Until recently, people were allowed to opt out of Aadhaar and withdraw consent to have their data stored. This is no longer going to be an option.(Siddhant Jumde / HT Illustration)
Until recently, people were allowed to opt out of Aadhaar and withdraw consent to have their data stored. This is no longer going to be an option.(Siddhant Jumde / HT Illustration)

Aadhaar marks a fundamental shift in citizen-state relations: From ‘We the People’ to ‘We the Government’

Your fingerprints, iris scans, details of where you shop. Compulsory Aadhaar means all this data is out there. And it’s still not clear who can view or use it
By Pranesh Prakash | Hindustan Times
UPDATED ON APR 03, 2017 12:34 PM IST

Imagine you’re walking down the street and you point the camera on your phone at a crowd of people in front of you. An app superimposes on each person’s face a partially-redacted name, date of birth, address, whether she’s undergone police verification, and, of course, an obscured Aadhaar number.

OnGrid, a company that bills itself as a “trust platform” and offers “to deliver verifications and background checks”, used that very imagery in an advertisement last month. Its website notes that “As per Government regulations, it is mandatory to take consent of the individual while using OnGrid”, but that is a legal requirement, not a technical one.

Since every instance of use of Aadhaar for authentication or for financial transactions leaves behind logs in the Unique Identification Authority of India’s (UIDAI) databases, the government can potentially have very detailed information about everything from the your medical purchases to your use of video-chatting software. The space for digital identities as divorced from legal identities gets removed. Clearly, Aadhaar has immense potential for profiling and surveillance. Our only defence: law that is weak at best and non-existent at worst.

The Aadhaar Act and Rules don’t limit the information that can be gathered from you by the enrolling agency; it doesn’t limit how Aadhaar can be used by third parties (a process called ‘seeding’) if they haven’t gathered their data from UIDAI; it doesn’t require your consent before third parties use your Aadhaar number to collate records about you (eg, a drug manufacturer buying data from various pharmacies, and creating profiles using Aadhaar).

It even allows your biometrics to be shared if it is “in the interest of national security”. The law offers provisions for UIDAI to file cases (eg, for multiple enrollments), but it doesn’t allow citizens to file a case against private parties or the government for misuse of Aadhaar or identity fraud, or data breach.

It is also clear that the government opposes any privacy-related improvements to the law. After debating the Aadhaar Bill in March 2016, the Rajya Sabha passed an amendment by MP Jairam Ramesh that allowed people to opt out of Aadhaar, and withdraw their consent to UIDAI storing their data, if they had other means of proving their identity (thus allowing Aadhaar to remain an enabler).

But that amendment, as with all amendments passed in the Rajya Sabha, was rejected by the Lok Sabha, allowing the government to make Aadhaar mandatory, and depriving citizens of consent. While the Aadhaar Act requires a person’s consent before collecting or using Aadhaar-provided details, it doesn’t allow for the revocation of that consent.

In other countries, data security laws require that a person be notified if her data has been breached. In response to an RTI application asking whether UIDAI systems had ever been breached, the Authority responded that the information could not be disclosed for reasons of “national security”.

The citizen must be transparent to the state, while the state will become more opaque to the citizen.

HOW DID AADHAAR CHANGE?

How did Aadhaar become the behemoth it is today, with it being mandatory for hundreds of government programmes, and even software like Skype enabling support for it?

The first detailed look one had at the UID project was through an internal UIDAI document marked ‘Confidential’ that was leaked through WikiLeaks in November 2009. That 41-page dossier is markedly different from the 170-page ‘Technology and Architecture’ document that UIDAI has on its website now, but also similar in some ways.

In neither of those is the need for Aadhaar properly established. Only in November 2012 — after scholars like Reetika Khera pointed out UIDAI’s fundamental misunderstanding of leakages in the welfare delivery system — was the first cost-benefit analysis commissioned, by when UIDAI had already spent 28 billion. That same month, Justice KS Puttaswamy, a retired High Court judge, filed a PIL in the Supreme Court challenging Aadhaar’s constitutionality, wherein the government has argued privacy isn’t a fundamental right.

Every time you use Aadhaar, you leave behind logs in the UIDAI databases. This means that the government can potentially have very detailed information about everything from the your medical purchases to your use of video-chatting software.

Even today, whether the ‘deduplication’ process — using biometrics to ensure the same person can’t register twice — works properly is a mystery, since UIDAI hasn’t published data on this since 2012. Instead of welcoming researchers to try to find flaws in the system, UIDAI recently filed an FIR against a journalist doing so.

At least in 2009, UIDAI stated it sought to prevent anyone from “[e]ngaging in or facilitating profiling of any nature for anyone or providing information for profiling of any nature for anyone”, whereas the 2014 document doesn’t. As OnGrid’s services show, the very profiling that the UIDAI said it would prohibit is now seen as a feature that all, including private companies, may exploit.

UID has changed in other ways too. In 2009, it was as a system that never sent out any information other than ‘Yes’ or ‘No’, which it did in response to queries like ‘Is Pranesh Prakash the name attached to this UID number’ or ‘Is April 1, 1990 his date of birth’, or ‘Does this fingerprint match this UID number’.

With the addition of e-KYC (wherein UIDAI provides your demographic details to the requester) and Aadhaar-enabled payments to the plan in 2012, the fundamentals of Aadhaar changed. This has made Aadhaar less secure.

SECURITY CONCERNS

With Aadhaar Pay, due to be launched on April 14, a merchant will ask you to enter your Aadhaar number into her device, and then for your biometrics — typically a fingerprint, which will serve as your ‘password’, resulting in money transfer from your Aadhaar-linked bank account.

Basic information security theory requires that even if the identifier (username, Aadhaar number etc) is publicly known — millions of people names and Aadhaar numbers have been published on dozens of government portals — the password must be secret. That’s how most logins works, that’s how debit and credit cards work. How are you or UIDAI going to keep your biometrics secret?

In 2015, researchers in Carnegie Mellon captured the iris scans of a driver using car’s side-view mirror from distances of up to 40 feet. In 2013, German hackers fooled Apple iOS’s fingerprint sensors by replicating a fingerprint from a photo taken off a glass held by an individual. They even replicated the German Defence Minister’s fingerprints from photographs she herself had put online. Your biometrics can’t be kept secret.

Typically, even if your username (in this case, Aadhaar number) is publicly known, your password must be secret. That’s how most logins works, that’s how debit and credit cards work. How are you or UIDAI going to keep your biometrics secret?

In the US, in a security breach of 21.5 million government employees’ personnel records in 2015, 5.2 million employees’ fingerprints were copied. If that breach had happened in India, those fingerprints could be used in conjunction with Aadhaar numbers not only for large-scale identity fraud, but also to steal money from people’s bank accounts.

All ‘passwords’ should be replaceable. If your credit card gets stolen, you can block it and get a new card. If your Aadhaar number and fingerprint are leaked, you can’t change it, you can’t block it.

The answer for Aadhaar too is to choose not to use biometrics alone for authentication and authorisation, and to remove the centralised biometrics database. And this requires a fundamental overhaul of the UID project.

Aadhaar marks a fundamental shift in citizen-state relations: from ‘We the People’ to ‘We the Government’. If the rampant misuse of electronic surveillance powers and wilful ignorance of the law by the state is any precedent, the future looks bleak. The only way to protect against us devolving into a total surveillance state is to improve rule of law, to strengthen our democratic institutions, and to fundamentally alter Aadhaar. Sadly, the political currents are not only not favourable, but dragging us in the opposite direction.

(Pranesh Prakash is policy director at the Centre for Internet and Society, and Affiliated Fellow at Yale Law School’s Information Society Project)

SHARE THIS ARTICLE ON
Close
Bihar Chief Minister Nitish Kumar greets Chief Justice of India Sharad Arvind Bobde; Union Law Minister Ravi Shankar Prasad is also present during the inaugural function of the Shatabdi Bhawan at High Court, in Patna.(ANI)
Bihar Chief Minister Nitish Kumar greets Chief Justice of India Sharad Arvind Bobde; Union Law Minister Ravi Shankar Prasad is also present during the inaugural function of the Shatabdi Bhawan at High Court, in Patna.(ANI)

Comments against judges 'disturbing new trend': Law minister Ravi Shankar Prasad

PTI
PUBLISHED ON FEB 27, 2021 06:10 PM IST
Prasad was addressing a function here organised to mark the inauguration of a new building of the Patna High Court by Chief Justice of India S A Bobde, in presence of Bihar Chief Minister Nitish Kumar, among others.
Close
Maharashtra continues to report the highest daily new cases at 8,333. In picture - Covid-19 testing in Mumbai.(HT Photo)
Maharashtra continues to report the highest daily new cases at 8,333. In picture - Covid-19 testing in Mumbai.(HT Photo)

Six states report surge in daily new Covid-19 cases: Government

ANI, New Delhi
PUBLISHED ON FEB 27, 2021 06:05 PM IST
India's present active caseload now stands at 1.44 percent of the country's total positive cases.
Close
A health worker collects a swab sample for a Covid-19 test.(HT Photo/ Raj K Raj)
A health worker collects a swab sample for a Covid-19 test.(HT Photo/ Raj K Raj)

This is what one dose of Covid-19 vaccine will cost in Gujarat

By hindustantimes.com | Edited by Mallika Soni
PUBLISHED ON FEB 27, 2021 05:59 PM IST
“The price of Covid-19 vaccine in Gujarat will be 250 in private hospitals and it will be provided free of cost in govt hospital across the state,” Patel was quoted as saying by news agency ANI.
Close
Bombay high court and all subordinate courts in Maharashtra, except Pune, had resumed in-person hearings in December after a gap of eight months.
Bombay high court and all subordinate courts in Maharashtra, except Pune, had resumed in-person hearings in December after a gap of eight months.

Bombay High Court refuses to hear case after lawyer removes mask in courtroom

PTI, Mumbai
PUBLISHED ON FEB 27, 2021 05:48 PM IST
  • A single-judge bench of Justice Prithviraj Chavan was on February 22 hearing an appeal matter during which the appellant's advocate removed his mask in the courtroom contrary to guidelines.
Close
Varanasi: Congress leader Priyanka Gandhi speaks on the occasion of Ravidas Jayanti, at Sant Ravidas temple in Varanasi, Saturday, Feb. 27, 2021. (PTI Photo)(PTI02_27_2021_000135B)(PTI)
Varanasi: Congress leader Priyanka Gandhi speaks on the occasion of Ravidas Jayanti, at Sant Ravidas temple in Varanasi, Saturday, Feb. 27, 2021. (PTI Photo)(PTI02_27_2021_000135B)(PTI)

'True religion never divides': Priyanka Gandhi at Varanasi's Ravidas temple

Posted by Prashasti Singh | PTI, Lucknow
PUBLISHED ON FEB 27, 2021 05:36 PM IST
This is the second time in the past two years when the Congress leader has visited the birth place of Sant Shiromani Guru Ravidasji, a Congress release issued in Lucknow said.
Close
The chief minister's tweet comes after a 17-year-old boy was beaten up and stabbed for allegedly opposing three boys who were stalking his sister.(HT photo)
The chief minister's tweet comes after a 17-year-old boy was beaten up and stabbed for allegedly opposing three boys who were stalking his sister.(HT photo)

Kejriwal says Delhi's law and order situation 'in serious turmoil'

By hindustantimes.com | Edited by Arpan Rai, New Delhi
UPDATED ON FEB 27, 2021 05:43 PM IST
Delhi chief minister Arvind Kejriwal on Saturday said in a tweet, "Deeply concerned by the murder of a 8-yr old girl in Khichdipur & attack on a 17-yr old boy in Kalkaji.
Close
The police sub inspector who wa escorting the truck was not in uniform.(Representational Photo)
The police sub inspector who wa escorting the truck was not in uniform.(Representational Photo)

Rogue cop arrested for escorting truck carrying methyl alcohol in dry Bihar

By Ajay Kr Pandey
PUBLISHED ON FEB 27, 2021 05:35 PM IST
  • Muzaffarpur's Senior Superintendent of Police said 4,400 liters of methyl alcohol was seized from the truck.
Close
Chandra Shekhar Azad(File photo)
Chandra Shekhar Azad(File photo)

Chandra Shekhar Azad's 90th death anniv: 'Azad hi rahein hain, azad hi rahenge'

By hindustantimes.com | Edited by Mallika Soni, Hindustan Times, New Delhi
PUBLISHED ON FEB 27, 2021 05:32 PM IST
After single-handedly fighting the police for a while with just a pistol and a few cartridges, Azad shot himself in the head, fulfilling his vow of dying as a free man and not as a British captive on February 27, 1931.
Close
The I&B ministry on Monday issued a public notice asking entities involved in uploading or streaming of news and current affairs through digital media to comply with the directive.(Representational Photo/Bloomberg)
The I&B ministry on Monday issued a public notice asking entities involved in uploading or streaming of news and current affairs through digital media to comply with the directive.(Representational Photo/Bloomberg)

Emergency interim blocking directions by I&B Ministry not new, clarifies govt

ANI
PUBLISHED ON FEB 27, 2021 05:31 PM IST
The government said this provision is exactly the same as being exercised by the Secretary, Ministry of Electronics and Information Technology (MeITY) for the past 11 years under the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009.
Close
Cabinet secretary Rajiv Gauba asked the states to enforce Covid appropriate behaviour and deal firmly with any violations of such norms, to further prevent the spread of the disease.(HT Photo)
Cabinet secretary Rajiv Gauba asked the states to enforce Covid appropriate behaviour and deal firmly with any violations of such norms, to further prevent the spread of the disease.(HT Photo)

As Covid-19 cases rise, Centre asks states to deal Covid-19 violations firmly

By hindustantimes.com | Written by Srivatsan K C, New Delhi
PUBLISHED ON FEB 27, 2021 05:31 PM IST
Cabinet secretary met the chief secretaries of Maharashtra, Punjab, Gujarat, Madhya Pradesh, Chhattisgarh, West Bengal, Telangana and Jammu and Kashmir — states that have been reporting a surge in the active caseload or the number of cases in the past week.
Close
Indian youth Congress supporters with posters, cylinders shout slogans during a protest against the hike in fuel price outside the residence of Textiles Minister Smriti Irani, in New Delhi on Saturday. (ANI Photo)
Indian youth Congress supporters with posters, cylinders shout slogans during a protest against the hike in fuel price outside the residence of Textiles Minister Smriti Irani, in New Delhi on Saturday. (ANI Photo)

Fuel price hike: Youth Congress stages protest outside residence of Smriti Irani

PTI, New Delhi
PUBLISHED ON FEB 27, 2021 05:21 PM IST
Irani, when in the opposition, would take to the streets even if prices of petrol and diesel rose by 5 per litre, but today she is "completely silent" as the country faces an "all-round inflation", said Indian Youth Congress (IYC) president Srinivas B V.
Close
The IAF's aerobatic display teams, the fixed wing 'Suryakirans' and rotary wing 'Sarang', along with Tejas arrived at Colombo on Saturday. (Representative Image)(PTI)
The IAF's aerobatic display teams, the fixed wing 'Suryakirans' and rotary wing 'Sarang', along with Tejas arrived at Colombo on Saturday. (Representative Image)(PTI)

IAF jets to feature in Sri Lankan Air Force's 70th anniversary celebrations

PTI
PUBLISHED ON FEB 27, 2021 05:18 PM IST
"Suryakirans, Sarang and LCA Tejas will participate in an air show at Galle Face, Colombo, scheduled from March 3 to 5 as part of the 70th anniversary celebrations of SLAF," the IAF said in a statement.
Close
MP Shashi Tharoor captioned his quirky tweet as 'one of the better WhatsApp forwards of the day!'. (PTI Photo/Manvender Vashist) (PTI02_11_2021_000247B)(PTI)
MP Shashi Tharoor captioned his quirky tweet as 'one of the better WhatsApp forwards of the day!'. (PTI Photo/Manvender Vashist) (PTI02_11_2021_000247B)(PTI)

Shashi Tharoor has a message for Indian cricket team. It has a 'spin'

By hindustantimes.com | Edited by Ayshee Bhaduri, Hindustan Times, New Delhi
UPDATED ON FEB 27, 2021 05:07 PM IST
  • Shashi Tharoor's message featured a picture of Gandhiji’s famous spinning wheel or Charkha along with the text 'spinners have always done well in Ahmedabad especially against England'
Close
Congress leader Ghulam Nabi Azad during a 'Shanti Sammelan' event in Jammu. (PTI)
Congress leader Ghulam Nabi Azad during a 'Shanti Sammelan' event in Jammu. (PTI)

News updates from HT: Congress G-23 honor Azad, discuss Gandhian philosophy

By hindustantimes.com, Hindustan Times, New Delhi
PUBLISHED ON FEB 27, 2021 04:50 PM IST
Here are today’s top news, analysis, and opinion. Know all about the latest news and other news updates from Hindustan Times.
Close
A deserted street in Amravati during its seven-day lockdown.(PTI)
A deserted street in Amravati during its seven-day lockdown.(PTI)

Covid-19: Lockdown extended in Maharashtra's Amravati for another week

By hindustantimes.com | Written by Deepali Sharma, Hindustan Times, New Delhi
UPDATED ON FEB 27, 2021 04:52 PM IST
The officials also said the situation in the district will be reviewed by March 5-6 to see if there is any improvement and a further decision will be taken.
Close
SHARE
Story Saved
OPEN APP