhaar should be used to allow entry,” Matthan said, “Then the airport must devise other methods and standards to ensure that security and passenger tracking is achieved.”

Safeguarding Aadhaar Numbers

The AEEBBS also raises questions on the manner in which airlines and airports will store non-biometric data like passenger Aadhaar numbers. UIDAI regulations published in July 2017 say companies and government departments must store Aadhaar numbers in secure, isolated, databases called ‘Aadhaar Data Vaults’.

Each Aadhaar number in these vaults must be associated with a “reference key” — which is like a nick-name for the Aadhaar number. So instead of using a citizen’s Aadhaar number for a given transaction, businesses must preserve the confidentiality of the number by using the reference key instead.

Jet Airway’s decision to print Aadhaar numbers, rather than the reference keys, on the boarding passes, suggests that the airline is not following UIDAI guidelines — a problem that is likely to multiply as more airlines start gathering this information to avail of the AEEBBS facility. Jet Airways did not respond to requests for comment.

Once the AEEBBS is in place, BIAL also intends to use passenger data, harvested during check-in and boarding, for commercial purposes, but it is unclear if and how this data will be anonymised before it is used.

“We aim to make meaning of the abundant data that will be collected,” the BIAL spokesperson said, insisting that the airport would respect traveller privacy and the data would not be sold to third parties. “In due course — and with passenger consent — we intend to use business intelligence to make the journey more impactful.”

For lawyer Matthan, the AEEBBS is an example of why India needs a comprehensive data protection law to address issues between citizens and private corporations.

“There is a need to ensure that Aadhaar is based on a sound framework of privacy protection,” he said, noting that the recent Supreme Court judgment protected citizen privacy against infringement by the government.

Data protection legislation, he said, would ensure that private corporations are held to the same standard.

SHARE THIS ARTICLE ON
app
Close
Prime Minister Narendra Modi virtually launches pan-India rollout of COVID-19 vaccination drive, in New Delhi, Saturday, Jan. 16, 2021. (PTI Photo)
Prime Minister Narendra Modi virtually launches pan-India rollout of COVID-19 vaccination drive, in New Delhi, Saturday, Jan. 16, 2021. (PTI Photo)

News updates from Hindustan Times: PM to interact with vaccine jab beneficiaries

By hindustantimes.com
UPDATED ON JAN 22, 2021 08:59 AM IST
Here are today’s top news, analysis and opinion at 9am. Know all about the latest news and other news updates from Hindustan Times.
Close
Farmers hold flags as police personnel stand guard behind barricades during protests against new farm laws at Ghazipur (Delhi-UP border) (Sakib Ali / HT Photo).
Farmers hold flags as police personnel stand guard behind barricades during protests against new farm laws at Ghazipur (Delhi-UP border) (Sakib Ali / HT Photo).

Govt-farm leaders to meet today, unions adamant on R-Day rally | Key points

By hindustantimes.com | Edited by Karan Manral
PUBLISHED ON JAN 22, 2021 08:51 AM IST
The Sanyukt Kisan Morcha on Thursday rejected the government’s proposal to suspend the three farm laws for 18 months.
Close
Prime Minister Narendra Modi. (PTI)
Prime Minister Narendra Modi. (PTI)

PM Modi to interact with Covid-19 vaccination beneficiaries, vaccinators in Varanasi

UPDATED ON JAN 22, 2021 08:46 AM IST
The interaction comes as over a million health workers have now been vaccinated, with over 230,000 getting doses on Thursday alone. The government data shows there has been an increase in daily immunisations
Close
Youngsters enjoy the snow on a hilltop after heavy snowfall, on the outskirts of Srinagar on January 19. (File photo)
Youngsters enjoy the snow on a hilltop after heavy snowfall, on the outskirts of Srinagar on January 19. (File photo)

Widespread rain and snowfall likely in the hills today: IMD

By HT Correspondent | Edited by Smriti Sinha
PUBLISHED ON JAN 22, 2021 08:29 AM IST
Minimum temperatures over northwest India are likely to rise by 2-4° C during Saturday and Sunday and fall by 2-4 ° C during the subsequent 48 hours
Close
In 2014, Biden, then the US Vice President, had hosted a lunch for the Indian prime minister at the state department during his visit. (REUTERS)
In 2014, Biden, then the US Vice President, had hosted a lunch for the Indian prime minister at the state department during his visit. (REUTERS)

Biden supports ‘successful’ ties between US, India leaders, says White House

By Yashwant Raj, Washington
PUBLISHED ON JAN 22, 2021 08:14 AM IST
  • As the new administration settles in, policy makers and experts in both the US and India are eager to know Washington's policy and approach on India.
Close
US Vice President Kamala Harris listens as US President Joe Biden speaks on his administrations' Covid-19 response.(Bloomberg Photo)
US Vice President Kamala Harris listens as US President Joe Biden speaks on his administrations' Covid-19 response.(Bloomberg Photo)

Kamala Harris as vice president further cements India-US ties: White House

PTI, Washington
PUBLISHED ON JAN 22, 2021 07:59 AM IST
"Certainly, historic moment for all of us in this country but a further cementing of the importance of our relationship,” White House Press Secretary Jen Psaki said on Kamala Harris election as vice president.
Close
Government officials, who did not wish to be named, said these events were cancelled because the elderly and children are more susceptible to contract Covid-19.(PTI)
Government officials, who did not wish to be named, said these events were cancelled because the elderly and children are more susceptible to contract Covid-19.(PTI)

Curtailed by pandemic, the Republic Day parade is different this year

PUBLISHED ON JAN 22, 2021 07:50 AM IST
One prominent event that drew crowds and cheers – stunts on motorcycles by the army and the personnel of the paramilitary forces – have been cancelled this year.
Close
Prime Minister Narendra Modi will interact with Covid-19 vaccine beneficiaries on Friday. (ANI File Photo )
Prime Minister Narendra Modi will interact with Covid-19 vaccine beneficiaries on Friday. (ANI File Photo )

PM Modi to interact with Covid-19 jab beneficiaries, vaccinators in Varanasi

By hindustantimes.com | Written by Kanishka Sarkar, Hindustan Times, New Delhi
PUBLISHED ON JAN 22, 2021 07:48 AM IST
Top government officials have said that the Prime Minister, 70, is likely to be vaccinated for Covid-19 in the second phase of the immunisation programme.
Close
The analysts said central leadership of the BJP seems to have left it to Yediyurappa to deal with the problem.(PTI)
The analysts said central leadership of the BJP seems to have left it to Yediyurappa to deal with the problem.(PTI)

Dissent escalates in Karnataka BJP against Yediyurappa after cabinet reshuffle

By Sharan Poovanna
PUBLISHED ON JAN 22, 2021 07:41 AM IST
The new ministers as well as those who were divested of key portfolios hit back at the chief minister. The CM inducted seven ministers into his cabinet on January 13.
Close
Perarivalan was among seven persons convicted by a Special TADA court for being part of the conspiracy to assassinate former PM Rajiv Gandhi on May 21, 1991.(File photo)
Perarivalan was among seven persons convicted by a Special TADA court for being part of the conspiracy to assassinate former PM Rajiv Gandhi on May 21, 1991.(File photo)

Will decide in 4 weeks on mercy plea of Rajiv case convict: Tamil Nadu Guv to SC

By Abraham Thomas | PTI
PUBLISHED ON JAN 22, 2021 07:38 AM IST
During pendency of the mercy plea, the Tamil Nadu Cabinet in September 2018 recommended release of all seven convicts including Perarivalan for their involvement in the 1991 assassination.
Close
Sasikala, 63, is due to be released from Bengaluru’s Parappana Agrahara prison on January 27 after serving a four-year term following her conviction for amassing assets disproportionate to her income.(PTI File Photo)
Sasikala, 63, is due to be released from Bengaluru’s Parappana Agrahara prison on January 27 after serving a four-year term following her conviction for amassing assets disproportionate to her income.(PTI File Photo)

Sasikala tests positive for Covid days before release from prison

By Sharan Poovanna, Divya Chandrababu, Chennai And Bengaluru
PUBLISHED ON JAN 22, 2021 07:34 AM IST
Sasikala had tested negative on Wednesday when she was taken to Bowring Hospital in Bengaluru after complaining of breathlessness and fever.
Close
India on Thursday sent 2 million doses of a coronavirus to Bangladesh, a gift that is likely to foster bilateral relations further between the two South Asian neighbors.(AP/PTI)
India on Thursday sent 2 million doses of a coronavirus to Bangladesh, a gift that is likely to foster bilateral relations further between the two South Asian neighbors.(AP/PTI)

India sends Covishield vaccines to Mauritius, Seychelles, Myanmar

By hindustantimes.com | Edited by Shankhyaneel Sarkar, Hindustan Times, New Delhi
PUBLISHED ON JAN 22, 2021 07:32 AM IST
  • Under India’s ‘Neighbourhood First’ policy, India has already dispatched vaccines to Nepal, Bangladesh, Bhutan and the Maldives as India has assured that friendly nations get every form of support.
Close
Maheshwari also said that keeping in mind the increasing responsibility of its VIP security wing, the force is enhancing its skills to match up to the Special Protection Group (SPG), which protects the Prime Minister and is a separate agency.(PTI)
Maheshwari also said that keeping in mind the increasing responsibility of its VIP security wing, the force is enhancing its skills to match up to the Special Protection Group (SPG), which protects the Prime Minister and is a separate agency.(PTI)

May induct women officers in specialised anti-maoist force: CRPF DG

By HT Correspondent, New Delhi
PUBLISHED ON JAN 22, 2021 07:30 AM IST
“We are favourably considering inducting women in CoBRA (Commando Battalion for Resolute Action),” Maheshwari said, addressing mediapersons at a press conference.
Close
People familiar with the matter added Union minister Satya Pal Singh asked what the ministry was planning to do regarding cybercrimes such as phishing.(Representative image)
People familiar with the matter added Union minister Satya Pal Singh asked what the ministry was planning to do regarding cybercrimes such as phishing.(Representative image)

No clear definition, computer-aided offence a cybercrime: MHA report

By Deeksha Bhardwaj, New Delhi
UPDATED ON JAN 22, 2021 07:50 AM IST
“Such offences are dealt as per the legal provisions of the Information Technology Act, Indian Penal Code, POSCO etc,” the ministry has said. It added that government has also straightened the legal framework by dealing with cybercrime cases against women and children as child sex abuse materials.
Close
After a phone conversation with his Chinese counterpart Wang Yi, Pakistan foreign minister Shah Mahmood Qureshi announced on Thursday that Beijing had gifted 500,000 doses of the Sinopharm vaccine as aid.(AP File Photo )
After a phone conversation with his Chinese counterpart Wang Yi, Pakistan foreign minister Shah Mahmood Qureshi announced on Thursday that Beijing had gifted 500,000 doses of the Sinopharm vaccine as aid.(AP File Photo )

Amid India’s Covid vaccine export, China offers 500k doses to Pak

By Rezaul H Laskar, New Delhi
PUBLISHED ON JAN 22, 2021 07:11 AM IST
Two Indian flights carried two million doses of Covishield to Dhaka and one million doses to Kathmandu, and people familiar with matter said on condition of anonymity that supplies would be sent to Seychelles (50,000 doses), Mauritius (100,000 doses) and Myanmar (1.5 million doses) on Friday.
Close
SHARE
Story Saved
OPEN APP