265 - Rebuttal on UIDAI - Economic & Political Weekly

By: Ram Krishnaswamy, Vickram Crishna
Vol XLV No.40 October 02, 2010
LE

R S Sharma’s “Identity and the UIDAI: A Response” (EPW, 28 August 2010) argues, in response to Usha Ramanathan’s “A Unique Identity Bill” (EPW, 24 July 2010), that “The UIDAI has stated its role and objectives in various public documents, and also outlined these in its draft bill”, but she has “fundamental misunderstandings” on the UIDAI, that her “suggestion of links to the NATGRID/DNA data banks is pure conjecture” and that her article misrepresents the UIDAI’s stated objectives.

Sharma has obviously chosen to ignore the increasing number of articles in the media questioning Aadhaar, written by lawyers, economists, technologists, security professionals, sociologists, civil society supporters, scholars, academics and biometric experts, and the list goes on.

Does he really imply that everyone who questions Aadhaar is misinformed? The very foundation of “Aadhaar” that assumes “the absence of an identification infrastructure, under which every Indian has a unique identification number, has been one of the biggest barriers for the poor in accessing welfare and social services effectively”, is a sweeping generalisation, unfounded by facts from the field.

It is not the needy who possess bogus entitlement cards, but the very public servants in charge, together with other stakeholders and vested interests. Stocks are written off as being issued to all these bogus cards and the foodgrains are sold in the black market, while the remainder unsaleable stocks rot in unprotected warehouses. It is interesting that the whole nation understands this, except, apparently, the people in UIDAI.

If there is silence from some sections of the people regarding the UIDAI, it is because of the deliberate misinformation that Aadhaar is aimed at the poor. So the educated and not so poor are under the false belief that it does not affect them.

A simple and direct question to Sharma is: will he be the first to accept an Aadhaar, and share the Aadhaar number with his bank, insurance company, passport office, regional transport authority, mobile phone service provider, electricity distributor, ration card issuing authority, Income Tax authority and property registrars?

Sharma writes, “When it comes to sharing of data, the UIDAI is of the view that the individual is an active, not a passive participant, and does not need self-appointed spokespeople to debate on their behalf”.

The individual that Sharma refers to here represents millions of the poor and illiterate queuing up for subsidised rations. Sharma apparently needs reminding that it was self-appointed spokespeople who stood up to win this nation its independence, finally wrested within three years of the most brutal, callous, deliberate and avoidable choking off of food supplies that left millions dead in Bengal.

Ram Krishnaswamy, Vickram Crishna
Mumbai

252 - Justifying the UIDAI - A Case of PR Over Substance? - Desi Critics

October 04, 2010
Ruchi

RS Sharma (DG, UIDAI) in his article “Identity and the UIDAI: A Response” (EPW, Aug 28, 2010) claims that Usha Ramanathan’s article “A Unique Identity Bill” (EPW, July 24, 2010) reflects some “fundamental misunderstandings on the objectives of the UIDAI, the features of the identity number and the impact it will have on privacy”. In his rebuttal, he makes four broad points:

UIDAI has been deeply consultative and transparent, having “undertaken a wide range of consultations […] [with] economists who have worked on welfare design, civil society activists and scholars, academics, law experts as well as biometric experts […][and] with several stakeholders at various levels across the country”;
Data convergence is not unique to the UID project, “The UID database is not what makes convergence of information possible – this is fully possible, even today, without Aadhaar” and concerns of this nature will be addressed through the personal data protection framework being developed by the DoPT;
UIDAI is not a part of the national security focus of the GoI, “suggestion of links to the NATGRID/DNA data banks is pure conjecture, meant to create apprehensions on the UIDAI project”;
Profiling, tracking and surveillance are not possible and/or supported in the UID system


A review of some facts – the reader may come to own conclusions.



Consultative and Transparent?

“Consultation” must feed into the project design and scope if it is to be meaningful and not just a PR exercise. However UIDAI was ready with its approach and design document in less than three months (leaked[i] in November 2009) after Mr. Nilekani joined as Chairman and first employee[ii] in July 2009. Further despite widespread dissent and without addressing any concerns, the Authority has solidified project details by releasing tenders and signing MoUs with virtually all the important players such as state governments, rural development and petroleum ministries, LIC, state banks etc. This unilateralism was most evident in the way UID was linked to NREGA through an MoU with the Rural Development ministry without consulting the CEGC[iii], the statutory body to oversee NREGA’s implementation.

A consultative approach also mandates an inclusive engagement process, which allows all interested stakeholders to participate (each resident is a stakeholder in the UID project). Finally the proceedings of consultations must be detailed and publicly accessible to ensure that diversity of opinions and transparency of motives of involved parties are reflected. All of this irrespective of tedium must be adhered to especially for a project that mandatesuniversal inclusion.

The actual approach by UIDAI meets none of the above criteria: despite multiple explicit demands, open public meetings were summarily rejected. Proceedings of “consultation with stakeholders” (ministries, state governments, banks, industry representatives etc) are not available. Some of these consultations[iv] are with organizations (SVP National Police Academy, NASSCOM, Forward Markets Commission, venture capitalists etc) whose connection to the stated purpose of efficient and transparent delivery of state services is not apparent.

Only proceedings of “civil society organization” meetings are available, which have been summarily and/or misleadingly transcribed. For instance, in the Shimla-IIAS consultation[v], dissent is reduced to “The two sides of the debate were ably represented, with Prof. Sanjay Palshikar, Prof. Zoya Hasan, and Dr. Ramakumar presenting a civil liberties perspective”. One wonders if it’s a Freudian slip that CSO consultations have been split from “meetings with stakeholders”, given that the vehement objections of the former have not affected the project design or the Authority’s functioning at all.

A last word on transparency: Public estimates of the project cost range widely between Rs. 70,000 crores to Rs. 150,000 crores. The Authority has not made its budget public despite having functioned for almost two years and having received two budget allocations. This is especially ironic since the Authority derives justification in part by promising to save the exchequer money by eliminating leakages but resists a simple cost-benefit analysis by giving its own price tag.

National Identification Authority of India Bill

Many provisions of the draft NIA Bill are antithetical to civil society’s concerns, and their inclusion here can only amount to complete disregard for civil society consultations. First, the overall bill is aimed at achieving statutory status for the Authority not its regulation, thereby containing no details of implementation (summarily covered by the phrase, “as may be specified by regulations”). Irrelevant to the stated purpose of improving delivery of welfare services, the Authority plans to store transaction records (Clause 32(1)) to disclose for “national security” (Clause 33(b)) thus reinforcing concerns of state surveillance. Equally egregiously, the Authority seeks to reserve sole locus standing to move court (Clause 46) in a bid to evade accountability.

Having drafted a contentious bill, the Authority provided only a short two-week window for public feedback, which in spite of multiple demands, it has not made public (leaving individual groups to make their comments accessible in a scattered manner). Further in direct contravention to the process of public feedback, the draft Bill was listed for introduction in the Lok Sabha 2010 monsoon session.

Data Convergence, Privacy and State Surveillance

UIDAI has oft argued that data convergence is possible even without the UID project and thus responsibility for protection against it is not its problem. RS Sharma claims that “mobile numbers, PAN card numbers and passport numbers can all be used to profile, identify and converge data on individuals by agencies”. UIDAI contradicts itself – its biggest self-proclaimed USP is the ability to de-duplicate databases to ensure that there is only one of each person in the database. The very elimination of these vast numbers of duplicates is supposed to lead to tens of thousands of crores in savings. It stands to reason then that any convergence of this duplicate-infested erroneous data will be both highly problematic (given the inability to do reliable one-to-one matching) and will yield bad data. Plus no other number is linked to biometrics or envisioned for use across all major transactions of the individual’s life as UID numbers are. Thus what is game changing for efficient delivery of government services will also be game changing for other more intrusive purposes.

Furthermore the individual data protection framework in the works by DoPT does not address civil liberties concerns. By focusing on individual privacy and explicitly taking the state out of the picture on pretext of national security (as with the amended Information Technology Act 2008, defense and intelligence agencies’ exemptions from the RTI Act etc), no checks or regulation will be applied on state power at all (the predominant cause of concern against UID facilitated data convergence). In fact this focus on individual privacy is the perfect foil to dilute the RTI Act and evade accountability of public officials.

Regarding the assertion that the UID project is not part of the national security focus of the GoI, there are many unanswered questions, some of which include:

If the purpose of UID is wholly and solely to deliver government services efficiently and transparently, then why is “national security” part of the legislation? Does any legislation related to these individual welfare schemes (NREGA, PDS, RTE, NRHN etc) contain a similar “national security” provision? Then why should legislation for an Authority restricted solely to these schemes worry about national security since it seems unlikely that a cross border combatant will want to pilfer some low quality subsidized grain
Why is the Home Ministry installing fingerprint readers in all the police stations of the country under the Automated Finger Print Identification Systems[vi] (AFIS) project?
Finally, for a project whose benefits are premised on removing duplicates and “convergence” of social sector schemes, it appears counter-intuitive that overlapping and synergistic projects like UID and NATGRID (cross-linked government databases) will be independently duplicated instead of “converged”.
RS Sharma claims that the Authority clearly restricts the collection of any data that could be used to profile individuals/communities; however data convergence will render such provisions irrelevant. Further storing “details of every request for authentication of the identity of every aadhaar number holder and the response provided thereon by it in such manner and for such time as may be specified by regulations” (Clause 32(1), Draft NIA Bill 2010) is the equivalent of tracking, especially given the fact that each authentication request represents the physical presence of the individual at that location (for biometric verification). Merely saying that the Authority will retain “authentication records in a manner similar to the retaining of credit cards record” does not lessen the seriousness of this provision. Plus anyone who’s seen a credit card statement knows that there is no dearth of information with the credit card companies about each transaction.

Changing the Problem to Fit the Solution

UIDAI has time and again asserted that the “inability to prove identity is one of the biggest barriers preventing the poor from accessing benefits and subsidies.” Framed thus, the UID project seems like the obvious answer.

The reality though is different. In rural areas, the ability to prove identity is not the problem. How would a purely notional (and oppressive) concept like caste be so ingrained if one’s identity were so nebulous? Inability to access government services is one of lack of information and distorted power structures and introducing an opaque process consisting of fingerprint readers, mobile connectivity and centralized verification will not empower the disenfranchised.

In urban areas, the real issue is one of exclusionary state policy and not inability to prove identity. Shaloo, my household help has a Delhi based bank account, medical records and school report cards dating from 2001. However she cannot get a gas connection or a ration card because she lives in a jhuggi[vii]. She is also not eligible for rehabilitation when her slum will be demolished (as slated for CWG 2010) because she is unable to prove residency before the cut-off date of Dec 31, 1998. This is clearly a matter of policy, which cannot be addressed by a UID number. For the truly identity-less (e.g., beggar community), UID approach is weak relying on “introducers”.

It also bears mention that formalization/regulation is a good thing only when the state is genuinely attempting to be inclusive (which cannot be assumed to be universally true). Anonymity allows those on the fringes of society to get their work done through informal channels, an option that will be closed with the regimentation envisioned by UIDAI.

Another example of this kind of conceptual chicanery of changing the problem for a force-fit solution is the article “A Unique Way to Ensure Learning” (Livemint, Aug 19, 2010) by the Akshara Foundation. In this the authors argue that “it is necessary to gather enough data at the child level so that the right levels of interventions are focused on the appropriate target groups” and that “a universal and unique identification system will help in improving quality outcomes in a significant manner.” The article further cites a potential example of UID at work: “Remedial interventions are required to bring what the system calls “slow learners” to mainstream levels. This means that we need to know who needs help: This is possible only by administering diagnostic baseline tests and logging this data on a child-by-child basis, and then initiating the remedial interventions to wipe out specific legacy problems”. World over learning outcomes are overwhelmingly linked to the quality of teachers, but this article mentions teachers just once – predictably where UID can be used – to track attendance in government schools (who will make them teach?). Further the idea of tracking individual as opposed to aggregate learning outcomes is useful when only a few children are slipping through the cracks, so as to direct supplementary child specific interventions. However when the education system is failing almost all our children (in Karnataka, only 11% children in classes III to V can read English sentences; around 40% of the children between classes I and VIII can read a class II-level text and less than 20% could do simple division in mathematics), the obvious need is to fix the system and not run around logging data on a child-by-child basis.

The UID project comes in benevolent packaging; however claims of good intentions can be sustained only with complete transparency of objectives and participatory processes instead of trying to push through projects with PR and stealth

UID Resources – For Other UID updates

 

195 - Identity and the UIDAI: A Response by R.S.Sharma - EPW Article

By: R S Sharma
Vol XLV No.35 August 28, 2010

 The absence of an identification infrastructure, under which every Indian has a unique identification number, has been one of the biggest barriers for the poor in accessing welfare and social services effectively. The UID number that will be provided will be an enabler – a number that helps governments design better welfare programmes, enables residents to access resources more easily wherever they live, and allows agencies to deliver benefits and services effectively and transparently. The number will thus be an identity infrastructure, and the foundation over which multiple services and applications can be built for the resident.

The article “A Unique Identity Bill” (EPW, 24 July 2010) reflects some fundamental misunderstandings on the objectives of the Unique Identity Authority of India, the features of the identity number, and the impact it will have on privacy. A response. The objective of the Unique Identification Authority of India (UIDAI), constituted in January 2009, is a simple one: to issue a unique identity (UID) number for every resident in the country. The impact of this initiative, however, goes to the heart of our development agenda today. The UIDAI will fill a significant gap that has existed in our regulatory infrastructure. India has long lacked the identification infrastructure that is in place in countries around the world.1 The absence of this in India has been one of the biggest barriers that the poor face in accessing welfare and social services effectively, as it increases costs and effort of identification as well as the risk of duplicates.

The key role of this UID number is that of an enabler – a number that helps governments design better welfare programmes, enables residents to access resources more easily wherever they live, and allows agencies and programmes – such as the National Rural Employment Guarantee Scheme (NREGS), the Public Distribution System (PDS) and the Sarva Shiksha Abhiyan (SSA) – to deliver benefits and services effectively and transparently. The number will thus be an identity infrastructure, and the foundation over which multiple services and applications can be built for the resident.
The UIDAI has stated its role and objectives in various public documents, and also outlined these in its draft bill. Despite these efforts to clarify the various aspects of the UID Authority, the article by Usha Ramanathan “A Unique Identity Bill” (EPW, 24 July 2010) reflects some fundamental misunderstandings on the objectives of the UIDAI, the features of the identity number, and the impact it will have on privacy.
I do not believe that members of the public, on reading the UIDAI documents, would reach the same conclusions that this article has. Regardless, I would like to address any concerns it may have raised.

Consultations by the UIDAI
At the outset, the author implies in her article that the UIDAI has not been consultative enough, and not opened the UIDAI draft bill sufficiently for comments and discussion.
This remark takes an arbitrary factor – the timeline the UIDAI provided for comments – as proof that the UIDAI has not encouraged discussion on the draft bill. The possible provisions of the bill have, in fact, been under discussion for a significant period of time. Since Nandan Nilekani was appointed chairman of the UIDAI last year, the UIDAI has undertaken a wide range of consultations on what the draft bill should look like, with economists who have worked on welfare design, civil society activists and scholars, academics, law experts as well as biometric experts.
The UIDAI has also engaged in discussions and consultations with several stakeholders at various levels across the country – various ministries and departments of the government, all state governments, the Planning Commission, the Thirteenth Finance Commission, and various independent regulatory authorities. (The details of these consultations are publicly available on the web site.)
These discussions over the last year have shaped the eventual bill, which took into account the various concerns and viewpoints expressed. The invitation for comments once the draft bill appeared on the web site was in addition to this.
Sharing of Information
The article makes the following, apparently tautological statement: “convergence (combining information) is a predictable and inevi table consequence of the UID project”.
The UID database is not what makes convergence of information possible – this is fully possible, even today, without Aadhaar. Mobile numbers, PAN card numbers and passport numbers can all be used to profile, identify and converge data on individuals by agencies.
Overall, concerns on convergence and linking of data can only be addressed through a broad personal data protection regime which will be applicable to all agencies that collate data. The Department of Personnel and Training is currently spearheading an effort to examine the legal framework for personal data protection in the country.
Such a law would also be able to differentiate between benign convergence, which is in the interest of the beneficiary, and illegitimate convergence. The example the article offers – the sharing of health records between hospitals – in fact illustrates that combining data is not always for sinister goals. Sharing of medical records should require the consent of the patient, but is useful for the individual being treated, as it would alert doctors to the patient’s medical history, such as pre-existing heart conditions that rule out anaesthesia, or reactions to particular medication. This would enable better and also cheaper treatments, since different hospitals would not subject patients to the same medical test multiple times.
When it comes to sharing of data, the UIDAI is of the view that the individual is an active, not a passive participant, and does not need self-appointed spokespeople to debate on their behalf. A strong data protection law would ensure that data sharing when it is done, is done with the consent of the individual. Such a law would also give individuals the space and security to choose the information they keep private, according to their own needs. So while an individual may not want a pizza parlour to have access to her personal information, a PDS beneficiary accessing a toll-free number on the system may want to share more information on family members, income and home address to ensure that she receives her subsidy effectively. The author ought to recognise that the preferences of the latter individual are as important as the former.
NATGRID, DNA Bank, NPR and UID
The article suggests that the UIDAI is a part of a national security focus of the Government of India. As mentioned, the goal of the UIDAI project is to issue an identification number to residents for better service access.2 While the NATGRID and the DNA data banks are playing critical national security roles for the country, the UID Authority is attached to the Planning Commission and is not connected to these efforts. Neither is the UIDAI implementing the National Population Register (NPR) – this is under the ambit of the Registrar General and Census Commissioner.
The author’s suggestion of links to the NATGRID/DNA data banks is pure conjecture, meant to create apprehensions on the UIDAI project, and trivialises the actual concerns of the millions of residents who live today without recognition.
Profiling, Tracking and Surveillance
The author also makes multiple statements that the UIDAI has not addressed concerns on profiling and tracking of individuals using Aadhaar information. Her argument ignores several clear, well-highlighted provisions that the bill makes to address concerns of profiling and surveillance.
Profiling of individuals is not possible in the UIDAI system. The bill clearly states3 that the definition of demographic data the UIDAI will collect cannot be expanded to include any profiling information, such as on race, religion, caste, tribe, ethnicity, language, income or health. Tracking and surveillance are also not supported in the UID system.
The UIDAI is also barred from revealing information stored in the central identities data repository. There are only two exceptions to the rule of information disclosure, for reasons of national security, and these exceptions are captured in Section 33. Our approach here reflects one that is followed the world over – where national security and the threat of terrorism remain a very strong reason to provide selective access to information. Such disclosures would have clear checks and balances, and would require a court order or the approval of a concerned minister as well as an additional joint secretary. The article has chosen to quote solely this clause, without citing the various protections that would prevent its misuse.
To further limit misuse of data, the Authority will not have records of transactions that the resident would have engaged in. The Authority will only retain authentication records in a manner similar to the retaining of credit card records – to protect the interest of residents in case of disputes of authentication.
Denial of Service
The author contends that while every resident is entitled to an Aadhaar, the UIDAI does not recommend that delivery of services and benefits cannot be denied due to a lack of UID number.
Policies for providing or denying service are determined by the service provider – it is a function they perform today and will continue to perform, with or without the UIDAI. The UIDAI cannot dictate their processes to them. Additionally, the Aadhaar is meant to replace the various kinds of documentation agencies now demand as proof of identity and proof of address. It does not make sense therefore, for the UIDAI to state that agencies should not require the Aadhaar number to provide services, once these numbers have become sufficient proof of identity and address.
Additional Comments
The article makes some additional, erroneous remarks which either misunderstand or misrepresent the UIDAI’s stated objectives:
(i) “S. 12 – the UID chairperson and members can be appointed by the central government, giving the government control over the persons running the institution”.
As is the case with all of India’s regulatory institutions, the Authority will be created by an act of Parliament and hence will be a statutory authority and accountable to Parliament and the judiciary.
(ii) “The Bill does not limit the use of the number”.
In Section 28, the Bill envisages the creation of an independent body called the Identity Review Committee which shall ascertain the extent and pattern of usage of the Aadhaar numbers across the country and prepare a report annually and make recommendations to the central government.
(iii) “There is no grievance redressal mechanism mandated by law – it may be set up by regulation or it may not”.
The Authority is setting up a grievance redressal mechanism to address feedback and complaints from residents receiving the Aadhaar. The information and grievance mechanisms are already being tested by the UIDAI.
(iv) “In its powers and functions the UIDAI has the authority to define the use of the UID number for the delivery of benefits and services”.
The government today faces the challenge of weak delivery of resources and services across several welfare schemes. The power of the UIDAI to define the use of the Aadhaar number for the delivery of benefits and services is in order to help
reduce leakages and improve resource delivery across such schemes.
(v) The UIDAI has entered into MoUs “without legitimacy, and they do not have the statutory power to collect, hold and transmit information about people”.
This is patently untrue. The UIDAI is an attached office of the Planning Commission and was constituted by an order dated 28 January 2009. The constitution of the authority is valid in law and within the executive authority of the government.
(vi) Pointing to the numbering system document on our web site, the article states that the UID system is expected to live on for years, clearly indicating that the number is a “tagging device” that is likely to live on beyond a person’s lifetime.
The numbering system document is a technical, not a policy document. It was written to lay down the numbering logic for designing the Aadhaar number. Quoting statements from this document to suggest that the Aadhaar number is a tagging device is fundamentally inaccurate. The sentence the article quotes was made
regarding the fact that the population of the country keeps growing, and the numbering logic needs to ensure that sufficient Aadhaar numbers are available.
(vii) Given biometric inaccuracy and lack of debate and answers, it is too early to seek parliamentary approval.
As mentioned previously, the UIDAI has held numerous consultations and debates with government and regulatory institutions as well as civil society groups, the public and subject matter experts, including in biometrics on the use and architecture of the Aadhaar number. Contrary to the article’s assumptions, accuracy from biometrics can now be achieved at a very high level, crossing 99% when different kinds of biometrics are combined, as the UIDAI intends to do. This assessment has come from the Biometrics Committee that was constituted to study the various biometrics and make recommendations best suited to India’s population and environment.4 The UIDAI has adopted the committee’s recommendations to collect face, fingerprint and iris biometrics, in order to ensure that even people with non-existent fingerprints (due to physical labour) would be issued an Aadhaar.
The author of the article views the state as an oppressor; she would do well to
acknowledge that it is the government which spends on the delivery of social benefits such as food, health, education and work, and the government is consequently keen to ensure that these benefits actually reach the people they are intended for. This is the animating principle behind Aadhaar. Without building better and more secure social welfare nets, and ensuring access for the poor to education and health, our efforts against inequality and poverty will come to naught. Aadhaar is the foundation on which we can provide the services and resources individuals need to ensure their dignity, and their right to a better life.
Notes
    1    The United States for instance, has built a strong network of welfare services that residents access through the social security number (SSN), and the United Kingdom and European countries deliver social services to residents through similar identification numbers, such as the National Insurance Number.
 2    This goal is restated in the preamble of the draft bill.
 3    Ref Section 2(h), and Section 9.
 4    The Biometrics Committee report is in the public domain, and available on the UIDAI web site.