274 - What happens if you refuse a UID card? - Rediff

October 08, 2010 10:55 IST

What happens if you refuse a UID card because you believe it violates your civil liberties?
Can the government deny you your rights because of this?

Vicky Nanjappa finds out.

It is just a matter of time before every Indian possesses a 16-digit Unique Identification number that will set her/him apart from a billion fellow countrymen.

Questions have been raised if the Centre will make the card compulsory for every Indian citizen.

M N Vidyashankar, principal secretary, department of information and technology, explains to Rediff.com, "Every resident of India [ Images ] is entitled to a Unique Identification number. The procurement of the UID is subject to the fulfilment of certain procedural requirements. The Unique Identification Authority of India does not make it mandatory to have a UID number."

"It remains to be seen how the respective state governments will implement this project," Vidyashankar added.

"The decision to deny certain rights to a citizen who refuses a UID is completely at the state government's discretion," the principal secretary, IT, pointed out.

Article 21 of the Constitution clearly states that every citizen has the right to liberty.

The personal information furnished by citizens for the UID will be stored in a common government database, which could easily be misused.

The Union government, sources added, is in no hurry to assign UIDs and is planning a gradual implementation of the scheme.

The pace notwithstanding, the Centre would like to ensure that every Indian gets an identification number, which, some government officials believe, is imperative for security-related issues.

In due course, the government could ensure that a UID is required for even simple tasks like opening a bank account, filing income tax returns, applying for a passport or a driving licence.

The government plans to complete this entire process in the next five years.

After the government issues a circular in local newspapers citizens will need to go to the enrolment office with evidence that they are Indian citizens, and proof of their age etc.

S/he will be fingerprinted and photographed at the enrolment office.

The UID card will be issued in 20 days.

113 - Nilekani proposes online food accounts - Source Rediff

Nilekani proposes online food accounts
July 14, 2010 08:53 IST

Nilekani proposes online food accounts

The Unique Identification Authority of India [ Images ] on Tuesday expressed its keenness to join hands with the Department of Food and Public Distribution to reform

78 - Why the UID number project must be scrapped by Gopala Krishna - Source Rediff

Why the UID number project must be scrapped
June 02, 2010 13:49 IST

Activist Gopal Krishna makes a case that the Unique Identification Number project is a gross violation of fundamental human rights and points out that a similar project/law in Britain is going to be repealed.

This is with reference to a privacy invasion project which is relevant to India [ Images ] and all the democratic countries of the world. The very first bill that is to be presented by the UK's new coalition government in the British Parliament is to repeal its Identity Cards Act 2006 even as Government of India has chosen to give approval to Unique Identification Number project that threatens citizens' privacy. Clearly, what is poisonous for civil liberties in the UK cannot become non-poisonous in India.

If one takes cognisance of the claim that the 'UID system is a civilian application of biometrics' and compares it with current practices, one finds that such a claim is quite misplaced.

In the report there is reference to a study commissioned by the US Department of Homeland Security to International Biometrics Group. Will someone explain how manifest reference to such a study constitutes civilian application?

In our country, it is rarely noticed as to when the concept of massively organised information quietly emerged to become a means of social control, a weapon of war, and for the victimisation of ethnic groups. Nandan Nilekani, co-founder and former chief executive of Infosys Technologies Ltd [ Get Quote ], India's second largest software company, has misled the Government of India into making it believe that in a country with 48 percent illiteracy, a 12-digit card would be helpful in reaching the poorest of the poor.

The Unique Identification Number/Aadhar project that emerged from the constitution of Unique Identification Authority of India in January 2009 reminds one of what happened from the period preceding Adolf Hitler's [ Images ] arrival to January 1933 when he occupied power, to Second World War and since then. The way International Business Machines, the world's largest technology company and the second most valuable global brand, colluded with the Nazis to identify Jews for targeted asset confiscation, ghettoisation, deportation, and ultimately extermination to help Hitler with its punch card and card sorting system -- a precursor to the computer -- made the automation of human destruction possible is a matter of historical fact.

Unmindful of the lessons from Germany [ Images ] in particular and Europe in general, advancing the argument of targeting, it has been claimed on the floor of Parliament by the finance minister while presenting the 2010-11 Union Budget that the UID project 'would provide an effective platform for financial inclusion and targeted subsidy payments,' the same targeting measures can be used with vindictive motives against citizens of certain religion, caste and ethnicity or region or towards a section of society due to economic resentment.

Curiously, the finance minister and the head of UID/Aadhar project refer to financial inclusion and not about economic inclusion of the poor. Exclusion of certain sections of society for political reasons had led to the targeted massacre of 1947, 1984 and 2002 in India. If an exhaustive trans-disciplinary study is conducted it would reveal how privacy is closely connected to data protection and the same was readily available to perpetrators of riots, massacres and genocide in our country.

The UID project is going to do almost exactly the same thing which the predecessors of Hitler did, else how is it that Germany always had the lists of Jewish names even prior to the arrival of the Nazis? The Nazis got these lists with the help of IBM which was in the 'census' business that included racial census that entailed not only count the Jews but also identifying them. At the United States Holocaust Museum in Washington, DC, there is an exhibit of an IBM Hollerith D-11 card sorting machine that was responsible for organising the census of 1933 that first identified the Jews.

The Government of India cannot guarantee that in future, when the Nazis or some such sort come to power in India, they would not have access to UID for vindictive measures against certain sections of the citizenry. This is evidently the journey of 'identification' efforts from January 1933 to January 2009, when the UID Authority was announced.

The UID and National Population Register is all set to do what IBM did in Germany, Romania and in Europe and elsewhere through 'solutions' ranging from the census to providing list of names of Jews to Nazis. The UID has nothing to do with citizenship, it is merely an identification exercise.

Against such a backdrop, as concerned citizens, we welcome the progressive step by the new coalition government in the UK to scrap its controversial national identity card scheme in order to safeguard citizens' privacy and act against intrusions. The scrapping of the UK's ID project is planned to be done in the next 3-4 months. Besides repealing the Identity Cards Act 2006 and outlawing the finger-printing of children at school, the UK government would stop its National Identity Register and the next generation of biometric passports, the Contact Point database and end storage of Internet and email records.

But unlike the UK, the Government of India through a Press Information Bureau release dated May 18 has stated that 'the Cabinet Committee on Unique Identification Authority of India related issues today approved in principle the adoption of the approach outlined by UIDAI for collection of demographic and biometric attributes of residents (face, all ten fingerprints and iris) for the UID project. It was also decided to include data of the iris for children in the age group of 5 to 15 years. The same standards and processes would be adhered to by the Registrar General of India for the NPR exercise and all other registrars in the UID system.'

Not surprisingly, the government is feigning ignorance about the democratic movement against such efforts. In India too, there is a robust case against rejecting what has been rejected in the UK. The UID project is a blatant case of infringement of civil liberties. The government's identification exercise follows the path of the Information Technology Act 2000 that was enacted in the absence of no data or privacy protection legislation.

As is the case with the UID project, in the UK too the scheme has been vacillating from one claimed purpose to another. The project is being bulldozed in the name of poor by saying, 'Identity becomes a bottleneck if one wants to have a ration card, driving licence, passport, bank account or a mobile connection. It will enable poor residents to access multiple resources including education, health and financial services.'

Following the footprints of the UK's discredited project, it is being said that 'the identity number will help get a child admission in school.' Perhaps fearing abandonment of the project, in the aftermath of the UK government's decision, it is being now said that the Unique Identification Number is optional, not mandatory.

How is it that two democracies deal with the issue of ungovernable breaches of privacy differently? While the UK government is proactive in protecting the privacy of its citizens, the Government of India is ridiculing the very idea of privacy and civil liberties.

It is highly disturbing that at almost the same time, India's minority coalition government plans to do just the contrary with astounding disregard to citizens' privacy by stamping them with an UID number based on their biometric data. Such a 'surveillance' effort through the world's largest citizen identity project for 'creating a Unique Identity Number for every resident in India' undermines our democracy beyond repair.

Related to the UID number project is the NPR project. This is for the first time that the NPR is being prepared. The database will be built by the Registrar General of India. It is noteworthy that the census and NPR are different. The census is the biggest source of data on demography, literacy and education, housing and household amenities, economic activity, urbanisation, fertility, mortality, language, religion and migration. It serves as the primary data for planning and the implementation of policies of the central and state governments.

The NPR involves the creation of a comprehensive identity database for the country. It will include items of information such as the name of the person, father's name, mother's name, spouse's name, sex, date of birth, place of birth, current marital status, education, nationality as declared, occupation, present address of usual resident and permanent residential address. The database will also contain photograph and finger biometry of persons above the age of 15.

After the NPR database is finalised, the next task would be assigning every individual a UID. This number will be added to the NPR database. It is proposed to issue identity cards which will be a smart card with UID number printed on it and include basic details like name, mother's/father's name, sex, date and place of birth, photograph. Complete details will be stored in the chip.

Like in the UK, in India too there is a need for a similar measure to stop the efforts underway through the UIDAI to issue a UID number to every resident in the country. Issuing unique identity numbers to the 1.2 billion residents of India based on biometric data is fraught with hitherto unimaginable dangers of human rights violations. It has emerged that it all started rolling in the aftermath of a meeting of the empowered group of ministers on November 4, 2008, and a meeting of the prime minister's council of the UID Authority on August 12, 2009, wherein it was decided that there was a 'need for a legislative framework' akin to the UK's Identity Cards Act 2006 which is now being scrapped.

The 13th Finance Commission has made a provision for an incentive of Rs 100 per person (Rs 400-500 per family) to bribe citizens below the poverty line to register for the UID and has recommended a grant of Rs 2,989.10 crore to be given to the state governments for the same. The three states (Karnataka [ Images ], Madhya Pradesh [ Images ] and Andhra Pradesh) who have signed an MoU on their part have set up state-level committees to work as UIDAI registrars for collecting biometric samples like thumb impression or cornea configuration of each individual resident. Has there been any debate so far in the legislatures about the ramifications of a project which is all set to be scrapped in the UK?

As per the Authority's Office Memorandum signed by director general, UIDAI, dated September 29, 2009, 'The main objective is to improve benefits service delivery, especially to the poor and the marginalised sections of the society. To deliver its mandate, the UIDAI proposes to create a platform to first collect the identity details and then to perform authentication that can be used by several government and private service providers.'

The reference to private service providers is inexplicable, for the work is meant to be an exercise for public purpose and for the poor and the marginalised. The promise of service delivery to the poor and the marginalised hides how it will enable access to profit for the IT industry and the biometrics industry. Such claims are quite insincere, misleading and factually incorrect. It reminds one of the pledges in the Preamble of the Constitution of India, it will have us believe that the UID Authority would fulfil the constitutional promise of economic equality. Such objectives are bad sophistry at best.

This authority in turn set up a Biometrics Standards Committee in order 'to review existing standards and modify/extend/enhance them so as to achieve the goals and purpose for de-duplications and authentication' through framing biometrics standards for fingerprints, face and iris.

The authority defines biometrics as 'the science of establishing the identity of an individual based on the physical, chemical or behavioural attributes of the person.' Besides, photos of the face are commonly used in various types of identification cards, it is undertaking the use of fingerprints for identification and recording the iris, the annular region of the eye, bounded by the pupil and sclera on either side which is considered the most accurate biometric parameter.

The committee reveals that 'the biometrics will be captured for authentication by government departments and commercial organisations at the time of service delivery.' The commercial organisation mentioned herein is not defined.

The Biometrics Standards Committee refers to previous experiences of the US and Europe with biometrics. A technical sub-group was also formed that collected over 250,000 fingerprint images from 25,000 persons sourced from districts of Delhi [ Images ], UP, Bihar and Orissa for analysing Indian fingerprints. It may do the same for the iris and face as well to form a database size of 1.2 billion. It has been recommended that the 'biometrics data are national assets and must be preserved in their original quality.' The committee refers to citizens' database as a national asset.

Both the UID and NPR, through convergence, represent a case of the State and the 'market' tracking citizens for one reason or the other. It is benign neither in its design nor in its execution. The working paper of the UIDAI revealed that the 'UID number will only guarantee identity, not rights, benefits or entitlements'. It is also said that it would not even guarantee identity, it would only provide 'aid' in identification.

We support the campaign of the people' movements, mass organisations, institutions and concerned citizens and individuals who strongly oppose the potential tracking and profiling based techno-governance tools such as the UID number. We demand that Parliament or the Comptroller and Auditor General should probe the UID Authority's work from January 2009 till date.

In view of the above mentioned facts, we submit that the collection of such data is a classic case of gross violation of fundamental human rights. The Government of India should take prompt lessons from the UK government's decision to scrap its National ID project and desist from taking the path paved by IBM for the Holocaust and abandon its UID/Aadhar project.

Gopal Krishna is a member of the Citizens Forum for Civil Liberties.


Do you agree with the views expressed above? Or do you have a view to the contrary? Do let us know in the message board below.

Gopal Krishna

46 - UID number: Challenges and security concerns by Sunil Chandramani - Source - Rediff

UID number: Challenges and security concerns

May 13, 2010 09:31 IST

Sunil Chandiramani, Partner and National Director-Advisory Business Leader-Government Services, Ernst & Young (E&Y), with a team of 15 people is busy with India's [ Images ] most ambitious programme of providing a unique identification (UID) number to residents of India.

E&Y has been selected as a consulting partner by the Unique Identification Authority of India (UIDAI).

With just about three months left for UIDAI to have its systems operational, Chandiramani, in a chat with Shivani Shinde, speaks about the role of his firm besides the challenges and security concerns associated with the rollout of UID number. Edited excerpts:

What is the role of E&Y?

We are technology consultants. Our role is to help UIDAI select and procure technology including procuring the managed services provider. We also have to manage the implementation.

This is something we hope to do over the next three years. The work would involve setting up the core - technology and the processes - followed by the rollout. The core work has to be done right and we cannot afford to fail.

So, you have a contract for three years?

No, our contract is for one year and this is the first phase. But even if we don't get the second year contract, the technology would have been procured by that time, and the project implemented. The only piece that would remain would be the rollout. Of course, we would like to be the part of the rollout as well, as that is the most challenging part.

From a rollout perspective, banks, IT department, colleges, insurance firms, schools will be used as registrars. The rollout part is very critical. But before that we have to think of systems that would tackle all the scenarios. Like what happens if someone loses his or her UID number.

Do you think the systems will be ready by August 2010 for the rollout?

I would not yet be ready to comment on the August rollout as yet. We still have to get a few RFPs closed. The crucial among them is the biometric piece. But by the end of May, we need to close all the RFPs.

Which other tenders will come up for bidding?

Some of the request for proposals (RFPs) that have come up are in the application side and biometric segment. We will soon announce RFPs for the managed services provider.

The biggest chunk will be the managed services, as the provider will have to manage the entire repository of data. This will mean that the vendor will have to provide a system and be involved in the de-duplication process. That means every time someone sends a biometric print, the systems need to match them and get back to the person and that too in real-time.

What about security concerns surrounding data and access to it, especially since there are plans to have UIDs online too?

People tend to think that online means access to information on the fly. But that does not mean that any individual can access the data. To give an instance, when it comes to commercial use, any commercial vendor - bank, insurance firms etc - who needs to verify an individual's UID will need to take imprints of fingers and send it to UIDAI asking for authentication.

This is online and real-time. However, UIDAI will not send your finger prints or any other detail. It will just confirm the authenticity of the imprints. Hence, the repository is not accessible to anyone. Besides, adequate measures would be built into the tech systems to ensure that the data are being added to the repository according to the set standards.

A security breach can occur nevertheless...

Use of any technology brings challenges but what matters is, if the security is manageable. I think it is manageable. As an extra security measure, UIDAI has added four digits to the 12-digit number. This PIN-based four-digit identification will be masked. So, at anytime this four-digit number gets changed then everything changes.

Over a time there is a possibility that these kind of information when it is shared could be tracked. We also think there will be more than enough people who will try to get more than one UID or will at least try to get. We are setting rules that if someone intentionally attempts to defraud then there will be penalties and other measures built in.

What about privacy issues?

The concern that arises of this is, who can access this data and where the data will reside. India will also need to have data privacy policy. I think privacy forums need to be formed and this should happen as we roll out. In some cases, there might be a need for regulatory changes and in some cases, for an outreach programme.

Would UIDAI use the census data or the machinery for the rollout?

No, census data will not be used for the UID project as of now. This is because the census team collects name, address and other details by visiting every house. But for UID, we need to capture facial expressions, finger prints and take iris scans. You cannot move around and get this data.

You will have to go to a centre to do it. Over a period of time, the census data might be used. Besides, when the UID gets captured you have to get it right at the first time. The person who will take these details will send the data to UIDAI.

The UIDAI team will check the quality of the data sent and then reject or select it. If this is rejected, the individual will be called again at the centre; it's a long process. Add to this, the centres will need to verify the person and the details they are providing. The census team would not do this detailed work.

How big is the IT opportunity in this project?

I wouldn't know the value but from an opportunity perspective, it's huge. Especially, for the hardware segment. Imagine the number of biometric machine required to capture the data of a billion people, along with the PCs and servers to support this data. Solutions will form a smaller part.

Shivani Shinde in Mumbai