jace

Biometrics are not discussed much these days because Aadhaar is no longer a strictly biometric id – either at enrollment or in usage.

Biometrics are not collected for toddlers and not considered reliable for under-15s, and that segment was about 30% of the population in the 2011 census. An unknown number have never updated Aadhaar to add biometrics.

Biometric auth fell into disuse with the shift to mobile internet. The government tried strong-arming Apple and Google into taking fingerprint scanners out of the hardware secure zone so they could send scanned fingerprints (minutiae) to UIDAI servers. That didn't work, so they tried coaxing OEMs to make Aadhaar phones with a second fingerprint reader. TRAI – whose chairman 2016-2020 was the ex-UIDAI head – even tried framing it as "device neutrality" borrowing from European app store regulation. None of that worked, so they just moved from biometrics to SMS OTPs for rich people, while continuing to harass poor people for it.

Aadhaar as a unique id was always a galaxy-brained idea when there's no biometrics for children, no removal of dead people, and confusion of uniqueness in an identity scheme vs uniqueness in a much smaller welfare scheme where there's always surplus population who will never notice identity theft.

The only good thing about Aadhaar is the card – it's given people a document that's near-universally accepted. But the Aadhaar card is an organic development that was not part of the original design – where the card was merely meant to be a receipt delivered via the post as a probe to confirm the address – and remains an afterthought in the narrative. Even today you'll find Aadhaar proponents who don't understand how the card is a very different thing from the digital id they associate Aadhaar with.

I should also point out that Aadhaar in fact attempts to capture identity itself, not merely issue a document. The founding management articulated it as a "digital atma (soul)", and the card that people use as a document today was originally meant to be a postal probe to confirm the address by delivering a receipt containing the assigned number (the only way to receive it).

That ridiculous ambition led to their many stupid choices and to further perversion as no other government department could understand what this was and how to use it, so they all invented their own usage processes – with enough loopholes to severely damage its utility as a credential.

The SSN equivalent is PAN, not Aadhaar.

The equivalent of a US SSN in India is PAN, the Permanent Account Number issued as a tax identifier, for both individuals and other tax-paying legal persons.

It has been in use for decades prior to Aadhaar.

Correct, and my original draft had several paragraphs attempting to explain this, but this article was going into the print edition of the newspaper where they have a very hard limit on space. All of it got dropped.

Here is my 2017 attempt at articulating it in the context of Aadhaar: https://medium.com/karana/aadhaars-implicit-patriarchy-a0168...

There are a very large number of people from whom biometrics cannot be collected, or cannot be reliably collected (meaning they change rapidly):

1. Newborn babies (who are all issued Aadhaar without biometrics) 2. Children (rapid change) 3. Old people (fading eyes, wrinkled skin) 4. Workers handling harsh materials (smoothened fingertips) 5. Disabled people (missing fingers) 6. Visually impaired (iris scans won't work)

Biometrics are optional in the design of Aadhaar because all these classes have to be accommodated. But in practice? How do you distinguish between "unable to provide biometrics" and "refusing to provide biometrics with fraudulent intent"? Who makes this determination in each case where biometrics are required?

The design of Aadhaar also imagines that the machine is more reliable than the human authority using the machine, so the human does not need be trusted and government can therefore outsource citizen interactions to non-gazetted officials (ie, cheaper for the govt), who no longer have the authority to override the process when biometrics cannot be used.

This destruction of government accountability is the problem. This is the other half of the Aadhaar project. It's not just an innocent technological system, it's one that was explicitly conceived and funded as a way for one ideology within government (neoliberalism) to dismantle an older socialist ideology, without any thought for what happens to the technologically-excluded.

And what is the post-Aadhaar loss? Nobody knows, because there's no accounting. We're still in the "don't allow critical examination of Aadhaar" era of this regime.

Also, I got my COVID-19 vaccination without Aadhaar. It wasn't asked anywhere. I'm not sure what you're referring to as a connection between them.

The article doesn't make an argument around biometrics. Biometrics are needed even for getting a passport or registering a property purchase, but notice how those are never brought up in any argument around Aadhaar's use of biometrics, whether arguing for or against.

Procedural speed-ups are not because of the technology of Aadhaar, but because of the regulatory regime favouring it. The same fast processes also work without Aadhaar wherever there's been regulatory pushback against mandatory Aadhaar. For instance, video KYC works just fine without Aadhaar, and CKYC with just PAN also does instant KYC.

These are procedural decisions, not technological improvement with Aadhaar. Dig into how it works and you'll find that the technology isn't even where they claim it is.

Not just for privacy, but broken processes and duplicitous technological claims. It doesn't solve the problems that people assume it does. It does solve other problems, which is why there's so much enthusiasm for enforcing it.

But it's hard getting mainstream attention for how these are different sets of problems.

You have one and only one Aadhaar number.

You give it to every service provider that has internal reasons to prevent double sign-up (usually: state sponsored subsidy)

Or if you don’t comply, the service provider will share their entire database with UIDAI (Unique ID Authority of India) and discover your Aadhaar number and add it to your record themselves. This scheme was colourfully marketed as “inorganic seeding” and ran without legal backing for several years.

If an Aadhaar number shows up twice in the database, it is considered a duplicate and the extra entry is deleted from the service provider’s database.

If no Aadhaar number shows up for a customer, it is considered a ghost and that person is also removed from the database. Sample side effects:

1. Several individuals who depended on the state for food grains were now classified as ghosts and died of hunger. The government attempted to dismiss the news as too fantastical to be true.

2. In an experimental case, this was done on a voter database in one state, and two million individuals found they could not vote in the 2019 elections because their voter identification was deleted. The government saved a shitload of money by not bothering to notify these individuals, also in violation of a legal requirement for due process.

Somewhere in the middle of these delightful experiments, they acknowledged that it was a bad idea to allow random service providers to upload their entire customer database, so they stopped the service. This enlightenment conveniently came after every major provider had run through the program once.

Later still, they acknowledged that if a service provider can add an Aadhaar number against a customer’s record without the customer’s consent, then nothing prevented fraud from occurring within the service provider. The solution to this problem was to acknowledge that Aadhaar numbers are confidential, so that an individual is protected from fraud in their name — as long as they manage to keep their number confidential.

Of course, no solution was found for service providers adding random Aadhaar numbers to create new ghosts.

Oh, and incidentally, it is not possible to perform biometric authentication on a dead person, and so it is not possible to mark an Aadhaar holder as deceased. The dead cannot certify their own death, and as RS Sharma — that founding Director General (whose post was later designated as CEO) keeps telling everyone [1][2], Aadhaar numbers were designed to be public and usable only against biometric authentication.

So now by design, Aadhaar numbers are perpetual, valid as long as they are in use, and any service provider can claim to be providing service to any Aadhaar number, and dead people can’t complain about deficient service, which is most convenient for fraudsters. The dead live on as ghosts in the machine.

[1] https://indianexpress.com/article/opinion/columns/aadhaar-in... [2] https://www.thehindu.com/news/national/concept-of-aadhaar-da...

India's equivalent of SSN is PAN, the Permanent Account number, which predates Aadhaar by decades.

DBT is also older than Aadhaar and uses IFSC + account numbers. An Aadhaar layer was added to it, wherein a new mapper from Aadhaar number to IFSC was added, but the additional indirection only creates additional opportunity for error and fraud, as the Airtel Payments Bank fraud demonstrated on a mass scale.

Jio's onboarding of 4G customers was not exclusively based on Aadhaar eKYC. They accepted any valid id, as I personally tested, but somehow Aadhaar propagandists fail to quote the break-up of IDs used.

Please, do a cross-check that you're not citing from propaganda material.

It is designed to be a universal foreign key. The number is supposed to be confidential, but almost no one treats it as such, and the founding CEO of the organisation (since retired) has repeatedly argued in public that the number should be public, and the official policy of regarding it as confidential was a poor compromise made to satisfy privacy critics. Since the architecture is not designed around confidential numbers, there is no actual way to keep it confidential.

Tokenization was promised and implemented in a rush while petitions against Aadhaar were being heard in the Supreme Court in 2018, but the tokens (called "virtual id") are not usable anywhere.

Good sir, if you are required to add an Aadhaar number to an account everywhere, how is it not tracking?

There are now serious proposals to require Aadhaar for social media accounts too.

I made Hasjob and Hasgeek, which are separate, but seeing as how everyone refers to Hasjob as Hasgeek, they're going to be merged in a bit.

All feedback and ideas welcome.

That happens by confiscating the phone. The US fifth amendment doesn't apply in India. Anything on a device isn't safe from a police search.

The technical side of Aadhaar is also incredibly inept. There is several days worth of reading material at https://medium.com/karana.

You seem to have sat through a presentation on Aadhaar. Have you sat through any presentations on corruption? On what basis are you making comparisons with other parts of the world?

The numbers are not generated on the client side. An enrollment packet is, containing biometrics and demographics, for which a number will be generated using biometric deduplication server-side.

The catch: only residents (not citizens) of India are authorised to have a number. Because one person technically cannot have more than one Aadhaar number (reality: ha!), the theory is that a government subsidy database needs one unique Aadhaar number per beneficiary.

This theory breaks down when you enroll an individual who does not need an Aadhaar number because they are not a resident. That number can be misused by another resident to get a second entry into the database, and it's a perfectly legitimate number linked to an Indian phone number that can receive an OTP and behave indistinguishably from a resident.

Fake enrolments are the equivalent of a hack of the US SSN system that would allow anyone anywhere in the world to make an SSN for themselves. What could they possibly do with that?

<3

(Y u no support emoji, HN?)

FWIW, TRAI has no jurisdiction over Facebook and so obviously has not passed any ruling on them. Free Basics has not been banned.

The only thing TRAI has done is banning telecom operators from offering different websites at different prices.

pmarca had no justification to use colonial rhetoric here.

This order makes no mention whatsoever of Free Basics. It merely bans price-based discrimination.

And there is no evidence whatsoever that Free Basics helps bring people online. Even Facebook was unable to find a single person who was new to the internet courtesy FBS. https://medium.com/backchannel/how-india-pierced-facebook-s-...

Here's the order this article is referring to: http://www.trai.gov.in/WriteReadData/WhatsNew/Documents/Regu...

> We need to build a more lasting institution to prepare in advance for future papers, have lists of people it can reach out to, and manage the hidden minutiae required to combat these issues.

Which is exactly what we will do.

Which is why we the volunteers have figured we need to be better prepared for Act 3. Stay tuned.

Facebook claims 11 million supporters. The "vocal subgroup" at SaveTheInternet has only 400k. Who's shouting down whom?

Facebook isn't paying for any of it (apart from the developer screening process and proxy server). They expect their telco partners to bear the expenses, who naturally have no expectation of recovering it from the poor who can't afford to pay, and so don't bother to market the service to them. The telcos market "Free Internet" (and after some backlash "Free Facebook") to urban youth to lure them away from other telcos. FB's own data says 80% of users are switchers, not the newly connected.

Facebook's stated intent is one thing, what's actually happening on the ground is something else.

Said person is an FB employee and director of public policy for India and the region. I guess she and her staff are the only people working out of Delhi, so they took a hotel room. FB's India HQ is down south in Hyderabad.

There is no contact information in those files (there's a bunch of them). Just a date, name and (template) comment. Mostly pointless.