A modern state that cannot establish identity is not very useful.

(Wow, I am being downvoted).

Lack of papers is what Aadhaar is supposed to cure.

You are passing the identity buck. These people are so poor they live their whole lives without a solid roof over their head.

They don't have a birth certificate, a driver's license, a passport. The mere mention of these documents is somewhat of a cruel joke in their economic context.

They would have to give up a significant part of the benefits to middlemen in the old system.

(edited).

I guess you are attacking this issue keeping privacy in mind. However, from the Government's point of view, the need for linking mobile phones is to have a secured way of authenticating your Aadhaar related transactions. The Government doesn't want to end up in a liability if a situation arises where the OTP was sent to a person who later claims that the number did not belong to him in the first place. The Government is actually trying to protect itself from future litigations.

This is the same reason many services, including banks and credit card companies recommend 2-Factor Authentication. Since Aadhaar is primarily an authentication mechanism and not a tracking mechanism, authentication can only be performed either by scanning your fingerprints or via a trusted device through an OTP (in this case, your verified and trusted mobile number). Since a fingerprint scanner is not ubiquitous but a mobile is, the Government is for now relying on mobile OTP for conducting most authentications.

The AG has argued in court that mobile linking is to prevent terrorists from getting Aadhaar. This is on top of the weird order that DoT issued: https://www.huffingtonpost.in/chitranshul-sinha/no-the-supre...

(tl;dr: DoT quotes a Supreme Court ruling which questioned the government on KYC-norms for telecom industry, which the DoT conveniently reworded to mean "Aadhaar"-only)

On the other hand, somebody the government doesn't suspect can simply sign up for I.D. like anybody else and carry out an attack at their convenience.

This is personal for you - I am not directly affected by Aaddaar. Perhaps you should step back and ponder the question I had posed. Aadhaar strikes a raw nerve among many. Similar to the debate over ACA in the US.

I am simply trying to understand why.

It used to be the case before but is no longer the case. Aadhaar, even by this very article's admission, states that "Officials estimate that taxpayers have saved at least $9.4 billion from Aadhaar by weeding out “ghosts” and other improper beneficiaries of government services."

$9.4 billion is a huge amount of money saved by the exchequer. That is almost 2% of the India's annual budget. In a country with a very small tax base, every rupee saved is an earning in itself.

First - Most of the savings which the govt has attributed to aadhar they later walked back and admited it was due to gas price reductions and not because of aadhar.

Second - auth failures result in people not getting their ration- these are then counted as savings by the govt. if they were correctly accounted as a liability not only would the savings vaporize, additional costs would appear.

In the USA for example, you need photo ID & a SSN to open pretty much any financial account or to fly. Many businesses require ID to do business with them on an adhoc basis. I also know in many countries ID is required to open any telecom account.

Is the fact that aadhaar is attached to biometrics and the fear of future genocide the root of the controversy?

Now, you must link your Aadhaar with your:

- PAN, before you can file a tax or register a company

- Bank Account, or else it could be shut down (this was pushed down the parliament via a amendment to the prevention of money laundering act)

Most countries have varying KYC-norms. However, Aadhaar is a very-weak KYC-source. It doesn't require proof of citizenship (foreigners can get aadhaar) or residence (you are required to stay for 180 days in India, but UIDAI doesn't verify this). It doesn't verify proof of residence either (it was meant as a identity document for everyone - even those without homes). Add this to the fact that UIDAI has fired half of the agencies on grounds of fraud who were responsible for Enrollment.

There are a lot more issues with Aadhaar: there is a no proper security procedure, no audit reports have been published ever, and despite the numerous breaches, UIDAI refuses to take a proper stance.

>It now turns out that almost all the Aadhaar numbers issued till date – 99.97 per cent – have been issued to people who already had at least two existing identification documents.

Even the poorest in India have had ration cards.

[0]: https://thewire.in/law/most-aadhar-cards-issued-to-those-who...

A ration card was being issued to every Tom, Dick and Harry before Aadhaar. The purpose of a ration card was only for those below poverty line and during war times. Plenty misused it for commercial purposes. It's so much better to procure subsidized rice at 2 rupees per kg and sell it in the open market for 50 rupees per kg. Government had no way to track this corruption.

You might look at it as just a replacement for voter ID and ration card, but the real difference is felt by that poor man who is finally getting what was due to him.

>the real difference is felt by that poor man who is finally getting what was due to him.

The poor man was screwed by the middleman earlier (aadhaar does not solve quantity fraud - your fingerprint matching does not guarantee that the shopkeeper gives you exactly 5kg of your quota of ration) and continues to be screwed by the middleman. At the same time, the DBT scheme has seen intense opposition from people on the ground.

>According to a press note issued by the campaign, Rai did not deny the results of the survey that said 97% of people are unhappy with the new system.

Rai here is Jharkhand’s food minister Saryu Rai

Daily Wage laborers have been most impacted by DBT[1] in their ability to get benefits timely because of exclusion issues with aadhaar, but the government keeps marking these figures off as "savings".

[0]: https://medium.com/karana/lpg-savings-due-to-aadhaar-is-only...

[1]: https://thewire.in/rights/jharkhand-nagri-ration-pds-direct-...

If the market price of wheat is Rs. 30, and the old system was that the ration shop used to sell it at Re. 1 + the ration coupon, then the value of the coupon was Rs. 29.

If the new system was that you put Rs. 29 into everyone's bank account, then well maybe the ATM is a longer walk than the shop etc. But if the new system is to give people only Re. 1 then no wonder there's a riot!

Am I reading your [1] correctly? The problem is a 30-fold reduction in subsidy, not a new delivery infrastructure?

But while earlier it was just a walk to the shop and getting your ration card stamped, now you must:

1. Go to your bank (which may not even have a branch in your village)

2. Hope that the network is up

3. Confirm that the money has reached your account. If not, go home and retry (1) on another day

4. Withdraw the money and then go buy your ration at the subsidy shop

Edit: This the relevant quote from the article:

>Earlier, people would take their ration cards [...] and be able to purchase rice at Re 1/kg, with each member of a priority household allotted five kg. Now, [...] – money is first transferred into each household’s Aadhaar-linked bank account. They have to then withdraw this as cash, take it to the local ration dealer and buy rice at Rs 32/kg – of which Re 1/kg comes from the ration card holder [and the rest comes from the subsidy that you withdraw as cash].

Sounds like a massive business opportunity for banking. Your village may not have an ATM but I bet it has cellphone signal. Wasn't every Kenyan SMS-ing money around a decade ago?

The Kenyan-SMS has also led to a monopoly of mpesa in the market, which the RBI is trying to avoid by bringing some decent regulations in the space of digital banking.

Honest question: how much does this matter?

For instance, I believe in Denmark your ID number is simply not a secret at all, no more than your name. While in the US, your SSN & address basically seems to let any crook empty your bank account.

Since paper-aadhaar is still very much accepted as a proof, just having the number is enough (in many cases) to take over someone's identity and get a new SIM issued, which you can then use for emptying the bank account.

There are also phishing scams happening with Aadhaar since it uses OTP as the authentication factor. We have OTPs as 2FA for bank transactions, and it works because the first factor is still secret (credit card number or your banking credentials). However, if your first factor is your Aadhaar number, the security goes down tremendously, since every organization under the sun is now asking your Aadhaar.

I'm tempted to wardrive Aadhaar OTPs sent over unencrypted SMS.

Weird. Maybe it's different from state to state or probably area to area. Atleast where I reside (Telangana), getting a new SIM requires fingerprint authentication followed by SMS OTP to an existing mobile number. If you do not have an existing number linked to Aadhaar, only then a fingerprint scan would suffice. I have also opened a bank account here following the same procedure. I had to get one number ported and that required multiple authentication too.

The known attacks I have come across in India include the hacker somehow coming across your sim card number and using that to get a new sim card issued in your name. A lot of people have had their bank accounts drained this way (source: social media posts)

There was another thread in an yesterday on this where someone mentioned they could just rent a cell tower in Malaysia at $10 an hour and broadcast your number as roaming there to get your messages. Also mentioned were mobile number porting attacks though I don't know how viable that would be in India.

There are so many apps with the permission to read your messages on Android. I wonder how many of these upload your messages to the cloud. An attacker could simply get the OTP from there. By creating a malicious app or attacking the database of another app uploading your messages. Also possibly your sim card number which I have seen apps broadcasting in the open, unencrypted.

Another scenario - let's say you have a prepaid connection. You go abroad on a vacation without this number or get sick or whatever, and forget to recharge your phone. The provider can stop your services and give your sim to a new user. The new user now gets all your OTPs.

There are probably more attacks. Messages to your phone are just not a safe choice for 2-factor authentication, but sadly that is the base on which aadhar is built upon. Even today one can open a bank account with just an aadhar number and an OTP. Wait till people start taking loans in others' names.

Can you forge one with MS Word or is it somehow more secure than that?

What do you mean by unencrypted SMS. How do you sms is unencrypted?

Add to this that the legal encryption limit for GSM is India is just 40 bits and you can easily wardrive SMSs

I dont know how people are ok with Aadhar. Recently the aadhar data of widows in Delhi was leaked. You can find their address and various details.

I've been to the local than to register a cyber crime. Their words: "You are lucky you lost only a few tens of thousands of RS. People are losing lakhs and the Cyber cell cant help them."

Now you want India to stop subsiding poor? Do you even know the level difference between US and India. And history of political/economic systems?

And who should be making solutions, Internet warriors like you ? Comparing US, then bend over and gives his DNA to get a tourist visa. Hay, I gave it voluntary !