Aadhaar is for empowerment, not Big Brother: UIDAI CEO Ajay Bhushan Pandey

'In order for somebody to do Big Brother kind of a job, one has to collect lots of data and Aadhaar collects very minimal data', he said

At a time when civil society and the public at large have raised concerns over the overarching power the government has given to the Aadhaar programme, AJAY BHUSHAN PANDEY, CEO, Unique Identification Authority of India (UIDAI), told Kiran Rathee that the idea of Aadhaar being used as a Big Brother programme for the government to spy on citizens is completely unfounded. Moreover, while some people have been asking to get external agencies to review the security of Aadhaar, Pandey says being a critical state function, it’s better to not “be disclosing all your cards to everybody”. Edited excerpts:

UIDAI is one of the entities in the world which has over a billion users putting the Authority in the league of firms like Google, Apple and Microsoft. Regarding security procedures, these companies do hackathons, involve ethical hackers, and crowd source ideas to further improve security. Is UIDAI also open to do such things?

Unlike all these platforms you have mentioned, though we are also a very large platform, we are performing a very crucial state function for which security is important. We take various possible measures and try to assess all kinds of feedback not only what is coming in media or social media, but also lots of things which may not be appearing in media at all. There may be some people who may be very secretly doing it (to attack UIDAI servers). So what we have to do is and what we are doing is that we are constantly assessing the threats which may be emerging from anywhere be it media or social media or even outside, a completely unknown domain, and we take proactive measures to ensure that such attempts do not at all succeed. The only constraint here is that we do not discuss what kind of threats we get and what are the kinds of counter measures that we take in the interest of security because one of the fundamental principles of the security is that you have to access the risks and you have to take action but at the same time, you should not be disclosing all your cards to everybody.

There have been voices from members of civil society that Aadhaar invades privacy of citizens. What is your take on that?

There could be a misconception among a section of people. What they need to understand is that Aadhaar is an enabler. Aadhaar is for empowerment and it is nowhere going to be a Big Brother or so. It is completely ruled out in the Aadhaar architecture and Aadhaar design and law itself. In order for somebody to do Big Brother kind of a job, one has to collect lots of data. Aadhaar collects very minimal data whether at the time of enrollment or at the time of authentication. Aadhaar collects only the basic demographics like name, age, gender, and biometrics like face, fingerprints and iris. It does not collect the data about a person’s family, eating habits, contact list, income, profession, likes or dislikes, bank account details. Aadhaar does not have that kind of information anywhere in its database. Aadhaar by law is prohibited from asking for such information. Therefore any apprehension of future misuse is also ruled out because asking or collecting such information in future is completely prohibited under the Aadhaar Act and any violation will be dealt with criminal offence. Whoever is responsible for collecting and maintaining such data can be charged criminally. Therefore, the UIDAI maintains the principle of minimal data and optimal ignorance. So when you don’t have data, the question of somebody becoming a Big Brother does not arise.

But with the government linking most of the services such as bank accounts and mobile numbers with Aadhaar, the question of surveillance arises?

Let me give a counter example. Suppose you are giving your mobile number and PAN card at most places. Can the government link all these data just like that? If you have given your mobile number and PAN card to a bank and if you have given your mobile number and PAN card to income tax authorities and you have also given mobile number and PAN card for buying a property. Now that these two numbers are common in these three databases, can the government, without authority of the law, link the three databases? No, the government cannot do this. Let’s suppose the government asks the bank to give a person’s data. Will the bank give? The answer is no because under banking laws it is not allowed and that data will not be given even to the government. Similarly, if your data is held with some department, data has to be used for that purpose only. People have given their PAN card numbers at many places. Was any government able to aggregate the data on the basis of PAN card? The answer is no. The government is not in the business of becoming a Big Brother as India is a strong democratic state where the rule of law is there with strong judicial oversight and free press.

If any government department wants data, it can only ask for it under a due authority of law. For example, if the income tax department wants bank details of a person, then it has to issue a notice under the Income Tax Act saying there is a proceeding to be conducted against the person on the basis of reasonable apprehension of a possible tax evasion and then ask for data. But without any reasonable cause or suspicion, no income tax officer can ask for anyone’s data just because the PAN card is in data. 

If Aadhaar number is given to 10 different authorities that do not automatically mean that the data can be aggregated by anyone. That is not possible. In case of Aadhaar, it will be doubly difficult. For example, if a bank account which is linked with Aadhaar, the banking law and also Aadhaar law will apply on sharing of a customer’s data. So it is double protection.

If some bank unauthroisedly discloses Aadhaar details to other agency, be it a government, then it will be violating law. Any such unlawful disclosure is a criminal offence, punishable with three years’ imprisonment. So with such strong safeguard, the possibility of Aadhaar becoming an instrument of surveillance is completely ruled out. 

There have been instances when the demographic details of Aadhaar have been leaked and made public. Recently, there were reports that Aadhaar demographic details can be bought for a few rupees?

It was not a case of data breach. After all, name, age, gender and address are not secret information. The same information is also available on voter ID cards. The Aadhaar Act says is it sensitive information but it is not secret. Therefore, the Aadhaar Act says even though it is just a basic demographic information such as name, address, etc, even that should not be disclosed without the consent of the Aadhaar holder. But supposing if such demographic information is disclosed, this is not a case of data breach. It would be a case of unauthorised disclosure which is punishable under the Aadhaar Act as well as other laws such as the Information Technology Act, etc. So, we need to understand the difference between unauthorised disclosure and data breach.

There have been instances when biometric authentication did not take place due to worn out fingerprints in old age or hard manual work. What are the other modes of authentication?

We have multiple modes of authentication. If the fingerprint does not work, we have said the iris could be tried and one time password method could be tried. Now we are coming up with face authentication from July 1 where the person’s fingerprint, along with the face, will be used. So even if the fingerprint match score is less, along with the face, the person could be authenticated. Even after all this, if there is an authentication failure, the law provides that a backup mechanism should always be there so that no one should be denied benefits. Instructions have been issued from the Cabinet secretary to all the agencies that nobody is denied of the benefits due to lack of Aadhaar authentication.

In some instances where it was found that a person has been denied benefits, we are advising the state governments to be more vigilant and they need to take action against those who are not following the instructions. In a country of 1.2 billion people if the instructions have been issued and if they are largely complied with, there may be few aberrations, but the whole system should not be discarded. 

Some of the state governments were also collecting biometric data for their own schemes. There must be duplication as Aadhaar data is now used for most of the welfare schemes across the country?

That was a situation prior to Aadhaar but now most of the state agencies have stopped collecting biometrics and they are relying on Aadhaar authentication. The data which the state governments collected was in their domain and our biometrics are quite different and encrypted in different manner. 

Various fintech companies have approached UIDAI to revoke access to agencies that provide e-KYC verification and authentication services for them?

UIDAI has not barred anyone. All the agencies which are there with us they continue to operate services. What we have done is that we are asking them to follow provisions under the Aadhaar Act strictly and they should not share data with anyone else, even the basic demographic data should not be shared. 

Aadhaar has been given to 1.2 billion people. They will need to establish their identity to get hassle-free services not only from the government, but also from various private bodies. So certain safeguards have to be there because we don’t want Aadhaar number to proliferate at various places like the mobile number. For that we are bringing this virtual ID and also now offline verification through the QR code.

Given the concerns regarding privacy, is Aadhaar open to some third-party audit of the security system?

What kind of audit we are talking about. See we live in a parliamentary democracy. The Aadhaar Act provides for certain security audit from Standardisation Testing and Quality Certification (STQC), then we have CAG audit and there is also the parliamentary oversight. With all these safeguards, the question is which third-party we are talking about. The question is Aadhaar is national critical infrastructure where the whole country’s economic activity will depend, to that extent whatever is necessary, the Parliament in its wisdom has decided that UIDAI will be audited in this way, so best thing is to confine ourselves to that kind of auditing. Just because some people are saying and therefore we should open this nationally vital critical infrastructure to such use.