<link rel="stylesheet" href="//fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C700italic%2C400%2C700">National identification numbers Archives « Aam JanataSkip to content

2

On August 24th 2017, WikiLeaks published secret documents from the ExpressLane project of the CIA pertaining to the cyber operations the OTS (Office of Technical Services), a branch within the CIA conducts against liaison services. The OTS provides a biometric collection system to liaison services around the world with the expectation for sharing of the biometric takes collected on the systems. Additionally, the CIA has developed ExpressLane - a covert information collection tool to secretly exfiltrate data collections from these systems without the knowledge of the vendors as well.

ExpressLane installs and runs covertly behind a benign splash screen indicating a software upgrade and is used when OTS agents perform on site upgrades on the biometric system. The installation raises no suspicions other than the minor notices which don't appear to be out of the ordinary for a software installation.

The core components of the OTS system are based on products from Cross Match, a US company specializing in biometric software for law enforcement and the Intelligence Community. The company hit the headlines in 2011 when it was reported that the US military used a Cross Match product to identify Osama bin Laden during the assassination operation in Pakistan. This company also provides biometrics collection systems for UIDAI's Aadhaar in India.

The response to these revelations in India has been astonishingly muted. A foreign government having access to confidential and highly accurate information on citizens of India amounts to an attack on India's sovereignty. The existence of Aadhaar itself now becomes a government sanctioned weapon against the country and citizens. The Aadhaar must be destroyed.

The few reports in media restrain themselves to very conservative reporting of the actual leaks without committing themselves to stating the implications for the country. This too is concerning, because it indicates an inadequate comprehension of how tech works in the media and renders the media toothless when it comes to providing public oversight on the highly insecure progression of the Digital India project.

On its part, the UIDAI has issued its standard voodoo denials. No explanations, no data, no alarm, no need for any investigations, nothing. Assurances that "all is well, don't worry" is all the UIDAI appears to have on any of the mounting concerns about the Aadhaar being illegally imposed on the citizens of India with blatant disregard to repeated orders of the Supreme Court. And of course, flat out lies - the hallmark of anything supported by the Modi government. Here are some claims debunked.

Aadhaar system has stringent security features to prevent any unauthorised transmission of data.

And here we thought UIDAI filed a case against Abhinav Srivastava, co-founder ofQarth Technologies Pvt. Ltd, who released an entire app that made unauthorized use of Aadhaar data e-kyc, then let him go, because he didn't have bad intentions. And oh, they complained about unauthorized access and then also claimed that no data was breached. We get it. There was no breach. He was using an authorized api without being authorized. No breach. Just reading news on the UIDAI is enough to give anyone who understands tech security high blood pressure.

No, Aadhaar most certainly doesn't have stringent security features to prevent unauthorized transmission of data. Aadhaar devices were not even encrypted till well after UIDAI started claiming 90% enrolment across the country (another dubious claim, for another day).

“Some vested interests are trying to spread misinformation that since ‘Cross Match’ is one of many devices which are being used in biometric devices by various registrars and agencies in Aadhaar ecosystem, the biometrics being captured for Aadhaar are allegedly unauthorisedly accessed by others.”

This is complete bullshit. The vast majority of people objecting to Aadhaar have nothing to gain from its failure (other than national and personal security). In contrast, the vast majority of people defending Aadhaar without any data, independent audit, robust explanations of technology and worse are invariably employed by UIDAI or its affiliates or have founded them (or, in a recent trend, are anonymous handles - I wonder who, other than Sharad Sharma could be behind those). Where is the misinformation in CIA being a spy agency, or it being known to engage in illegal and digital spying or it being known to subvert democratic governments in countries? Where is the "misinformation" in a leak of secret documents on a site that so far has never been questioned on the authenticity of leaked information it publishes?

Aadhaar biometric capture system has been “developed within our own country and it has adequate and robust security features to prevent any possibility of any such unauthorised capture and transmission of data regardless of any biometric device that may be used”.

This statement can be true, only if the UIDAI spokesman is a US national, because even the UIDAI website offers driver downloads for Cross Match and L-1 devices. The same Cross Match and L-1 that have apparently got biometric capture systems from the OTS branch of CIA on the understanding of data sharing. And the Express Lane is the data theft on top of that.

“In addition, there are many other rigorous security features and processes within UIDAI ensuring that no biometric data of any individual is unauthorized accessed by anyone in any manner whatsoever,”

This is a breathtaking lie, because the CONTRACT UIDAI had with L-1 Identity Solutions Operating Co Pvt Ltd, Morpho and Accenture Services Pvt Ltd, says that the company was given Aadhaar data access "as part of its job". This contract has also been reported and objected to in the past and on this blog as well in 10 big problems with the Aadhaar UID card project.

Golden rule in C-Sec is: If physical access is compromised, everything is gone. Wikileaks talks about physical access. It is about installing a backdoor on the source where biometric is acquired at the device driver level. Encryption argument is useless in that case. But encryption != Security.

(update: UIDAI has made some vodoo argument about how access is secured on UIDAI premises and what not. It is nonsense. Aadhaar data is collected out in the real world where the espionage would be happening. Whether UIDAI pickles the data or freezes in some on premises further access to foreign companies it makes no difference to that)

How much Aadhaar data and how much access do foreign BSPs have?

And this information is from an RTI filed by Col. Thomas, that the BSP (Biometric Service Provider) "may have access to personal data of the purchaser (UID), and/or a third party or any resident of India..." Further, Clause 3, which deals with privacy, says that the BSP could "collect, use, transfer, store and process the data".

Excerpt from UIDAI contract with Biometric Service providers
Excerpt from UIDAI contract with Biometric Service providers

In other words, the UIDAI has been deliberately undermining Indian security using Indian funds and flat out lying about its activities. The entire organization must be dismantled and its leaders investigated.


Too late!

A 9 judge bench uninamously declared privacy to be a fundamental right

This opens a whole new can of worms and is a threat to many of your favorite ways of bullying.

Aadhaar is going to go down. One way or the other. This judgment is just the start.

A battle in a war against Aadhaar. An Aadhaar that stops at nothing, respects no rights, refuses to cross no lines in rendering both national security and individual at risk.

Imposing Aadhaar is clearly an act that puts India at risk of big data surveillance. 

Citizens were conned into getting Aadhaar as something that would help them get their rights. Fact is, having an Aadhaar entitles you for NOTHING. Imposing an Aadhaar DENIES you rights you already had.

It is still not too late to be on the right side of history. Roll back Aadhaar. Then you will not have to LIE when you claim that you saved the country from it when that house of cards comes down. #IssuedInPublicInterest

Otherwise, prepare for war. Aadhaar will be fought all the way by citizens who refuse to bow down to profiteers and foreign intelligence agencies. Who refuse to see the poor starve because the government is fine with it and has other priorities that prefers them to suffer rather than disobey an invasive dikkat. You will not be able to lay this country at the feet of those who want to control it. Try all you want. LIE all you want.

If you really are interested in putting India first, like you demand from random others as proof of patriotism, stop throwing India under the feet of your masters. Stop allowing people to trample the interest of its citizens. Stop allowing people to weaken its laws, create social divisions and drive the country to civil war just because a polarized country is profit for some. Stop attacking those trying to draw attention to important issues and help them get fixed instead. A country beongs to all the citizens. ANYONE who tells you otherwise is using you and attacking your country. Not us.
vidyut
Vidyut

Aadhaar exposes citizens to unacceptable risk

The government knows. It does not care if the entire life earnings of someone are at risk for its goals. You know this. I know this. The rest is hogwash to make your poliitical masters appear blameless in the eyes of voters. When you do it, you are harming the country.

Sharad Sharma woke to tweetstorm in Atlanta
Sharad's denial of trolling from his real account
sharads-indiaforward2
indiaforward2-sharads
Allegations of foreign intelligence affiliations

Aadhaar is so indefensible that key promoters use fake accounts to defend

If you can accept this done to Indians to protect and profit your masters, how do you claim to be patriotic?

Patriotism isn't in jingoistic bulltying of others to toe lines we arbitrarily draw.

If you cannot speak up when injustice is inflicted on the citizens of your country, you are the anti-national, and those opposing it are patriotic.

Choose well, or you'll AGAIN be forced to LIE that Modi and BJP were always anti-Aadhaar after we defeat it.

https://www.youtube.com/watch?v=d0c3OBZb6A0

That is all. Stating my intentions upfront.

In a landmark challenge to Aadhaar on the grounds of privacy being an inalienable fundamental right, a 9 judge bench of the Supreme Court of India upholds Right To Privacy as an Intrinsic Part Of Right To Life And Personal Liberty

Supreme Court of India has once again come to rescue the citizens of India by declaring that right to privacy is a fundamental right. This is a big jolt to a government which was turning itself to a surveillance state by intruding every aspect of the life of the individual. This decision was made unanimously reflecting the absolute legal voice on the issue.

The decision was given by a big bench of nine judges who ruled that right to privacy is an intrinsic part of Right to Life and Personal Liberty under Article 21 and entire Part III of the Constitution.

The part III is related to the fundamental rights which have been given to people to live their life as they wish for and develop their personality in full manner. The decision is linked to the government’s effort to make Aadhaar mandatory for the social welfare policies; government also amended Income Tax Act to make Aadhaar mandatory for the IT which SC accepted as valid but government was attempting to extend Aadhaar based surveillance almost in all aspects of the individual’s life. The decision may help to halt this process though SC has to deliver decision on Aadhaar later but is now established that Indian government cannot be a surveillance state as the privacy of the individual cannot be explored and penetrated in absolute manner extending in all aspects of private domain of the person.

The decision has thus overruled the M P Sharma verdict of 1950( six judges judgment) and that of Kharak Singh of 1960 (eight judges) judgments of the same court that right to privacy is not protected under the Constitution..

The decision has been based on article 21 of the fundamental rights. The article is the most interpreted article of the constitution as SC has interpreted it in different dimensions of human life. The article states that “No person shall be deprived of his life or personal liberty except according to procedure established by law.” In the same article by 86th Constitution Amendment, 2002 the 21A was added stating that ‘under 21A the State shall provide free and compulsory education to all children of the age of six to fourteen years in such manner as the State may, by law, determine.’

The Supreme Court has taken a wider view of the right to personal liberty that it cannot be controlled by the administrative fiats and the legislations. Aadhaar issue will be heavily impacted after the decision and its decision will be dealt during the coming time but the recent decision has illuminated the hopes that SC will also limit the government powers with respect to Aadhaar. It was felt by the citizens that compulsion of Aadhaar was unnecessarily placing them under stress. From banks to entrance examinations Aadhaar was becoming a compulsory identity. In several places the old person s were faced with the problem of not getting their pensions as they were not in a position to attach the Aadhaar cards. The practical problem was that they were so old that their fingerprints did not appear or were not in position to Aadhaar camp where these cards were being prepared due to old age or no one support them to take them to the camps. Several old women have complained about this sorry state of affairs.

Government did not take a flexible view and attempted to monitor every action of the individual. The fear was that Aadhaar compulsion might put the person always under stress. That day was not far away when government could ask the person attach Aadhaar whenever anyone you purchased a newspaper or visited a restaurant for a dinner or stayed in a hospital or was hanging out in a park.

In the societies where governments are fearful of the force of the citizens such steps are contemplated. Supreme Court by its decision has placed the limits on any malafide intention and has empowered the citizens of the country.

Supreme Court is really a custodian of humane values and lives of the Indian citizens. Constitution is paramount and so the WE THE PEOPLE OF INDIA. Supreme Court has upheld it and no power can dilute it is now a well established fact.

Originally published on CounterCurrents.org

After false Aadhaar benefits claims perjury to deny citizens right to privacy in case, R S Prasad claims govt always saw privacy as a fundamental right after landmark defeat in judgment by 9 judge bench.

R S Prasad makes another Aadhaar and privacy related false claim.

The Supreme Court gave a landmark 9 judge bench judgment upholding privacy as a fundamental right of citizens. The government was among the defendants and had vigorously stated that privacy was not a fundamental right.

Today, after the judgment, R. S. Prasad, Union Minister holding Law and Justice and Ministry of Information Technology portfolio in the Government of India tweeted:

Govt was of the view that #RightToPrivacy should be a fundamental right.

This is complete nonsense, of course. If the government was of the view that privacy was a fundamental right, why was the case in court at all and fought vigorously all through to the top till a 9 judge bench provided a judgment on a matter of crucial importance to the rights of citizens that the government was violating?

Attorney General Mukul Rohtagi, who represents the Union Government presented the government's stand in the Supreme Court as privacy was not a fundamental right of Indian citizens and that the Constitution makers would have put it there if they had intended it to be. The government's stand was that privacy is a right, but not a fundamental right (normal rights can be overruled by the government in various circumstances, while fundamental rights cannot).

Constitution makers did not intend to make right to privacy a fundamental right.

~ Attorney General Mukul Rohtagi while representing the Union government in Supreme Court before a 9 judge bench.

The government wants to be able to overrule a citizen's right to privacy in order to force them to enroll for Aadhaar or lose their right to essential services, subsidies, and documents. Aadhaar, imposed by the government on citizens was being challenged in court in this landmark case by citizens against their government. What R S Prasad is claiming is a flat out lie.

The Union Government actually made the ridiculous claim that citizens don't have absolute right over their bodies, sparking massive outrage on social media with hashtags like #MyBodyMyRight #RightToPrivacy starting to trend and remaining popular from then to now.

Advocate General Mukul Rohtagi cited two cases that supported this view. Rohtagi additionally falsely claimed in court that Aadhaar was foolproof and that the court should balance the right of the petitioners against those of the 700 million people it allegedly serves (which was also a false claim, because having an Aadhaar does not entitle you to anything, but in fact a lack of Aadhaar can prevent you from availing rights and services you already had access to). This outrageous falsehood has also been robustly challenged.

So the Attorney General committed perjury to defend the government's obsession with surveillance of citizens and when they got soundly defeated anyway, now R S Prasad is claiming that they supported the peititoners who fought against them? This is so absurd as to make no sense. If the government respects privacy as a fundamental right, why does Aadhaar exist at all? Why are people being forced to get an Aadhaar if they want to use essential services like the subsidies they are entitled to or to pay tax or to hold a bank account or even a phone?

Conclusion: R S Prasad is lying. It is the beginning of the usual jumble of words you see around this government and particularly around Aadhaar cover ups that turns their actual meanings into their opposites.

Under the Aadhaar system, all Indian citizens are being allotted a unique twelve-digit identity number by the State upon obtaining biometric data including fingerprint and iris scans and upon submission and verification of certain demographic data including the name, date of birth and residential address.

The new identity is different from all previous identity documents issued by the State. While a driving license or a passport were identity ‘documents’ that once issued were in the possession and under the control of the citizen as “original documents”, the Aadhaar number and associated demographic and biometric data is a data entry in a digital database in the possession and under the control of the State and any other entities who might gain access to this database whether with legal authority or otherwise.

Further the nature of the information that the State uses to identify a person under the Aadhaar system is entirely different from that used under earlier systems of identification. Until now the State relied upon photo-identity cards to determine someone’s identity. Under the Aadhaar system, the markers for identity determination include fingerprints and iris scans. For the first time, biological data not visible to the human eye and inaccessible to and non-decipherable by a lay person or a non-expert, is being obtained from citizens and is being stored digitally in a central repository for all 1.3 billion Indians with the ostensible purpose of identifying them.

Yes, the citizen is issued an Aadhar card with a number on it, but that card and the photograph on it and the face of the person presenting that card are no longer sufficient for the State to accept that the person is who he or she says they are. The biometric data must match. If the biometric data match fails, then the State will refuse to accept the identity of that person.

Also, the Aadhaar based identity is ultimately a number in a digital database. That number can be deactivated or even deleted. The database is outside the possession and control of the citizen. If his Aadhaar number in the database ceases to exist, the citizen has no proof of his identity as a citizen. The citizen ceases to exist for the State.

The Aadhaar related debates have focused on the right to privacy and on the apprehension of surveillance by the State and on issues of the security of Aadhaar databases. But there are more deep-seated concerns about the Aadhaar biometric identification system that I discuss here and which are important to understand how great a threat the Aadhaar biometric identification system poses to the privacy, liberty and security of Indian citizens.

There are several scenarios in which this digital biometric identification database can fail, be modified, be stolen, be leaked, be misused or be manipulated by State or non-State interests to the detriment of citizens and their rights. I discuss how the centralized and digital nature of this database as well as its use of biometric markers of identity which by their very nature are not accessible to or verifiable by ordinary individuals, creates many such scenarios where citizens can lose control over their identity and their very person-hood and be left with no recourse in extremely harmful situations. The greatest threat posed by the Aadhaar system is that citizens will lose control over their identity, they will be unable to establish their identity under certain circumstances, and they will also be exposed to an exponentially higher risk of identity theft.

The digital Aadhaar biometric identification system it is argued not only violates the right to privacy, but it creates significant risks that threaten the very right to identity and person-hood of Indian citizens and thus the right to citizenship itself. The Aadhaar system fundamentally alters the social contract underlying the Constitution of India by enabling a potentially malevolent State to deny the very identity of “inconvenient” citizens. A cost-benefit analysis of the Aadhaar system, even accepting its stated advantages, cannot justify such immense risks to citizens.

This post was originally published here by Seema Sapra.