64 - Aadhaar's tryst with privacy - DNA

Aadhaar's tryst with privacy

Tuesday, 1 April 2014 - 6:00am IST | Place: Mumbai | Agency: DNA
Usha Ramanathan

It must be very embarrassing for the UIDAI. They are having to become the champions of 'privacy' of the persons on their database after holding on to a position that privacy was not an issue in the UID project. In the past year, an impressive array of petitioners had approached the Supreme Court challenging the UID project. They were asking the court to intervene and protect the citizenry from a project that was aggressively building a database of residents even after Parliament had said 'no' to it; that there was no law, and no protection against the data being used, mined and shared with all manner of agencies and companies including, significantly, companies with close links with foreign intelligence agencies.

Governments were making UID enrolment mandatory for getting wages, pensions, scholarships, rations, subsidies for kerosene and LPG, and to register marriages, rental agreements, wills and sale deeds … the list seemed to go on without end. Evidence revealed that the UIDAI was canvassing for the UID number to be adopted in all manner of systems. And, 'privacy' was used as a shorthand to express the varied concerns that the project had begun to raise.The UIDAI gave short shrift to the concerns raised about privacy. They said: "The contention that the scheme impinges on the numerous fundamental rights including the right to privacy is denied. The UIDAI seeks only very basic data on demographics like name, age or date of birth, gender and postal address. In case of biometric data, the fingerprint scans and iris are essential to undertake the de-duplication …."

And so these did not constitute any threat to privacy.Now, in February-March 2014, here was the UIDAI before the courts making an elaborate pitch for the fundamental right to privacy of the Indian resident. It began with the CBI being given the task of investigating the rape of a seven-year-old in January 2013 in a toilet in her school in Goa. Months after the occurrence, the CBI claimed to have found a 'chance palm print' to try and identify which, they said, they wanted the UIDAI to hand over to them its database of persons enrolled in Goa; and the Judicial Magistrate obliged them with an order. The UIDAI appealed the order, first to the Bombay High Court, and then to the Supreme Court. And 'privacy' was one of the main planks on which their arguments rested. They invoked Article 14, Article 21, Article 20 (3), Section 124 of the Evidence Act. They referred to a 1997 decision of the Supreme Court which held that the right to privacy is a part of the right to life and personal liberty "enshrined in Article 21 of the Constitution". They sought support from the 'triple test' set out in a case, and said that they could not be asked to disclose information held by them unless the 'triple test' that involved Articles 14, 19 and an emphasis on procedural protection had been met.

They drew on the decision about techniques such as narco analysis that were administered on a person which, the Supreme Court had held, violated the boundaries of privacy. With this, the UIDAI is saying that rules do exist and apply, but only for others; and not for the proponents of this extraordinary project. Interesting take. What the CBI is saying is, plainly, unacceptable: that there is a database, we have an unsolved case that is causing public outrage, so let us do a roving inquiry with a database, now that it exists, and never mind what it means for those who have been made to hand over their biometrics to an entity that, in any case, is not bound by any law. The UIDAI's arguments are valid, all right. But why would privacy not be similarly relevant when dealing with the UIDAI? And where is the UIDAI going to find the forked tongue that will defend and defy privacy rights, in one single contradictory breath?As for the court, on March 24, 2014, it directed that the UIDAI was "restrained from transferring any biometric information of any person who has been allotted the Aadhaar number to any other agency without his/her consent in writing".

The UIDAI says it is okay for it to hang on to the data of residents because they have given it 'voluntarily'. But the UIDAI has been caught out using the 'mandating' of the UID number — it uses the word 'insist' — for all manner of services and subsidies to get people to enrol 'voluntarily'. The court ordered, on September 23, 2013, that "no person should suffer for not having an Aadhaar card" even if some authority had said it would be mandatory. This seems to have been too complicated for the agencies, and the court has had to say it again, in simpler terms, on March 24, 2014.

They had earlier depicted the 0.057 per cent false positive identification rate — where the wrong person may be identified as a match — as a miniscule number. Now they had to admit that "applied on the UIDAI database of 60 crore residents (this) will imply false matches of lakhs of residents….(which) would put lakhs of innocent residents under the scanner."Echoing the concerns raised by those questioning the UID project, the UIDAI said in their petition to the Bombay High Court: "Further, there is also no saying if the said data could be misused by any person in whose possession it is handed." Quite an admission, that.Till this point, the UIDAI strategised like one who 'owns' the database might — planning for a 'revenue model', projecting profits, and independence from the government. Suddenly, they have had to change the language and use terms such as 'custodian' and 'trustee' of the residents' demographic and biometric data. Quite a climbdown, even if it is still only nominal.There is a lot more where that comes from, and a lot more to worry about.

The writer works on the jurisprudence of law, poverty and rights

55 - Not-so-unique recipe for disaster - DNA

Not-so-unique recipe for disaster

Aadhaar, with several loopholes, has become an embarrassment for the government

On September 23, two judges of the Supreme Court directed that “no person should suffer for not getting the Aadhaar card”. Why did the court need to say this? In 2009 and 2010, when the project had just been launched, enrolment was promoted as being voluntary. It was marketed as a convenience for those who already had other forms of identity; and a boon to those without any identity document, with the poor as the primary constituency. It was presented as a means to practise ‘inclusion’, that is, those for whom benefits and subsidies had been out of reach because they had no means of identifying themselves to the State and other private entities would now have an identity. Yet, the small print, even then, was saying something else. In April 2010, the Strategy Overview document of the UIDAI read: “UID will not be mandated: The UIDAI approach will be a demand-driven one, where the benefits and services that are linked to the UID will ensure demand for the number. This will not, however, preclude governments or Registrars from mandating enrolment.” So, making the UID mandatory was intended; only, the UID would work on, and with, Registrars to introduce the element of compulsion. This allowed the UIDAI to keep talking about ‘inclusion’, while governments and their departments would be egged on to bully people into enrolling for a UID on threat of exclusion from services. Take the proposed linking up between the UID and the PDS in a UIDAI document titled (no marks for guessing) UID and PDS. “To support enrolment, the central government will mandate that the UID numbers of each family member should be recorded in the ration card and the data base should be made available” to the UIDAI. That is quite unambiguous! Its document titled UID and Public Health has this: “Every citizen must have a strong incentive or a “killer application” to go and get herself a UID, which one could think of as a demand side pull. The demand side pull needs to be created de novo or fostered on existing platforms by the respective ministries. Helping various ministries visualise key applications that leverage existing government entitlement schemes such as the PDS and the NREGA will (1) get their buy-in into the project (2) help them roll out mechanisms that generate the demand pull....”. These are documents that have been around since 2009-10, and the UIDAI has been hard at work getting governments and agencies to link the UID number to all manner of services. Why does it matter that the UID is made mandatory? One, there is yet no law that covers this project. The UIDAI has been saying that should not matter because they were set up by an executive order, and that should be quite enough. That is a wholly questionable proposition, and it is, in fact, under challenge in court. But, the fact that a law was in fact introduced in Parliament in December 2010, and the Standing Committee on Finance rejected it in a scathing report that asked that both the project and the law be sent back to the drawing board, cannot be glossed over. There is also no law protecting privacy; the idea of data about individuals being the new property is helped by trivialising the right to privacy. Then, there is a startling fact that too few people have recognised: biometrics, which the UIDAI has been claiming can uniquely identify every individual, had not been tested when the project began. The decision was made on assumptions. This is not just a hypothesis. Take a look at this: In a ‘notice inviting applications for hiring of biometrics consultant’ issued by the UIDAI in January/February 2010, the UIDAI admitted complete ignorance about the effectiveness of biometrics: “there is a lack of a sound study that documents the accuracy achievable on Indian demographics (that is, larger percentage of rural population) and in Indian environmental conditions (that is, extremely hot and humid climates and facilities without air-conditioning). In fact, we do not have any credible study assessing the achievable accuracy in any of the developing countries.... The ‘quality’ assessment of fingerprint data (in the UIDAI’s ‘preliminary assessment’) is not sufficient to fully understand the achievable de-duplication accuracy.” It was in this state of ignorance that the decision to make biometrics the ‘unique’ factor was made. Today, three years later, it has become evident that old people and the poor are facing hurdles in authenticating themselves through biometrics. The UIDAI’s own authentication reports reveal how flawed the system is. More recently, the UIDAI has been talking of thousands of permanent enrolment stations, and people are advised to periodically re-enrol their fingerprints and iris. This is the first admission that biometrics are not forever, and that they change. Yet, the project refuses to pause. Making the UID mandatory in a system that cannot authenticate with any degree of certainty is only a prescription for massive exclusion. Why is no one in government verifying the field situation and asking the tough questions? Direct Benefit Transfer has shown itself to be a mere excuse for making the UID mandatory. In Delhi and Maharashtra, for instance, registering a will or a rent agreement or a sale deed, or getting married, needs a UID. Government servants, and high court judges, in Maharashtra are not to get their salaries unless they are enrolled. In Kerala, children cannot be enrolled in schools. In Delhi, EWS category were threatened with exclusion. Everywhere, gas subsidy is mandatorily linked with the UID number. And the list goes on. It is no wonder that the court was asked to step in to stop this rampant and irresponsible use of a number produced through a deeply defective process. The writer works on the jurisprudence of law, poverty and rights Usha Ramanathan Today, three years later, it has become evident that old people and the poor are facing hurdles in authenticating themselves through biometrics. The UIDAI’s own authentication reports reveal how flawed the system is

Published Date:  Sep 27, 2013

Copyright restricted. For reprint rights click here

14 - Activists, Researchers doubt security of UID Data - DNA

Activists, Researchers doubt security of UID Data - DNA

Sat, 22 Jan 2011-09:50pm , Mumbai , PTI


Activists and researchers today raised doubts over security of data being collected for the Unique Identification (UID)project and its public utility.

"The personal information being collected for the UID would be stored in a central database system without assuring protection against data theft. There could be a possibility of profiling, tracking and surveillance with the help of the information," Usha Ramanathan, an independent law researcher said today at a press conference

There are also doubts over the efficacy of the project. The UID claims better delivery of public schemes such as PDS or NREGA but does not say how would it help the people, Ramanathan said.

The UID number will only guarantee identity, not rights, benefits, or entitlements. In fact, when UID is not compatible with records in ration shops, how the government is going to plug leakages in the public schemes," associate professor from Tata Institute of Social Sciences, R Ramakumar said.

Besides, the infallibility of biometrics fingerprints and iris scan, is still being tested. The evidences have begun to emerge that callused hands, corneal scars and cataract induced by malnourishment may leave many millions outside this pattern of identification, Ramanathan claimed.

UID is the UPA government's most ambitious project headed by Nandan Nilekani, under which one billion Indians would be given a unique identity number. Prime Minister Manmohan Singh handed over the first identity card called Aadhaar at Tembhli village in Nandurbar district of Maharashtra in September last year.