Centre for Internet and Society

UID: Are your biometric I-cards stacked against you?

praskrishna — 2012-06-26T09:33:51Z

Imagine a rural family of five. Mom. Dad. Two kids. And Grandma. Assume too that they are below the poverty line. The day is coming when this family will have to give its biometrics out to myriad agencies.

This article by M Rajshekhar was published in the Economic Times on June 24, 2012

You know that Nandan Nilekani's Unique Identification Authority of India (UIDAI) or the Registrar General's National Population Register (NPR) has been collecting biometrics for a while now.

But a set of other departments have entered the fray. This ranges from the PDS department, ministry of rural development (MoRD), states' education departments, the Rashtriya Swasthya Bima Yojana (RSBY), banks, the department of social welfare, the post office...they are all collecting biometrics (see Agencies Collecting Biometrics Right Now).

This is the latest iteration in India's tryst with biometrics. From a beginning where only the NPR — and, a little later, the UIDAI — were to capture biometrics, we have now reached a point where myriad departments and ministries are camping in India's villages and towns, capturing fingerprints and iris images.

Identity Thieves

There was to be one large database. Now, we are moving to a system where multiple agencies capture and store biometrics data in myriad servers. This is amplifying the risk of biometric theft.

As Sunil Abraham, the head of Bangalore-based Centre for Internet and Society says, "If biometrics is used as authentication factor then it would be possible for a criminal to harvest your biometrics — such as using a glass to collect fingerprints — without your conscious cooperation. Or the registrar can cache your biometrics and duplicate transactions."

As the number of databases containing biometrics rises, the risk of this information leaking out increases. There have been complaints against an UIDAI enrolment agency called Madras Security Printers that it had sold data to private companies. There were also charges that enrolment agencies had outsourced the enrolment work to other companies, which they are not allowed to do.

What complicates matters further is there are not many safeguards. The country doesn't have a policy on how biometrics can be captured, used, stored and destroyed. But before we get deeper into that story, it is useful to understand why multiple departments have begun collecting biometrics.

Biometric Rush

According to a senior bureaucrat who recently retired from the ministry of planning, the answer lies in the 2014 elections. "For the government, cash transfers are the large reforms that they think UPA 2 can point towards in the next elections. For this reason, they need all this up and running before 2014."

However, over the past few months, parts of the government are increasingly unsure if UIDAI and NPR will meet their targets. "I do not think the 2014 target can be met at all," says a senior official in the National Informatics Centre (NIC). "We have to enroll another 800 million people. Then, we have to deduplicate them. Then, we have to make the cards and distribute them."

This is one reason why a set of government departments are configuring their own alternatives. Take the Department of Financial Services (DFS). It has been testing an online, biometric system for cash payments in Haryana's Mewat district for months now. Here, each bank will store its customers' biometric information in its own servers.

If a customer of bank A goes to a banking correspondent (BC) agent of bank B, his biometrics would be forwarded by bank B to bank A for authentication. Once authenticated, the transaction will be completed. "We should be rolling the new system out nationally from July or August," says the bureaucrat.

The rural development ministry is also testing its payment system. Once the local administration tells the ministry about who worked how many days, the ministry will be able to put money into their accounts automatically via a payment gateway. Right now, this is done manually with the block development officer and sarpanch making out the cheques.

This pilot, says DK Jain, joint secretary, MoRD, started 3-4 months ago in parts of Gujarat, Karnataka, Odisha and Rajasthan. In another six months, it will be available across the country. And then, there is the PDS.

Here, different states are putting different systems in place. Andhra, says a senior mandarin in the food ministry, is going with UID, Haryana is looking at smart cards, Jharkhand is going with Aadhaar, MP and Gujarat are testing food coupons, while Chhattisgarh has decided to use RSBY and Orissa has chosen NPR.

Apart from this, data is also being collected by the RSBY and BC companies on behalf of the banks handling welfare payments, or scrambling to meet their financial inclusion targets.

Sunil Abraham is quoted in this article.

For more details visit http://editors.cis-india.org/news/are-your-biometric-i-cards-stacked-against-you

UID project draws flak from civil rights activists

praskrishna — 2011-04-02T12:26:20Z

The unique identification project is drawing a flak from civil rights activists.

The unique identification project drew flak from civil liberties activists in the city on Wednesday. "Unique identification is an encroachment of privacy. With the new technology, it will be easy to track people," members of Citizens Against UID / Aashar, a forum floated by those opposing the project, including PUCL and SICHREM, said. They said the project should not be implemented until people's participation was ensured.

Read the original article in DNA

For more details visit http://editors.cis-india.org/news/UID-project-draws-flak

UID Poster 2

praskrishna — 2013-09-24T10:17:09Z

For more details visit http://editors.cis-india.org/internet-governance/blog/uid-2.pdf

UID Poster 1

praskrishna — 2013-09-24T10:15:30Z

For more details visit http://editors.cis-india.org/internet-governance/blog/uid-1.pdf

UID New Grid

praskrishna — 2011-07-25T06:10:36Z

new grid summary

For more details visit http://editors.cis-india.org/internet-governance/publications/uid-new-grid

UID Meeting in Bangalore – A Report

praskrishna — 2011-01-04T08:14:52Z

On 23 November 2010 a public meeting was held for the UID in Bangalore. The speakers included B.K Chandrashekar, former Chairman of the Karnataka Legislature Council, Mr. Vidyashankar, Principal Secretary to Government of e-commerce, Sunil Abraham, Executive Director of Centre for Internet and Society, Jude D’Souza, Technology Specialist and Mathew Thomas, Retired Army Officer.

Mr. Chandrashekar opened the public talk by giving a summary of the UID scheme, and sharing his own personal apprehensions to the project. Voicing his concerns as to the scale and architecture of the project, the collection of biometrics from individuals, and the fact that other countries have abandoned similar projects – he raised many points that evoked thought from the audience.

In his presentation, Jude D’Souza explained how the technology (iris scanners and fingerprint readers) that is used in the UID project can be easily spoofed. Through demonstration he proved how fingerprints can be replicated and subsequently authenticated with the use of simply a wax model. He also raised the point that high resolution cameras are now able to capture an individual’s fingerprint and iris at that point the captured image can be transferred and duplicated, and subsequently used for authentication. The point emphasized by D’Souza was that the technology being used by the UID is not as fool proof as is being claimed, and yet nowhere in the Bill or project is this concern being addressed. Redress for possible transaction errors is not provided for in the Bill, and it is not clear if a problem does arise what steps an individual should take.

Sunil Abraham spoke on the legality of the UID project. Emphasizing the point that civil society does not oppose the project in itself, but that civil society is concerned with the weaknesses that exist in the proposed legislation. He noted problems such as an overly broad scope, privacy concerns, and lack of adequate forms of redress. Mr. Abraham also contrasted the UID project with the identity work that has been done in Estonia, and raised the question as to whether a centralized is entirely necessary as opposed to a decentralized system of identity.
Mathew Thomas, through the use of many examples drove home two main questions.

Why is a project that is based on biometrics with a centralized structure necessary?
Can the project realistically meet its proposed objectives of bringing benefits to the poor?

Using the UK’s failed centralized identity scheme, which is similar to the UID scheme, he made the argument that India has the opportunity to learn from the mistakes of others, and this opportunity should not be overlooked or passed by. Mr. Thomas also pointed out that a proper cost benefit analysis is lacking for the project, as well as proper test trials of the technology and scheme.

Mr. Vidyashankar presented on the progress of the UID in Karnataka and answered questions concerning the project. In particular he focused on explaining the collection of information for Know Your Resident (KYR), and Know Your Resident+ (KYR+). KYR information includes: an individual’s name, address, date of birth, gender, relation details, phone number (optional), email (optional), and financial information. KYR+ includes: Physically Handicapped, EPIC Card No, Pan No., Bank Details, LPG Gas Connection, Supply Card, MNREGA Job Card, RSBY Card No, Pension ID, National Population Register No, Property Tax, Electricity Consumer No., Water Connection No., and BPL Data. The purpose of collecting the extra data for KYR+ is to prevent the exploitations of subsidies. By having on record who is eligible for what benefit, the over collection of benefits will be stopped. Vidyashankar also addressed privacy concerns, assuring the audience that information is encrypted at the time of collection and secured for privacy measures.

The reaction from the audience was one of apprehension, and in some cases anger. Individuals questioned the achievability of the objectives of the project, and expressed concerns that their tax money was being wasted. The overall sentiment in the room was that the UID project and Bill will be passed through Parliament but that in the long run, it will not benefit the everyday Indian citizen.

In a later interview Mr. Vidyashankar kindly clarified different details of the project that were still unclear. For example, if an individual needs to update the information in their profile – like their address - they are able to by visiting the closest centre , authenticating themselves, and requesting that the information be changed. He also clarified that registrars and enrollers are monitored as they are registering and authenticating individuals. He also clarified that numbers issued today and in the pilot projects will be valid after the Bill is passed through parliament. At the close of the interview he again assured me that the UID project does account for individual’s privacy, and is able to adequately protect collected data on due to the use of level five encryption. Despite Mr. Vidyanshankar’s assurances, it does not seem logical that the UID project is privacy safe, if a Privacy Legislation is being created specifically to protect the data that the UID will be collecting. It is concerning that the UID project is being carried forward without adequate built in safeguards, and even more concerning that it will the Bill could be passed through parliament and become a living law without the much needed privacy safeguards in place.

Note: Recently a final draft of the UID Bill that will be submitted to the Lok Sabha was released to the public. Civil Society has responded with comments and concerns for the UID Bill, which can be found on the CIS website.

VIDEOS

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/uid-meeting-november

UID info can be misused

praskrishna — 2011-04-02T12:26:27Z

Public organisations, NGOs and concerned citizens feel UID may become an easy database for anti-social elements.

The Unique Identification number (UID) could become an easy database for anti-social elements, according to public organisations, NGOs and concerned citizens. They felt that the UID should be discouraged till more transparency and accountability was introduced in the system.

They were speaking during a discussion on the UID here on Wednesday.

"Including so many details of individuals into a Central database could be dangerous," said Sunil Abraham, executive director, the centre for internet and society. He said various users of the data such as banks, telecom companies, government departments could potentially make it dangerous.

There are concerns that this will also lead to a police raj in the state. "As it is now there are so many anti-establishment movements, it will become very easy for the cops to arrest people and put them behind bars on the pretext of biometric mismatch. And nobody can question the technology," said Jagadish Chandra.

See the original article in the Deccan Chronicle

For more details visit http://editors.cis-india.org/news/uid-info-can-be-misused

UID has no legal sanctity, says lawyer-activist

praskrishna — 2013-03-11T06:08:32Z

‘Iris scanning adopted for the UID project is flawed as the iris keeps changing’

This article was published in the Hindu on March 3, 2013. CIS organized a workshop at the event.

Unique Identification Authority of India (UIDAI) and the UID project have no legal sanctity, said independent law researcher and human rights activist Usha Ramanathan on Saturday.

Speaking at a workshop on the UID, the National Population Register and Governance, organised by the Centre for Internet and Society, Ms. Ramanathan said the UIDAI has “no clear legal status.” “The fact that there are no limits placed on its functioning is deeply worrying,” she remarked.

Ms. Ramanathan pointed out that an agency, which was created by a mere executive order in 2009, now “owns” the data obtained from Indian citizens. Although the UIDAI has said enrolment is not mandatory, a host of providers of essential services – from ration shops to LPG distributors and now even railway tickets – require Aadhaar authentication.

The idea of using biometric validation of identities was adopted despite there “being no evidence of its viability anywhere in the world,” Ms. Ramanathan said. In fact, several reports have established the failure of biometrics as a means of validating identities, she claimed. The iris scanning, which has been adopted for the UID project is flawed because the iris does change over time, she said.

Anant Maringati, a geographer from Hyderabad, said the “positive” potential of the project have been usurped by entities such as microfinance institutions, which sue them to track those who have defaulted on loans.

‘An agency, which was created by a mere executive order in 2009, now owns the data obtained from Indian citizens’

‘Although the UIDAI has said enrolment is not mandatory, providers of essential services seek Aadhaar authentication’

For more details visit http://editors.cis-india.org/news/the-hindu-march-3-2013-uid-has-no-legal-sanctity

UID Grid

praskrishna — 2011-07-25T06:08:17Z

uid grid

For more details visit http://editors.cis-india.org/internet-governance/publications/uid-grid.xlsx

UID elicits mixed response

praskrishna — 2011-04-02T06:32:44Z

Which is the root cause for pilferage of welfare funds in India: fake identity or corruption?

Can the Unique Identity Card (UID) project solve this problem or will it create other more serious issues like infringement of constitutional rights, etc? These were the points fiercely debated at a panel discussion on UID organised by the Centre for Internet Society and Citizens' Action forum.

Chief Electoral Officer M N Vidyashankar, who made a presentation on the progress of the UID project in the State, at times, struggled to convince the audience on the necessity and feasibility of the project.

According to Mathews Thomas of the Citizens' Action Forum, the UID project creates more problems than it is expected to resolve.

“First, it was launched bypassing Parliament. It will only store biometric and other data of all citizens. This could result in illegal migrants claiming citizenship. Further, it will not prevent corruption in Public Distribution System or other schemes. The huge expenditure it will incur is also a matter of grave concern,” he said.

Defending the project, Vidyashankar said it was necessary to weed out discrepancies in multiple identity documents.

“It's well known that inconsistencies in a person's name, father's name, address, etc, creep in multiple documents. For instance, there will be different spellings of a person on a voter ID card, a driving Licence, a passport, and a PAN card. The UID will help in checking such discrepancies,” he asserted.

No operator will be able to tamper with the data. The laptops will have two screens to help the applicant see the entries. Data will first go to the Grameen Business Centre from where it will head to the Central Identity Database Repository which will issue a randomly generated number, he added.

Former Minister Prof B K Chandrashekhar said that there were several concerns in the UID project which need to be addressed properly.

Read the original in Deccan Herald

For more details visit http://editors.cis-india.org/news/uid-mixed-response

UID coverage in Udayavani

praskrishna — 2011-04-02T11:13:24Z

A press conference was held at the Press Club in Bangalore on 26 July, 2010. It was co-organised by Citizen's Action Forum, Alternate Law Forum and the Centre for Internet and Society. Mathew Thomas and Vinay Baindur were the speakers. Leading Kannada newspaper Udayavani covered this event.

UID coverage in Udayavani

For reading the original click here.

For more details visit http://editors.cis-india.org/news/uid-udayavani-news