Skip to main content
Sabrang
Sabrang
Freedom Politics

Aadhaar Security: The Emperor Has No Clothes

Prabir Purkayastha 19 Jan 2018

Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system.

 
Image Courtesy: The Financial Express
 
Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system. Two recent cases – that reported recently by Tribune and the French security researcher reporting on the novice-level security of the mobile App of Unique Identification Authority of India (UIDAI) – bring out a completely different threat, that of identity theft and therefore, the possibility of attacks from criminals on our bank accounts. Or linking our Aadhaar to their mobile numbers or bank accounts that are involved in criminal activities.

This issue is not simply whether the state has a right to force us to link all our economic, or other activities to our Aadhaar number. But while doing so, is it protecting us from the consequence of linking our Aadhaar number to our bank accounts, mobile numbers and other such things? Or is it laying us open to various criminal threats? Threats to our money, or even to our personal security? It is as if the state is forcing us to have combination lock for entry into our houses, then deposit the combination in a specified data bank with no security, thereby making it easy for criminals to obtain the combinations.

The Tribune reporter – as reported by Tribune and not contested by UIDAI – secured access to the entire personal data of nearly a billion Aadhaar holders by paying just Rs. 500 and within 10 minutes. According to the state authorities quoted by Tribune, there are only two people in Punjab that have the necessary security clearance to access the entire Aadhaar database. That this access was being sold for only Rs. 500, and the access provided within 10 minutes, show how seriously the Aadhaar ecosystem has been compromised.

Even UIDAI conceded that only the biometric data held in a central repository is safe. Its press statements repeatedly emphasised that this part of the Aadhaar database has not been compromised. As yet. By implication, everything else is compromised.

A French security researcher, who investigated the security in the mobile app released by UIDAI for use in our smart phones – showed how weak the security of Aadhar bases systems really is. The security expert, who calls himself Eliot Alderson and uses a twitter handle @fs0c131yJan7, showed that the security in the mAadhaar app which can be downloaded from Google Play store - to be used to provide the Aadhaar details to any service provider who uses Aadhaar based verification- was minimal. It uses code snippets widely available on the net, stores the password on the mobile, the so-called random number generator produces the same number every time. Even more embarrassingly, Khosla Labs, a private players which developed this App for UIDAI, does not seem to know how to generate a proper certificate of ownership - it showed Google and not UIDAI as the owner of this app. According to Alderson, they also appear to have lost the ability of updating their app, and are now releasing new apps in the place of the compromised one.

Aadhaaro120.jpg

The android app developed by Khosla Labs for UIDAI is officially owned by Google, as per their own certificate!

Then Aadhaar security being weak will create a risk if your mobile is lost or stolen. And yes, if you lose your mobile, you are at risk of your bank account being cleaned before you block the mobile. By itself, this risk is not to the entire community of 1 billion Aadhaar holders. It brings out the security in the Aadhaar ecosystem, as exemplified by this code from Khosla Labs, is extremely poor.

Before we think that Khosla Labs is an exception, and the Aadhaar ecosystem security may be better managed - it would be instructive to know the credentials of Khosla Labs. Its three co-founders held important positions in UIDAI - and Srikanth Nadhamuni, one of its three founders, was UIDAI’s Head of Technology.

We are not discussing conflict of interests here. Nor that Khosla Labs is one of the interveners in the Supreme Court Aadhaar case, arguing on the “immense benefits” to the nation from Aadhaar. We are simply pointing out that if an organisation that includes the former head of tech in UIDAI delivers this quality of software for its mAadhaar, how safe is the rest of the Aadhaar ecosystem?

The original vision of the Aadhaar system is that the Aadhaar number is not our identity, the ID is the biometric information that we carry in our finger tips; or our eyes. It was supposed to be our fingerprints and iris data that would verify us. The problem of using biometrics for verification are numerous: from false positives, identifying wrong persons as valid users, and false negatives to failure to verify legitimate Aadhaar holders. This on top of poor connectivity and frequent lack of electricity in our towns and villages that operate computers, the internet and the biometric devices.
Faced with such problems, the authorities decided that biometric verification would be carried out only for the poor, such as ration card holders. For the vast majority of transactions, it is the Aadhaar “card” that is being used as the ID proof. The problem here is that the entire system was supposed to be built on biometric data as ID proof and not the other card. If the Aadhaar card – a duplicate of which can be printed out by anybody for anybody – is to be used for verification, then the system is in a deep crisis. As the system was never supposed to be built using the UID number as our ID proof, that could explain the poor, or non-existent security of the Aadhaar ecosystem for any data, other than the biometric data.

We haven’t even discussed here the risk that we carry when we link our Aadhaar to our bank accounts and phone numbers. How much protection do we have against misuse and hacking by insiders? As the Airtel case showed , any company that demands an Aadhaar for verification, in this case our phone number, can get our “informed consent” by popping up a 5,000 word document asking us to click “I Agree”. Airtel fraudulently used peoples’ “consent” to open 37.21 lakh Airtel Payment bank accounts, and diverted the gas subsidy payments of the customers to these accounts without their knowledge.

The state mandated Aadhaar has created a leaky eco-system that is now a security nightmare. UIDAI is clearly scrambling to restore some credibility to the Aadhaar system after the double hits of last week. It has proposed a virtual ID scheme that can be used for authentication, as well as facial recognition. The problem is that it is too late to use virtual ID schemes. Our Aadhaar number and details, including our bank account information, is already available in databases that have low, or virtually no security. It is like locking the stable door after the horse has bolted.

Facial recognition is hardly a solution. It has failed with Google software identifying images of people with dark skins as gorillas . And Apple identifying all owners of its latest i-Phones in China as the same individual: all Chinese look alike to Apple’s software !

UIDAI has promised the Indian state and its big capital that it will deliver the data of the country’s citizens for surveillance and business purposes. It will replicate the US National Security Agency equivalent by using our Aadhaar data; provide big data of its citizens to combat Google and Facebook; enable financial transactions to Indian fintech companies and banks. All of this on a very weak and shaky foundation.

For those familiar with failing software projects, there is a now sense of desperation in the UIDAI’s responses: from shooting the messenger – filing FIR against Tribune – to clutching at straws. All the measures it is proposing do not address the fundamental issue of a hugely compromised Aadhaar security system, built with public money, and at a huge cost. Can we now take a hard look at whether the Aadhaar project can actually deliver what it has promised? And scale back the Aadhaar project on which we not only continue to throw more money, after the money we have already invested, and more over create huge risks to our citizens? And perhaps to our economy itself?

Courtesy: Newsclick.in

Aadhaar Security: The Emperor Has No Clothes

Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system.

 
Image Courtesy: The Financial Express
 
Most people assume that critics of Aadhaar are concerned about citizens’ fundamental right to privacy, or the loss of statutory benefits such as rations due to a faulty Aadhaar system. Two recent cases – that reported recently by Tribune and the French security researcher reporting on the novice-level security of the mobile App of Unique Identification Authority of India (UIDAI) – bring out a completely different threat, that of identity theft and therefore, the possibility of attacks from criminals on our bank accounts. Or linking our Aadhaar to their mobile numbers or bank accounts that are involved in criminal activities.

This issue is not simply whether the state has a right to force us to link all our economic, or other activities to our Aadhaar number. But while doing so, is it protecting us from the consequence of linking our Aadhaar number to our bank accounts, mobile numbers and other such things? Or is it laying us open to various criminal threats? Threats to our money, or even to our personal security? It is as if the state is forcing us to have combination lock for entry into our houses, then deposit the combination in a specified data bank with no security, thereby making it easy for criminals to obtain the combinations.

The Tribune reporter – as reported by Tribune and not contested by UIDAI – secured access to the entire personal data of nearly a billion Aadhaar holders by paying just Rs. 500 and within 10 minutes. According to the state authorities quoted by Tribune, there are only two people in Punjab that have the necessary security clearance to access the entire Aadhaar database. That this access was being sold for only Rs. 500, and the access provided within 10 minutes, show how seriously the Aadhaar ecosystem has been compromised.

Even UIDAI conceded that only the biometric data held in a central repository is safe. Its press statements repeatedly emphasised that this part of the Aadhaar database has not been compromised. As yet. By implication, everything else is compromised.

A French security researcher, who investigated the security in the mobile app released by UIDAI for use in our smart phones – showed how weak the security of Aadhar bases systems really is. The security expert, who calls himself Eliot Alderson and uses a twitter handle @fs0c131yJan7, showed that the security in the mAadhaar app which can be downloaded from Google Play store - to be used to provide the Aadhaar details to any service provider who uses Aadhaar based verification- was minimal. It uses code snippets widely available on the net, stores the password on the mobile, the so-called random number generator produces the same number every time. Even more embarrassingly, Khosla Labs, a private players which developed this App for UIDAI, does not seem to know how to generate a proper certificate of ownership - it showed Google and not UIDAI as the owner of this app. According to Alderson, they also appear to have lost the ability of updating their app, and are now releasing new apps in the place of the compromised one.

Aadhaaro120.jpg

The android app developed by Khosla Labs for UIDAI is officially owned by Google, as per their own certificate!

Then Aadhaar security being weak will create a risk if your mobile is lost or stolen. And yes, if you lose your mobile, you are at risk of your bank account being cleaned before you block the mobile. By itself, this risk is not to the entire community of 1 billion Aadhaar holders. It brings out the security in the Aadhaar ecosystem, as exemplified by this code from Khosla Labs, is extremely poor.

Before we think that Khosla Labs is an exception, and the Aadhaar ecosystem security may be better managed - it would be instructive to know the credentials of Khosla Labs. Its three co-founders held important positions in UIDAI - and Srikanth Nadhamuni, one of its three founders, was UIDAI’s Head of Technology.

We are not discussing conflict of interests here. Nor that Khosla Labs is one of the interveners in the Supreme Court Aadhaar case, arguing on the “immense benefits” to the nation from Aadhaar. We are simply pointing out that if an organisation that includes the former head of tech in UIDAI delivers this quality of software for its mAadhaar, how safe is the rest of the Aadhaar ecosystem?

The original vision of the Aadhaar system is that the Aadhaar number is not our identity, the ID is the biometric information that we carry in our finger tips; or our eyes. It was supposed to be our fingerprints and iris data that would verify us. The problem of using biometrics for verification are numerous: from false positives, identifying wrong persons as valid users, and false negatives to failure to verify legitimate Aadhaar holders. This on top of poor connectivity and frequent lack of electricity in our towns and villages that operate computers, the internet and the biometric devices.
Faced with such problems, the authorities decided that biometric verification would be carried out only for the poor, such as ration card holders. For the vast majority of transactions, it is the Aadhaar “card” that is being used as the ID proof. The problem here is that the entire system was supposed to be built on biometric data as ID proof and not the other card. If the Aadhaar card – a duplicate of which can be printed out by anybody for anybody – is to be used for verification, then the system is in a deep crisis. As the system was never supposed to be built using the UID number as our ID proof, that could explain the poor, or non-existent security of the Aadhaar ecosystem for any data, other than the biometric data.

We haven’t even discussed here the risk that we carry when we link our Aadhaar to our bank accounts and phone numbers. How much protection do we have against misuse and hacking by insiders? As the Airtel case showed , any company that demands an Aadhaar for verification, in this case our phone number, can get our “informed consent” by popping up a 5,000 word document asking us to click “I Agree”. Airtel fraudulently used peoples’ “consent” to open 37.21 lakh Airtel Payment bank accounts, and diverted the gas subsidy payments of the customers to these accounts without their knowledge.

The state mandated Aadhaar has created a leaky eco-system that is now a security nightmare. UIDAI is clearly scrambling to restore some credibility to the Aadhaar system after the double hits of last week. It has proposed a virtual ID scheme that can be used for authentication, as well as facial recognition. The problem is that it is too late to use virtual ID schemes. Our Aadhaar number and details, including our bank account information, is already available in databases that have low, or virtually no security. It is like locking the stable door after the horse has bolted.

Facial recognition is hardly a solution. It has failed with Google software identifying images of people with dark skins as gorillas . And Apple identifying all owners of its latest i-Phones in China as the same individual: all Chinese look alike to Apple’s software !

UIDAI has promised the Indian state and its big capital that it will deliver the data of the country’s citizens for surveillance and business purposes. It will replicate the US National Security Agency equivalent by using our Aadhaar data; provide big data of its citizens to combat Google and Facebook; enable financial transactions to Indian fintech companies and banks. All of this on a very weak and shaky foundation.

For those familiar with failing software projects, there is a now sense of desperation in the UIDAI’s responses: from shooting the messenger – filing FIR against Tribune – to clutching at straws. All the measures it is proposing do not address the fundamental issue of a hugely compromised Aadhaar security system, built with public money, and at a huge cost. Can we now take a hard look at whether the Aadhaar project can actually deliver what it has promised? And scale back the Aadhaar project on which we not only continue to throw more money, after the money we have already invested, and more over create huge risks to our citizens? And perhaps to our economy itself?

Courtesy: Newsclick.in

Related Articles

Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Theme

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Campaigns

Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Videos

India

Kashmiri Pandit Protest continues for seventh day

Multiple Protests continue, for more than seven days, over Kashmiri Pandit employee Rahul Bhat’s murder in the Valley. Supported by Kashmiri Muslims and Kashmiri Sikhs, the protestors have come forward to accuse the BJP led administration of sending people, who are desperate for jobs, in risky areas with no security and a meagre salary.

India

Kashmiri Pandit Protest continues for seventh day

Multiple Protests continue, for more than seven days, over Kashmiri Pandit employee Rahul Bhat’s murder in the Valley. Supported by Kashmiri Muslims and Kashmiri Sikhs, the protestors have come forward to accuse the BJP led administration of sending people, who are desperate for jobs, in risky areas with no security and a meagre salary.

IN FACT

Analysis

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Archives