My problems with Aadhar and how to fix them

When I first heard of Aadhar, I was excited. It sounded like a good technical solution to the problem of many people without identification in this country. Back in 2009 when it started enumerating individuals, it felt like a great thing. It was supposed to be the following.

1. Many people in this country are not able to get an identification and it provided a mechanism for them to get an identification. If you did not have any address proof or such thing, you could still get an Aadhar.
2. It was supposed to be a system which will make sure an individual could not get two Aadhar number and thus would uniquely verify the identity of an individual.
3. Biometrics was only supposed to be used for de-duplication.

Fast forward to 2017-18, we learned few things about Aadhar.

1. There was very few instance where people could get an Aadhar number without any supporting proof. So the promise that people without any other identity could get Aadhar was either not needed or could not materialize.
2. Because of very heavy reliance on fingerprints, many people who have a valid Aadhar number can't be authenticated anymore. These individuals fall into all categories, manual labors, top executives of companies, retired individuals. Once biometrics stops working, there is no recourse for these people.

I was all right with Aadhar, but very soon the worst of my fears came true. The system that was supposed to provide identity to individuals who did not have it because a system to track individuals. I have friends and family who work in government and private institutions who were supposed to handle Aadhar and knowing them I knew very soon it will turn into a large-scale data harvesting system.

Aadhar was supposed to be nothing more than an identity service. The problem with Aadhar are many but in my eyes, the biggest problems are as below.

1. Because of its hard linkage to Biometrics, it is not like a password that can be changed. If there is a compromise, the only thing one can do is to die.
2. Every entity that needs to use Aadhar has to have your Aadhar number. It is like that cousin that keeps on asking your Play Store or App Store password whenever (s)he wants to download that next big game. Just think of an OAuth system where the OAuth client needs to have access to your password to authenticate you.
3. The system itself was extremely poorly designed and the partners on which it depended really were not making any money so they decided to monetize in multiple different ways by asking bribes during enumeration and selling whichever data they could get hold of. 
4. Anybody who gets access to Aadhar database has just too much information about an individual, his name, email address, physical address, mobile number, his PAN number, all his bank accounts, his vehicles, his driving license. This is almost like putting all your assets in a room and putting a signage on top that says "Come and steal it".

As things stand today, I seriously believe that some political grouping should just run on the promise of abolishing aadhar, but I think that is wishful thinking on my part so I am trying to just think of a way that would reduce the risk.

1. The complete software of Aadhar needs to be open sourced. (I think that is also true for EVM firmware). 
2. Aadhar needs to be taken back to what it was envisaged to be. The "Targeted Delivery of Financial and other Subsidies, benefits and services Act" needs to be repealed and a new Law created for "Resident Identity Privacy Control Act". 
3. The need to share the Aadhar number needs to be done away with. Whichever entity needs to authenticate my identity can send me a signed URL to UIDAI portal that I will click on and enter my aadhar credentials. This should return a signed response that the service provider can hold on to as a proof of authorization. Nobody needs to know my aadhar number.
4. Complete Aadhar data needs to encrypted both in flight and at rest.
5. It should be made completely voluntary. Anybody who is willing to prove his identity the good old fashioned way should be allowed to do so.

Not that anybody cares, but I thought I would just get this off my chest.

My problems with Aadhaar bill

When Aadhaar was launched by the UPA government, it was meant to be a system that provides a mechanism to authenticate people so that targeted subsidies can be given. Since most subsidies were not reaching target population it sounded like a good idea. When the registration started, I also registered for it because the biggest proponent of Aadhaar, Nandan Nilkeni, always maintained that it was only meant as an authentication system for government subsidies.

Recently the parliament has passed the Aadhaar law. As I read it, following clauses stand out and make me wonder whether it is a right thing or not.

Cases when information may be revealed: In two cases, information may be revealed:

In the interest of national security, a Joint Secretary in the central government may issue a direction for revealing, (i) Aadhaar number, (ii) biometric information (iris scan, finger print and other biological attributes specified by regulations), (iii) demographic information, and (iv) photograph.  Such a decision will be reviewed by an Oversight Committee (comprising Cabinet Secretary, Secretaries of Legal Affairs and Electronics and Information Technology) and will be valid for six months.   

On the order of a court, (i) an individual’s Aadhaar number, (ii) photograph, and (iii) demographic information, may be revealed.

So a Joint Secretary in the government of India can issue a direction for revealing all the information in the interest of national security with no clear definition of what national security consists of. As we have seen, even few students shouting slogans (inappropriate ones) can become an issue of national security.

This is only half the problem as far as the aadhaar is concerned. Aadhaar depends on two sets of biometrics. Finger print and retina scan. I believe both of these mechanisms have an error rate of 1 in 10 million. These are great for finding criminals, but once you collect data for a country of the size of India, things become difficult.

Let's say, in the situation of a national interest, police picks up a fingerprint from a crime scene and run it against aadhaar database. Given the error rates of 1 in 10 million, there would be 100 people in the country whose fingerprints may match. The way our judicial system works, the onus of proving that you are innocent will fall on you. To me it is really scary thought. Aadhaar is good enough for disbursing subsidies, if somebody else claims my subsidy, I will be unhappy but if I am caught for a crime I did not have anything to do with, I think it is a problem of a very different scale.

Aadhaar card enrolment, an experience

Since the day GoI declared that in not so distant future, the cooking gas (LPG) subsidy would be delivered directly to the customer through a scheme called direct benefit transfer (DBT), Whole of India is running after getting an elusive piece of number called Aadhaar number. I never bothered to go for it, because it involved standing in a line for hours.
Yesterday, I saw this website that had a method where I could get an appointment online, fill the form online and then only show up at the enrolment center for document verification and biometrics, so I decided to give it a try. Here are my experiences for getting enrolled for Aadhaar.

• Getting an appointment was easy, may be because the website is new and not many people are aware of it. But I could get the appointment for next day and there were many slots open till the evening.
• I also filled all the forms online but since I was not certain of how the data would be made available, I also took physical forms and filled them and carried them with me.
• As I reached the enrolment center, I was pleasantly surprised to find a person sitting there with a list of people who had taken the appointment for document verification. He verified the documents and asked me to go to the adjacent room which had the setup for enrolment.
• This is where proceedings took a turn for the worse, The guys who were actually doing enrolment, had no clue of the appointment system. It was every individual for him/her self. The person with the loudest voice was the next person in line.
• We waited for an hour hoping that somebody would call us but nobody called up.
• To make things further complicated, there seems to be another system at http://appointments.uidai.gov.in which is also issuing appointments at the same center with same timings. The center does not have list of people from this system. They only have list of people from the system I mentioned earlier. This is resulting in the people at the center getting overloaded since they have twice as many people showing up.
• Anyway, we also used the loudest voice method to get ourselves scanned for biometrics and got our enrolment done.
• The data that we entered online, is not available at the center so it has to be entered again and that is extremely time consuming.

In nutshell, like most of the other ideas of GoI, it is a brilliant idea gone horribly wrong in implementation. I only hope, as time goes along they fix it.