UIDAI lodges FIR against newspaper over Aadhaar data breach report

Unique Identification Authority of India deputy director BM Patnaik named four people, including a reporter, in the FIR. The article was published on January 3, raising questions on the agency’s ability to protect its database.

An FIR has been lodged against The Tribune newspaper and a journalist over a report on anonymous sellers allegedly selling Aadhaar numbers through Whatsapp, an Indian Express report has said.

Employees mark their attendance through an Aadhaar-based biometric system in the Planning Commission.(Vipin Kumar/HT Photo)

The FIR filed by Unique Identification Authority of India (UIDAI) deputy director BM Patnaik named reporter Rachna Khaira and three other people contacted for the article. They were identified as Anil Kumar, Sunil Kumar and Raj.

Joint commissioner of police (crime branch) Alok Kumar said an investigation has already been launched into the matter. The FIR was registered under sections 419 (punishment for cheating by impersonation), 420 (cheating), 468 (forgery) and 471 (using as genuine a forged document) of the IPC, besides section 66 of the IT Act and section 36/37 of the Aadhaar Act.

The Tribune report, dated January 3, had stated that it cost the reporter just Rs 500 (and ten minutes) to get an “agent” to create a gateway and provide her with a login ID and password. “Lo and behold, you could enter any Aadhaar number into the portal, and instantly get all the particulars that an individual may have submitted to the UIDAI, including name, address, postal code, photo, phone number and email,” it alleged.

The FIR accused The Tribune of “purchasing” a service being offered by anonymous sellers to gain unrestricted access to details of over a billion Aadhaar numbers. “The above-mentioned persons have unauthorisedly accessed the Aadhaar ecosystem in connivance of the criminal conspiracy… The act of the aforesaid involved persons is in violation of (the various sections mentioned in the FIR)… Hence, an FIR needs to be filed at the cyber cell for the said violation,” it added.

Harish Khare, editor-in-chief of The Tribune, rejected the Indian Express’ request for a comment on the FIR. The UIDAI did not respond to calls and texts made by the newspaper either.

The UIDAI had denied any Aadhaar data breach after the report first appeared in The Tribune, and went on to clarify that “a mere display of demographic information cannot be misused without biometrics”.