India extends ‘Orwellian’ ID card scheme as critics warn of risks

library
crime | hacking | security

This month, the Indian government has been busy ensuring people use their Aadhaar card to access all sorts of things – including the free school meals and uniforms, food subsidies and pensions that are a life line for so many vulnerable people. According to the Guardian, critics argue that this controversial biometric identity card both restricts fundamental rights and exposes more than 1bn people to privacy risks.

Hundreds of thousands of people in India could be left without essential government services and benefits … The potential of unmonitored and unregulated use of such linked data by the private sector is massive.

The Aadhaar card’s roots, I understand but cannot verify, lie in a desire to curb illegal immigration in border villages in the aftermath of the 1999 Kargil War with Pakistan. The idea took its first steps with the Citizenship (Amendment) Act, 2003, which made some significant amendments to India’s Citizenship Act, 1955, including the addition of the clause:

The Central Government may compulsorily register every citizen of India and issue national identity card to him.

The Unique Identification Authority of India (UIDAI) was established six years later, in 2009, to issue Unique Identification numbers (UID), or “Aadhaar”, to all residents of India. UIDAI issued its first Aadhaar on September 29 2010 and has, according to official figures, issued more than 1.127bn since then – to 88.2% of India’s population.

Over the years, the Aadhaar has created a great deal of controversy. In 2010, The Hindu described the project as “Orwellian” and cited four major concerns:

The violation of people’s privacy and civil liberties
Whether the database was up to retaining the biometric information of more than 1bn people
No cost-benefit analysis or feasibility study
Whether it would be able to deliver the benefits promised, including India’s Public Distribution System (PDS) to the social sector.

In December 2011, the Parliamentary Standing Committee on Finance rejected the National Identification Authority of India Bill, 2010, raising a number of concerns. These included:

Although the scheme claims that obtaining Aadhaar number is voluntary, an apprehension is found to have developed in the minds of people that in future, services / benefits including food entitlements would be denied in case they do not have Aadhaar number.

India’s Supreme Court issued an interim in 23 September 2013 stating that “the government cannot deny a service to anyone who does not possess Aadhaar, as it is voluntary”. Yet, earlier this month, the Guardian report highlights, India’s government sent schools a notification that, from July, children will need to show their Aadhaar cards to get free school meals.

After facing intense criticism from opposition concerns that the government has made Aadhaar mandatory under the mid-day meal scheme and activist concerns that this will lead to some children losing out on vital nutrition, minister Prakash Javadekar refuted their suggestions saying, according to Indian Express:

All beneficiaries will get mid-day meal and the government will ensure that all the beneficiaries get the 12-digit unique identification number also.

Reading between the lines, it seems the card will soon become – whether the government admits it or not – compulsory for kids receiving free school meals. More than that, this “voluntary card” will also soon become mandatory for many everyday aspects of all Indians’ lives:

In fact, earlier this month, the Times of India reported that the card is already mandatory for three dozen schemes with more on the horizon:

Aadhaar will soon be mandatory for all 84 schemes covered so far under direct subsidy benefit transfer programme.

While those without an Aadhaar can apply for the identity card by June 30 and get benefits till then by furnishing alternative documents, it’s not clear what will happen from July 1. Will Indians without a card be denied access to services and schemes?

India now finds itself in quite a situation that many will of you will find quite alarming. The Huffington Post India highlights a number of key concerns, many linked to India’s lack of privacy laws: “In India, the right to privacy still doesn’t exist.”

There are no safeguards to prevent inappropriate profiling, meaning patterns of citizens’ behavior could be studied as more and more private organizations link their data to Aadhaar.
Any legal action against any misuse or theft of Aadhaar data can only be initiated by UIDAI, leaving citizens with no legal recourse should a breach occur.
UIDAI is at liberty to collect biometric information beyond iris and fingerprint scans, for example DNA.
Private agencies can also use Aadhaar, which contradicts an earlier stated objective of the scheme restricting the use of Aadhaar to government expenditures.

HuffPost also raises concerns about the security of the data and the potential for its misuse by cyber criminals, noting in particular that the “personal data of online consumers can never be fully secure” and “many third-party apps using Aadhar data may not be screened or audited for security”.

Aadhaar with its many connections is, without doubt, the world’s most ambitious project of its type, as Paul Romer, the World Bank’s chief economist told Bloomberg. He added:

It should be part of the policy of the government to give individuals some control over the data that the private firms collect and some control over how that data is used.

Other countries are watching the Aadhaar project intensely, especially since the World Bank has given it the thumbs up by saying in its World Development Report 2016:

A digital identification system such as India’s Aadhaar, by overcoming complex information problems, helps willing governments to promote the inclusion of disadvantaged groups.

For good or for bad, the Aadhaar will remain and will remain controversial. It will definitely face some difficult tests over the coming months and years:

How easy is the system to use?
How robust is the technology?
How secure is the data?
Will breaches/compromises be dealt with adequately?

It also continue to raise some longer-term concerns:

Will some people be left out?
Has it gone too far?
Will access to the data be abused?
How will the data be used in the future?

I think, however, the key question has to be: will Aadhaar promote the inclusion of disadvantaged groups, or simply leave them out or open to abuse?

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/E9v9GaOg0yc/

Comments are closed.