"All that is necessary for the triumph of evil is for good men to do nothing".
Edmund Burke
"Among a people generally corrupt liberty cannot long exist".
Edmund Burke
“In matters of conscience, the law of the majority has no place.”
Mahatma Gandhi

"Democracy was the greatest gift of our freedom struggle to the people of India. Independence made the nation free. Democracy made our people free. A free people are a people who are governed by their will and ruled with their consent. A free people are a people who participate in decisions affecting their lives and their destinies".
Rajiv Gandhi
Hi-tech without Panchayati Raj is just a bogus stunt for geeks and nerds."
Mani Shankar Aiyar, Congress leader

Wednesday, December 1, 2010

RAM KRISHNASWAMY & VICKRAM CRISHNA

RAM KRISHNASWAMY & VICKRAM CRISHNA 

Rebuttal on UIDAI- Economic & Political Weekly

 Article no 666 Rebuttal on UIDAI - EPW Article
By: Ram Krishnaswamy, Vickram Crishna
Vol XLV No.40 October 02, 2010

R S Sharma’s “Identity and the UIDAI: A Response” (EPW, 28 August 2010) argues, in response to Usha Ramanathan’s “A Unique Identity Bill” (EPW, 24 July 2010), that “The UIDAI has stated its role and objectives in various public documents, and also outlined these in its draft bill”, but she has “fundamental misunderstandings” on the UIDAI, that her “suggestion of links to the NATGRID/DNA data banks is pure conjecture” and that her article misrepresents the UIDAI’s stated objectives.
 
Sharma has obviously chosen to ignore the increasing number of articles in the media questioning Aadhaar, written by lawyers, economists, technologists, security professionals, sociologists, civil society supporters, scholars, academics and biometric experts, and the list goes on.
 
Does he really imply that everyone who questions Aadhaar is misinformed? The very foundation of “Aadhaar” that assumes “the absence of an identification infrastructure, under which every Indian has a unique identification number, has been one of the biggest barriers for the poor in accessing welfare and social services effectively”, is a sweeping generalisation, unfounded by facts from the field.
 
It is not the needy who possess bogus entitlement cards, but the very public servants in charge, together with other stakeholders and vested interests. Stocks are written off as being issued to all these bogus cards and the foodgrains are sold in the black market, while the remainder unsaleable stocks rot in unprotected warehouses. It is interesting that the whole nation understands this, except, apparently, the people in UIDAI.
 
If there is silence from some sections of the people regarding the UIDAI, it is because of the deliberate misinformation that Aadhaar is aimed at the poor. So the educated and not so poor are under the false belief that it does not affect them.
 
A simple and direct question to Sharma is: will he be the first to accept an Aadhaar, and share the Aadhaar number with his bank, insurance company, passport office, regional transport authority, mobile phone service provider, electricity distributor, ration card issuing authority, Income Tax authority and property registrars?
 
Sharma writes, “When it comes to sharing of data, the UIDAI is of the view that the individual is an active, not a passive participant, and does not need self-appointed spokespeople to debate on their behalf”.
 
The individual that Sharma refers to here represents millions of the poor and illiterate queuing up for subsidised rations. Sharma apparently needs reminding that it was self-appointed spokespeople who stood up to win this nation its independence, finally wrested within three years of the most brutal, callous, deliberate and avoidable choking off of food supplies that left millions dead in Bengal.
 
Ram Krishnaswamy, Vickram Crishna
Mumbai
__________________________________________

25th August 2010
by Ram Krishnaswamy and Vickram Crishna 




Ram Krishnaswamy and Vickram Crishna ask whether the government is justified in allocating such a huge investment on Aadhaar, while there are more important issues to be addressed. This is the third part in a series published only in Moneylife

Why shouldn’t Indians, too, have a single-point identity reference, available on demand? After all, we don’t need to look too far for a model ID card.

Just across the bay, in fact. All Singaporeans over the age of 15 compulsorily have an IC card. It is coloured pink for citizens and blue for permanent residents. It is not compulsory to carry the IC card at all times, and there is no compulsion to produce it on demand. On the other hand, ‘suspicious’ individuals can be detained by police until the IC is produced. In Singapore, the good of society is considered more important than the rights and liberties of individuals.

The front side of the IC card displays the holder’s name, race, date of birth, sex, country of birth and a colour photograph. On the reverse are the National Registration Identity Card (NRIC) number and its bar code, a fingerprint, issue date and the holder’s current residential address and nationality, in case of a permanent resident.

Singapore is a society in which bubblegum is a banned substance; reading materials considered indecent are banned; a citizen can be thrown into jail for littering and it is a crime to neglect to flush a public toilet. It has been described as “a nation of people which is clean, green, safe, rich and ruled by fear.” Break the law in Singapore? Be prepared to experience six lashes on bare buttocks with a rattan cane. Singapore is a semi-Police State run by benevolent dictators, where law & order prevails 24/7; police are well-paid; and corruption is almost non-existent. India is a far cry from Singapore. But right next to that island nation is Malaysia, and a quick look at the Malaysian IC card, also known as ‘MyKad’, issued to 28 million Malaysians, will illustrate what the Indian Aadhaar card will become in years to come.

MyKad incorporates both photo identification and fingerprint biometric technology, and is designed with six main functions: identification, driver’s licence, passport information (although a passport is still needed for overseas travel), health information (blood type, allergies, chronic diseases, etc), and an e-cash function. The card can also function as an ATM card. Malaysia plans to add digital signatures for e-commerce transactions.

It is common knowledge that corrupt Malaysian police harass minority Indians by illegally detaining and confiscating their MyKads, without which they simply cease to have any proof of identity. It is also widely known that anyone with a card reader can access all the information contained in the card.

While the USA does not have an official ID card, Americans have their Social Security Number (SSN). It is so widely used that it has become a de facto ID card, although there may be up to 12 million false SSNs in use today. The USA Patriot Act, enacted by the US Congress to vastly increase powers of surveillance and implement a biometric identification system, faced enormous opposition and has, since, been scaled back.

UK Labour Party’s ID card scheme, now permanently abandoned, was aimed at tackling fraud, illegal immigration and identity theft—but it was too expensive and an infringement of civil liberties. The cards were designed to hold personal biometric data on an encrypted chip, including name, photograph and fingerprints. The supporting National Identity Register was designed to hold up to 50 pieces of information.

Appalling losses of personal information from other government and private depositories helped fuel a public outcry that finally propelled political action in the UK this May. Some Indians, who are regularly bombarded with intrusive and unsolicited phone calls and texts, know data leakages are uncomfortable—and commonplace. It remains to be seen whether India will follow the example of privacy and human rights-conscious nations, with its people standing up to say ‘No’ to spending unconscionable amounts of money on half-solutions to ill-defined problems.

(Ram Krishnaswamy is an IIT Madras alumnus and Vickram Crishna is an IIT Delhi alumnus).
____________________________________________________ 
18th August 2010
Numbers Game Part I & II - Aadhaar Articles

Ram Krishnaswmy & Vickram Crishna - Money Life Articles
____________________________________________


Ram Krishnaswamy & Vickram Crishna - Money Life Articles

In our previous issue, we looked at three questions about the scheme to enumerate every Indian citizen. In this article, the second in a series published only in Moneylife, Ram Krishnaswamy and Vickram Crishna look at three more questions, focused on the technologies and how they are already being deployed

This is the second article in a series where we examine the government’s ambitious ‘Aadhaar’ scheme, under which the Unique Identity Authority of India (UIDAI) plans to assign each Indian resident a unique 12-digit number.

Q1: Is enumeration via a single reference archive the best way to reduce inefficiencies and prevent money leakages in subsidy programmes?


 
Most articles about Aadhaar  harp on the superior quality of technology to be used and that this will significantly cut the cost, time and hardship of necessary verifications.

The reality is somewhat different; to suggest that the UID assignation process will be robust enough to eliminate duplicate and fake identities and can be verified and authenticated in an easy, cost-effective way, is somewhat premature, if not simply hype.

Some of the potential flaws in the process are listed briefly.
(a) Digitally-stored fingerprints are not image scans of real fingerprints, they are digital maps, reduced to a finite number of ‘points’. This computerised system was designed decades ago to cut down the time and effort needed to manually match thousands of prints of previously convicted criminals with a criminal suspect, not to provide perfect identifiers;
(b) Digital representations of biometrics invariably allow for both false positives and negatives, as the original purpose is either to facilitate security pass-through for a relatively small number of people (convenience), or to rapidly filter through large numbers of images by pre-matching each image to a reduced set of digital markers;
(c) The value-addition of iris scanning is unknown for testing on such a scale. The immediate cost is stupendous: per-identity costs go up from about Rs31 to about Rs450, but the results are not known, since such testing has never been done. This is quite different from scaling up a relatively reliable known procedure; iris scanning may well be quick and reliable (even after optimising it with a digital shortcut and securing it from man-in-the-middle attacks during data transfers), but this is currently untested.

Again, it must be emphasised that the purpose is mission-critical; every single genuine person must be allowed to move ahead with whatever activity is being filtered, without fail, else the expenditure on UID is wasted. Similarly, every single fraudulent attempt must be detected and stopped, without fail. Neither achievement is even claimed.

By the time the database is created and verification scanners become commonplace, we could end up with a database of a population that exceeds the census figures, and UIDAI will have to spend again for de-duplication, which would involve knocking on the doors of suspected fraudsters (and genuine applicants who may have failed one of the tests or another, for a host of reasons) for identification. This is the present problem, that databases of applicants cannot be absolutely verified.

And it is not even as though the government is blind to the problem. Recently, the rural development ministry launched its own revamped enumeration exercise to identify the poorest of the poor (who qualify for the designation ‘below the poverty line’ or BPL). This exercise is carried out every five years and the current process is being designed to eliminate the failures of previous surveys.

Q2: How effective are the pilot studies being carried out?

Reports indicate that the rural studies being undertaken in several states fall short of standards of both accuracy and confidence. The national census exercise, which has been merged this time with the National Population Register at the urging of the UIDAI, is also contentious.

It is crucial for a participatory democracy that those surveyed be honestly and fully informed about the purpose of collecting personal information on such an intrusive and massive scale. Unfortunately, this appears not to be the case, as respondents claimed later that they were told that they would get free photographs and eye tests, or that this survey would assure them subsidies or the supply of free essentials. Similarly, respondents of the census have been surprised to find that they are expected to reveal details of religion and caste, an enumeration that is against the letter and spirit of the Constitution of India. This has been sidestepped by replacing the census exercise with the creation of the National Population Register, a crucial component of the proposed UID database.

While doing this is evidently legal, it goes beyond the ambit of the census. As such, it compromises the integrity of an institution that has had an honourable and long history (the current census is the fifteenth).

Q3: Will adequate precautions be taken to safeguard the database?

No system is completely immune to attack or, for that matter, internal leakages, other than one completely sealed off from outside links. Since a centralised digital identity store can only work when incoming data can be matched to the information in the database, one must take for granted that it will be prey to such attacks. This is the bane of all e-governance scheme designs ( aadhararticles-unique-id-for-indians-boon-or-bane ).

Legally, there is no effective deterrent for such attacks. Worse, insiders (i.e., government personnel) are specifically protected by their sovereign work contracts from legal action, except with the specific permission of their superior officers. The existing laws on cybercrimes have not been tested against leakages in government systems, because their draconian provisions (search and seizure without warrant, massive penalties) do not apply to government servants.

There are three kinds of database faults: creational (deliberate or accidental falsification of identity, resulting in diversion of benefits from those entitled to them); design-based (incorrect verification due to compromise of the verification process, including man-in-the-middle attacks on data transfers); and procedural (for instance, when telecommunication faults or natural disasters create a need for rapid re-routing of verifications to alternate, or manual, methods). In the absence of an effective legal redressal framework, the process needs review and should not proceed beyond the research stage.

Even at the research stage, the lack of judicial protection for the Constitutional right to personal privacy deserves highlighting. The conduct of research and live pilot studies inevitably places citizens and residents of India at risk of loss of privacy, particularly with regard to sensitive personal information, including biometrics. Much of this information is needed to safeguard property, ownership, fixed and moveable assets, especially money itself, and the addition of UID must be wholly positive, or it can even put your property at risk.

UIDAI officials have repeatedly stated that such protection must be created but its lack does not daunt them in practice. The consequences of wrongful identity matching, once UID becomes the standard reference point, are really harsh on the individual and the current legal environment (civil cases take years and decades to resolve) is not up to the task of providing remediation.

For this reason alone, without completely foolproof systems in several areas of technology as well as law (idealistic at best, if not far-fetched), going ahead with the UID is a deplorable waste of money.

To summarise, we have asked six simple questions here, to clear doubts about the deliverable merits of the Aadhaar scheme. We find it is not likely to provide benefits to the poorest of the poor in India; secondly, is not even designed to do so, definitely not in its first phase. on the contrary, it is likely to benefit the upwardly mobile part of the population. As far as solving the terrible problems that plague the delivery of benefits to the poor is concerned, a single reference point for verifications is neither the best-known solution, nor is the exceeding difficulty of building and operating a centralised database achievable at a reasonable cost and effort. There is no clarity, therefore, on whether making the effort is sensible at all.

Also, there is no clarity on whether it will be possible to adequately safeguard the database, from its creation to its subsequent use as the ultimate reference. We found serious concerns with the methods being used to gather data in the pilot studies that point to the possibility of future abuse as well as manipulation of ill-informed people to make them cooperate.

(Ram Krishnaswamy is an IIT Madras alumnus and Vickram Crishna is an IIT Delhi alumnus)

____________________________________________ 
29th July 2010
UID Issue: Numbers Game Part 1
Ram Krishnaswamy & Vickram Crishna - Money Life Articles

Unique Identity Authority of India (UIDAI) will assign unique numbers to all people in India (‘Aadhaar’ is the brand name chosen by the for its flagship scheme), to serve as a single reference point to help establish identity. We found over 200 articles extolling the merits of the project and gathered them on the blog aadhararticles.blogspot.com. Rather than reassure, however, they raise several questions about the worth of the project. Ram Krishnaswamy & Vickram Crishna address three key questions in this article—the first in a series that will be published only in Moneylife

The Aadhaar scheme proposes to assign each Indian resident a unique 12-digit number, thus enumerating a Unique IDentity for all. India’s current population stands at around 1.2 billion. In addition, millions of foreigners are temporarily based here. UIDAI has set an initial target of issuing 600 million unique numbers within five years (by 2015) (read more at aadhararticles-making-unique-impression

This seems an ambitious target, considering the scale and cost (Rs45,000 crore) of the project. Through this series of articles, we will provide the information needed to understand this massive project and its potential consequences for us as Indians and as global citizens.

Q1. Will the intended beneficiaries truly be people who live below the poverty line?

The primary purpose of Aadhaar is avowedly social welfare: dividing wealth equitably. Of course, ‘wealth’ is not really in the picture; India is trying to guarantee everyone the bare minimum needed to live healthily. Benefits in cash or kind are distributed under various schemes, such as the National Rural Employment Guarantee Scheme (NREGS), Sarva Shiksha Abhiyaan, National Rural Health Mission and Bharat Nirman.

One of the problems with such schemes is the difficulty of ensuring that their benefits accrue only to the targeted population—typically, persons living below the poverty line. Such people are easily disenfranchised by an endless cycle of verification of records, ruining the efforts made to ensure fair distribution and causing real delivery rates to falter between 6% and 15%, as estimated by the late prime minister Rajiv Gandhi and others.

With Aadhaar, this problem is expected to be resolved. Aadhaar is a one-time verification system to which all records will be inextricably linked (read more at aadhararticles-unique-identification-number-project- Cautious optimism With UID, beneficiaries of any scheme can be verified by just checking a few critical details—for instance, name, fingerprints and, now, perhaps, iris scans—in order to quickly confirm their identity. However, largely due to the additional requirement of iris scans to reduce error rates, the per-user cost estimate has shot up from Rs31 to Rs450.

Now, here’s an interesting statement: “The UID will become the single source of identity verification” (read more at  aadhararticles-uid-project-law resorces ). It means that once residents are enrolled, they can use the number in many places—they will be spared the hassle of repeatedly providing supporting identity documents for each service they wish to access.

However, it is pertinent to note that the services that will actually be simplified in the near term by the Aadhaar numbers include: opening a bank account, obtaining a passport, driving licence, etc. The public distribution system (PDS), NREGS and other such public-benefit services have neither budgets nor plans to integrate their systems with Aadhaar referrals.

It seems clear that, after spending a huge amount of money and putting in all this effort, the UID will, in the initial few years, primarily benefit people who access relatively sophisticated and upmarket services.

Q2. Will UID meet the needs of the poor?

If a poor person gets money that is due to him directly in his bank account, he will have no reason to plead with tyrannical local officials or grovel before his elected representatives (read more at aadhararticles-against-insecurity-uid-is-good-idea number of bank branches as of March 2002, the latest figures we could find on the Reserve Bank of India’s website, was just over 66,000, and less than half of these were in rural areas which account for around 70% of the population.

A back-of-the-envelope calculation shows that each rural branch would need to service over 22,700 account-holders—clearly beyond their reach in a land where urban customers struggle to get decent and timely banking services from branches which need to cater to only around 9,000 customers each. If money is to be mandatorily disbursed directly into bank accounts of the recipients under various schemes (the process to be simplified using UID), it definitely won’t target the poorest of the poor.

One emerging solution is micro-banking, but micro-banking organisations will need to upgrade their technology considerably to deliver services, if UID referrals are to be included. Micro-banks are also not included within the broad banking framework, meaning that existing security measures ensure that they cannot access clearing-house operations and other such enablers of modern banking.
The upgrade cost is not factored into UID budgets, nor is UIDAI mandated to drive the changes that are needed in the banking system without which the UID referral is irrelevant.

Q3. How will UID contribute to the country’s economy?

This is a big-vision project (read more at aadhararticles-unique-id-for-indians-boon-or-bane ) through which government services can be provided, tracked and accounted for, together with enabling a multitude of private-sector products and services that rely on accurate identification of consumers. Various departments, based on their needs, will refer to the UID number. This will help remove duplicate names from their service lists. While this would help clean up lists for NREGS, senior citizen pension schemes, PDS, etc, it may also help clean up benami bank accounts, etc. Informally, the Income Tax Department is known to have projected an additional tax collection of about Rs40,000 crore annually!

These claims may hold, if the scheme were intended to act against the continuing use of unaccounted money for trading. In that case, the target community would only be the economic arrivistes—people who already have enough money to regularly feel the need to spend or acquire it by underhand means. This would include all government officers, their extended families, politicians, businesspeople, agriculturists controlling upwards of 25-50 hectares of land, and so on.

In fact, the projected gains, in terms of enhanced income-tax collection, simplifying transactions with government agencies for cash-related activities and so on, are primarily beneficial to this economically stable or upwardly mobile class.

However, the scheme is sought to be justified on the basis of deliverables to the downtrodden. It is doubtful whether Aadhaar will boost the country’s economy directly or help reduce the outgo on avoidable subsidies; or whether it will provide a combination of these benefits; or whether the true objective depends on who asks the question.

It seems far more likely that the unstated purpose of the scheme is to target the upwardly mobile class, but to do that, all Indian residents will have to be induced, by one means or another, to register themselves ‘voluntarily’.

A closer look at what appeared to be basic questions raises some worries. Next fortnight, we will look at the uncomfortable questions that arise as a result of the technology itself being insufficiently explained, at least in the media.
__________________