Dear UIDAI, You Have Some Answering to Do on Aadhaar; Start Here

Aadhaar project is the result of a poorly-monitored and poorly-designed process that neglected security or control.

That the UIDAI was badly architected as a single point of failure is something many have said for years. The Tribune report suggests a single point of access can give anyone access to the entire database. The problem with the bad design will be compounded as more and more people start to use and link their Aadhaar. To make things worse, the State Resident Data Hub (SDRH) contains copies of the states’ Aadhaar database, and then their own data on top of that.

What Does Parliament Say?

A typical response that can be expected from our Parliamentarians is that the Aadhaar Act imposes penalties as a measure to guard against prevent illegal access.

It doesn’t make sense – the law makes access illegal, but doesn't prevent illegal access. People do illegal things until they are caught. So this means that more of your data will be compromised.

What Does UIDAI Say?

A typical response that can be accepted from the UIDAI is that biometrics are not accessible. This doesn’t add up either. This is personal and sensitive data that is at risk of being leaked – someone can gain access to all the information about you.

Legally, the Aadhaar Act treats your Aadhaar number as sensitive data on par with biometrics. So anyone who claims otherwise is incorrect and may be attempting to mislead. This includes ministers in Parliament.

The discrepancies in the UIDAI architecture, as highlighted in this January 2018 The Tribune article by Rachna Kaira, means that anyone can print your Aadhaar card. Think about it. How often have you been asked for biometric authentication, instead of simply checking your Aadhaar card as proof of identity? Exactly. The card is enough for most people.

What the article suggests is that unless someone complains, the UIDAI has no idea whether someone accessing the Aadhaar database is authorised to do so or not.

The way things stand, it looks like anyone can get an “enrollment agency administrator ID” through a CSC – the UIDAI will never know about its legitimacy.

The Tribune article mentions "1 lakh illegal users" without going in to detail. My question, then, is this:

How will the UIDAI know how many fake enrolments have been done, without re-authenticating every individual who has ever gotten an Aadhaar? Re-verification for 1.19 billion people? We know that won’t happen. 

This is a big mess and is a result of a hastily-done and poorly-monitored and poorly-designed enrollment process that prioritised speed over security or control. Rushing into the process is Nandan Nilekani’s fault, and it is the fault of the Congress and BJP governments to have blindly trusted Nilekani’s decisions.

Honestly, I don't know who can ever fix this HUGE Aadhaar mess – it is too big a mess, too complicated, and too many people have been affected.

Questions That UIDAI Needs to Answer

1. How many village-level enterprises were given access to the Aadhaar database?
2. What practices are/were followed in order to ensure that access is given only to personnel authorised by the UIDAI?
3. Do the CLCs or VLCs have the ability to give database access to third parties without the UIDAI’s permission or knowledge? What processes are in place to prevent this?
4. Does each VLE have access to the entire Aadhaar database, or only parts of it? Is the data in silos, or is a single point of access able to give access to the entire database? What led to this decision making?
5. What mechanisms does the UIDAI have in place to detect and monitor unauthorised access?
6. What mechanisms does the UIDAI have in place to the usage of non-secure connections to the database?
7. Does the UIDAI have any processes in place to ensure that security of SRDHs? What kind of monitoring does the UIDAI do over the operations of SRDHs?
8. What processes does the UIDAI have to detect addition of fake entries into the Aadhaar database?
9. For enrollments done through unauthorised access, has the UIDAI ever cancelled registrations of those who have been enrolled via such means? How many such instances have been detected and what action has the UIDAI taken regarding such enrollments?

(Nikhil Pahwa is the founder of Medianama. This is an opinion piece and the views expressed above are the author's own. The Quint neither endorses nor is responsible for the same.)