Slashdot Mirror


Story Of a Country Which Has Built a Centralized Biometrics Database Of 1.1B People But Appears To Be Mishandling It Now (mashable.com)

In a bid to get more Indians to have a birth certificate or any sort of ID card, India announced Aadhaar project in 2009. At the time, there were more Indians without these ID cards than those with. As a result of this, much of the government funding for the citizens were disappearing before they could see them. But according to several security experts, lawyers, politicians and journalists, the government is using poor security practices, and this is exposing the biometrics data -- photo, name, address, fingerprint, iris info -- of people at risk. More than 1.1 billion people -- and 99 percent of all adults -- in India have enrolled themselves to the system. From a report: "There are two fundamental flaws in Aadhaar: it is poorly designed, and it is being poorly verified," Member of Parliament and privacy advocate, Rajeev Chandrasekhar told Mashable India. Another issue with Aadhaar is, Chandrasekhar explains, there is no firm legislation to safeguard the privacy and rights of the billion people who have enrolled into the system. There's little a person whose Aadhaar data has been compromised could do. [...] "Aadhaar is remote, covert, and non-consensual," he told Mashable India, adding the existence of a central database of any kind, but especially in the context of the Aadhaar, and at the scale it is working is appalling. Abraham said fingerprint and iris data of a person can be stolen with little effort -- a "gummy bear" which sells for a few cents, can store one's fingerprint, while a high-resolution camera can capture one's iris data. The report goes on to say that the Indian government is also not telling how the data is being shared with private companies. Experts cited in the story have expressed concerns that those companies (some of which are run by people who were previously members of the team which designed the framework of Aadhaar) can store and create a parallel database of their own. On top of that, the government is making Aadhaar mandatory for availing several things including registration for nation-wide examinations, but in the beginning it promised Aadhaar will be used only to help poor get grocery at subsidized prices.

27 of 60 comments (clear)

  1. Did they consider ... by quenda · · Score: 5, Funny

    Offshore outsourcing the project?

    1. Re:Did they consider ... by frank_adrian314159 · · Score: 1, Offtopic

      They must have. The tons of genius, high-skilled computer programmers over there (that we desperately need over here via H1-B visas) would have never allowed this kind of security flaw to creep in.

      --
      That is all.
  2. Re:Oh noez! by cayenne8 · · Score: 1, Offtopic

    And these are the people we're outsourcing our IT work too....or desperately needing to import the H1B visas for...?

    --
    Light travels faster than sound. This is why some people appear bright until you hear them speak.........
  3. So wait... by Anonymous Coward · · Score: 1

    Not a single incidence of data being stolen, just the FUD lawyers trying to make a buck off paranoia?!

    1. Re:So wait... by Anonymous Coward · · Score: 3, Insightful

      A quick Google search suggests otherwise: https://encrypted.google.com/#...

  4. High-tech, Indian style by ddtmm · · Score: 1, Troll

    They're storing fingerprints on gummy bears. Next we'll find out Homer Simpson manages the "database". "Abraham said fingerprint and iris data of a person can be stolen with little effort -- a "gummy bear" which sells for a few cents"

  5. Re: Appears to be by Anonymous Coward · · Score: 1

    The whole purpose of tracking citizens is to make sure there's only one way to live in "the system". This is the wet dream of any dictatorship, to be able to revoke your life privilege by casting you into effective exile, making it impossible to have a phone, bank account, home. If you can make it impossible to buy bread then all the better.

    It wouldn't be cruel or inhuman to do this because people would insist you could just find other ways to live. In reality there wouldn't be any such way and you're set up for a guaranteed worst possible failure. Helps them sleep at night though.

    Human farming. The way it should be done.

  6. Re:They fucked up their own shit? by alvinrod · · Score: 4, Interesting

    The bureaucracy in India is so incompetent that it's borderline malicious. I had a colleague that had been in the U.S. for a long time but was going to move back to India to help with the care of his aging parents who were having some medical problems, but was delayed and prevented from returning for an extended periods because his own government didn't believe he was who he claimed to be because apparently someone had stolen his identity and had been voting in years worth of elections while he was in the U.S.

    Beautiful country and nice people, but I think they spend so much of their time being conquered and ruled by other groups that the local populace never developed an ability for efficient governing.

  7. Re:Oh noez! by LordWabbit2 · · Score: 4, Interesting

    I worked alongside one of the biggest consulting firms in the world, they might not be great programmers, but when you throw 300 of them at a project the project gets completed. Buggy as shit, convoluted (so you HAVE to go back to them) but it gets the job done. THAT is all management give a shit about, because it's their bonus on the line. Once they have their bonus they wander off and leave us to maintain the stinking pile of poo.

    --
    There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
  8. Re:They fucked up their own shit? by Richard_at_work · · Score: 4, Insightful

    You can say that again - in 2013, roughly a third of all Indian MPs (158 of 543) were under investigation for serious criminal charges, a third of all lawmakers (1,448 of 4,835) were also under investigation on serious criminal charges. Nearly half of those MPs were under investigation were being investigated for crimes such as murder and abduction.

    Its one of the most corrupt governmental systems that also calls itself a democracy...

    Lets not forget that a caste system is still extremely prevalent in India, so some people have utterly no hope of being elected or being represented in government.

  9. Identity verification is a mess in India by 140Mandak262Jamuna · · Score: 5, Informative
    In India verification of identity has been a mess for a long time. Much of this complaint is true, and the Indian government can mess things up royally or vice-royally. But you can compare the new system with perfect system and carp about it. Perfection is the goal, but doing better than current version is the shipping criterion, as any coder knows.

    Before aadhaar (meaning proof in Hindi, cognates with similar word in most of indian languages) it was an incredible mess. For most people "the ration card" issued to families to avail services of subsidized food served as a form of identity. Originally it had no photos, and it was one per family, not individual. But the state governments made some basic efforts to curtail fraudulent cards, so it served as an identity card. Voter registration lists were inflated. Migrant people did not have one. Credit worthiness could not be verified. So unsecured loans are never available from organized sector. All unsecured loans were made by local loan sharks who knew people personally. Almost all the commerce was done by cash. Allowed untaxed black money to mix freely with white money. So much so that the government had demonetized 500 Rs, and 1000 rs currency notes. Unless you can prove you had that note legally, you can't exchange it for the new legal tender. It did it back in 1976 too. The country was formed only in 1947.

    The mess is far larger than any one can imagine or fix in short term. Finding fault with any new system is easy. Unless you offer viable solutions and work to address your concerns, one would think, it is just a troll or astro turf or feigned outrage.

    Funny story: I was a lucky person with a propane gas cylinder account with a government owned gas supplier when I graduated from college. Propane gas stoves are the way most cooking is done in India for about half the population. It was a hot thing to have a gas cylinder account! All due to the foresight of my mom who "registered" my name using the ration card when I was in sixth or seventh grade. When I left for America, that account became very valuable. I gave the cylinder I had to my friend. So every time the cylinder would run out, he would use my name and get a replacement. Not sure if I gave my ration card to him too. When I ran into him some 15 years later he said, "I never forgot you. How could I ? Every 20 days, I had to call the Indane Gas company, and identify myself as 140mandak262jamuna!"

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Identity verification is a mess in India by Anonymous Coward · · Score: 2, Interesting

      Problem is that India has multiple ID cards, and Adhaar card just adds to it. You forgot to mention the PAN card, which is a photo-ID card w/ a chip, and which could easily have co-opted everything the Adhaar card is supposed to do, and more. A PAN card ought to work as a voter ID card, but that's again different. Also, the first Adhaar 'card' was just a slip of paper with the person's name: nothing that couldn't be scrawled by anybody. That's what's made up this whole mess.

      If the Indian government simply consolidates the Aadhar card, the Voter ID card, the PAN card and the Ration card all into one, it would solve their problem. They could put it in an actual server, maybe hosted by the NCERT or some other organization that does have serious computing resources, and then run things from there.

    2. Re:Identity verification is a mess in India by Hognoxious · · Score: 1

      If the thing is leaking biometric information and who knows what else all over the place you can't fix that in release 2. Once it's out, it's out.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  10. Re:Oh noez! by Big+Hairy+Ian · · Score: 1, Funny

    Could be worse they could be running a private Email Server

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  11. Re:They fucked up their own shit? by fustakrakich · · Score: 1

    It's malicious incompetence. Everybody has the old meme backwards.

    --
    “He’s not deformed, he’s just drunk!”
  12. Make SS cards real ID cards by unixisc · · Score: 4, Interesting

    This!!! In the US, one needs a Social Security number to do anything - open accounts to do any tracking, but it's a stupid piece of paper that legally is not supposed to be laminated. In the meantime, you have controversies over cities issuing driving licenses to illegals, and thereby making the appearance of legalizing them. As well as the proposal by the TSA to require everybody to carry their passports w/ them in some jurisdictions.

    Better idea: why not make SS cards like DL cards, which would include photos, personal details (eye color, hair color, et al, like in DLs, but not addresses), and then a chip that includes details like a person's legal status (citizen/GC/visa type, state in which one can vote, et al) and make that the ID that they are required to show anywhere? That way, DL would no longer be proof of anything aside from the authorization to drive, and the SS card can be used for things like Voter ID, travelling on planes, e-Verify, et al. Then cities that issue DLs to illegals would no longer be changing anything about their legal status to be here, only whether they can legally drive or not. Which shouldn't be an issue - one could legally go from Juarez to El Paso, get a TX DL and then drive anywhere in TX on a tourist visa, but not be mistaken for a legal resident of the US.

  13. Re:They fucked up their own shit? by ems2004 · · Score: 3, Informative

    Don't put the blame on cast system for incompetence. It is the affirmative action(policy of reservation) that forces the incompetent to have any job that requires skill without having any merit. It is the low cast people now having a field day who know nothing but have all the power.

    --
    ..... best things in life are not so free..........
  14. Re:Get your priorities right, India by GLMDesigns · · Score: 1

    A "pathetic world joke" compared to which other countries? Nigeria? Egypt? Brazil? Indonesia? Pakistan?

    --
    If you're scared of your govt then you need to further restrict its powers
    Vote 3rd Party in 2016 and beyond
  15. Re:Make SS cards real ID cards by spikenerd · · Score: 1

    Sure, smart people can easily solve the universal ID problem, but those same people mostly know that we are better of not solving that problem. I would personally like to thank all the other smart people for continuing to keep this problem complicated, messy, and unresolved.

  16. Re:Oh noez! by luis_a_espinal · · Score: 1

    Could be worse they could be running a private Email Server

    Or taking selfies with the football man.

  17. Re:Make SS cards real ID cards by dargaud · · Score: 1

    Ideous ? Why ? Most (all?) countries have an ID card system. It's necessary for interactions between you and the state and I don't see what the big deal is. I guess replublicrats find it easier to cheat on elections without ID cards.

    --
    Non-Linux Penguins ?
  18. Re:Make SS cards real ID cards by unixisc · · Score: 1

    What exactly is your idea of a 'National ID card'? My idea 2 posts above was to make the SSN card more secure - include a chip w/ a smart card interface, and in it, embed all the information about you that's necessary for any background check. Name, photo, fingerprint/retina scan, legal status (citizen/GC/type of visa held), marital status, married name (if applicable), state in which you are registered to vote, just about everything. All that is embedded in the card chip. You're ever asked for ID, that's what you give. Not DLs. You're taking a flight? It's needed, not your DL. Your DL would only be needed to let you drive, and nothing else.

  19. Re:Oh noez! by luis_a_espinal · · Score: 1

    and both are really quite bad, given the context. the latter though, wtf...!?

    The later strongly suggest the whole "they are both equally bad" is nothing but a fallacy. They are both bad, but not equally (Trump is a complete fucking liability to our national security), no matter how people want to cut the mustard.

  20. Re:Make SS cards real ID cards by unixisc · · Score: 1

    One more cretin who can't tell the difference b/w race and nationality. Yeah, I only want citizens, regardless of their race, to vote. I do not want a citizen of UK, France, Saudi Arabia, Iran, China, Russia, India, Israel, Laos or Brunei voting in our elections

  21. Re:Make SS cards real ID cards by unixisc · · Score: 1

    What does the Metric system have to do w/ this? In fact, I can make a good case for building a new system based on powers of 2, which would enable microprocessor based instrumentation w/ little software programming involved, since it would mainly involve registers, counters, muxes, et al rather than complete computer systems

  22. Re:Make SS cards real ID cards by unixisc · · Score: 1

    For 3 years, the US government has been trying to make (state-issued) DL cards like passports; only a few states have complied.

    Uh, that's what I was arguing against. Leave DL cards only for driving, rather than as a photo ID, so that DMVs in sanctuary states like CA are free to issue them to illegals, w/o making them recognized ID for anything else. Instead, overhaul what the SS card is and let that be the universal ID that people use whenever they are travelling within the borders.

    Passports will be needed, since there are a lot of countries that are not geared to use something like this as a substitute.

    According to whom? If a US DMV is issuing such identity to non-citizens, then it obviously isn't a representation of immigration status. To be fair, this is the government's fault. They should give people a kick up the arse for using a DL as a green card, or an SS card as an identity card.

    The latter - SS number for ID - has been there for the last 30 years, so it's probably there to stay. Which is why I suggested overhauling the SS card. Once it's there and loaded w/ all the information, any establishment that wants proof of ID will require to see that, instead of a DL or a college ID card.

  23. Re:They fucked up their own shit? by Luthair · · Score: 1

    One can't entirely believe those numbers though because both the police and judicial system are corrupt too, so we can't really know whether the officials are corrupt or are being targeted by other corrupt officials.