Unpacking Aadhaar: How biometric id for a billion really works
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Jonnalagadda, Kiran
Aadhaar is India's national biometric identity database, with over one billion records comprising fingerprints, iris scans and basic demographic information. It is presented as identity technology, allowing an individual to identify themselves, but also as an identification technology, allowing the state to see an individual, identify fraudulent welfare beneficiaries, and thus realise savings. These claims are not complementary. They are in fact contradictory, compromising each other. If one must be true, the other must somehow be false, and this is the reality of Aadhaar. This talk will demonstrate how Aadhaar's attempt to be a cure for all kinds of ailments has in fact resulted in large scale exclusion and fraud. We will look at a series of design assumptions in Aadhaar's architecture, the gaps in them, and then examples of how these gaps were exploited, from public news reports. Aadhaar is often touted as a revolutionary technology that has simultaneously given identity to billions and realised substantial savings from fraud for the government. These utopian visions are finding buyers around the world. Jamaica, Morocco and Kenya have all adopted projects inspired by Aadhaar, and more countries are following suit. Unfortunately, Aadhaar is not magic, and there is now an urgent need for a sober understanding to be taken worldwide. The Kaarana project began in 2017 as a collaboration between programmers and lawyers, to document architectural assumptions and their impact on human rights. The project's findings were presented as evidence to the Supreme Court of India in 2018, and are acknowledged in a scathing dissent by Justice Chandrachud (September 2018). This dissent was in turn cited by the Supreme Court of Jamaica to shut down a biometric identity program in that country (April 2019). In September 2019, Kaarana member Anand Venkatanarayanan also appeared as a witness in the Supreme Court of Kenya in a petition against Huduma Namba, the Kenyan biometric identity program. We hope that this presentation at CCC will help public interest technologists from around the world prepare for a critical examination of similar programs in their countries.
 The previous talk was overwhelmingly depressing and dealt with CIA illegally spying on people and Julian Assange being under constant surveillance and you think it cannot possibly be worse, but it can because our next speaker is going to tell you about systems for collection of biometric data and digital identities and how they can potentially make lives worse not just for dozens of people but for hundreds of millions of people or billions of people. So let's hear it for Kiran Jano Agadda. Yes unpacking the compromises of Adar and other digital identities inspired by it. Kiran is the founder of Karana Projects, an organization examined in identity programs. So he's going to tell us about the most depressing thing you're going to hear in this room today. Thank you. Thank you Kiran. Thanks everyone I'm glad to be here. So let's get started. Well as always these things start with an origin story. So in the beginning we did not have identity cards everybody knew you by your name or your way of face and then things got a little complicated and we got ID papers and before long this was a meme. Where are we? Okay come on. Technology doesn't like working and it doesn't want to work. Yes. So we are hackers. We like to think all problems can be solved by hacking and a decade ago in 2009 in India some of our kind looked at this ID paper problem and thought there has got to be a better way. I mean why do papers have a life of their own? What happens if we lose your papers? Do you not have identity anymore? What happens if your papers are confiscated? Does that change who you are as a person and how do we think of this in a better way? And so for inspiration you can go back to the voyager spacecraft. When the voyager spacecraft left earth for outer space it carried this image on it. Now this is the aliens edition of showing ID papers. Who are you? Humans. This is good for outer space then why can't we do something like this on earth? And so these people started asking why do you need to see my ID? You can see me. My body is my ID. So this is nice but bodies can't go online and so you need to know somehow extract the soul of your body and take it online and this is not an ideal reference. This is in fact how they think about it and this is the statement that they make explaining how they think about this that your soul your atma can be uploaded into the cloud and then exist online. And how do you do this? Well the approach that they took up was to say collect all your biometrics. They take your photograph, they take your fingerprints, all 10 fingers, they take two iris scans and they give you an agar which means foundation which is supposed to be the foundation of the rest of your life. This is quite literally now how you enter cyberspace in their vision. Now if they want so much data from you what more could they possibly want? And this is something that worried the judge of the Supreme Court of India who went on to ask see well are you going to do this next? At this point you're wondering is this satire or is this science fiction? Well nope the database of the built has 1.25 billion entries in it and this is how they announce that number with a Christmas greeting. So where do they keep this data? As computer programmers we often struggle to explain technical concepts to a non-technical kind of audience and this is sort of what happened in the Supreme Court of India when a case against Aadha was being heard last year. The Atonich general Mr. KK Vinogopal who was 87 years old at that time explained data storage to the justices of the Supreme Court explaining that it is stored behind in a complex that has walls that are 13 feet high and 5 feet thick therefore it is safe. So as you can expect the public phone is very funny and since then 13 foot wall is a meme in India. What are you doing? Well it's behind the 13 foot wall so nothing to worry about. But this isn't your word jokes. So we can go back to Arthuklok who made this statement you know that any sufficiently advanced technology is indistinguishable from magic. Your average person does not understand how technology works so to them technology is magic and this essentially then means that we hackers who understand technology are society's magicians. You got a magic wand, you wave it and problems are solved and this is how people think this is supposed to work but we know better. We actually know how technology works and we do not we know when technology does not work and it is imperative on us to call it out and that's what I'm here for today to explain to you why this technology does not work and what we need to be doing about it. So let's start off with the basics. What does Arthuklok actually collect? This is their rough database structure. They collect biometrics and they collect demographics. In the biometrics they classify them into two components the core biometrics which are your fingerprints and your iris scans are considered extremely confidential data and will never be shared that's the mandate that they offer but your photograph which is also biometric can be shared because it is after all what goes into an identity card. The other part is the demographics. They collect your name, your date of birth if it is known, a lot of people in India do not know when they were born, they are your gender, you can declare yourself as a transsexual that's accepted in the other system and then they collect a postal address and this information is what you submit when you enroll. Your biometrics are then sent for deduplication against the entire database so there are billion plus records in there. If you write enrol today they will compare your biometrics with every single record already in the database to confirm that it's not already enrolled. Now this is a process that takes roughly about 45 days so that's how long it takes for them to confirm that you are a new enroly and you now have another number that's guaranteed unique and anybody can apply. The only requirement is that you physically present in India. The law says you have to be there for 180 days but nobody checks so you can just walk into any other enrollment center sign up and you will have an ID. The number when it is assigned to you is sent to you by post. You do not get notified online and the letter that they give you it looks like this is essentially the way they confirm finally that your address is actually real because if this was your address you're supposed to receive the card and therefore your proof of address is confirmed. This as you can expect is a serious problem for migrant workers who cannot guarantee where they're going to be when the letter arrives but we'll get to that later. So the API set are available. There are three basic APIs. There is a demographic identification API which unfortunately mistakenly called an authentication API even though it's not. In what you do in this API is if you're calling the API you submit an other number and you submit a piece of demographic information like you say this other number and this name do they match and you get a yes or no answer. You do not get any information back or you can do this with a fingerprint authentication. You actually upload a scan fingerprint and another number and say do these things match and you get a yes or no or if you cannot take a fingerprint for whatever reason you can ask for a password to be sent to the phone number that's been registered and you get a six digit number give the number and the other number and say do they match and then you verify that somebody gave you the right one time password and therefore you authenticated into their account. All three of these APIs do not give you any information from the database except there's another one called the electronic know your customer database which is used for ID checks for institutions like banks where you do get the information back but we'll get into that again later. Now if you take just this minimalist API see very little data collection apart from biometrics very little demographic connection and nothing is ever written back outside of the KYC API. So on the basis of this minimalism the unique identification authority of India claims that it cannot be used for surveillance because it does not know anything. This is a public claim that they repeatedly make except for one little detail the other number itself is now a universal foreign key because that's what you use to authenticate with other into some other database and who runs those databases as it turns out it's a government again most of them are run by the government. So if you have a government that is really interested in surveillance and a department of the government runs an ID program which it claims cannot be used for surveillance what should the government do when it really wants to use it for surveillance but they make it mandatory for everything and that gets you a situation where Adar is officially voluntary but in practice mandatory which leads to the next meme in India Adar is voluntarily mandatory. So let's look at what is mandatory for it is mandatory to collect any welfare benefit it is mandatory if you want to pay tax or rather pay a file your tax returns I mean nobody will ever dare say we will not take your tax money. To file your tax return you need Adar if you do not earn enough to file taxes and you collect welfare you need Adar so that's like everybody's covered. To get a birth certificate for a newborn baby you need an Adar for the baby to get a death certificate for someone who's died you need an Adar number for the person who died if you want to get married well both parties have to provide an Adar number and at this point it's like what's left who is it optional for. Now the death certificate part is interesting how do you verify the Adar number of a dead person? You can't take the fingerprints I mean the dead can't consent apart from the fact that your technology will stop working once the body gets cold you can't send a one-time password to a dead person's mobile phone because that's indistinguishable from theft my phone has been stolen and somebody declared me dead I mean is it acceptable? So they in fact do not have any authentication for dead people someone's dead you can't get a death certificate without providing an Adar number and well they didn't sign up for Adar in their lifetime so what are you going to do now? You just submit any random number sometimes you submit your own number sometimes the coroner submits their number and so now what you get here is your first instance of a database that is supposed to be a biometrically secure and authenticated completely failing to do its purpose because this is a use case that was completely not considered okay and this is not unusual okay the apis I just described require a license that license is almost impossible to get so what do most people do? Well they just take an Adar number and put in the database they don't bother to take anything about it so part of what happens here is in the implementation of Adar there is this recurring confusion between three very different concepts identification authentication and authorization okay the fact that you can accept my ID and confirm its legitimate is not the same thing as confirming that I am the holder of their identification and it's not the same thing as me saying I'm okay with you doing something in my name these are three different things okay I'll give an example of where this can go massively wrong in 2017 the telecom regulator issued an order asking telecom companies to authenticate all of their customers to make sure that they were no SIM cards issued to people that they do not know who they were issued to so they forced an exercise across the country asking telecom operators to go find their customers and get them to authenticate with Adar okay telecom companies have become so big in India that they're turning into banks and so this happened with one of them and after this exercise a lot of people started complaining that they were not receiving welfare benefits anymore I mean you authenticated your phone connection and your welfare stopped what happened so this this turned into a bit of a scandal and eventually we discovered what had happened all of them had opened new bank accounts that they did not know existed and the welfare money was going to the new bank account okay here is how much the external fraud was and this is just one telecom operator the telecom operator had obtained a banking license and they were desperate for customers so when you went to authenticate your phone connection they used that authentication as authorization to open a bank account and reroute your subsidy money and you would not even have been aware of that okay and so this scam essentially stole 1.9 billion rupees from 310,000 individuals for one telecom operator alone I think the number is wrong it's not 310,000 it's 3.1 million I'm sorry I'm off by 1 0 so how do you make a mistake this fundamental in your design and for this you have to go back to the what attorney general said you know the same day that he said that it's protected by a 13 foot wall he also went on to explain what the whole point of Adar was and as you can see the assumption made in Adar is that the individual is fraudulent unless they prove that they are not that is the fundamental design assumption of Adar so what it has essentially done is that it's very carefully replaced your rights as a citizen with privileges granted by the state for good behavior and that should have been a violation of the constitution it takes people a while to realize that this is a very subtle change that they made that you were entitled to welfare under the constitution of India and it was the state's responsibility to give it to you if you deserved it but what they did was flip it around and say you have to be the person who proves your legitimacy to receive what is actually due to be you okay and then you have a term for this they call it the self-cleaning database this is a reference I found in a book the first time I found an explanation of how they thought about this so essentially for the state to hold you up your rights requires considerable resources on the part of the state and if the state's running a budget deficit well they're not going to deliver on your rights as they're supposed to and this is the fundamental problem of most developing economies that you may have rights but the state doesn't know to give it to you because they're lacking the capacity so what Adar does to solve the problem is to say well if the state can't do its thing you must do it as a citizen this is your duty as a citizen now to behave like a good citizen and show to the state that you are keeping your data clean this is not a wayward reference while this is an author in a book pointing this out in fact this is how the state explains this in the parliament of India the other system has a mechanism of self-cleaning the data during course of time so what happens when you aren't with people like this if you insist that to collect your subsidies to collect your rations which is food that your rationed food if you want to collect it you must authenticate biometrically and the technology does not work for whatever reason your fingerprints don't scan there is no cell phone connection something else has gone wrong what do you do well it goes to bizarre extents this is a new story where a remote village in India did not have a good mobile connection but somebody discovered that the top of the tree there was an internet connection and so they put a fingerprint scanner on the tree and now you climb up and put your finger there and only then you're given food this is one example but obviously there are lots of these so what happens if we can't do this this is a dive this is a compilation of reports of how many people have died because the technology failed these numbers have been growing fortunately last year the supreme court insisted that if the technology doesn't work it is not the citizen's fault and you must provide an alternative and I don't know what the current numbers are I don't expect they're much better than this it's probably as dismal as it is because the state really has no interest in in upholding rights so ironically enough the database design has no feature for reporting a death their official FAQ says somebody related to has died how do you report it and they say well we don't know how to record a death so just ignore it so what happens to dead people you know we had we start off with this talk of how your soul your asthma is uploaded into the cloud as it turns out now you become a ghost in the system and you continue to exist as a fictional entity in a database because they do not know how to record that you have died this URL has a list of possibilities and problems that arise out of the fact that they do not record a death okay so why are they doing all these things okay and the logical purpose you know what is it supposed to do it's supposed to fix a corruption problem in welfare distribution by ensuring subsidies are not misrouted and delivered to someone who did not deserve a subsidy so the way they do this and this is an employee manual from 2014 this is the next track and the basic idea that is part of the training for government employees is that you must record an ad hoc number for every person in your database so if you got like a hundred million welfare delas welfare recipients you are required to collect a hundred million ad hoc numbers how do you do this one you can go door to door and collect everybody's numbers yeah or you can do what's called an inorganic seeding and they use the term seeding to describe the act of collecting ad hoc numbers so they have what's called an organic seeding where the beneficiary comes to you and says here's my ad hoc number and then they have the inorganic seeding where you take it without their consent okay it's in the manual so they also claim this is foolproof because beneficiaries who are claiming benefits in the names of others such persons will not be able to authenticate themselves after all it you're supposed to do a biometric authentication before you take their name in the database but when you're doing it inorganically you're not doing a biometric authentication and so what happens there is they also point out that it is possible for the government employee to get it wrong and they just you know possibility of life so essentially thumbs up to the state thumbs down to the citizen that's a design okay and of course bullying a person to comply is not the same thing as technology that actually works and fraud exists as a violation of technology itself here's a case where another number was issued to a god okay and the letter was printed it was dispatched and the postman had to return it saying I do not know where to deliver this so how does this happen as it turns out the hackers who built this who are so proud of their biometric deduplication completely forgot about document verification and you can put a real person's fingerprints and upload a picture of a god or a dog or whatever else there have been other numbers issued to cows to trees to gods and nobody checks those documents you can be anybody you feel like you can also get around it but not submitting a biometrics because well there are people who don't have fingers or who don't have eyes or whose eyes one scan and what you do about them so in your technical design you offer a biometric exception all it requires is an enrollment agent who's willing to accept that you have an exception and must feed in the system how many cases of fraud have happened using the exception route nobody knows okay out of the 1.25 billion enrollments that they claim how many of these are fraudulent nobody knows because nobody checks these documents you can get a document in the name of the god if you like now it gets even more bizarre so this is from a news report and this news report very conveniently publish the other number itself which is a 12 digit number up on top okay other numbers are supposed to be confidential like they are like credit card numbers you know if you have the number you can claim to given welfare to someone so you do not publish your number in public so this went out in the press and someone else built on this and got himself a gas connection with subsidies so lord hanuman the god has an other number and also buys cooking gas from the state so this one I could just go on and on with these stories like any manner of fraud you want it's in the system it's been exploited and the ultimate price obviously is if you can steal biometrics itself and that too has happened so this is a case in the state of uter pradesh where the police found a gang trading in stolen biometrics okay there's a little bit of side story over there you know where at the top they refer to them as a gang and then below they become hackers okay and this shift in usage is not innocent they use gang to refer to low intelligence thugs who are operating on the street and then they use the word hackers to refer to people doing a higher level act in this case this part became an extremely interesting story for us to investigate because we discovered how bad the enrollment software itself was when you enroll the enrollment agent is required to first authenticate themselves and then accept an authentication on behalf of the individual who's trying to get enrolled and the enrollment agent's id is used to ensure there is a quality check so you know if there's fraud you know who was the source of the fraud it turns out that the enrollment client is built in java and it's a bunch of jar files and the authentication module is a jar file if you do not want to authenticate you replace the jar file with something else that offers the same api but does not authenticate and that's it you enroll that's the quality of the software so when you bring these issues up with the uid a this is what they do they are the ministry of gunyal every single time you report a story like this and say we have discovered a data breach you've discovered a vulnerability we have discovered something going on well they say well the data that we have in our database is safe is your copy that's stolen yeah it's effectively this the cidr is the central identities repository and the cidr remains safe and secure nobody has managed to break in nobody can use your other number without authentication official response every single time you report a problem like this yeah it's gotten so bad that the former boss of uid a is a man named ram sevak sharma who's currently the chairman of the telecom regulatory authority issued a public challenge saying hack me i guarantee you you cannot now this is incitement to a criminal act yeah it is also a violation of the law to publish your own other number but he's the boss he does it nobody says anything to him you know and it's a statement of his privilege more than anything else so he went on to promise that he will not take action against anyone who hacks him but how the hell does a private citizen offer you immunity against a criminal act so obviously nobody took him on and he went on to declare victory and all we could do was make cartoons yes we did this literally was the only way to respond to a provocation like that so once again you have to stop and ask how is it possible for such utter incompetence to come out of a democracy i mean democracy is supposed to have checks and balances that prevent this kind of thing from happening how did this happen and one way to understand it is maybe other was never about welfare at all maybe it was never about giving people identity maybe it was always about the state wanting to make it convenient to identify people and once you look at the timeline of adhah where did this project come from how did how did you create a project that goes on to enroll a billion people i mean it can't happen just because people voluntarily came and said i love it i'm signing up yeah it had to be forced on them what forces them to do it so the larger timeline is this completely apart from where this came from and it goes back to 1999 there was a year when india went to war with pakistan over a conflict in a region called kargil in the state of jamun kashmir and what the government of india figured is some people from pakistan came into india passed off as indian citizens and caused this to happen and so you can't let this happen you can't let this happen you can't have non-indians wandering around the streets of india how are you going to stop them well so the government's solution was well we're just going to integrate every single resident of this country and find out if they're indian or not so they called this project the national population register it was meant to be a database of every single citizen of india this is after the 1999 incident not recently and then they had a second project called the national registry of citizens where you take the npr data and go back and integrate everyone and say are you indian or not okay with all 1.2 or 1.3 billion people and then they lost elections so 2004 they lose elections the project basically doesn't move forward and the new government appoints a technocrat who gives it a new marketing spin saying look this is not about surveillance at all this is about welfare and we're going to make people's lives better and he goes on to create a fairly fantastic media profile to the point where the economist does pr for him you saw what goes wrong with other everything that goes wrong and this is the economist last week essentially saying africa should import this from india it's economist you can look it up so you have one pr campaign running like this about how it's all for welfare and you have the government that sponsored this pr campaign who went on to lose elections again and the party that originally created a surveillance database in 1999 is back in power now since 2014 and they're back on the original agenda and so this month they passed what's called the citizenship amendment act which provides a path to citizenship of india if you are from pakistan bangladesh or afghanistan and you're not a muslim that's the condition the bill explicitly excludes muslims from citizenship of india now this is very clearly a violation of the constitution of india in fact article 14 which is the shirt i'm wearing here this is my protest shirt essentially says that the state shall not deny equality before the law or equal access to the law to anybody in the jurisdiction of india it is not restricted to citizens it is applicable to all persons and the act that has just been passed is a violation of the constitution now we have a majority in government they can do what they please because there is literally no opposition to stop them which leaves it up to the people and as a result of this they have been protest all over india for the last month sample of news reports they have been millions of people on the streets of india of walking around asking for protest most people have not figured out that this is actually based on adar because adar is the marketing term for the project that is meant to survey and separate the people of india into citizens and non-citizens based on their religion so this is very dense this is from protest yesterday morning thank you Kiran we have some time for questions so please line up behind the microphones and we also have signal angels who will pass on the questions from the internet and we're going to take one right now where are any data leaks when the guy posted his number on twitter well there have been multiple data leaks uh i'll point you to a fairly interesting one the chairman of the ui di mr nandan lekin thought so little about data leaks that he published his adar number online many years ago and after subsequently being told that maybe this is not the best idea for you as a chairman of the entity to leak your own number he finally deleted it but the internet never forgets and you can find this on stack overflow today so you just go to stack overflow search for nandan lekin he will find his adar number consequences of leaks yes in fact the estimate of the total number of adar numbers that are leaked in public is well past 200 million thank you microphone number two please yeah first of all thanks for the talk i think that um civil registry and and public databases or public service databases of uh of citizens um are definitely a topic that we should discuss here more um the problem with this one is is very very obvious uh but but i'd like just to mention that many of the privileges that that we as a community uh being grown up in a western uh let's say um stable democracy we derive from having a birth certificate and being able to get an identity even if it's just one in paper and there is a question coming right yeah so i would i would like to ask one one thing yes why don't they use the paper that is being sent out as sort of an identification thing like like we have with our id cards for a simple reason that um they really believe in this vision and they do not want people using paper cards yeah but also in terms of um was this the first ID because you know india doesn't have comprehensive birth registration um the ui da answered this question under the right to information act which is like the equivalent of the us freedom of information access and in 2015 they explained how many times how many enrollments happened against other documents versus the person not having any documents at all and the person taste level was 99.5 percent had at least two documents proving their id okay so this idea that it gave id to people who do not have one is completely false as per their own admission thank you microphone number one uh do you generally oppose um the idea of a central identification number or just the implementation by a flailing state like india that's a slightly lower question yes so the state always makes a huge difference you know the quality of the institutions of a state make a huge difference i was in fact having a discussion with someone here yesterday who pointed out that distrust in centralized id seems to be a common wealth phenomenon yeah the uk doesn't have one the us doesn't have one but germany seems to have one um and most civil law jurisdictions seem to be okay with the idea of centralized id as long as it's well regulated so yes so the nature of government makes a huge difference and i would say i can't speak of the technology of whether it's being good or bad separate from whether the governance of it is good or bad thank you microphone number two hi karen thanks a lot for the talk um if i'm not wrong a few months ago maybe a year ago i read about this um big democracy event going on in india um now there is a few countries that are considering using id for elections to avoid fraud and all the sort of things and i come from a country that has been trying really hard to implement an id system that is reliable and it helps to combat fraud in elections do you think this id system can be somehow reformed to make the whole democracy process easier in india we have a case study of this fortunately so i don't know to speak from theory so in india we had a state called andhra padish which split into two separate states so now they're called andhra position talangana and part of what happens when you split a state is that now you have separate elections for each state and so you need to know who the voters of your state will now be in the new state you know previously you had one voter database for your entire state now you have two separate voter databases and you need to know which person is in which state so for the process of separating the database they went ahead and collected other numbers and ended up deleting a significant fraction of the voter database because they couldn't prove that they were residents of the state okay asam is a different story so the andhra position talangana story is particularly illustrative of how if you think you can bring in a technological solution you probably are going to make it worse in fact you're guaranteed going to make it worse thank you kiran jono agada a round of applause you
 The previous talk was overwhelmingly depressing and dealt with CIA illegally spying on people  and Julian Assange being under constant surveillance and you think it cannot possibly be worse,  but it can because our next speaker is going to tell you about systems for collection of  biometric data and digital identities and how they can potentially make lives worse not just  for dozens of people but for hundreds of millions of people or billions of people. So let's hear it  for Kiran Jano Agadda. Yes unpacking the compromises of Adar and other digital identities  inspired by it. Kiran is the founder of Karana Projects, an organization examined in identity  programs. So he's going to tell us about the most depressing thing you're going to hear in this room  today. Thank you. Thank you Kiran. Thanks everyone I'm glad to be here. So let's get started. Well  as always these things start with an origin story. So in the beginning we did not have identity cards  everybody knew you by your name or your way of face and then things got a little complicated  and we got ID papers and before long this was a meme. Where are we? Okay come on.  Technology doesn't like working and it doesn't want to work. Yes.  So we are hackers. We like to think all problems can be solved by hacking and a decade ago in 2009  in India some of our kind looked at this ID paper problem and thought there has got to be a better  way. I mean why do papers have a life of their own? What happens if we lose your papers? Do you not  have identity anymore? What happens if your papers are confiscated? Does that change who you are as a  person and how do we think of this in a better way? And so for inspiration you can go back to the  voyager spacecraft. When the voyager spacecraft left earth for outer space it carried this image on it.  Now this is the aliens edition of showing ID papers. Who are you? Humans. This is good for  outer space then why can't we do something like this on earth? And so these people started asking  why do you need to see my ID? You can see me. My body is my ID. So this is nice but bodies can't go  online and so you need to know somehow extract the soul of your body and take it online and this  is not an ideal reference. This is in fact how they think about it and this is the statement that  they make explaining how they think about this that your soul your atma can be uploaded into the  cloud and then exist online. And how do you do this? Well the approach that they took up was to say  collect all your biometrics. They take your photograph, they take your fingerprints, all  10 fingers, they take two iris scans and they give you an agar which means foundation which is supposed  to be the foundation of the rest of your life. This is quite literally now how you enter cyberspace  in their vision. Now if they want so much data from you what more could they possibly want?  And this is something that worried the judge of the Supreme Court of India who went on to ask  see well are you going to do this next? At this point you're wondering is this satire or is this  science fiction? Well nope the database of the built has 1.25 billion entries in it and this is  how they announce that number with a Christmas greeting. So where do they keep this data?  As computer programmers we often struggle to explain technical concepts to a non-technical  kind of audience and this is sort of what happened in the Supreme Court of India when a case against  Aadha was being heard last year. The Atonich general Mr. KK Vinogopal who was 87 years old at  that time explained data storage to the justices of the Supreme Court explaining that it is stored  behind in a complex that has walls that are 13 feet high and 5 feet thick therefore it is safe.  So as you can expect the public phone is very funny and since then 13 foot wall is a meme in  India. What are you doing? Well it's behind the 13 foot wall so nothing to worry about.  But this isn't your word jokes. So we can go back to Arthuklok who made this statement you know that  any sufficiently advanced technology is indistinguishable from magic. Your average person  does not understand how technology works so to them technology is magic  and this essentially then means that we hackers who understand technology are society's magicians.  You got a magic wand, you wave it and problems are solved and this is how people think this is  supposed to work but we know better. We actually know how technology works and we do not we know  when technology does not work and it is imperative on us to call it out and that's what I'm here for  today to explain to you why this technology does not work and what we need to be doing about it.  So let's start off with the basics. What does Arthuklok actually collect? This is their rough  database structure. They collect biometrics and they collect demographics. In the biometrics they  classify them into two components the core biometrics which are your fingerprints and your  iris scans are considered extremely confidential data and will never be shared that's the mandate  that they offer but your photograph which is also biometric can be shared because it is after all  what goes into an identity card. The other part is the demographics. They collect your name,  your date of birth if it is known, a lot of people in India do not know when they were born,  they are your gender, you can declare yourself as a transsexual that's accepted in the other system  and then they collect a postal address and this information is what you submit when you enroll.  Your biometrics are then sent for deduplication against the entire database so there are billion  plus records in there. If you write enrol today they will compare your biometrics with every single  record already in the database to confirm that it's not already enrolled. Now this is a process  that takes roughly about 45 days so that's how long it takes for them to confirm that you are a new  enroly and you now have another number that's guaranteed unique and anybody can apply. The  only requirement is that you physically present in India. The law says you have to be there for  180 days but nobody checks so you can just walk into any other enrollment center sign up and you  will have an ID. The number when it is assigned to you is sent to you by post. You do not get  notified online and the letter that they give you it looks like this is essentially the way  they confirm finally that your address is actually real because if this was your address you're  supposed to receive the card and therefore your proof of address is confirmed. This as you can  expect is a serious problem for migrant workers who cannot guarantee where they're going to be  when the letter arrives but we'll get to that later. So the API set are available. There are three  basic APIs. There is a demographic identification API which unfortunately mistakenly called an  authentication API even though it's not. In what you do in this API is if you're calling the API  you submit an other number and you submit a piece of demographic information like you say this other  number and this name do they match and you get a yes or no answer. You do not get any information  back or you can do this with a fingerprint authentication. You actually upload a scan  fingerprint and another number and say do these things match and you get a yes or no or if you  cannot take a fingerprint for whatever reason you can ask for a password to be sent to the phone  number that's been registered and you get a six digit number give the number and the other number  and say do they match and then you verify that somebody gave you the right one time password  and therefore you authenticated into their account. All three of these APIs do not give you any  information from the database except there's another one called the electronic know your  customer database which is used for ID checks for institutions like banks where you do get the  information back but we'll get into that again later. Now if you take just this minimalist API  see very little data collection apart from biometrics very little demographic connection  and nothing is ever written back outside of the KYC API. So on the basis of this minimalism  the unique identification authority of India claims that it cannot be used for surveillance  because it does not know anything. This is a public claim that they repeatedly make  except for one little detail the other number itself is now a universal foreign key because  that's what you use to authenticate with other into some other database and who runs those databases  as it turns out it's a government again most of them are run by the government.  So if you have a government that is really interested in surveillance  and a department of the government runs an ID program which it claims cannot be used for  surveillance what should the government do when it really wants to use it for surveillance  but they make it mandatory for everything and that gets you a situation where Adar is officially  voluntary but in practice mandatory which leads to the next meme in India Adar is voluntarily mandatory.  So let's look at what is mandatory for it is mandatory to collect any welfare benefit  it is mandatory if you want to pay tax or rather pay a file your tax returns I mean nobody will  ever dare say we will not take your tax money. To file your tax return you need Adar if you do not  earn enough to file taxes and you collect welfare you need Adar so that's like everybody's covered.  To get a birth certificate for a newborn baby you need an Adar for the baby to get a death  certificate for someone who's died you need an Adar number for the person who died if you  want to get married well both parties have to provide an Adar number and at this point it's like  what's left who is it optional for. Now the death certificate part is interesting  how do you verify the Adar number of a dead person?  You can't take the fingerprints I mean the dead can't consent  apart from the fact that your technology will stop working once the body gets cold  you can't send a one-time password to a dead person's mobile phone because that's indistinguishable  from theft my phone has been stolen and somebody declared me dead I mean is it acceptable? So  they in fact do not have any authentication for dead people someone's dead you can't get a death  certificate without providing an Adar number and well they didn't sign up for Adar in their lifetime  so what are you going to do now? You just submit any random number sometimes you submit your own  number sometimes the coroner submits their number and so now what you get here is your first instance  of a database that is supposed to be a biometrically secure and authenticated completely failing to do  its purpose because this is a use case that was completely not considered okay and this is not  unusual okay the apis I just described require a license that license is almost impossible to get  so what do most people do? Well they just take an Adar number and put in the database  they don't bother to take anything about it so part of what happens here is in the implementation  of Adar there is this recurring confusion between three very different concepts identification  authentication and authorization okay the fact that you can accept my ID and confirm its legitimate  is not the same thing as confirming that I am the holder of their identification  and it's not the same thing as me saying I'm okay with you doing something in my name  these are three different things okay I'll give an example of where this can go massively wrong  in 2017 the telecom regulator issued an order asking telecom companies to authenticate all of  their customers to make sure that they were no SIM cards issued to people that they do not know  who they were issued to so they forced an exercise across the country asking telecom operators to go  find their customers and get them to authenticate with Adar okay telecom companies have become so  big in India that they're turning into banks and so this happened with one of them and after this  exercise a lot of people started complaining that they were not receiving welfare benefits anymore  I mean you authenticated your phone connection and your welfare stopped what happened  so this this turned into a bit of a scandal and eventually we discovered  what had happened all of them had opened new bank accounts that they did not know existed and the  welfare money was going to the new bank account okay here is how much the external fraud was and  this is just one telecom operator the telecom operator had obtained a banking license and  they were desperate for customers so when you went to authenticate your phone connection  they used that authentication as authorization to open a bank account and reroute your subsidy money  and you would not even have been aware of that okay and so this scam essentially stole 1.9 billion  rupees from 310,000 individuals for one telecom operator alone  I think the number is wrong it's not 310,000 it's 3.1 million I'm sorry I'm off by 1 0  so how do you make a mistake this fundamental in your design  and for this you have to go back to the what attorney general said you know the same day that  he said that it's protected by a 13 foot wall he also went on to explain what the whole point of  Adar was and as you can see the assumption made in Adar is that the individual is fraudulent  unless they prove that they are not that is the fundamental design assumption of Adar  so what it has essentially done is that it's very carefully replaced your rights as a citizen  with privileges granted by the state for good behavior  and that should have been a violation of the constitution  it takes people a while to realize that this is a very subtle change that they made that you were  entitled to welfare under the constitution of India and it was the state's responsibility to  give it to you if you deserved it but what they did was flip it around and say you have to be the  person who proves your legitimacy to receive what is actually due to be you okay and then  you have a term for this they call it the self-cleaning database this is a reference I found in a book  the first time I found an explanation of how they thought about this so essentially for the state  to hold you up your rights requires considerable resources on the part of the state and if the  state's running a budget deficit well they're not going to deliver on your rights as they're supposed  to and this is the fundamental problem of most developing economies that you may have rights  but the state doesn't know to give it to you because they're lacking the capacity so what  Adar does to solve the problem is to say well if the state can't do its thing you must do it as a  citizen this is your duty as a citizen now to behave like a good citizen and show to the state  that you are keeping your data clean this is not a wayward reference while this is an author in  a book pointing this out in fact this is how the state explains this in the parliament of India  the other system has a mechanism of self-cleaning the data during course of time  so what happens when you aren't with people like this  if you insist that to collect your subsidies to collect your rations which is food that your  rationed food if you want to collect it you must authenticate biometrically and the technology  does not work for whatever reason your fingerprints don't scan there is no cell phone connection  something else has gone wrong what do you do well it goes to bizarre extents this is a new  story where a remote village in India did not have a good mobile connection but somebody  discovered that the top of the tree there was an internet connection and so they put a fingerprint  scanner on the tree and now you climb up and put your finger there and only then you're given food  this is one example but obviously there are lots of these  so what happens if we can't do this  this is a dive this is a compilation of reports of how many people have died because the technology  failed these numbers have been growing fortunately last year the supreme court  insisted that if the technology doesn't work it is not the citizen's fault and you must provide an  alternative and I don't know what the current numbers are I don't expect they're much better  than this it's probably as dismal as it is because the state really has no interest in  in upholding rights so ironically enough the database design has no feature for reporting  a death their official FAQ says somebody related to has died how do you report it  and they say well we don't know how to record a death so just ignore it  so what happens to dead people you know we had we start off with this talk of how your soul your  asthma is uploaded into the cloud as it turns out now you become a ghost in the system and you  continue to exist as a fictional entity in a database because they do not know how to record  that you have died this URL has a list of possibilities and problems that arise out of  the fact that they do not record a death okay so why are they doing all these things okay and the  logical purpose you know what is it supposed to do it's supposed to fix a corruption problem in  welfare distribution by ensuring subsidies are not misrouted and delivered to someone who did not  deserve a subsidy so the way they do this and this is an employee manual from 2014  this is the next track and the basic idea that is part of the training for government employees  is that you must record an ad hoc number for every person in your database  so if you got like a hundred million welfare delas welfare recipients you are required to  collect a hundred million ad hoc numbers how do you do this one you can go door to door and collect  everybody's numbers yeah or you can do what's called an inorganic seeding and they use the term  seeding to describe the act of collecting ad hoc numbers so they have what's called an organic  seeding where the beneficiary comes to you and says here's my ad hoc number and then they have  the inorganic seeding where you take it without their consent okay it's in the manual so  they also claim this is foolproof because beneficiaries who are claiming benefits in the  names of others such persons will not be able to authenticate themselves after all it you're  supposed to do a biometric authentication before you take their name in the database  but when you're doing it inorganically you're not doing a biometric authentication  and so what happens there is they also point out that it is possible for the government  employee to get it wrong and they just you know possibility of life  so essentially thumbs up to the state thumbs down to the citizen that's a design  okay and of course bullying a person to comply is not the same thing as technology that actually  works and fraud exists as a violation of technology itself here's a case where another number was  issued to a god okay and the letter was printed it was dispatched and the postman had to return  it saying I do not know where to deliver this so how does this happen as it turns out the  hackers who built this who are so proud of their biometric deduplication completely forgot about  document verification and you can put a real person's fingerprints and upload a picture of a god  or a dog or whatever else there have been other numbers issued to cows to trees to gods  and nobody checks those documents you can be anybody you feel like  you can also get around it but not submitting a biometrics because well there are people who  don't have fingers or who don't have eyes or whose eyes one scan and what you do about them  so in your technical design you offer a biometric exception all it requires is an enrollment agent  who's willing to accept that you have an exception and must feed in the system  how many cases of fraud have happened using the exception route nobody knows okay out of the 1.25  billion enrollments that they claim how many of these are fraudulent nobody knows because nobody  checks these documents you can get a document in the name of the god if you like now it gets even  more bizarre so this is from a news report and this news report very conveniently publish the  other number itself which is a 12 digit number up on top okay other numbers are supposed to be  confidential like they are like credit card numbers you know if you have the number you can claim to  given welfare to someone so you do not publish your number in public so this went out in the press  and someone else built on this and got himself a gas connection with subsidies so lord hanuman  the god has an other number and also buys cooking gas from the state  so this one I could just go on and on with these stories like any manner of fraud you want it's in  the system it's been exploited and the ultimate price obviously is if you can steal biometrics  itself and that too has happened so this is a case in the state of uter pradesh where the police  found a gang trading in stolen biometrics okay there's a little bit of side story over there  you know where at the top they refer to them as a gang and then below they become hackers  okay and this shift in usage is not innocent they use gang to refer to low intelligence  thugs who are operating on the street and then they use the word hackers to refer to people doing a  higher level act in this case this part became an extremely interesting story for us to investigate  because we discovered how bad the enrollment software itself was when you enroll the enrollment  agent is required to first authenticate themselves and then accept an authentication on behalf of  the individual who's trying to get enrolled and the enrollment agent's id is used to ensure  there is a quality check so you know if there's fraud you know who was the source of the fraud  it turns out that the enrollment client is built in java and it's a bunch of jar files  and the authentication module is a jar file if you do not want to authenticate you replace  the jar file with something else that offers the same api but does not authenticate and that's it  you enroll that's the quality of the software so when you bring these issues up with the uid a  this is what they do they are the ministry of gunyal every single time you report a story like  this and say we have discovered a data breach you've discovered a vulnerability we have discovered  something going on well they say well the data that we have in our database is safe is your copy  that's stolen yeah it's effectively this the cidr is the central identities repository  and the cidr remains safe and secure nobody has managed to break in nobody can use your other  number without authentication official response every single time you report a problem like this  yeah it's gotten so bad that the former boss of uid a is a man named ram sevak sharma who's  currently the chairman of the telecom regulatory authority issued a public challenge saying hack me  i guarantee you you cannot now this is incitement to a criminal act  yeah it is also a violation of the law to publish your own other number  but he's the boss he does it nobody says anything to him you know and it's a statement of his  privilege more than anything else so he went on to promise that he will not take action against  anyone who hacks him but how the hell does a private citizen offer you immunity against a criminal act  so obviously nobody took him on and he went on to declare victory and all we could do was make  cartoons yes we did this literally was the only way to respond to a provocation like that  so once again you have to stop and ask how is it possible for such utter incompetence to come out  of a democracy i mean democracy is supposed to have checks and balances that prevent this kind  of thing from happening how did this happen and one way to understand it is maybe other was never  about welfare at all maybe it was never about giving people identity maybe it was always about  the state wanting to make it convenient to identify people and once you look at the timeline of  adhah where did this project come from how did how did you create a project that goes on to enroll  a billion people i mean it can't happen just because people voluntarily came and said i love it i'm  signing up yeah it had to be forced on them what forces them to do it so the larger timeline is  this completely apart from where this came from and it goes back to 1999 there was a year when  india went to war with pakistan over a conflict in a region called kargil in the state of jamun  kashmir and what the government of india figured is some people from pakistan came into india  passed off as indian citizens and caused this to happen and so you can't let this happen you can't  let this happen you can't have non-indians wandering around the streets of india how are you going to  stop them well so the government's solution was well we're just going to integrate every single  resident of this country and find out if they're indian or not so they called this project the  national population register it was meant to be a database of every single citizen of india this  is after the 1999 incident not recently and then they had a second project called the national  registry of citizens where you take the npr data and go back and integrate everyone and say are you  indian or not okay with all 1.2 or 1.3 billion people and then they lost elections so 2004  they lose elections the project basically doesn't move forward and the new government appoints a  technocrat who gives it a new marketing spin saying look this is not about surveillance at all this  is about welfare and we're going to make people's lives better and he goes on to create a fairly  fantastic media profile to the point where the economist does pr for him you saw what  goes wrong with other everything that goes wrong and this is the economist last week  essentially saying africa should import this from india  it's economist you can look it up so you have one pr campaign running like this about how it's  all for welfare and you have the government that sponsored this pr campaign who went on to lose  elections again and the party that originally created a surveillance database in 1999 is back  in power now since 2014 and they're back on the original agenda and so this month they passed  what's called the citizenship amendment act which provides a path to citizenship of india  if you are from pakistan bangladesh or afghanistan and you're not a muslim  that's the condition the bill explicitly excludes muslims from citizenship of india  now this is very clearly a violation of the constitution of india in fact article 14 which  is the shirt i'm wearing here this is my protest shirt essentially says that the state shall not  deny equality before the law or equal access to the law to anybody in the jurisdiction of india  it is not restricted to citizens it is applicable to all persons and the act that has just been  passed is a violation of the constitution now we have a majority in government they can do  what they please because there is literally no opposition to stop them which leaves it up to  the people and as a result of this they have been protest all over india for the last month  sample of news reports they have been millions of people on the streets of india of walking around  asking for protest most people have not figured out that this is actually based on adar because  adar is the marketing term for the project that is meant to survey and separate the people of india  into citizens and non-citizens based on their religion  so this is very dense this is from protest yesterday morning  thank you Kiran we have some time for questions so please line up behind the microphones  and we also have signal angels who will pass on the questions from the internet and we're going  to take one right now where are any data leaks when the guy posted his number on twitter  well there have been multiple data leaks uh i'll point you to a fairly interesting one  the chairman of the ui di mr nandan lekin thought so little about data leaks that he  published his adar number online many years ago and after subsequently being told that  maybe this is not the best idea for you as a chairman of the entity to leak your own number  he finally deleted it but the internet never forgets and you can find this on stack overflow  today so you just go to stack overflow search for nandan lekin he will find his adar number  consequences of leaks yes in fact the estimate of the total number of adar numbers that are  leaked in public is well past 200 million thank you microphone number two please yeah first of all  thanks for the talk i think that um civil registry and and public databases or public service databases  of uh of citizens um are definitely a topic that we should discuss here more um the problem with  this one is is very very obvious uh but but i'd like just to mention that many of the privileges  that that we as a community uh being grown up in a western uh let's say um stable democracy  we derive from having a birth certificate and being able to get an identity even if it's just  one in paper and there is a question coming right yeah so i would i would like to ask one one thing  yes why don't they use the paper that is being sent out as sort of an identification thing like like  we have with our id cards for a simple reason that um they really believe in this vision  and they do not want people using paper cards yeah but also in terms of um was this the first  ID because you know india doesn't have comprehensive birth registration um the ui da answered this  question under the right to information act which is like the equivalent of the us freedom of  information access and in 2015 they explained how many times how many enrollments happened  against other documents versus the person not having any documents at all and the person  taste level was 99.5 percent had at least two documents proving their id  okay so this idea that it gave id to people who do not have one is completely false as per  their own admission thank you microphone number one uh do you generally oppose um the idea of a  central identification number or just the implementation by a flailing state like india  that's a slightly lower question yes so the state always makes a huge difference you know the  quality of the institutions of a state make a huge difference i was in fact having a discussion  with someone here yesterday who pointed out that distrust in centralized id seems to be a common  wealth phenomenon yeah the uk doesn't have one the us doesn't have one but germany seems to have one  um and most civil law jurisdictions seem to be okay with the idea of centralized id as long as  it's well regulated so yes so the nature of government makes a huge difference and i would say  i can't speak of the technology of whether it's being good or bad separate from whether the  governance of it is good or bad thank you microphone number two hi karen thanks a lot for the talk  um if i'm not wrong a few months ago maybe a year ago i read about this um big democracy event going  on in india um now there is a few countries that are considering using id for elections to avoid  fraud and all the sort of things and i come from a country that has been trying really hard to  implement an id system that is reliable and it helps to combat fraud in elections do you think this  id system can be somehow reformed to make the whole democracy process easier in india  we have a case study of this fortunately so i don't know to speak from theory  so in india we had a state called andhra padish which split into two separate states so now they're  called andhra position talangana and part of what happens when you split a state is that now you have  separate elections for each state and so you need to know who the voters of your state will now be  in the new state you know previously you had one voter database for your entire state now you have  two separate voter databases and you need to know which person is in which state so for the process  of separating the database they went ahead and collected other numbers and ended up deleting  a significant fraction of the voter database because they couldn't prove that they were residents  of the state okay asam is a different story so the andhra position talangana story is particularly  illustrative of how if you think you can bring in a technological solution you probably are going  to make it worse in fact you're guaranteed going to make it worse thank you kiran jono agada  a round of applause  you
36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_0_2099.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_2100_2363.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_2364_5027.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_5028_8339.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_8340_17747.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_17748_22007.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_22008_25187.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_25188_28115.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_28116_28391.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_28392_30599.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_30600_35015.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_35016_35723.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_35724_35855.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_35856_37043.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_37044_42671.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_42672_43739.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_43740_44171.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_44172_44543.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_44544_44639.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_44640_46763.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_46764_49007.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_49008_49211.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_49212_55283.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_55284_57143.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_57144_57227.png 36c3-10885-eng-deu-fra-Unpacking_the_compromises_of_Aadhaar_and_other_digital_identities_inspired_by_57228_57727.png