MOST people assume that critics of Aadhaar are concerned about citizens fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system. Two recent cases – that reported recently by Tribune and the French security researcher reporting on the novice-level security of the mobile App of Unique Identification Authority of India (UIDAI) – brings out a completely different threat. This is identity theft and therefore, the possibility of attacks from criminals on our bank accounts. Or linking our Aadhaar to their mobile numbers or bank accounts that are involved in criminal activities.

This issue is not simply whether the State has a right to force us to link all our economic, or other activities to our Aadhaar number. But while doing so, is it protecting us from the consequence of linking our Aadhaar number to our other numbers, such as bank accounts and mobile numbers? Or is it laying us far more open to various criminal threats? To our money, or even our personal security?  It is as if the State is forcing all of us to have a State mandated combination lock for entry into our houses, depositing the combination in specified databanks, and then making it easy for criminals to obtain the combinations.

The Tribune reporter – as reported by Tribune and not contested by UIDAI – secured access to the entire personal data of nearly a billion Aadhaar holders by paying just Rs 500 and within 10 minutes.  According to the State authorities quoted by Tribune, there are only two people in Punjab that have the necessary security clearance to access the entire Aadhaar database. That this access was being sold for only Rs 500, and the access provided within 10 minutes, shows how seriously the Aadhaar ecosystem has been compromised.

Even UIDAI conceded that only the biometric data held in a central repository is safe. Its press statements repeatedly emphasised that this part of the Aadhaar database has not been compromised. As yet. By implication, everything else is compromised. 

The second strike on the security of the Aadhaar system came from a French security researcher, who investigated the security in the mobile app released by UIDAI for use in our smart phones. This app – mAadhaar –  can be downloaded by anybody from the Google Play Store and used to provide the Aadhaar details to any service provider that uses Aadhaar based verification. The French security expert, who calls himself Eliot Alderson and uses a twitter handle @fs0c131yJan7, showed that the security in the mAaadhaar, developed by a private contractor, Khosla Labs, was minimal. It uses code snippets widely available on the net, stores the password on the mobile, the so-called random number generator generates the same number every time. Even more embarrassingly, Khosla Labs does not seem to know how to generate a proper certificate ownership, it showed Google as the owner of the app. According to Alderson, they also appear to have lost the ability of updating their app, and are now releasing new apps in the place of the compromised one.

The mAadhaar will create a risk if your mobile is stolen. And yes, if you lose your mobile, you are at risk of your bank account being cleaned before you block the mobile. By itself, this risk is not to the entire community of one billion Aadhaar holders. It brings out that the security in the Aadhaar ecosystem, as exemplified by this code from Khosla Labs, is extremely poor. It appears that the security of the mAadhaar software is at the level of a school project; or run by interns who have very little knowledge of security except what they can learn from the internet.

Before we think Khosla Labs is an exception, and the Aadhaar ecosystem security may be better managed, it would be instructive to know the credentials of Khosla Labs. Its three co-founders held important positions in UIDAI and Srikanth Nadhamuni, one of its three founders, was UIDAI’s head of technology. 

We are not discussing conflict of interests here. Nor that Khosla Labs is one of the interveners in the Supreme Court Aadhaar case, arguing on the “immense benefits” to the nation from Aadhaar. We are simply pointing out that if an organisation that includes the former head of tech in UIDAI delivers this quality of software for its mAadhaar, how safe is the rest of the Aadhaar ecosystem?

The original vision of the Aadhaar system is that the Aadhaar number is not our identity, the ID is the biometric information that we carry in our finger tips; or our eyes. It was supposed to be our fingerprints and iris data that would verify us. The problems of using biometrics for verification are numerous: from false positives identifying wrong persons as valid users, to false negatives, failure to verify legitimate Aadhaar holders. This, on top of poor connectivity and frequent lack of electricity in our towns and villages that operate computers, the internet and the biometric devices.

Faced with such problems, the authorities decided that biometric verification would be carried out only for the poor, such as ration card holders. For the vast majority of transactions, it is the Aadhaar “card” that is being used as the ID proof. The problem here is that the entire system was supposed to be built on biometric data as ID proof and not the card. If the Aadhaar card – a duplicate of which can be printed out by anybody for anybody – is to be used for verification, then the system is in a deep crisis. The system was never supposed to be built using the UID number as our ID proof, and that is why the poor, or nonexistent security of the Aadhaar ecosystem for any data, except the biometric data.

We have not even discussed here the risk that we carry when we link our Aadhaar to our various accounts and phone numbers. How much protection do we have against misuse and hacking by insiders? As the Airtel case showed, any company that demands an Aadhaar for verification, in this case our phone number, can get our “informed consent” by popping up a 5,000 word document asking us to click “I Agree”. Airtel fraudulently used peoples’ “consent”, and diverted their gas subsidy payment to accounts it had opened in Airtel’s payment bank.

The State mandated Aadhaar has created a leaky eco-system that is now a security nightmare. UIDAI is clearly scrambling to restore some credibility to the Aadhaar system to the double hits of last week. It has proposed a virtual ID scheme that can be used for authentication, as well as facial recognition. The problem is that it is too late to use virtual ID schemes. Our Aadhaar number and details, including our bank account information, is already available in databases that have low, or virtually no security. It is like locking the stable door after the horse has bolted, that too from a hole at the back.

Facial recognition is hardly a solution. It has failed with Google software identifying images of people with dark skins as gorillas. And Apple identifying all owners of its latest i-Phones in China as the same individual: all Chinese look alike to Apple’s software!

UIDAI has promised the Indian State and its big capital that it will deliver the data of the country’s citizens for surveillance and business purposes. It will replicate the US National Security Agency equivalent using our Aadhaar data; provide big data of its citizens to combat Google and Facebook; enable financial transactions to Indian fintech companies and banks. All of this on a very weak and shaky foundation.

For those familiar with failing software projects, there is a now a sense of desperation in the UIDAI’s responses: from shooting the messenger – filing FIR against Tribune – to clutching at straws. All the measures it is proposing do not address the fundamental issue of a hugely compromised Aadhaar security system, built with public money, and at a huge cost. Can we now take a hard look at whether the Aadhaar project can actually deliver what it has promised? And scale back the Aadhaar project so that we not only continue to throw good money further, after money we have already invested, but also create huge risks to our citizens? And perhaps to our economy itself?