In September 2010, despite misgivings in many quarters, the Government of India embarked upon a preposterous exercise to provide every resident – not citizen, mind you – of the country with a Unique Identification number [UID, brand name Aadhaar], which would identify residents by iris scans, fingerprints and photographs. The Government claimed this Police State-style identification procedure would help root out corruption from social welfare schemes. Many were sceptical even then.

Now, a little over a year later, the UID has come under scrutiny from several quarters on account of issues relating to privacy of data, technical feasibility of the scheme, the phenomenal costs involved, and above all, the security of the collected data.

While all personal data has its own sanctity, UID is of a different and hitherto unprecedented dimension altogether, for the simple reason that it pertains to the entire Indian population (everyone above the age of 5 years). Insecurity of such stupendous data can have untold and dangerous consequences for the individual and for the nation.

It is significant that the Unique Identification Authority of India, chaired by Mr. Nandan Nilekani, was set up under the Planning Commission by an executive order and NOT by an Act of Parliament. Last month, the Standing Committee on Finance rejected the proposal of the National Identification Authority of India Bill, 2010.  Hence there is no law governing the functioning of the UIDAI or its subordinate contracted agencies. Yet, all this while, the UID project is in full throttle and Mr. Nilekani enjoys the rank, perks, and privileges of a Union Cabinet Minister!

Recently, a PIL in the Madras High Court sought to scrap the project on grounds of being illegal. Counsel for the petitioners stressed that the UIDAI was constituted by an executive order and therefore had no powers to compile personal details of people, and that collection of the said details without permission from any statutory authority amounted to serious infringement of the constitutional rights of citizens.

Noting that the Citizenship Rules 2003 make mention only of “visible identification mark”, the PIL said the card is being made mandatory for services like LPG supply and the opening of bank accounts. Describing it as “surveillance profiling” and “compulsory extraction of movements” of citizens, the petition sought the disbanding of the Authority and putting its activities on hold with immediate effect.

(http://articles.economictimes.indiatimes.com/2012-01-09/news/30607638_1_uidai-welfare-schemes-biometric).

There is now widespread concern regarding the security risks involved in providing the UID database over networks in real time. There is a major risk in the transmission of data on un-secured networks and an unaddressed danger of data tampering (not necessarily by foreign agencies only). The Government of India has yet to install even moderate data protection systems, and though it recognises the need for such a law, it has allowed the UIDAI to continue its project without safeguards.

Interacting with the press some time ago, the Director General and Mission Director, UIDAI, admitted that fingerprints may not always work due to the prevalence of a high population dependent on manual labour (whose prints may get erased with work and age) and said this could give an error rate that could end up excluding 15% of the population!

Anyone who has handled data will tell you that the maximum margin of error permissible in larger volumes of data is ± 5%. How can Government of India be blasé about the possibility of 15% of the population ‘disappearing’ through a flawed data system? Yet these concerns do not seem to inhibit the UIDAI from continuing with the project without rectifying any of its most glaring deficiencies.

To get an idea of the security risks involved, one could take a look at the German National Id Card which was publicly cracked on television. The PIN systems on the card were cracked, thereby allowing the hackers to impersonate the card-holder and engage in online transactions using his/her identity!

As mentioned above, the Government of India has already failed in its attempt to provide legislative clearance to the UIDAI. The Standing Committee on Finance, which considered the National Identification Authority of India Bill, 2010, submitted its views to Parliament in December 2011.

The Standing Committee voiced concerns over the misuse of collected data after taking note of the failure of similar initiatives in other nations. The Committee said the project was ‘hasty’ and directionless in its approach, and was flagged off without any consideration of the financial implications.

The Standing Committee further criticised the government for having started enrolment under the UID project without parliamentary approval. It rejected the government’s position and the legal justifications offered, and asserted that when constitutional rights are violated, the powers of the executive remain circumscribed by those of the legislature.

The Standing Committee report noted that the enrolment process compromises the security and confidentiality of those enrolled in the UID project. It noted that without a proper data protection law in place, it would be difficult to deal with data tampering and misuse.

Additionally, we may note that UID is not proof of citizenship and is meant for all persons residing within the country. This is a matter that is causing concern in many quarters as it will entitle even illegal immigrants to procure an Aadhaar number – and then claim legal citizenship on that basis at a later date. This fear is reinforced by the fact that to get a UID, one does not need a single valid identity proof! All that is needed is an introduction by a person who already holds an Aadhaar number.

The Standing Committee rightly observed, “while the country is on one hand facing a serious problem of illegal immigrants and infiltration from across the borders, the National Identification Authority of India Bill, 2010, proposes to entitle every resident to obtain an Aadhaar number”.

The Committee rang the death knell of the project, “…the Committee categorically convey their unacceptability of the National Identification Authority of India Bill, 2010 in its present form. The data already collected by the UIDAI may be transferred to the National Population Register (NPR), if the Government so chooses. The Committee would, thus, urge the Government to reconsider and review the UID scheme as also the proposals contained in the Bill in all its ramifications and bring forth a fresh legislation before Parliament”.

Concerned citizens had long been warning against the implementation of Aadhaar. Unseen forces, however, ensured the project continued and last year there were also talks of linking essential services like LPG connections and the opening of bank accounts to the UID number. This naturally caused a swelling of numbers at Aadhaar enrolment camps.

Finally, as in the Lokpal non-event, our parliamentary representatives have woken up to the dangers of the UID. To invest massive national finances to collect highly invasive data, reminiscent of a Police State, is bad enough. To be unable to ensure the privacy of the individual, the security risk posed by illegal migrants obtaining UID’s, the use of biometrics which can be uncertain in certain circumstances, and above all, the security of data transmitted over networks in real-time – all these accumulated issues seem to have finally done the project in.

Some mysteries remain. Who conceived this project and how was it approved with suspicious haste? What was the real objective? After all, any villager knows that if proper targeting of social welfare schemes was all that was intended, then a proper coordination of village pradhan-BDO-Collector is all that is required; no contractors, no middlemen. After all, Government has already conducted several surveys to identify the needy families and persons in the country, which is how Planning Commission chief Montek Singh Ahluwalia fixed Rs 32/day as the baseline dividing poverty from prosperity.

The Government would be wise to quietly disband the UIDAI. It serves no national purpose.

See also

http://164.100.47.134/lsscommittee/Finance/42%20Report.pdf

The author is a student