Unique Identification: The Right Way Forward

I published a series of blog posts [dated Mar. 28, 2014; Apr. 8, 2014; Apr. 11, 2014 and Apr. 13, 2014] that identified legal infirmities and technological lacunae in the implementation of the Aadhar project. 

While the critical evaluation was generally well-received, some posed: “What’s the way forward?” Others commented that I had only pointed out flaws, but not given any solutions.  

Valid remarks, indeed! So, the stage was set for this piece, a first-cut attempt at recasting UIDAI.

Bolstering the Judicial Mechanisms 

At the outset, regardless of how watertight the identification system is, people with mala fide intentions will find loopholes and exploit them. In this context, the sophistication of technologies used, biometric or otherwise, is a moot point, since there have been many reports of not only fake and forged Aadhar card rackets, but also issue of Aadhar cards to dogs, trees and chairs. 

So then, how to counter rackets of the corrupt and the crooked? How to deter criminals from defrauding the system, through either upstream, fake-identity creation or downstream, fraudulent enjoyment of benefits and subsidies? 

The answer lies in first ushering integrity and discipline into the system. Penal provisions and judicial processes should be stringent enough to adequately and effectively deter offenders from flouting the “unique identification” system. This calls for strengthening the Indian Penal Code, 1860; the Prevention of Corruption Act, 1988; the Information Technology Act, 2000 and the Code of Criminal Procedure, 1973 with amendments to:  

1. Establish special, fast-track courts to try swiftly those accused of misusing or manipulating the system. 
2. Introduce summary proceedings for establishing culpability of those accused of offenses of creating, issuing, approving, possessing or benefiting from fake, forged or fraudulent identities. 
3. Impose on accused the burden of proving innocence, especially in cases of either officials issuing or persons possessing fake identities. 
4. Institute strong vigilance mechanisms, based on, say, statistical sampling and physical inspection, to verify and validate identities. 
5. Frame guidelines for speedy sanction of prosecution of public servants charged with corruption or creation of bogus identities. 

While some of the above measures may seem Draconian, they are necessary to vanquish the unholy “official-criminal” nexus and to introduce greater accountability into the system. Further, the “unique identity” system has to be designed with inherent checks and balances not only to ensure integrity and validity of identities, but also to eliminate false and fraudulent activities.   

Thus, the desideratum for successful implementation of a “unique identification” system in the country is suitable legal reforms. 

System Objectives 

In the overall analysis, the objectives of the “unique identity system” should be to:  

1. Build the National Citizen Register (NCR) and National Legal Residents Register (NLRR) through the above integrated process; 
2. Confer benefits and subsidies on citizens and eligible residents based on the twin registers, NCR and NLRR; 
3. Diligently identify and deport all illegal residents; and, eliminate their names from various other identity databases, particularly voter lists; 
4. Ensure high levels of data quality, integrity, consistency and availability in the repository; 
5. Implement identification mechanisms that are highly robust, reliable and effective, besides being fraud- and tamper-proof.  

Data Capture and Repository Creation 

The current UIDAI approach is a ‘zero-based’ approach, which redundantly replicates efforts of other agencies and authorities. This is inherently flawed since it will bring in ineligible persons and illegal migrants into the system. 

Instead, an integrated approach should govern the data collection process (refer diagram below). The system should not only be compliant with constitutional provisions, but also have requisite parliamentary approvals and mandate.

  

 

System and Process Details 

The focus should be on unification of all “touch-points” and “data-addition or deletion points”, encompassing the following phases of the human life-cycle. 

A) Births & Deaths 

1. Digitize existing births and deaths records; 
2. Build a centralized repository of citizens by integrating all birth and death registries and databases;
3. Network all clinics, hospitals, maternity homes, primary healthcare & childcare centers and mobile healthcare units to enable automatic addition of citizen records in the central repository;  
4. Connect all cemeteries, crematoria, burial grounds, towers of death, cremation ghats, etc. with the central registry to enable automatic registration of deaths in the central repository; 
5. Capture child name and gender along with birth details and parental information;
6. Provide for the capture of biometric data of minors after they attain adulthood. Till then, identification is through parents and guardians. 

B) Immigration check-points 

1. Network all seaports, airports and border checkpoints to capture arrival and departure information of Indian citizens and foreign nationals. 
2. Provide for capture of biometric data of foreign nationals at immigration checkpoints. 
3. Prepare a repository of non-resident Indians and lawfully residing foreign nationals. 

C) Existing Identity Database Unification 

1. Merge all existing “identity databases”, such as driver’s licenses, passports, voter IDs, birth and death registries, Kisan Photo cards, PAN cards, ration cards, etc.; 
2. De-duplicate data based on residential addresses and birth records; 
3. Link biometric data collected by UIDAI (subject to statutory approvals) with consolidated itentity data; 
4. Codify and standardize residential address data available with panchayats, municipalities, utility companies and postal authorities to help make identities “unique” and eliminate redundancies. 

D) Unique Identity Creation & Verification 

1. Validate “unique identities (UI)” physically through household visits (as in the case of issue of ration cards); 
2. Capture biometric data of citizens and legal residents, subject to parliamentary approvals during physical verification; 
3. Make use of the census process as a validity check to: (a) eliminate fake, fraudulent identities, and; (b) clean the UI repository. The census exercise inherently provides a periodic mechanism for ensuring integrity; 
4. Delete all bogus or duplicate identities unearthed during physical verification and biometric matching; 
5. Deport / extradite all unlawfully-residing migrants of foreign origin identified during the verification process; 
6. Institute vigilance squads to independently verify “unique identities” through a random sampling process. 

Insofar as “unique identity” authentication is concerned, I am of the considered opinion that photo cards, with biometric and biographic data encoded into an embedded IC (with or without encryption), is a more elegant and effective solution. That is so, because it minimizes the potential for error and opportunity for misuse that are likely with a network-based authentication service. 

Final Remarks 

A detailed technical study and on-field pilot are indeed essential for ascertaining the feasibility of the "unique identification" system design. Furthermore, it would be prudent to implement the project in a phased manner. 

The long and short of it is that only an integrated (and not isolated) “unique identification system” can be effective in meeting the challenges of scale, scope, complexity, efficiency and effectiveness that India poses. 

Do you agree? 

Aadhar, Corruption and Commonsense - The Last Nail in the Coffin

My earlier blog posts [of Mar. 28, 2014; Apr. 8, 2014 and Apr. 11, 2014] focused on the legal, constitutional and technological aspects of the Aadhar project. 

While all the criticisms in those posts are valid, relevant and necessary, none of them is sufficient for countering the argument in Aadhar’s favour, viz.,

“Aadhar helps remove corruption; it ensures effective implementation of social welfare programmes.” 

Really, I too was blown off my feet when I looked at that justification. That was only till I applied my mind to it. What emerged was a different picture, one that shows Aadhar in the poorer light of being neither fraud-proof nor corruption-proof.

To make out my case, I will start with a review of the Public Distribution System (PDS), as it exists today.

State of PDS Affairs

It is not mandatory to get a ration card in India.  But, it is a must for obtaining subsidized rations from the PDS network of “fair price shops”. There are three types of ration cards - EPL (Extreme Poverty Level), BPL (Below Poverty Line) and APL (Above Poverty Line). Eligibility depends on the economic status of the family.

The Constitution of India empowers (Article 246; List II in the Seventh Schedule) the Legislature of any State to make laws with respect to the control of procurement, supply and distribution of, and trade and commerce in, certain foodstuffs and essential commodities to targeted sections of society through a network of retail outlets called ‘fair price shops/depots’ or ‘ration shops’. 

Accordingly, the powers to administer the Public Distribution System vest with the State Government, which distributes the commodities allotted to the State by the Government of India. The allotment is based on the number of ration cards. This is an important constituent of the strategy for food security, particularly to poor and vulnerable sections of society.

Issue of Ration Card in Karnataka

The process flow for issue of ration cards in Karnataka is as follows: 

• First an (online) application is filed along with documents in support of identity, age, residential address and income level.
• The concerned “food inspector” records the receipt of the application in the prescribed register.
• The food inspector inspects the application and schedules an appointment with the applicant to verify originals of documents submitted in support of age, identity, etc., to determine eligibility for issue of a ‘ration card’.
• After documentary verification, the biometric data of all members of the applicant’s family is collected. The District Supply Office appoints private firms for the registration and collection of biometric data.
• The inspector then visits the applicant’s home address to determine income level (e.g., type of home, vehicles possessed, etc.) and verify entitlements for certain commodities (for e.g., only those households without LPG connections are eligible for supply of kerosene). 
• If the food inspector is satisfied about the eligibility of the applicant for the issue of a ration card, he approves the application. 
• The District Supply Office (DSO) then issues the ration card to the applicant. 
• The card-holder is required to report and get registered any changes in the household status, such as, change of member names or address, births, deaths, etc. 
• The ration card holder then obtains such subsidized, essential commodities (food grains, kerosene, etc.) at affordable prices. 

Systemic Loopholes; Endemic Leakages 

Any layman studying the existing system can recognise that despite checks and balances, there is ample scope for dishonesty and corruption. Major areas for fraudulent subversion of the civil supplies system may pertain to: 

1. Issue of ration cards (e.g., EPL, BPL, etc.) to ineligible persons: This is typically based on false declaration and fraudulent verification of income levels. It can go on with or without the connivance of government officials.
2. Issue of multiple (i.e., duplicate) cards to a household: This can be accomplished in collusion with the food inspector or otherwise. For e.g., a joint family can possess two cards: one card showing father as head of household and son as member and the other, showing son in a separate, nuclear family. Home addresses and names of family members can be modified or misrepresented to facilitate this.
3. Issue of fake or bogus cards: Again achieved with the connivance of the food inspector or otherwise, ration cards can be issued to non-existent “ghost households”. Ration cards can have imaginary individuals fraudulently included by bribing corrupt officials.
4. Non-existent family members: Deaths in a family may not get registered with the concerned authority. Furthermore, family members domiciled in a different place may continue to appear on the ration card.
5. Low quality of commodities: Adulterated and contaminated commodities may be supplied in ration stores.
6. Skimming and diversion of supplies: PDS shop owners, in collusion with government officials, may divert subsidized commodities to the open market. Some ration shops may even hoard and black-market essential commodities that are in short supply. Others may over-charge, falsify wastage or under-measure supplies.
7. Siphoning off unused quota: PDS shop owners, in cahoots with corrupt officials, may divert unused quotas to open markets. The unused quota is shown as fully used-up in books of the shop-owner.

Needless to say, the above scams lead to an inflated number of beneficiaries. It also imposes higher subsidy loss / burden on government. Often organised gangs, of ration shop keepers, government officials, criminals and touts) are involved in these rackets.

Plugging leakages with Aadhar  

Clearly Aadhar can play no role in plugging systemic lacunae numbered 1, 4, 5, 6 and 7 in the list above.  

However, Aadhar can potentially play a pivotal role in eliminating loopholes nos. 2 and 3 in those states, where, unlike Karnataka, biometric data is not captured as part of issue of ration cards. That is however a major assumption, since questions exist regarding:

(a) Quality achieved in successfully recording and de-duplicating biometric data; 

(b) Accuracy, consistency and reliability of “biometric pattern matching” during the identity authentication process; and, 

(c) System ability and availability to validate identity at anytime from anywhere with timeliness.

Thus, Failure to Enroll (FTE) rate, False Accept Rate (FAR) and False Reject Rate (FRR) all play a major role in determining the effectiveness of the biometric. And on top, there is the key metric of ‘stability’ of the biometric data over the lifetime of the individual. 

Effectiveness of Aadhar Biometrics 

A 4G Identity Solutions document (note: 4G-IDS is a supplier of biometric devices to UIDAI) makes interesting observations on fingerprinting efficacy.

1. Fingerprints de-duplication is cost effective only for small population and the cost of de-duplication goes up significantly due to manual intervention required for de-duplicating huge populations. 
2. Fingerprints are susceptible to bad data such as inability of a scanner to read dirty fingerprints clearly. People above 60 years and young children below 12 years may have difficulty enrolling in a fingerprinting system,due to their faded prints or underdeveloped fingerprint ridges. 
3. It is estimated that approximately 5% of any population has unreadable fingerprints, either due to scars or aging or illegal prints. In the Indian environment, experience has shown that the failure to enroll is as high as 15% (i.e., equivalent of about 200 million people in India) due to the prevalence of a huge population dependent on manual labour. 

Iris scanning does offer benefits of very high accuracy. But then, unlike fingerprinting, it is very expensive; it requires a lot of data storage space and network bandwidth for identity authentication in the field. 

Besides, effectiveness of the Aadhar identity validation service is questionable given that availability of non-stop power supply is a major issue in India, especially rural areas. Plus, it is unknown how reliable, robust and rugged identity authentication devices are likely to be in the dusty, hostile, often extreme operating environments of India - hot ‘n humid at some places; cold ‘n frigid at others; dry at some times of the year and wet ‘n damp at other times.

Grass-root Level Corruption and Criminal Activity 

The key question though is whether Aadhar can counter corruption effectively if determined criminal gangs are hell bent on exploiting and undermining the system.  

The answer is an emphatic NO!! 

In fact, Aadhar might increase leakages, because it enables illegal migrants to obtain Aadhar cards.  After all, it just takes an introducer's signature for such illegal foreign nationals to enroll themselves in UIDAI. Besides, creation of fake identities, by registering manipulated biometric data, is easier, particularly with the active involvement of enrolling agencies in such rackets. For instance, left slap and thumb prints of one person; right slap prints of another can be used to create a fake identity. It is equally easy to create bogus identities with the biometrics of the old and blind (unreadable fingerprints and non-existent irises).  

Further, rations can be withdrawn from fair-price stores either by claiming that sophisticated biometric validation devices are defective or by sabotaging them. Indeed, we can’t put the use of such devious and fraudulent methods beyond determined criminals. Can we? 

A worse scenario is that of identity theft. With the active involvement of enrollment agencies, criminals can have the biometrics of dead people replaced and continue to use their identities. Such nefarious plots can be hatched to hijack the identities of the living too.

Fighting Flaws and Failings 

Before implementing a high-cost, high-risk system like UIDAI, it would have definitely made sense for the government first to take several measures to strengthen the system at the ground level. A few measures that can be taken are: 

1. Greater accountability of officials combined with better vigilance mechanisms.
2. Periodic inspection of households and verification of beneficiaries to eliminate fake, bogus and ineligible cards.
3. Integration of all other identity databases in the country, such as driver’s licenses, bank accounts, voter IDs, birth and death registries, etc.
4. Postal address coding and standardization. 
5. More stringent penal provisions for fake identities and illegal residents. 
6. Fast track courts and summary proceedings for prosecuting accused guilty of defrauding the public distribution system.

Conclusion

So the big question: How foolproof, fail-proof and FRAUD-PROOF is the Aadhar system? 

Unless we have a concrete answer based on incontrovertible evidence, the conclusion is that Aadhar is a damn costly and risky venture. 

Or, should I say, adventure?   

SEBI and PFRDA: Not Aadhar for Aadhar's Existence

In an interview on NDTV’s ‘Buck Stops Here’, Barkha Dutt asked Nandan Nilekani, “UIDAI does not have parliamentary backing... So, why hasn’t parliament been able to endorse it all these years?" 

Nandan responded to that “UIDAI has been set up on an executive order” charge with a nonchalant: “Oh, it happens all the time. SEBI (Securities Exchange Board of India) and PFRDA (Provident Fund Regulatory & Development Authority) were both set up first and then enactments were passed."

Chalk and Cheese Comparison

Well Nandan's argument is completely over the top since it is based on an apples-to-oranges comparison, as can be made out from the distinctions summarized below:

1. SEBI and PFRDA, unlike UIDAI, are regulatory, i.e., ‘watchdog’ entities. UIDAI, on the other hand, is an operational, or, if I may, ‘workhorse’ body. 
   
2. SEBI and PFRDA are both not concerned with sensitive issues like citizenship, illegal migration, national security, etc. UIDAI relates to all such sensitive matters. 
3. The creation of SEBI and PFRDA was neither rejected nor opposed by Parliament. UIDAI was rejected by the 31-member Parliamentary Standing Committee on Finance, and hence it lacks legislative sanction.  
4. Neither SEBI nor PFRDA had any systemic loopholes that could be potentially exploited to confer benefits (such as subsidies, etc.) on illegal migrants. UIDAI, by enrolling all residents of India (lawful or otherwise), will surely lead to misuse of welfare schemes and wasteful outflows.  
5. SEBI and PFRDA did NOT entail the collection of personal (biographic and biometric) data by private parties (i.e., enrollers). UIDAI does. This raises questions on risks associated with data misuse or misappropriation, identity theft, etc. 
6. When SEBI and PFRDA were set up, they did NOT involve any infrastructure creation on as large a scale as UIDAI. So huge amounts of money have been invested on UIDAI with no accountability or transparency. 
7. Neither SEBI nor PFRDA violated any constitutional processes or parliamentary prerogatives. UIDAI did. This is a serious lapse since UIDAI is expected to generate revenues (through online authentication of ID).
8. While SEBI and PFRDA have quasi-judicial powers and functions, UIDAI is a purely executive outfit.  

Conclusion

There many other ways in which the existence of UIDAI, or the circumstances thereof, can be deemed to be incongruent and incompatible with that of either SEBI or PFRDA. But, that would be tantamount to beating a dead horse. Wouldn’t it? 

Bottom-line: Questions do persist about the aadhar (foundation) for the Aadhar scheme. And, drawing parallels with either SEBI or PFRDA is only obfuscating the issue with an obscure, tenuous argument!!

More Questions on Aadhar: A Follow-up Piece

My previous blog post looked into some aspects of the UIDAI Project. With my appetite for curiosity not fully satiated, I dug deeper into the antecedents of the project. A lot of unanswered questions is what my quest for the truth yielded. The details follow.

Residents of India

It can be intuitively discerned that the term “residents of India” includes the following classes of persons:  

1) Indian citizens residing in India:  

In accordance with express powers vested under Article 11 of the Constitution, the Indian Parliament enacted the Citizenship Act, 1955. This Act pertains to the acquisition and determination of Indian citizenship.  

Further, in exercise of the powers conferred under S. 18 (1) and (3) of the Citizenship Act, 1955, the Central Government has made The Citizenship (Registration of Citizens and Issue of National Identity Cards) Rules, 2003.

2) Foreign nationals residing in India:  

The Foreigners Act, 1946 and Registration of Foreigners Act, 1939 provide correspondingly for the exercise of certain powers in respect of and the registration of foreigners entering, being present in and departing from India. 

Both Acts provide for penalties against any person who contravenes, or attempts to contravene or fails to comply with, any provision of any rule made under the Acts. It is a also relevant to note that the Supreme Court too has asserted that the Government has unrestricted right to expel a foreigner [Hans Muller of Nurenburg v. Superintendent Presidency Jail, Calcutta (AIR 1955 SC 367); Sarbananda Sonowal v. Union of India (AIR 2005 SC 2920)]. 

In other words, there is no provision in the Constitution (or any statute under it) fettering this discretion of the Government.

Compilation of Citizenship and Residency Data

In accordance with Articles 11 and 246 (List 1 of the Seventh Schedule) of Constitution; and under the provisions of the Citizenship Act, 1955 and the Citizenship (Registration of Citizens and Issue of National Identity Cards) Rules, 2003, the Parliament has entrusted the statutory “Office of Registrar General & Census Commissioner, India, Ministry of Home Affairs, Government of India”, appointed under the Census Act, 1949, with the additional functions of:

A) Preparing and maintaining the National Population Register (NPR), which is a comprehensive identity database of all “usual” residents of the country. 

The creation of the National Population Register (NPR) is the first step in the preparation of the National Register of Indian Citizens (NRIC). Out of the universal data-set of residents, the subset of citizens would be derived after due verification of the citizenship status. Therefore, it is compulsory for all usual residents to register under the NPR.

B) Registering every citizen of India and issuing National Identity Card and National Identity Number of all citizens; and,

C) Maintaining a National Register of Indian Citizens.

On and from the date of commencement of the Citizenship (Amendment) Act, 2003, the Registrar General, India, appointed under sub-section (1) of Section 3 of the Registration of Births and Deaths Act, 1969 shall act as the National Registration Authority and he shall function as the Registrar General of Citizen Registration.

The objectives of creating this identity repository are two-fold:

• (i) Helps in better utilization and implementation of the benefits and services under govt schemes;
• (ii) Improving national planning and security.
  
  

Billion-Dollar Questions: First Set

When there is already a statutory body/agency/entity, viz., National Registration Authority, lawfully operating with parliamentary sanction with effect from 7^th January 2004 (the day The Citizenship (Amendment) Act, 2003 came into existence), why was UIDAI created to replicate the effort of capturing resident and citizen information, without Parliamentary sanction and in violation of the Constitution?

 

What is the ulterior motive behind the project being implemented despite being rejected by the Parliamentary Standing Committee on Finance?

Powers of Central Executive   

The Central Executive is entitled to exercise executive functions with respect to all those subjects which fall within the legislative sphere of Parliament (Article 73). 

The Constitution makes no attempt to define ‘executive power’, or to enumerate exhaustively the functions to be exercised by the Executive, or to lay down any test to suggest as to which activity or function would legitimately fall within the scope of the executive power. The truth is that the executive power of a modern state is not capable of any precise or exhaustive definition. 

The government in exercise of its executive power is charged with the duty and the responsibility of carrying on the general administration of the state. The scope of the executive power may be said to be residual, that is to say, any function not assigned to Parliament or the Judiciary may be performed by the Executive [Jayantilal Amrith Lal v. FN Rana; AIR 1964 SC 648], or governmental functions that remain after the legislative and judicial functions are taken away [Chandrika Jha v. State of Bihar; AIR 1984 SC 322].  

The executive power of the Union of India, as is well-known, is vested in the President [Article 53(1). The President exercises his functions either directly or through officers subordinate to him. Further, executive power, which runs co-extensively with the Legislative, is carried on by the Ministers and other officials. In order to effectively discharge its duties, each Ministry in the Government functions through various bodies and agencies, attached offices, boards, councils, bureaus, authorities, divisions, corporations, associations, commissions, undertakings, directorates, departments, etc.  

So long as the Executive enjoys majority support in the Legislature, it can go on discharging its policies and no objection can be taken on the ground that a particular policy has not been sanctioned by legislation. This, however, is subject to limitations, e.g., the executive cannot ignore a constitutional prohibition or provision. 

Thus, the executive power is to be exercised in accordance with the Constitution.

Independent Bodies

Thus, the Union Government enjoys the power to set up, within the constitutional and legislative framework, any independent body, agency, entity, authority, commission, corporation, etc. For e.g., various authorities created, through Acts of Parliament, include The Airports Authority of India; The National Highways Authority of India; National Biological Authority  (autonomous and statutory body under Biological Diversity Act, 2002); Steel Authority of India Limited (set up as a corporation); Sports Authority of India Limited () (set up as a society); Telecom Regulatory Authority of India Limited; etc.

Often such independent and autonomous bodies, with revenue generating potential, are established as legal entities with juridical personalities (a.k.a. artificial person), such as bodies of persons, corporations, etc., that are recognised by law as the subjects of rights and duties.

Such juristic entities have perpetual succession and a common seal with powers: (a) to acquire, hold and dispose of property, both movable and immovable; and (b) to contract, and to sue or be sued.

UIDAI Status

The UIDAI though, which is envisaged to earn revenues through identity verification, is set up as an attached office to the Planning Commission under notification A-43011/02/2009-Admn.I dated 28^th Jan. 2009.  

Of course, the Planning Commission itself, set up through a resolution of Cabinet Secretariat, Government of India, is an advisory body, which only makes recommendations to the Cabinet. The UIDAI on the contrary is a operational outfit that executives some function.

Billion-Dollar Questions: Second Set 

Why did the UPA-II Government set up the UIDAI as a body / authority with no juridical personality? Was it to ensure that privacy laws of the land could be skirted with impunity, and yet no liability? 

Why was Parliament bypassed and a scheme implemented unlawfully, thereby in contravention of the Constitution? 

Or, was it simply to confer benefits and legalise residence of illegal migrants in the country? 

Will Sri. Nandan Nilekani come clean with answers to the above questions? Or, am I perhaps expecting too much from a man who has much to hide?