The thinking Indian’s guide to Aadhaar

[Aadhaar is a disruptive idea and a technological leap forward. But a poorly thought-through, hasty implementation could have unintended consequences. Image by hugorouffiac under Creative Commons]

“In war, whichever side may call itself the victor, there are no winners, but all are losers” – Neville Chamberlain

The Judges ruled.

The Petitioners wanted it destroyed. 

The Government argued it’s their way or the highway.

As for citizens, they were mute observers.

The Result: Project Aadhaar is now on life support.

With the Supreme Court ruling, India is now clutching at a vision of what could have been. This was a tool that could have helped India leapfrog. But ironically, those who argued for it, and against it, claim victory.

How wrong both are!

Much of the blame for this lies with the government. It ought to have created a framework and a body to oversee policies for Aadhaar to evolve. This body could have listened in to what detractors may have to say and weighed in on what fixes must be made to Version 1.0 of Aadhaar. What was the hurry to push it through? Of course, Version 1.0 was flawed—but you need to fix the system, not stunt it.

On their part, detractors ought to have pushed all buttons to improve the system—not insist it be destroyed.

As for UIDAI, the entity that oversees Aadhaar, why couldn’t it simply admit the system had gaps, the policies that govern it are weak. Could it have been more open to constructive conversations?

These nuances were lost in what became a bitter battle of egos. A intricate, multi-layered, technically complex, and futuristic issue was handed over to a courtroom presided by five wise men with little or not understanding of technology to mediate upon. Take a guess on the number of times the term ‘foundational id’—which is as fundamental to the idea of Aadhaar, as speed of light is to the theory of relativity—is used in the entire Aadhaar judgement. Answer: Not once. Zilch. Zero.

Imagine, what if you are called in to decide the fate of the semiconductor industry and how chips must be made? But, you specialise not in semiconductors but in law. By no means am I suggesting the Judges are incompetent. But it’s like asking a pilot to repair an aircraft. A pilot can fly an airplane very competently, and get it to the intended destination. To ensure the engines are tuned just right and flight paths are safe, there are others who are tasked with the jobs.

In this case, the judges had to lean in on arguments made by both sides. Experts were called in from every place and the arguments were vicious. This extract from their order lays it out in black and white:

"There has been no other subject matter in recent past which has evoked the kind of intensive and heated debate wherein both sides, for and against, argue so passionately in support of their respective conviction. The petitioners in these petitions belong to the latter category who apprehend the totalitarian state if Aadhaar project is allowed to continue. They are demanding scrapping and demolition of the entire Aadhaar structure which, according to them, is anathema to the democratic principles and rule of law, which is the bedrock of the Indian Constitution.” (Italics mine.)

So, who is to blame? Certainly not the five judges at the Supreme Court listening in. Nobody can opine on an evolving ecosystem. One which is still taking its baby steps and needs correction. It has to be nurtured into maturity, with constant oversight.

But you get what you petition for. So, the bench opined on what it was asked to opine on. It led to two outcomes.

1. The verdict said Aadhaar can be used in some cases, in others it cannot. They thought their job was to stop it from being implemented at places where it thought it faulty. In doing that though, unwittingly, the verdict, blunted a knife that could otherwise have cut cobwebs of inequality and moved India into a more efficient orbit. 
2. All else is open to interpretation under the rather opaque Section 57. The contents of which most people are trying to come to terms with

Why did this happen? Nobody will say it in as many words. It is not the job of Supreme Court judges to deliver oversight. It is not the competent authority. It can only opine on what it has been asked to opine upon. The 1500-page order is cast in stone, and will set precedent for arguments that follow – technology shift and innovation that would have naturally evolved to address the weakness of the system be damned. We are now left with a system on life support.

As for those against Aadhaar, did they have to insist the baby be thrown out with the bathwater? While the bathwater is dirty and there is much work that can be done to secure it, the Supreme Court was not the forum for it. But what options did they have?

In an age where all technologies are evolving, what Aadhaar needed was a framework to help it through. Not a ruling that freezes it in time.

By way of examples, where were the informed discussions on how to prevent misuse or what penalties must be imposed if Aadhaar is misused. Why should anyone be allowed to store data for any period of time? Why did the Court decide data can be stored for six months? Why ought it not be a disposable system? All Aadhaar needs to do is authenticate a person is whom a person claims to be. All other data must reside in silos.

This is how Visa or MasterCard operates. It does not reveal to a merchant how much money resides in your bank when you swipe a debit card issued by it. While the Supreme Court order says it must not be done, where are the policies in place that frame it? What prevents it from happening? And what penalties must be imposed if it happens?

The answer is a simple one: There is no regulatory body. No consultative process.

The stakeholders in this battle got myopic and attached to their positions. They were not sincere to the cause. If they were, they would have debated these issues. The Government, and its detractors ought to have shown they have the intent to work to create Aadhaar Version 2.0.

But this is typical of battles fought on social media. You are either for or against something. There is no place for nuance, no middle-paths and no trade-offs. 

That this debate is not binary is something I have often tried to tell friends on multiple forums. And in a fit of exasperation, I had put together a Q & A, before this verdict was out for those who felt conflicted about Aadhaar.

Because Aadhaar is an issue that goes beyond political parties or the government—its impact will be felt on our future generations. Especially those who are silent today—on India Three— our fellow Indians who subsist, don’t know their rights and don’t even find out when and how their rights are abused. Buying on Flipkart and Amazon or sharing jokes on Sharechat will not make India a competitive digital economy. If India must keep pace with the US and China, it need a grassroots driven initiative that reaches people at the bottom of the pyramid, and builds digital infrastructure for everyone.

To start thinking about Aadhar, let’s put it into three buckets—its potential use, misuse and abuse. Each bucket must be closely inspected, and scenarios painted, before we rush headlong at arriving on any conclusions.

As you read, may I urge you to grapple with two contradictory ideas: Aadhaar is good and Aadhaar is bad.

The Uses

Is it useful to have a unique identity for every Indian?

Given the deficiencies of our infrastructure and gaps in healthcare, education, and distribution of welfare, can an identity system help cut the massive frictions the vast majority of our population face in accessing public services? Can a secure, reliable identity platform increase trust and make daily life simpler?

Can it be used for the good of society—to cut corruption, crime and leakages?

Let’s face it, our public services and resources don’t fully reach the intended recipients. Can you imagine the drag this has on the economy? If we don’t trickle down our wealth and public services, and cut corruption, we will forever remain a lopsided economy. Three countries in one, which never meet. Aadhaar (and the digital ecosystem it gives birth to) can be used to cut the ropes that hold us down. It can cut the arbitrage and rent that corruption creates. It can cut down crime by creating transparency and traceability.

Does such an identity system have flaws, both technical and practical?

Any exercise of this scale will have challenges, especially given the level of literacy and awareness among our not-so-privileged citizens. Every such shift in India goes through many twists and turns as we navigate the gaps between the ideal and the practical. Two steps forward and one step back…well, that’s us!

An example: It took us several years to dematerialise our stock markets fully and we did it at a time when the US market still operated using paper. Today we have one of the most solid, transparent equity markets in the world, on the back of this digitisation.

Does technology exist to overcome these flaws? Does it offer alternative paths in cases where the system fails to respond?

The operating context in India is complex—networks fail, Aadhaar agents can be compromised and the users may be unaware. We need creative use of technology and workflows in case the system fails to identify a citizen. If the Aadhaar database is not able to confirm your identity, then we need to find alternative workarounds.

Some of these are already provided for.

Aadhaar is based on biometrics, which in the absence of good birth and death records in the country, probably offers the most optimal way to establish the uniqueness of an individual. However, there are citizens without biometrics (no fingers, no iris) and the system, being probabilistic, will throw up false positives and false negatives, which need to be dealt with.

Aadhaar offers other ways to authenticate—through one time password (OTP), for those who have connected their mobile numbers to Aadhaar, or via facial recognition which was recently announced by the Unique Identification Authority of India (UIDAI).

Clearly, for the system to be accepted as fail-safe and robust, it will need multiple options for authentication, much as we have multiple reliable ways to make an online payment today—money doesn’t just disappear from your bank account. The Reserve Bank of India has ensured that.

The Misuse

By linking databases, can the system be used for profiling citizens?

A concern is that if Aadhaar is used by you to authenticate all your transactions, the database ends up developing a full profile for you and your family.

However, at present there isn’t one big database with all the data. The risk of a breach, and potential harm, depends on which data we are talking about.

The Aadhaar database itself collects minimal biometric information and follows the principle of optimal ignorance. When it receives an authentication request, it can only say Yes or No. The biometric data never leaves the system and UIDAI wouldn’t know the purpose of the transactions.

Though, there is a risk that someone might hack into other databases that have Aadhaar numbers and use that as a primary key to profile citizens. Anyone with access to these databases can use them for surveillance and profiling, provided they have access to multiple databases. Give that the vast majority of our voters are not so literate and not privileged, this profiling can be misused for a variety of purposes, including vote wars.

Thus in a sense, the risk lies in how Aadhaar is collected and used.

Can it be used to deny services to a citizen?

Another fear is that every service that depends on Aadhaar authentication can be denied to you—this includes your family too, since your kids’ schooling, your bank account, insurance account et al. are linked to your Aadhaar profile.

However, there’s a crucial difference between linking and authenticating.

Linking Aadhaar number to your kids’ school does not mean the school will ask them to authenticate every time they enter the classroom. Similarly, linking Aadhaar number to your bank account does not mean that you have to do Aadhaar authentication every time you draw money from an ATM. You can continue to do this even if your Aadhaar number is deleted. Consider this example described in The Wire: UIDAI deleted the Aadhaar number from the Central Identities Data Repository (CIDR), but that did not stop the user from making banking transactions. Also keep in mind, if the bank wanted to deny services, it only had to freeze the account—with or without Aadhaar.

Does it open up avenues for misuse by criminals to hoodwink the unsuspecting and illiterate masses of India?

We are already seeing several cases of misuse. Once again, like any software platform it will have bugs and clever individuals will find ways to use the system for their own gain. The more powerful the system is, the higher the incentive for criminals to break in.

I can see two levels of misuse:

1. Identity theft: Where citizens are misled into giving away their Aadhaar authentication to crooks who then misuse it to avail services or even blackmail people. We live in a world where SIM cards can be cloned and OTP messages intercepted.

2. Data breach: It is Aadhaar vs the hackers—a cat and mouse game. Any large-scale breach is a threat to our national security. On a more immediate level, the data passes many hands in the extended Aadhaar network and that poses a risk.

Remember that Aadhaar authentication is not common—even in places where it should be the norm. (The security at the airport entrance should demand Aadhaar authentication because, unlike popular perception, the Aadhaar card itself has no security feature. Anyone can print the card with any name and any random number and the security guard will let him through.)

Can a government employee in collusion use his/her privileged access to the system for wrongdoing?

We live with a huge government, we live with few checks and balances and we live with a very high penetration of low-grade corruption. And we know that a system that gives widespread access to government is open to misuse for a small under-the-table gift. This is the unfortunate, practical reality of our nation. Of course, this creates a new layer of risk.

The Abuse

Can the state abuse its powers?

Humans have a strange relationship with power—and the relationship with governments is even stranger. The Constitution is there to protect us, but it puts the onus on the citizen to prevent abuse of their rights. Aadhaar, if misused, can become a digital weapon in the hands of the powerful.

A note here: While we talk about Aadhaar misuse we also have to remember that many state governments maintain their own databases—State Resident Data Hubs—which have all the information that UIDAI has plus something more. Not much attention has been paid to these databases, and we have not had enough debate on the laws and regulations that govern these. They need to be brought into the ambit on the debate on abuse.

Does the system fundamentally alter both the scale and speed with which the state can move?

Very simply, the fear projected is that if a department puts you on an Aadhaar blacklist on a Friday evening at 8 pm, you cease to have rights at that very moment. You can be denied access to your money, travel—everything that needs Aadhar authentication. And courts open on Monday—assuming you get a hearing.

This assumes that every transaction we do needs authentication. Clearly that is not the case. Most activities don’t depend on KYC or authentication. Further, this assertion assumes that Aadhaar will be the only way to authenticate. That’s not the case either.

Note: Like I mentioned, you don’t need to use Aadhaar authentication at an ATM. That, of course, does not mean you are free from state abuse. The state can still freeze your accounts or your passports even in a non-Aadhaar world. Aadhaar just makes it faster and easier—but ONLY if Aadhaar authentication is required everywhere. Connecting Aadhaar to a service does not mean that service will require you to authenticate every time. It might be using it only for deduplication, where Aadhaar number is just an entry in the database.

If the databases are linked, can your entire life be frozen by an order to blacklist you?

Refer to the point above. Linking is not the same as authenticating every transaction.

That said, with or without Aadhaar, we must realise that we have entered a new digital age. We leave a digital trail wherever we go. We have consciously given more and more power to our governments because we expect them to take care of our security. After all, no one wants another Mumbai attack. When we have empowered the government, we also have to be aware that the state can use its power against its own people. It’s not easy to find balance—and we need to be careful, and aware of how any government uses Aadhaar and be fully informed as citizens.

The balance of power cannot shift from citizens to government, under the guise of digitisation.

Do citizens have constitutional and judicial protection if the state issues a “denial of service” or blacklist order against you?

Imagine an India without its courts and you will imagine a different India. Our judicial backbone has kept us a functioning democracy. That said, and given that Indian courts have a backlog of over 30 million cases, justice takes time to be delivered. So, in case a citizen is at the receiving end of abuse, access to a good lawyer and a sympathetic court will be expensive and time-consuming, especially when you can be locked out from accessing your own resources (e.g. your bank account is frozen).

The slow rate at which our law moves creates a natural and abiding incentive for abuse and corruption. This is the bane of our nation and it is something our future generations will hold against us.

The Issues

What about personal data “leaks” to your mobile companies? Is it the same level of threat as your entire data being available to the state?

Every bit of your data is being used by over 5,000 global adtech companies to target you. Of course, your phone and your desktop can be hacked and your entire life can be hijacked. But these companies are relatively harmless—they don’t “authenticate” your existence. You don’t cease to exist if they have a bug in their system or someone takes a decision to delete your data. Your life doesn’t come to standstill.

Remember, those are private corporations with a profit motive and can be compelled to act under the rule of the state and law. But what about the state itself?

Do we need to fundamentally rethink the balance between using technology, and banning it?

This is a much larger issue. Technology the world over is morphing faster than regulators and goverments can get their heads around it. Look at Bitcoin. Its primary use case seems to be that it has suddenly increased the velocity with which one can transfer money in near-anonymity across borders. Guess who wanted to be paid in Bitcoin? The guys who rolled out ransomware across the globe. Indian courts and regulators will have to grapple with these complexities every day. That doesn’t mean we stay backward. It just means that we stay alert and aware.

The Thinking

Can the system be only an identity system?

Maybe at this stage Aadhaar is not ready to become an “authentication” system but stay an identity verification system—till we have full accountability on how it will be used. We need to debate the merits here. And we need to create suitable bypasses in case of systemic failure. Lives cannot be lost to a technical glitch!

Should the database linkage be banned? 

No state official should be able to view your transactions across the spectrum. This should be a basic requirement—independent, non-linkable databases, which are scrambled. There is no need to pool the data at one place, and then worry about misuse and abuse. In any case, it creates a point of vulnerability for the enemies of our state to exploit.

Any transaction will leave a digital footprint, but no one should be able to see where you’ve been going or what you have been doing, unless you are under criminal investigation or a threat to the public.

Even for criminal investigation, we need the judiciary to create several tests before the database linkages can be constructed. We have a poor record of protecting citizens’ rights. We cannot handover a remote digital taser to every politician and bureaucrat.

Should the system ever be used for denial of services?

Again, would you as a citizen like to be at the receiving end of an Aadhaar blacklist? This needs to be at the core of the law around digital privacy and Aadhar. Unless you are proven guilty, by strict tests, you cannot be denied access.

Should you be worried about the state knowing more about you?

Of course you must. But remember, with or without Aadhaar, the state can and does all this. India runs at least five programmes that are explicitly for surveillance. Heard of Natgrid or Central Monitoring System? Similarly, it will be naive to assume that if a government agency needs to invade your privacy, it won’t be able to do that without Aadhaar.

So, it might be wrong to imagine that the data available to mobile companies is not available to the state.

The question then is whether Aadhaar provides the state one more door to get into our private lives. Yes, it does. Which is why we should put the pressure on the state to strengthen laws around data protection, and impose a better supervisory structure over our intelligence agencies. With or without Aadhaar.  

Should the judiciary set up special systems that can react at the speed of the state whenever this system is used?

Yes! We need special courts that work 24x7 to protect us against digital technology that can be weaponised 24x7. We need this for every kind of cyber-abuse. As long as our laws are behind the times, there will be scope for abuse.

Should we be in such a hurry to implement it?

There are several matters to be thought through—issues around informed consent, penalties for misuse, mechanisms for recourse, simple things like what happens if someone loses their mobile phone or goes off-grid. These need time, testing and introspection—we probably need to create Aadhaar 2.0 which is more robust and reliable.

However, going beyond technology and work-arounds, the biggest issues in my mind is education. We need awareness—not only among the unsuspecting and illiterate masses, but also among the educated lot about the best practices and security features available in Aadhaar. Basic hygiene principles like not giving just anyone your Aadhaar number, let alone letting them scan your fingerprints or iris without knowing their credentials and quizzing them about the purpose and so on. Similarly, keep your phone number and email ID updated on the Aadhaar site, so you get notifications every time your Aadhaar number is used. Aadhaar already provides for biometric lock. It has also announced virtual Aadhaar, which to a large extent brings down the risk of a third party linking databases using your Aadhaar number. Till every citizen understands what he or she has signed up for, we carry risk.

The Point

Of course, there are technical, infrastructure and in-use problems within Aadhaar. They can be resolved.  

The real problems are outside Aadhaar—on how it can be abused by the stakeholders.

In the past, Aadhaar has forced India to confront important questions such as whether privacy is a fundamental right. One can even argue that the data protection laws framed under Justice Srikrishna happened on account of the intense debate around Aadhaar. This judgement and data protection laws that are being scrutinized currently goes beyond Aadhaar. It can impact companies that include Facebook, Uber, Google and Amazon.

Similarly, let us hope Aadhaar will surface leakages, cracks, and lack of accountability in the government system. We should not wait for something drastic to happen. We should start examining it today.

As we move rapidly into a digital era, we should not think just in terms of judiciary providing a balance to the potential abuse of the system. Instead, we have to start thinking in terms of how the system itself can have enough internal checks and balances. Fighting misuse and hacking will be an everyday affair. As we digitise India, there is no hiding from that responsibility and the best technology minds of our country need to be deployed to protect us.

There is already much research in autopoiesis systems—that are capable of maintaining themselves. Some of the best legal minds across the world are thinking of building legal frameworks for a world that will be run by artificial intelligence and algorithms.

Why is it important? The same checks and balances we put on these systems to make sure that we are protected from the potential harms that could be caused, can also save us from the harms that government can cause us. Recourse and penalty, both, need to be enshrined in new laws that govern data usage.

Aadhaar is like a surgeon’s scalpel. It needs to be handled carefully, by those who have trained in its use for years. In the hands of someone with bad intentions or someone who is not sufficiently trained it can cause irreversible harm. But in the hands of a well-trained surgeon, it can save lives. It needs security, it needs regulations. But let’s not throw the baby out with the proverbial bathwater.

Moving slowly and thoughtfully may be the solution. If the system has gaps and is hackable, we need to put the safety pin back in. Calibrate its usage and impact as we evolve a version that works.

I may have missed many questions above. This is a debate on what probably is one of the most important decisions we face as citizens. Write in below.

PS: My stand: I love Aadhaar (and its companion IndiaStack). Much like I love our fully digitised stock market, our online passport and motor license offices or our land registries. They make things transparent and work for the citizen. So, instead of dismantling Aadhaar, we should make sure we use it, stop its misuse, absolutely ban its abuse, and create the right conditions for it to evolve.

The motor vehicle transformed humanity, but you don’t hand over the keys of your car to a 10-year-old. The death due to drunken driving leads to a charge of first-degree murder in some countries. We need to think the same way about Aadhaar. It can transform our nation, but equally the collateral damage from a shoddy implementation can be lethal.

So, can we now ask all the warring parties to lay down their arms? Is it possible to rework an ordinance via a consultative process, think up institutional frameworks that evolve with technology and resuscitate Aadhaar? Without it, India will be left behind.

Else, when history is written, no hagiographies will be written. Instead, how this matter was handled will be written about in very unkind words.

(With inputs from NS Ramnath)

Also Read

When a tech idea goes into a government office

A brief history of money, identity and Aadhaar

The future of privacy: A conversation with Rahul Matthan

The Aadhaar debate: Is common ground possible?