Aadhaar Security: The Emperor Has No Clothes

Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system. Two recent cases – that reported recently by Tribune and the French security researcher reporting on the novice-level security of the mobile App of Unique Identification Authority of India (UIDAI) – bring out a completely different threat, that of identity theft and therefore, the possibility of attacks from criminals on our bank accounts. Or linking our Aadhaar to their mobile numbers or bank accounts that are involved in criminal activities.

This issue is not simply whether the state has a right to force us to link all our economic, or other activities to our Aadhaar number. But while doing so, is it protecting us from the consequence of linking our Aadhaar number to our bank accounts, mobile numbers and other such things? Or is it laying us open to various criminal threats? Threats to our money, or even to our personal security? It is as if the state is forcing us to have combination lock for entry into our houses, then deposit the combination in a specified data bank with no security, thereby making it easy for criminals to obtain the combinations.

The Tribune reporter – as reported by Tribune and not contested by UIDAI – secured access to the entire personal data of nearly a billion Aadhaar holders by paying just Rs. 500 and within 10 minutes. According to the state authorities quoted by Tribune, there are only two people in Punjab that have the necessary security clearance to access the entire Aadhaar database. That this access was being sold for only Rs. 500, and the access provided within 10 minutes, show how seriously the Aadhaar ecosystem has been compromised.

Even UIDAI conceded that only the biometric data held in a central repository is safe. Its press statements repeatedly emphasised that this part of the Aadhaar database has not been compromised. As yet. By implication, everything else is compromised.

A French security researcher, who investigated the security in the mobile app released by UIDAI for use in our smart phones – showed how weak the security of Aadhar bases systems really is. The security expert, who calls himself Eliot Alderson and uses a twitter handle @fs0c131yJan7, showed that the security in the mAadhaar app which can be downloaded from Google Play store - to be used to provide the Aadhaar details to any service provider who uses Aadhaar based verification- was minimal. It uses code snippets widely available on the net, stores the password on the mobile, the so-called random number generator produces the same number every time. Even more embarrassingly, Khosla Labs, a private players which developed this App for UIDAI, does not seem to know how to generate a proper certificate of ownership - it showed Google and not UIDAI as the owner of this app. According to Alderson, they also appear to have lost the ability of updating their app, and are now releasing new apps in the place of the compromised one.

The android app developed by Khosla Labs for UIDAI is officially owned by Google, as per their own certificate!

Then Aadhaar security being weak will create a risk if your mobile is lost or stolen. And yes, if you lose your mobile, you are at risk of your bank account being cleaned before you block the mobile. By itself, this risk is not to the entire community of 1 billion Aadhaar holders. It brings out the security in the Aadhaar ecosystem, as exemplified by this code from Khosla Labs, is extremely poor.

Before we think that Khosla Labs is an exception, and the Aadhaar ecosystem security may be better managed - it would be instructive to know the credentials of Khosla Labs. Its three co-founders held important positions in UIDAI - and Srikanth Nadhamuni, one of its three founders, was UIDAI’s Head of Technology.

We are not discussing conflict of interests here. Nor that Khosla Labs is one of the interveners in the Supreme Court Aadhaar case, arguing on the “immense benefits” to the nation from Aadhaar. We are simply pointing out that if an organisation that includes the former head of tech in UIDAI delivers this quality of software for its mAadhaar, how safe is the rest of the Aadhaar ecosystem?

The original vision of the Aadhaar system is that the Aadhaar number is not our identity, the ID is the biometric information that we carry in our finger tips; or our eyes. It was supposed to be our fingerprints and iris data that would verify us. The problem of using biometrics for verification are numerous: from false positives, identifying wrong persons as valid users, and false negatives to failure to verify legitimate Aadhaar holders. This on top of poor connectivity and frequent lack of electricity in our towns and villages that operate computers, the internet and the biometric devices.

Faced with such problems, the authorities decided that biometric verification would be carried out only for the poor, such as ration card holders. For the vast majority of transactions, it is the Aadhaar “card” that is being used as the ID proof. The problem here is that the entire system was supposed to be built on biometric data as ID proof and not the other card. If the Aadhaar card – a duplicate of which can be printed out by anybody for anybody – is to be used for verification, then the system is in a deep crisis. As the system was never supposed to be built using the UID number as our ID proof, that could explain the poor, or non-existent security of the Aadhaar ecosystem for any data, other than the biometric data.

We haven’t even discussed here the risk that we carry when we link our Aadhaar to our bank accounts and phone numbers. How much protection do we have against misuse and hacking by insiders? As the Airtel case showed, any company that demands an Aadhaar for verification, in this case our phone number, can get our “informed consent” by popping up a 5,000 word document asking us to click “I Agree”. Airtel fraudulently used peoples’ “consent” to open 37.21 lakh Airtel Payment bank accounts, and diverted the gas subsidy payments of the customers to these accounts without their knowledge.

The state mandated Aadhaar has created a leaky eco-system that is now a security nightmare. UIDAI is clearly scrambling to restore some credibility to the Aadhaar system after the double hits of last week. It has proposed a virtual ID scheme that can be used for authentication, as well as facial recognition. The problem is that it is too late to use virtual ID schemes. Our Aadhaar number and details, including our bank account information, is already available in databases that have low, or virtually no security. It is like locking the stable door after the horse has bolted.

Facial recognition is hardly a solution. It has failed with Google software identifying images of people with dark skins as gorillas. And Apple identifying all owners of its latest i-Phones in China as the same individual: all Chinese look alike to Apple’s software!

UIDAI has promised the Indian state and its big capital that it will deliver the data of the country’s citizens for surveillance and business purposes. It will replicate the US National Security Agency equivalent by using our Aadhaar data; provide big data of its citizens to combat Google and Facebook; enable financial transactions to Indian fintech companies and banks. All of this on a very weak and shaky foundation.

For those familiar with failing software projects, there is a now sense of desperation in the UIDAI’s responses: from shooting the messenger – filing FIR against Tribune – to clutching at straws. All the measures it is proposing do not address the fundamental issue of a hugely compromised Aadhaar security system, built with public money, and at a huge cost. Can we now take a hard look at whether the Aadhaar project can actually deliver what it has promised? And scale back the Aadhaar project on which we not only continue to throw more money, after the money we have already invested, and more over create huge risks to our citizens? And perhaps to our economy itself?