275 - Don't worry about privacy - The Financial Express

Sunil Jain
Posted: Tuesday, Oct 12, 2010 at 2230 hrs IST

Can the UIDAI be used for religious profiling or to collect data about an individual’s spending habits? What about identity theft?

According to UIDAI authorities, the structure of the database is such that you cannot query it; it is like a black box. So, you cannot ask it, for instance, to give you all the names ending with Jain along with their addresses. Nor can you ask it for all the names of individuals residing in an area with a particular pincode. Since all that the database has is a name, sex, age, address, fingerprints, photograph and an iris-scan, there is no question of having information about spending habits. Since the database has been developed to only answer a simple yes/no, the UIDAI authorities claim identity theft is not possible.

Sponsoring a ‘Project Get MyIris’, with a reward of say a million dollars to a person who can hack into the system, to get your biometrics including the iris details, wouldn’t be a bad idea to set everyone’s hearts at ease!

If it can’t be queried, how does it work?

It can be queried to answer yes/no to items within the database. Once you get UIDAI’d, or Aadhar’d to use the project’s brand name, you get a laminated, waterproof, tear proof paper that can last 20 years. (In case you forget your number, or lose the paper, you can, with your fingerprints, get a duplicate ID number.) So, let’s say the income tax authorities start asking for UIDAI numbers while issuing PAN cards, and now want to check if the person with the UIDAI number ABCD1234 is Sunil Jain, it will get a yes/no answer. If you submit the fingerprint of a person and ask if this is Sunil Jain, you will get a yes/no. If you ask for a fingerprint of Sunil Jain, the database is not programmed to give it to you.

Can the programming be changed to allow for this in the future?

Theoretically it can, but UIDAI authorities say the plan is to keep it this way. In addition, there are various other checks to protect the database. But since the database does not keep information on incomes or credit card histories, the incentive to hack into it is low.

Is it possible to get a fake UIDAI number?

You can, but you can never ever get another UIDAI number under another name. So, if an individual X goes and gets a UIDAI number under he name Y, she can never apply for another UIDAI number. Say, she does. The system will automatically reject her saying there is already another person with the same biometrics in the system. That is, the incentive to game the system is zero. In case you wish to have your ID changed, say you no longer think having an Amitabh Bachchan ID is helping, you can get it changed after submitting your biometrics again. But no person can ever have more than one UIDAI number.

How do you get a UIDAI number?

Each state government appoints registrars and they, in turn, could appoint a UTI or a Wipro as an enrolment agency. Go to the enrolment agency and get yourself a number.

Do they ask for any proof of address?

Yes. There are 17 documents that can be used as proof of identity, ranging from a PAN card to photo IDs issued by recognised educational institutions. There are other documents that are to be used as proof of address.

What if you don’t have an address? And will the UIDAI go and check if the person actually lives at the address given?

If you don’t have proof of address, as in you’re a migrant, there is the concept of introducers and they can vouch for you. This could be the Panchayat head, for instance. No check of the address will be done, but this is where your UIDAI number will be sent.

How do you find an introducer if you are a migrant worker?

UIDAI has just tied up with an alliance of 20+ NGOs that work with migrants. So the NGO will find a way to help. In the case of Delhi’s homeless who were given UIDAI numbers, the homeless shelters they lived in were entered as the address. The design execution is kept flexible.

Can I be the introducer for my maid servant?

Not right now! Since there is no penalty for introducing the wrong person, the idea is to limit the introducers to certain types of officials the government trusts. In Andhra Pradesh, the government has appointed the NREGA department as the introducer. As a last resort, the UIDAI can also appoint introducers and get them registered with it. So, DLF can be registered as an introducer given the number of migrant labourers it works with, or even TeamLease given its status as the largest temping agency in the country. But that’s in the future.

work with ration cards and how will it certify the income of the person getting the card?

UIDAI cannot certify the income of a household. So, in case of Delhi, the government will get a survey done to identify the poor and to give them ration cards. If they have UIDAI numbers, these will be fed on to the card. If this will be a smart card, with my biometrics (collected by the Delhi government) or with my UIDAI number, each time I buy rations, my card will reflect this. Now let’s say that one person tries to get three ration cards, as a brother in one, a father in another and a son in the third, the Delhi government’s computer will be able to spot that one UIDAI number figures three times. But if there’s a rich person who has a BPL card, the UIDAI can do nothing to detect this.

So how can that be done?

If the Delhi government wants, it can run its UIDAI numbers against those with the Income Tax Department or those with various property registries or some other database. If the numbers are common, the ration card can be rejected.

Does the UIDAI pay money to people who get numbers?

The 13th Finance Commission has allocated Rs 100 for each person in case a state has 100% coverage of BPL households. So if the state government wishes, it can make a payment.

Is UIDAI a substitute for KYC?

Not yet, but RBI is considering this. Last fortnight, RBI called a meeting with all banks where UIDAI authorities demonstrated how the UIDAI number could be used to make financial transactions in faraway villages. The UIDAI is discussing the possibility of using UIDAI for telcos as a substitute for the KYC required as per the rules.

Why should a poor person get a UIDAI number?

Today, any person getting government money, through NREGA or various health and other schemes, has to go to a designated office to check on whether the money has arrived. This could end up wasting precious days of working time and involve significant transport costs. If a person has a UIDAI number and uses this to open a Post Office account, the money can be electronically wired by the government. While sitting in the village, using the Banking Correspondent in her village, she can get to know if the money has arrived and then withdraw it. Zero transaction costs.
you let the poor know of these benefits?

UIDAI itself has a Rs 50 crore budget for advertising this year. There is no limit to the budgets the states have....

260 - Column : Where’s the privacy Bill? - FINANCIAL EXPRESS

Bibek Debroy
Posted: Tuesday, Sep 28, 2010 at 2346 hrs IST

The Cabinet has approved the National Identification Authority of India (NIAI) Bill and it is expected to be placed before Parliament in the Winter Session. Before reacting, it is still a Bill. It will be referred to a Standing Committee, then passed by both Houses, then receive President’s assent and then be notified. Until then, it isn’t law. There are two strands behind transition towards the UID (unique identity) idea. First, there was a multi-purpose national identity card (MNIC) idea, driven by considerations of security and identified with the NDA government in 2002. This was meant for citizens, not residents. So there can be a national register of citizens (NRC) and a national register of residents (NRR) and the two are not identical.

Under the UPA, UID became equated with the NRR and not NRC. On this difference, UIDAI’s (Unique Identification Authority of India) response will be that it is only the first step and UID (with photographs and biometry) doesn’t create any entitlements. There is nothing to prevent the ministry of home affairs (MHA) from using UID to eventually segregate NRC from NRR. However, that’s not how ministries and the government departments (say, the police) are likely to look at UID. Existence of UID is likely to be looked upon as creating entitlements and establishing citizenship.

Second, under the UPA, UID was driven less by concerns of security and more by intentions of improving efficiency of public expenditure and facilitating e-governance. Even if we don’t identify the poor and target subsidies (outside UIDAI’s mandate), UID can curb fake identity and reduce leakage and corruption. That’s the Aadhar idea. But who has legally authorised Aadhar and UIDAI and allowed it to collect data?

No one, and neither Aadhar nor UIDAI have any constitutional or legal sanction. As of now, they are outside Parliamentary scrutiny, too. A limited objective of the Bill is to provide legal sanctity to UIDAI, to be renamed NIDAI (National Identification Authority of India). But surely such a major exercise should not be based on a narrow and limited agenda. For instance, both tort law and constitutional law protect private data from unlawful intrusion. There must be safeguards on recording inaccurate data, corruption of data, unauthorised access and disclosure, mission creep (where additional features and objectives are bunged into the main database) and profiling. The point is we do not have legislation on privacy and data protection, the civil rights angle. The Bill has some clauses on commercial abuse of database, some restrictions on nature of information collected and penal clauses on abuse. It also borrows on the IT Act of 2000. But that’s not enough.

One response is the following. We have a rollout deadline in Maharashtra and a subsequent timeframe of 2014. Let’s not hold that up. Arrangements have already been made for the first 12-digit number to be handed over by the Congress president in Nandurbar district in Maharashtra on September 29 and the PM is going to be there too. Parallel legislation on privacy and data collection will surface.

The NIAI Bill is only one part of the jigsaw. If parallel legislation on privacy and data collection doesn’t surface, surely it will be flagged by the Parliament’s Standing Committee when the Bill is introduced in the Lok Sabha. Let’s not bother about that now. After all, as legislation it is still only a draft. That’s a very casual and ad hoc way of approaching the problem. If there is one thing that has characterised Nandan Nilekani and UIDAI’s work so far, that is transparency, placing information in public domain and consultations. Comments were also invited on the draft Bill, and points that civil society organisations are making now are not new. Therefore, the NIAI Bill should have been cleared by the Cabinet with proposed legislation on privacy and data collection, as part of a package and not in isolation.

On December 16, 2009, Neeraj Shekhar asked a question in the Lok Sabha: “(c) whether confidentiality of personal details of individuals will be at risk after issuing UIN; (d) if so, whether the government needs to bring a privacy policy to safeguard the same; (e) if so, the details thereof; and (f) the method by which the UIN project will maintain a balance between privacy of individuals and requirement of security agencies to combat terrorism.”

V Narayanaswamy, the minister of state, replied, “A legal framework is being envisaged to safeguard the privacy of the resident’s data and also take care of the security requirements of the country.” This Bill is certainly not the one that envisaged law or legal framework. Was it necessary to have that deadline of September 29 and rush things through? As far as one can make out from reports, the Cabinet had no constructive comments on the draft Bill, apart from FM’s point about taxation decisions (context was exemption for resources collected by UIDAI) being finance ministry’s mandate. That’s not the way to address fears about Big Brother. Coincidentally, beyond 2013, UIDAI has annual targets of 300 million and Orwell’s “1984” talks about 300 million people, “all with the same face”.

The author is a noted economist

246 - adhaar data privacy concerns were misplaced’ - The Financial Express

Nistula Hebbar
Posted: Friday, Oct 01, 2010 at 0101 hrs IST

New Delhi: A day after the rollout of the first Aadhaar numbers from the tribal heartland of Maharashtra, Aadhaar chief Nandan Nilekani said privacy and data protection concerns were misplaced. In fact, Aadhaar firewalls were being offered to all government registrars, he said.

Aadhaar registrars include the revenue department, the RGI and other government departments. “It is a government-to-government exchange of data, so there should not be a problem with it,” he said.

“Our database is like a black hole, once the data is entered it cannot go out. The only use of the database is to authenticate your identity in your presence,” he said.

On concerns expressed by rights activist over data vulnerability, Nilekani made it clear that UID was not the only platform where such fears existed. “Credit card companies, passport forms, mobile phone connection forms, deal with far more intrusive data, therefore we suggested that all these issues can be taken on board by an over arching law dealing with privacy and data protection,” he said.

Incidentally, a group set up under department of personnel and training (DoPT) Shantanu Consul is in the process of firming up suggestions for a new law on data protection.

The next big challenge, Nilekani said was not privacy but scaling up the Aadhaar operations and enrollments. “We are looking at scaling up to millions of enrollments per month,” he said. Seven states have signed up for a post-October scaling up including Madhya Pradesh, Andhra Pradesh, Maharashtra, and Jharkhand.

“We will also test out the various applications that we want to link with the Aadhaar numbers including the public distribution system, MGNREGA, and financial inclusion,” he said.

Next stop is using Aadhaar numbers to implement the Food Security Bill.

232 - Column : Where’s the privacy Bill? - The Financial Express

Bibek Debroy
Posted: Tuesday, Sep 28, 2010 at 2346 hrs IST

The Cabinet has approved the National Identification Authority of India (NIAI) Bill and it is expected to be placed before Parliament in the Winter Session. Before reacting, it is still a Bill. It will be referred to a Standing Committee, then passed by both Houses, then receive President’s assent and then be notified. Until then, it isn’t law. There are two strands behind transition towards the UID (unique identity) idea. First, there was a multi-purpose national identity card (MNIC) idea, driven by considerations of security and identified with the NDA government in 2002. This was meant for citizens, not residents. So there can be a national register of citizens (NRC) and a national register of residents (NRR) and the two are not identical.

Under the UPA, UID became equated with the NRR and not NRC. On this difference, UIDAI’s (Unique Identification Authority of India) response will be that it is only the first step and UID (with photographs and biometry) doesn’t create any entitlements. There is nothing to prevent the ministry of home affairs (MHA) from using UID to eventually segregate NRC from NRR. However, that’s not how ministries and the government departments (say, the police) are likely to look at UID. Existence of UID is likely to be looked upon as creating entitlements and establishing citizenship.

Second, under the UPA, UID was driven less by concerns of security and more by intentions of improving efficiency of public expenditure and facilitating e-governance. Even if we don’t identify the poor and target subsidies (outside UIDAI’s mandate), UID can curb fake identity and reduce leakage and corruption. That’s the Aadhar idea. But who has legally authorised Aadhar and UIDAI and allowed it to collect data?

No one, and neither Aadhar nor UIDAI have any constitutional or legal sanction. As of now, they are outside Parliamentary scrutiny, too. A limited objective of the Bill is to provide legal sanctity to UIDAI, to be renamed NIDAI (National Identification Authority of India). But surely such a major exercise should not be based on a narrow and limited agenda. For instance, both tort law and constitutional law protect private data from unlawful intrusion. There must be safeguards on recording inaccurate data, corruption of data, unauthorised access and disclosure, mission creep (where additional features and objectives are bunged into the main database) and profiling. The point is we do not have legislation on privacy and data protection, the civil rights angle. The Bill has some clauses on commercial abuse of database, some restrictions on nature of information collected and penal clauses on abuse. It also borrows on the IT Act of 2000. But that’s not enough.

One response is the following. We have a rollout deadline in Maharashtra and a subsequent timeframe of 2014. Let’s not hold that up. Arrangements have already been made for the first 12-digit number to be handed over by the Congress president in Nandurbar district in Maharashtra on September 29 and the PM is going to be there too. Parallel legislation on privacy and data collection will surface.

The NIAI Bill is only one part of the jigsaw. If parallel legislation on privacy and data collection doesn’t surface, surely it will be flagged by the Parliament’s Standing Committee when the Bill is introduced in the Lok Sabha. Let’s not bother about that now. After all, as legislation it is still only a draft. That’s a very casual and ad hoc way of approaching the problem. If there is one thing that has characterised Nandan Nilekani and UIDAI’s work so far, that is transparency, placing information in public domain and consultations. Comments were also invited on the draft Bill, and points that civil society organisations are making now are not new. Therefore, the NIAI Bill should have been cleared by the Cabinet with proposed legislation on privacy and data collection, as part of a package and not in isolation.

On December 16, 2009, Neeraj Shekhar asked a question in the Lok Sabha: “(c) whether confidentiality of personal details of individuals will be at risk after issuing UIN; (d) if so, whether the government needs to bring a privacy policy to safeguard the same; (e) if so, the details thereof; and (f) the method by which the UIN project will maintain a balance between privacy of individuals and requirement of security agencies to combat terrorism.”

V Narayanaswamy, the minister of state, replied, “A legal framework is being envisaged to safeguard the privacy of the resident’s data and also take care of the security requirements of the country.” This Bill is certainly not the one that envisaged law or legal framework. Was it necessary to have that deadline of September 29 and rush things through? As far as one can make out from reports, the Cabinet had no constructive comments on the draft Bill, apart from FM’s point about taxation...

216 - A unique liberal dilemma - Yahoo News

Fri, Sep 24 05:49 AM
There are reports that Congress President Sonia Gandhi will lend her considerable political weight by being present at the launch of the UPA government's ambitious UID programme which seeks to give a single, unique identity number to all Indians in order to establish better state-citizen interface. In these politically charged times, with sections of the Congress sounding more coherent as opposition than the BJP, the Congress president's endorsement of the UID programme will indeed have great political significance. Of late, there is increasing opposition to the project by a small but influential section of civil society which has raised questions relating to potential violation of privacy and infringement of personal liberty by the state apparatus which might be tempted to abuse its access to the lives of citizens through the UID system.

Recently, Amartya Sen also lent some weight to such concerns by saying the UID project does raise questions of personal liberty.

Therefore, it is critical that Sonia Gandhi display unambiguous support for probably the most ambitious programmes undertaken by the UPA government so far. In fact many members of the National Advisory Council (NAC), which she heads, are highly sceptical about the UID programme. So this is one issue where Sonia Gandhi may differ with many members of NAC.

It is also interesting that among the first few UID numbers handed out will be to people living in Mumbai slums. In some ways a vast majority of the Mumbai slum-dwellers represent India's "mobile republic". As per official data, there are close to 250 million migrant workers in India who are on the move to seek jobs away from their village or place of birth. Mumbai possibly has the largest population of such subjects, most of whom are self-employed and relatively poor. So the symbolic importance of the UID launch in Mumbai slums must not be missed.

It must be clearly recognised that the emerging structure of India's economy is an unique one where 45-50 per cent of those incrementally gaining employment are self-employed. These self-employed citizens are largely poor and are considerably mobile in seeking work. The UID programme will particularly cater to some of these emerging structural realities of India's political economy. All current forms of identifications are based on specific geographical location, such as ration card, voter identification, driving licence, etc.

The UID will therefore be the only authentic, mobile identification number for over 250 million poor Indians on the move. Today banks invariably refuse to open accounts for migrant workers in big cities on the pretext that they don't have a permanent address. The UID will come as a great relief to this lot.

Some of India's liberal and enlightened citizens, who are ever so suspicious of the state's intentions, view the UID exercise as a "techno-commercial fantasy" which will not succeed. Indeed, there is a lot of cynicism around the project. However, for over 600 million poor, the physiological needs of survival clearly precede other philosophical/ intellectual concerns relating to loss of privacy felt so acutely by a section of liberal civil society.

One is not for a moment suggesting that the concerns over the UID project impinging on personal liberty are totally invalid. Simply put, there are the 600 million poor who, in the words of political scientist Partha Chatterjee, depend crucially for their survival on being able to choose tactically when to become visible and be counted by the state. This can be seen in government-led social sector programmes like rural employment guarantee, and targeted health and education services. The poor will certainly want mobile identities to be able to "become visible" at different locations across the country.

The rich, in contrast, want to largely remain out of the state's sight. In fact, it is likely that the creamy layer of society, which is economically and politically empowered, will not opt for the UID number. This lot has only limited interface with the state in their everyday life. They have access to private education, health, electricity and even security. They possibly depend on the state only for critical public goods such as clean air and water, since it is not easy to privately organise these.

Is there a contradiction between the majority of the poor seeking a sense of freedom by wanting to come under the state's radar and the others wanting to keep the state at bay while using it surreptitiously, when required? This paradox has been captured by Isaiah Berlin, one of the most influential political philosophers of the 20th century, in an essay where he explored "two concepts of liberty".

One concept of liberty, called negative freedom, is represented by the notion that individuals are totally free in society without any constraints or interference from others. The other concept — described as positive freedom — denotes submitting oneself to some collective form of self-determination, such as democracy. Even the 18th century French political philosopher Rousseau believed individual freedom is achieved through participation in the process whereby one's community exercises collective control over its own affairs in accordance with the "general will".

Of course, liberals argue that even in a democracy, driven by the general will, the government must actively create conditions for individuals to achieve self-realisation. This is seen in the form of constitutional guarantees of freedom of speech, movement, etc in liberal constitutional democracies. In the context of the UID project, bringing a new privacy legislation will denote a measure of negative freedom gained by individuals who want to guard against an "oppressive state".

Overall, there is always a striving to achieve a balance between positive and negative freedoms in a modern democracy. The unique identity project, once implemented, will also be tested in terms of the balance our constitutional democracy achieves between positive and negative freedoms this massive exercise creates. Its legal-political complexity cannot be denied as it seeks to create an official identity to empower over a billion people. Therefore, one must debate but avoid passing a premature judgment over the question of loss of privacy and personal liberty at this stage.

Before he died some years ago, Isaiah Berlin had said the only question that still remained unresolved in his mind was, "where should individual desires end and the needs of the collective begin?" This philosophical problem is not so easily resolved.

The writer is Managing Editor, 'The Financial Express'

mk.venu@expressindia.com

116 - Aadhaar data miners will serve prison term, pay fine - Source - Financial Express

Aadhaar data miners will serve prison term, pay fine

Posted: Wednesday, Jun 30, 2010 at 0218 hrs

New Delhi: The Unique Identification Authority of India will be collecting a mountain of individual data, a treasure trove for data miners. But those illegally mining here better be prepared for jail terms and hefty fines.