Big concerns about the Aadhaar card

'There are requiring agencies under the law and these are going to use Aadhaar for authentication of various kinds – these can be anybody including a person, a private entity or the government. So almost anyone can use this authentication system.'

Usha Ramanathan, an independent law researcher studying Aadhaar since 2009, speaks to Nitin Sethi about the problems she believes are built into the platform. 

Edited excerpts:

You have been a strong critique of the Aadhaar platform. Your principle concerns are…

One, the process has been deeply problematic. The various concerns that the last time we were able to express as people – the standing committee’s job is to listen to people, experts and experiences – we have had six years since the enrolment began.

That experience has to be reflected in the way we make the bill today. That process got short-circuited and that is hugely problematic.

Second, if you look at the definition of services, benefits and subsidies – it covers almost everything, including a gift which will be seen as a benefit – even for that they can say get an Aadhaar number. So they are covering any activity that we might have and putting it under the bill.

Third, there are requiring agencies under the law and these are going to use Aadhaar for authentication of various kinds – these can be anybody including a person, a private entity or the government. So almost anyone can use this authentication system.

We recognise that the project consist of two things. One is the biometric the other is the numbering scheme. 

The idea that every citizen in this country is to be numbered is the primary thing in the project.

The second part is that every database should have the number embedded in it so it becomes easy to collate information about people, easy to profile people and launch surveillance if you want.

Interestingly the law also provides that UIDAI will make rules of how to omit or deactivate the number.

In the context in which the law has been brought, it amounts to civil death if all services are linked to this number.

It has been said and written by Mr Nilekani too that the biometric data will not be given to anyone. This has been made to appear as if it is a protection of the citizen.

What we are finding is it’s a shield that the UIDAI is putting in place because it doesn’t want its database to be subject to any kind of scrutiny.

Why do you think that is so?

There are phases and I shall tell you what happened in these phases. In 2009 they decide on using biometrics without having done their studies on it.

Normally you would do your pilot studies and slowly test it out.

In this case, in 2010 document they say we have tried in a few places and the results are encouraging and that is it.

There is nothing more. In 2009 December you have the biometric standards committee which says we tested 25,000 people for just enrolment and authentication was not in the picture.

They said 2-5 per cent of these people did not have biometrics that worked.

They said if you were to make sure that you enrol them properly, then maybe the percentage will improve but it will not be enough for improvement so you would have to add another biometric, the Iris.

You can think of Iris because it is getting out of proprietary domain now, you may want to try it.

Yet they say you have to conduct your tests before you decide this.  But they just adopted it.

In Jan-Feb 2010, there is a notice inviting biometrics consultant to help figure out how to use it.

In that document they openly say that the NIST that environmental and demographic factors will decide how the biometrics will work – calloused hands, ambient temperatures, if you use chemicals, the kind of rural and urban lives – all these will make a difference.

They say that it’s not been tested either in India or in the entire developing world. So they have launched with it but we don’t know whether it will work or not.

The number of things have happened since then  - the proof of concept of enrolment and authentication, Iris – in each of these there are number of problems are set out.

How we came to know is when in Goa a rape of a child in school, the police didn’t do its investigation properly and the case was handed over to the CBI.

The CBI says we found a random palm print. They get an order from local magistrate that all those who have enrolled in Goa their biometric should be handed over to police.

The UID runs to high court saying no you can’t do this. Asked why, it says one because we have to protect the privacy.

In Supreme Court they were denying right to privacy. Then they say the biometric data cannot be used for forensics.

The way we have to collect and maintain database it can’t be used for biometrics.

By then the demand is scaled down, CBI is not asking for the whole database, but says check these sets of fingerprints against your database.

UID refuses and the Bombay HC says what’s your problem, let the scientist come and check if it can be matched.

They go running to the Supreme Court and they get it embargoed in March 2014.

When in August 2015 the court passes and order saying you can’t use Aadhaar for anything other than LPG and PDS – even that voluntary – there the court slips in that however you may have to give this information if a court asks for it in a criminal investigation.

Then UIDAI tells us they have established a centre called UBCC, Unique Biometrics Competence Centre.

In that they say the nature and diversity of working population of India makes biometrics a challenge.

The mission of this UBCC is to try keep doing research so that we can make this biometrics work for the people of the country. You are going to bank this whole system on that biometric?

They decided to fix an identity that is to be do with biometric and numbering. The agency does not reveal all the glitches it’s facing but you go out to Rajasthan. In many places 20-40 per cent is the maximum that biometric works. The rest is not working. Yet, they have not taken that evidence in to account when making this law.

They have protected the UIDAI by not inscribing in that an independent audit – something whether the system works for the poor or not.

Another really serious problem, is that this is not about government benefits alone.

This is the new data transaction. It’s a new property and there are multiple ways in which data mining can be done using this UID. 

You have that clause 57 which says that any private company or person can use this system.

This was pointed out in Parliament but they refused to take it out because this is intended for the market. This is one of those neo-liberal techno-utopias. They got a few partial privacy clauses that they put in – it doesn’t have consent. We do not have an opt-out clause. We don’t have many things that the A P Shah committee said we need to do.

Very interestingly, every official of the UIDAI will be treated as a public servant under the Indian Penal Code – which means you cannot prosecute a person without the sanction of the government. The only person who can launch prosecution is the UIDAI. What if there are problems with the UIDAI itself? One cannot ask any questions of it?

As it is when it comes to these companies which have been operating the system – there is nothing in place to define who you can use, the extent to which you can outsource work etc – all these issues have been raised earlier.

In fact they can outsource and have these companies handling, managing and dealing with our data and information.
 
Is the concerns about privacy limited to only a section of society considering the state already has the capability of monitoring data when and if it wants on an individual through physical means?

Privacy is about personal security. Privacy in this case, with the database, is about national security.

You are creating this whole data base of the citizenry. Which you say to the best of ability you shall protect and beyond that we don’t know.

Last year in Washington the whole biometric data got hacked and stolen and they are still trying to grapple with the consequences and implications of that are. Here you are creating a database with the national security question that you can’t run away from.

If the state wants to find out something about you it probably can about an individual.

It might be possible but they shall have to do some work to collect it. But it is like the difference between hand to hand combat and drone warfare.

You know what the nature of power is. In this case profiling will become so easy.

When the natgrid was being proposed, what would the natgrid be doing, it would using the UID to access multiple databases to provide you information in real time from 22 databases to 11 security agencies.

When we talk of privacy with Aadhaar it is not just about the number but the databases that will also be linked to the UID number.

They are asking for mobile phones, they are asking for email addresses they are asking for bank account numbers.

It’s been made the individuals responsibility to keep updating the information that changes. Then there is authentication agencies.

You may not even come to know who all are authenticating you for what purpose.

This number is going to open up the possibility of various databases in which your number is linked today to collate.

This is a facility that the project is providing to the state and but it is also providing for private players.

You see this eventually going to a mobile-based platform of authentication.

We are seeing on the field biometrics is working patchily and you have the Andhra Pradesh food and civil supplies study that showed 22 per cent of rations were not lifted after introduction of Aadhaar.

When they went and did the study on that they found that 50 per cent of the people had fingerprint problems.

Another percentage of them who had an Aadhaar mismatch. So if there are two databases and those two are not saying the same thing, the person who suffers is not those maintaining the database but you. We have seen this already happen.

Remember this project is a number linked with a biometric. So if the biometric does not work what is left?

It opens up the system to huge fraud and exclusion. So now they have started encouraging everyone to fill in their mobile numbers. So the mobile phone number linked to the UID number will tell you it’s that person.

If they want to continue with the biometric experiment without entirely relying on it because they can’t provide the identity they shall have to look somewhere else and indications are it would be the mobile phone.

It’s an interpretation of what I am reading. One thing I have to say of this project, almost everything they have done or they are doing has been said and written somewhere or the other and if the policy makers have not read it only shows how excellently the idea has been marketed.

Some contend that aadhar has worked and reached the 1 billion mark because so many people wanted to have an identity document that is easy to come by?

First of all its reached this number because people have got bullied and threatened with exclusion.

We have gone to these permanent enrolment centres and seen every time the Supreme Court says that you don’t compel them to get the numbers and people believe this time the government will follow the orders there is a slump in enrolment.

Then when they find the government is not adhering to the ruling the enrolment goes up again. Its coercion.

Earlier people were not so bothered one way or the other with Aadhaar but since it became coercive many have got irritated with it.

By their own admission. They have given this in an RTI and given this as a statistics to the court, they have an introducer system for anyone who didn’t have any other document.

It’s only 0.03 percent that needed this introducer system all the others were able to produce some or the other document.

Mr Nilekani has often said that all other IDs that you have are linked to something where as this is an identity platform that can work across everything.

But, if you take the voter ID – people were able to show that voter ID wherever they needed to establish their identity.

They used it for voting but they were able to use it for identification everywhere.

The confusion seems to continue. I heard it in the Parliamentary debate too with some calling it the Aadhaar card.

It’s not a card, it’s a number. The Attorney General told in the court that card you can show it may be like a photo ID in a train or something but otherwise it has no value.

He is right it has no value. When Reetika Khera and Jean Dreze did their sample study of a 1,000 people they showed that less than 1 per cent didn’t have any IDs. Many had multiple IDs.

Which is why when the biometric linked to the Aadhaar card fails to work it actually threatens to shrinks the idea of identity for people.
 
UID and its portability of benefits?

The idea of portability of say benefits, especially PDS you lose it on migration.

When a scheduled tribe person moves from one state to another he or she loses the benefits as the other state does not recognise him as a scheduled tribe therefore they are not entitled to the benefit.

But in the case of PDS say if I from a state was able access my grains in Delhi or Mumbai as a migrant?

The problem today with wanting to have portable PDS is that not you being unable to show you are a beneficiary but that the ration shops will have to have the grains for that number of people who are going to come and collect it.

So if say a thousand workers migrate from Odisha to Maharashtra to do some work and they want to collect their PDS there, the shops there have to be stocked with the grains for a 1,000 more people.

What if this was resolved by converting this entirely to a cash subsidy?

In many parts of the country you shall not have supply and shops.

The second thing is cannot provide protection against inflation. Third, take the case when for the first time they said they shall give cash as subsidy in the bank accounts against subsidised kerosene in Rajasthan.

They found that either the cash didn’t reach on time or it some that did not get the subsidy so people just backed off from buying subsidy.

Demand naturally fell as people didn’t have the money to buy. What we are missing often is that people who need these subsidies don’t have a buffer.

If the state is not going to be there to provide for them…maybe 10 years down the line when everyone is relatively more prosperous and we reach say the kind of state Brazil is in, where only a small portion of people – 7 per cent who need the support – we can think of something like this.

Today I don’t think we are anywhere ready for it. Before 47 per cent -77 per cent of the people needing some kind of direct assistance from the state.

This is the state backing of saying let the people deal with it. People can’t deal with the market.

This is why you have these closed systems right?