Aadhaar linkings | SabrangIndia News Related to Human Rights Wed, 24 Nov 2021 11:11:25 +0000 en-US hourly 1 https://wordpress.org/?v=6.2.2 https://sabrangindia.in/wp-content/uploads/2023/06/Favicon_0.png Aadhaar linkings | SabrangIndia 32 32 Aadhaar linking to Voter ID: Empowering voters or enabling surveillance? https://sabrangindia.in/aadhaar-linking-voter-id-empowering-voters-or-enabling-surveillance/ Wed, 24 Nov 2021 11:11:25 +0000 http://localhost/sabrangv4/2021/11/24/aadhaar-linking-voter-id-empowering-voters-or-enabling-surveillance/ On November 25, a standing committee will meet to discuss key electoral reforms, including the contentious proposal for linking of Aadhaar to Voter IDs

The post Aadhaar linking to Voter ID: Empowering voters or enabling surveillance? appeared first on SabrangIndia.

]]>
Aadhar Linking
Image Courtesy:oneindia.com

While Aadhaar was envisaged as a nation-wide programme to provide every citizen with a unique identity document, concerns have repeatedly been raised about its possible misuse as a means of surveillance by way of linking it to multiple other documents.

Now that a House Panel is expected to meet on November 25 to discuss electoral reforms including linking Aadhaar to Voter IDs, let us take a deeper look into what this entails and possible repercussions.

Why is the House Panel meeting?

On November 25, Standing Committee on Personnel, Public Grievances, Law and Justice, headed by Rajya Sabha member Sushil Kuamr Modi, is meeting to discuss a variety of electoral reforms. The chief among these are:

  • Remote voting
  • Linking Aadhaar to Voter ID
  • Common electoral roll
  • Action against elected representative who file false affidavits

The first two are key from the point of view of migrant workers, as they are registered as workers in their home states, but are unable to get adequate leave to travel to their home state in order to vote during elections.

Migrant Workers and Voting: Some facts and figures

A 2012 study showed that 78% of migrant labourers surveyed possessed voter ID cards and names present on voting lists of their home cities.

One survey shows that only 48% of those surveyed voted in the 2009 Lok Sabha elections when the national average was 59.7%. In the 2019 Lok Sabha polls, major sender states such as Bihar and Uttar Pradesh had among lowest voter turnout rates at 57.33% and 59.21% respectively (when the national average was 67.4%).

According to the 2011 census, the number of internal migrants stands at 45 crores, a 45% surge from the earlier census of 2001. Among these, 26% of the migration, i.e., 11.7 crores, occurs inter-district within the same state, while 12% of the migration, i.e., 5.4 crores, occurs inter-state.

Then there is the subject of circular migration where migrant workers move to find work during a specific period each year, but return to their home state after that.

Another element that needs a more nuanced discussion is how the lives of migrant workers are actually impacted more by decisions taken by various government authorities in the place where they live and work, instead of their home states. But they are unable to register as voters from these states as very often they do not have a proper address, something that also impedes them in other ways – such as leaving them out of the banking system. Clearly there is a web of interconnected problems.

In fact, SabrangIndia’s sister organisation, Citizens for Justice and Peace (CJP) had highlighted all of this in a memorandum to the Election Commission of India (ECI) as part of the Let Migrants Vote campaign.

Remote voting can certainly help migrant workers who would like to vote for elections being conducted in their home states. Postal voting is a mechanism that can be put to use for this purpose. This bypasses the need for inking Aadhaar to Voter IDs.

Another option is something rather basic, a measure that should have been implemented decades ago – maintain a database of migrant workers in every state on the district level if not the taluka level. This way a proper record of migrant workers can be maintained without the need to link Aadhaar to Voter ID.

These are clearly issues that need a deeper analysis and comprehensive debate before any decisions are taken on the subject. The deeply emotive subject of the right of migrant workers to vote, should not be manipulated to justify linking of Aadhaar with Voter ID.

Initial concerns about Aadhaar-Voter ID linking

Activists and data scientists had raised an alarm when it was revealed that as many as 55 lakh voters in Andhra Pradesh and Telangana had been left out of the electoral process due to linking of their Electoral Photo Identity Card (EPIC) and Aadhaar by the EC in 2015. It was alleged that the mandatory door-to-door verification was not undertaken before all these people’s names were purged from the rolls!

The move was the result of a process started in March 2015 by the election commissioners of the two states to link the two identity documents as part of the National Electoral Roll Purification and Authentication Programme (NERPAP) in a bid to weed out duplicate and bogus voters. Now, while the objective is indeed laudable, the inadvertent deletion that allegedly took place without following set procedure deprived lakhs of voters of their right to vote. In fact, following this fiasco, the Supreme Court halted the process later that year.

SC judgment on Aadhaar

In September 2018, the Supreme Court upheld Aadhaar’s constitutional validity. The Aadhaar case that was heard for a record 38 days by a bench comprising Chief Justice Dipak Misra, Justice DY Chandrachud, Justice AK Sikri, Justice AM Khanwikar and Justice A Bhushan delivered the verdict months after reserving judgment in May. There were three separate judgments from Justice Sikri, Justice Bhushan and Justice Chandrachud. CJI and Justice Khanwilkar did not pronounce a separate judgment but concurred with Justice Sikri. Justice Bhushan’s judgment was also in line with that of Justice Sikri. But Justice Chandrachud wrote a dissenting judgment.

However, in a partial victory for privacy activists, controversial sections such as those dealing with the national security exception and private players demanding Aadhaar data, were struck down. Section 33(2) of the Aadhaar Act that dealt with the National Security exception was struck down. This section permitted disclosure of information, including identity and authentication information, made in the interest of national security. Justice Sikri has also read down Section 33 (1) that enables disclosure of Aadhaar information on order of a District Judge. Now the owner of the information should be given opportunity of hearing before issuing such orders.

Additionally, Section 57 of the Aadhaar Act, that permitted private entities to use Aadhaar information to authenticate the identity of a person, was also held unconstitutional. Therefore, no private company can either demand Aadhaar information or make it mandatory for providing services. Aadhaar would not be required for opening a bank account or for getting a mobile phone connection.

Section 47 that allowed only the UIDAI to file criminal complaints in case of data breach has also been struck down. It has been held that exclusion of individuals from filing complaints was arbitrary.

Justice Chandrachud’s dissenting judgment

Justice DY Chandrachud wrote the lone dissenting judgment saying Aadhaar is liable to be declared as unconstitutional. “Violation of fundamental rights under the Aadhaar scheme fails on the touchstone of tests of proportionality,” he said. “Constitutional guarantees cannot be compromised by vicissitudes of technology,” he noted in a strongly worded dissenting judgment.

Justice Chandrachud also expressed his apprehensions about the misuse of data for profiling saying, “Biometrically enhanced identity information, combined with demographic data such as address, age and gender, among other data, when used in increasingly large, automated systems creates profound changes in societies, particularly in regard to data protection, privacy, and security. Biometrics are at the very heart of identification systems. There are numerous instances in history where the persecution of groups of civilians on the basis of race, ethnicity and religion was facilitated through the use of identification systems. There is hence an alarming need to ensure that the on-going development of identification systems be carefully monitored, while taking into account lessons learnt from history.”

It is this part that sends a shiver down the spine, given how Aadhaar data can possibly be used for voter profiling, targeting and even subsequent gerrymandering if Aadhaar is linked with Voter ID.

Renewed concerns about linking Aadhaar and Voter ID

Recently over 500 entities such as civil rights groups including Association for Democratic Reforms (ADR), Peoples’ Union of Civil Liberties (PUCL), Adivasi Women’s Network, Chetna Andolan, etc.; as well as groups working to defend digital freedoms and rights, such as Rethink Aadhaar, Article 21 Trust, the Internet Freedom Foundation (IFF), and the Free Software Movement of India, as well as activists, journalist and educators including CJP secretary Teesta Setalvad signed a statement calling the move to link Aadhaar with Voter ID “ill-thought, ill logical and unnecessary”.

The statement says that the signatories “are deeply concerned that this will almost certainly lead to mass disenfranchisement, could increase voter fraud, given the mass discrepancies in the Aadhaar database, and could violate people’s right to privacy by enabling voter profiling through the linkage of data sets.” It further elaborates, “India currently has no data protection law, and the current personal data protection bill has wide exceptions for the government. Any attempts to link Aadhaar to the voter IDs, would lead to demographic information which has been linked to Aadhaar, being linked to the voter database. This creates the possibilities for disenfranchisement based on identity, of increased surveillance, and targeted advertisements and commercial exploitation of private sensitive data.”  

A key reason cited is the violation of privacy and secrecy of vote. If the revelations of the Cambridge Analytica scandal where Facebook data of millions of users was used to allegedly rig the US elections in favour of Donald Trump by micro-targeting voters with false news is anything to go by, imagine the ramifications if it was demographic data of millions of Indians sourced from the Aadhaar database…

Related:

Let Migrants Vote
Migrant Lives Matter: Open Letter to the Election Commission
CJP campaigns for migrant workers’ Right to Vote
SC upholds Aadhaar’s Constitutional Validity, but partially addresses Privacy Concerns
Understanding the Aadhaar Case

The post Aadhaar linking to Voter ID: Empowering voters or enabling surveillance? appeared first on SabrangIndia.

]]>
The linking of Aadhar Card: The benefits and perils https://sabrangindia.in/linking-aadhar-card-benefits-and-perils/ Wed, 16 Oct 2019 03:59:02 +0000 http://localhost/sabrangv4/2019/10/16/linking-aadhar-card-benefits-and-perils/ The State on numerous occasions has tried to impose the use of the Aadhar card upon the citizens. While, the Supreme Court has upheld a few of such mandates of the State, the question of whether the imposition is valid on few other services keeps coming up before the Courts of the land vide myriad […]

The post The linking of Aadhar Card: The benefits and perils appeared first on SabrangIndia.

]]>
The State on numerous occasions has tried to impose the use of the Aadhar card upon the citizens. While, the Supreme Court has upheld a few of such mandates of the State, the question of whether the imposition is valid on few other services keeps coming up before the Courts of the land vide myriad petitions, rendering the rhetoric of the Aadhar in limbo.

Aadhar

On October 14, the Supreme Court refused to entertain a plea by BJP leader Ashwini Kumar Upadhyay seeking directions to the government and few of its agencies to make it mandatory to link social media accounts with Aadhar to ‘combat the menace of paid news and fake news’.

The Aadhar card, with its Unique Identification Number, at its inception was an identity document meant to be a means for inclusion. The Act itself is called The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. The nomenclature of the law suggests its purpose quite clearly but the government’s employment of the card in the past few years across avenues has raised several questions regarding the validity of such use as per the Act and its constitutional validity.

Mr.Nandan Nilekani, back in 2010 in an interview with Civil Society Online had said, “The purpose of this programme is very clear. It is about inclusion. It is about the fact that there are a few hundred million people in this country who don’t have any form of identity, who don’t have a birth certificate, who don’t have a school certificate, 75 million homeless people…they are the ones who are suffering due to lack of identity.”

In the light of the petition seeking linking of social media accounts to Aadhar, and in times where the Aadhar data has been breached due to illegal practices of third parties, here’s a brief analysis of the government’s mandate on linking of Aadhar to various services and its effects.

Aadhar for PDS

Recent incidents are however proof that the arrival of the Aadhar Card has done the opposite of what it intended to do: inclusion. The Supreme Court, in its September 2018 judgment, has held section 7 of the Aadhar Act to be constitutional and held thus, “Section 7 of the Aadhaar is constitutional. The provision does not deserve to be struck down on account of denial in some cases of right to claim on account of failure of authentication.”

Following this, many state governments made production of Aadhar card/ Aadhar number mandatory at government run ration shops in order to procure monthly assigned ration. Sabrangindia reported that as per a survey conducted by the Right to Food campaign,as many as 272 families in Odisha’s Nabarangpur district did not receive their quota of foodgrains for the months of September and October because of discrepancies in linking their Aadhaar numbers to the public distribution system.Scroll also reported that the Right to Food campaign compiled data of starvation related deaths in the past year across 9 states and found that 19 of the 57 deaths were Aadhar related deaths. Aadhar related starvation is manifested in many ways like ration card is not linked with Aadhar card or failure of authentication of Aadhar biometrics, all of which ultimately means they cannot benefit from the subsidy scheme as per the National Food Security Act.

Aadhar for Direct Tax filings

The Supreme Court had in its landmark judgment of 2017 upheld individual’s right to privacy and temporarily halted government’s attempts to make the Aadhar card a mandatory document for all purposes. The Apex Court in its 2018 judgment, however upheld the linking of Aadhar card for income tax purposes in order to help the government in curbing incidents of tax fraud and to eliminate the menace of black money. Accordingly, the linking of Aadhar card to the PAN card has been made mandatory, failing which one’s PAN no. shall become inoperative, and a deadline of December 31 of this year has been set, which is an extension of already set deadline of September 30.

Aadhar for sim cards

The Central Government vide The Aadhaar and Other Laws (Amendment) Bill, 2018 made use of Aadhar for verification as an identity document voluntary for banking companies, financial institutions and intermediaries, as well as telecom companies. The implication of this amendment was that telecom companies, banks and other financial institutions and intermediaries cannot make production of Aadhar card mandatory for purposes of verification of identity of an individual in lieu of providing any kind of services.

However, this move came a little too late as many citizens had already linked their Aadhar cards to their SIM cards and Bank accounts following Centre’s directive in this regard in 2014.

Aadhar to vote

The Wire, had in its report analysed what means were used by the Election Commission (EC) in 2015 to link voter’s Aadhar cards and whether informed consent of voters was sought. The EC launched the National Electoral Roll Purification and Authentication Program (NERPAP) whose aim was to eliminate voter fraud and cases of duplicate voter IDs. The program was shut down by the Supreme Court in 2015, however, by that time, the EC, had already collected the Aadhaar numbers of over 300 million voters in a span of three months. In order to complete the herculean task in three months, the EC accessed the National Population Register in some states for seeding the Aadhar data in some other states it used DBT Seeding Data Viewer (DSDV) tool, a service that allows third-parties to view non-biometric identity data held by the Unique Identification Authority of India (UIDAI).[1]

In July 2019, the Delhi High Court had dismissed the plea of Ashwini Upadhyay of the BJP seeking linking of voter IDs to Aadhar cards, by asking the EC to take a decision in this regard within 8 weeks.It was recently reported that the EC is seeking to get legal sanction on the Aadhar – Voter ID linkage as it has made a proposal to the Ministry of Law to allow it to collect Aadhar details of new voters as well as of existing voters.

The current issue: Aadhar and social media

The Aadhar Act provides the usage of Aadhar identification mainly for the purpose of better distribution of social benefits and hence, if Aadhar is to be linked to social media accounts, the current piece of legislation is incapable of dealing with it and a new legislation, if at all, will have to be formulated and the same being a matter of legislation does not warrant a full fledged role of the judiciary.

A commentary in the Economic Times said that as a country, we must focus on investing on research to develop the technology to save our virtual space and not open our data for any misuse. It further pointed out that there is no “private” internet space for India per se and hence giving out such a pertinent ID number will expose user data to myriad threats in the cyberspace. Mahua Moitra, the MP belonging to Trinamool Congress, who has always been outspoken about pertinent issues, has taken a stand against the linking of Aadhar card to social media accounts and traceability of social media messages and seeks to implead herself in the case pending in Madras High Court. Mahua further said, “Technically skilled persons will always be able to use simple workarounds to mask their own phone numbers, or instead link messages to someone else’s number; technically unskilled individuals and laypersons would also be made more vulnerable by having their contact information exposed, thereby further eroding online safety and privacy norms.”[2]

Who is ‘Aadhar’ really ‘supporting?

The more widespread the network of linking Aadhar, the more are the chances of the same being breached making citizen’s data being subjected to serious danger. The linking of Aadhar card to services seems to have become some kind of political fashion, which is portrayed to people as a requisite for their security, while the resulting outcome is a stark contrast.The State is trying to portray itself taking up a paternalistic role by showcasing that surveillance is its only objective but even if the objectives of the government are assumed clean, such kind of surveillance only subjects the people and their data to grave peril.

The Aadhar debate is still on going, there is no absolute judgment by the apex court to determine what can and cannot come under the mandatory purview of Aadhar, neither has it given any directions to the central government to amend the law in that regard and hence, this Pandora’s box has opened up. What remains to be seen is for how long will the Supreme Court keep entertaining petitions against mandatory use of Aadhar and to what extent will it uphold the right to privacy that it so commemoratively affirmed.

 

 


The post The linking of Aadhar Card: The benefits and perils appeared first on SabrangIndia.

]]>
Aadhaar Security: The Emperor Has No Clothes https://sabrangindia.in/aadhaar-security-emperor-has-no-clothes/ Fri, 19 Jan 2018 06:08:36 +0000 http://localhost/sabrangv4/2018/01/19/aadhaar-security-emperor-has-no-clothes/ Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system.   Image Courtesy: The Financial Express   Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss […]

The post Aadhaar Security: The Emperor Has No Clothes appeared first on SabrangIndia.

]]>
Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system.

 

Image Courtesy: The Financial Express
 
Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system. Two recent cases – that reported recently by Tribune and the French security researcher reporting on the novice-level security of the mobile App of Unique Identification Authority of India (UIDAI) – bring out a completely different threat, that of identity theft and therefore, the possibility of attacks from criminals on our bank accounts. Or linking our Aadhaar to their mobile numbers or bank accounts that are involved in criminal activities.

This issue is not simply whether the state has a right to force us to link all our economic, or other activities to our Aadhaar number. But while doing so, is it protecting us from the consequence of linking our Aadhaar number to our bank accounts, mobile numbers and other such things? Or is it laying us open to various criminal threats? Threats to our money, or even to our personal security? It is as if the state is forcing us to have combination lock for entry into our houses, then deposit the combination in a specified data bank with no security, thereby making it easy for criminals to obtain the combinations.

The Tribune reporter – as reported by Tribune and not contested by UIDAI – secured access to the entire personal data of nearly a billion Aadhaar holders by paying just Rs. 500 and within 10 minutes. According to the state authorities quoted by Tribune, there are only two people in Punjab that have the necessary security clearance to access the entire Aadhaar database. That this access was being sold for only Rs. 500, and the access provided within 10 minutes, show how seriously the Aadhaar ecosystem has been compromised.

Even UIDAI conceded that only the biometric data held in a central repository is safe. Its press statements repeatedly emphasised that this part of the Aadhaar database has not been compromised. As yet. By implication, everything else is compromised.

A French security researcher, who investigated the security in the mobile app released by UIDAI for use in our smart phones – showed how weak the security of Aadhar bases systems really is. The security expert, who calls himself Eliot Alderson and uses a twitter handle @fs0c131yJan7, showed that the security in the mAadhaar app which can be downloaded from Google Play store – to be used to provide the Aadhaar details to any service provider who uses Aadhaar based verification- was minimal. It uses code snippets widely available on the net, stores the password on the mobile, the so-called random number generator produces the same number every time. Even more embarrassingly, Khosla Labs, a private players which developed this App for UIDAI, does not seem to know how to generate a proper certificate of ownership – it showed Google and not UIDAI as the owner of this app. According to Alderson, they also appear to have lost the ability of updating their app, and are now releasing new apps in the place of the compromised one.

Aadhaaro120.jpg

The android app developed by Khosla Labs for UIDAI is officially owned by Google, as per their own certificate!

Then Aadhaar security being weak will create a risk if your mobile is lost or stolen. And yes, if you lose your mobile, you are at risk of your bank account being cleaned before you block the mobile. By itself, this risk is not to the entire community of 1 billion Aadhaar holders. It brings out the security in the Aadhaar ecosystem, as exemplified by this code from Khosla Labs, is extremely poor.

Before we think that Khosla Labs is an exception, and the Aadhaar ecosystem security may be better managed – it would be instructive to know the credentials of Khosla Labs. Its three co-founders held important positions in UIDAI – and Srikanth Nadhamuni, one of its three founders, was UIDAI’s Head of Technology.

We are not discussing conflict of interests here. Nor that Khosla Labs is one of the interveners in the Supreme Court Aadhaar case, arguing on the “immense benefits” to the nation from Aadhaar. We are simply pointing out that if an organisation that includes the former head of tech in UIDAI delivers this quality of software for its mAadhaar, how safe is the rest of the Aadhaar ecosystem?

The original vision of the Aadhaar system is that the Aadhaar number is not our identity, the ID is the biometric information that we carry in our finger tips; or our eyes. It was supposed to be our fingerprints and iris data that would verify us. The problem of using biometrics for verification are numerous: from false positives, identifying wrong persons as valid users, and false negatives to failure to verify legitimate Aadhaar holders. This on top of poor connectivity and frequent lack of electricity in our towns and villages that operate computers, the internet and the biometric devices.
Faced with such problems, the authorities decided that biometric verification would be carried out only for the poor, such as ration card holders. For the vast majority of transactions, it is the Aadhaar “card” that is being used as the ID proof. The problem here is that the entire system was supposed to be built on biometric data as ID proof and not the other card. If the Aadhaar card – a duplicate of which can be printed out by anybody for anybody – is to be used for verification, then the system is in a deep crisis. As the system was never supposed to be built using the UID number as our ID proof, that could explain the poor, or non-existent security of the Aadhaar ecosystem for any data, other than the biometric data.

We haven’t even discussed here the risk that we carry when we link our Aadhaar to our bank accounts and phone numbers. How much protection do we have against misuse and hacking by insiders? As the Airtel case showed , any company that demands an Aadhaar for verification, in this case our phone number, can get our “informed consent” by popping up a 5,000 word document asking us to click “I Agree”. Airtel fraudulently used peoples’ “consent” to open 37.21 lakh Airtel Payment bank accounts, and diverted the gas subsidy payments of the customers to these accounts without their knowledge.

The state mandated Aadhaar has created a leaky eco-system that is now a security nightmare. UIDAI is clearly scrambling to restore some credibility to the Aadhaar system after the double hits of last week. It has proposed a virtual ID scheme that can be used for authentication, as well as facial recognition. The problem is that it is too late to use virtual ID schemes. Our Aadhaar number and details, including our bank account information, is already available in databases that have low, or virtually no security. It is like locking the stable door after the horse has bolted.

Facial recognition is hardly a solution. It has failed with Google software identifying images of people with dark skins as gorillas . And Apple identifying all owners of its latest i-Phones in China as the same individual: all Chinese look alike to Apple’s software !

UIDAI has promised the Indian state and its big capital that it will deliver the data of the country’s citizens for surveillance and business purposes. It will replicate the US National Security Agency equivalent by using our Aadhaar data; provide big data of its citizens to combat Google and Facebook; enable financial transactions to Indian fintech companies and banks. All of this on a very weak and shaky foundation.

For those familiar with failing software projects, there is a now sense of desperation in the UIDAI’s responses: from shooting the messenger – filing FIR against Tribune – to clutching at straws. All the measures it is proposing do not address the fundamental issue of a hugely compromised Aadhaar security system, built with public money, and at a huge cost. Can we now take a hard look at whether the Aadhaar project can actually deliver what it has promised? And scale back the Aadhaar project on which we not only continue to throw more money, after the money we have already invested, and more over create huge risks to our citizens? And perhaps to our economy itself?

Courtesy: Newsclick.in

The post Aadhaar Security: The Emperor Has No Clothes appeared first on SabrangIndia.

]]>