​

I only wanted to make a withdrawal (Image: Ruth Fremson/The New York Times/Redux/Eyevine)

Started in 2009, Aadhaar holds the fingerprints, iris and facial scans of 600 million Indians. Besides school attendance, the database is used to provide natural gas subsidies to India's rural poor, and to send wages directly to people's bank accounts. It is a way of providing identification to people who may not even have a birth certificate, and has been trumpeted by the national government as a way to stamp out fraud.

Aadhaar was the flagship programme of India's Congress Party, which lost to Narendra Modi's Bharatiya Janata Party (BJP) on 16 May in the country's general elections (see "A social election"). The BJP slammed Aadhaar in the run up to the election, calling it a failure and a waste of money. "They've been speaking out against it publicly," says Reetika Khera, an economist at the Indian Institute of Technology in Delhi. "They've been trashing it."

India isn't the only developing country with a national biometrics programme. There are more than 1 billion people enrolled in biometrics schemes across the developing world. Governments claim the systems are filling an "identification gap" left by a lack of official documentation, such as birth certificates, that citizens of rich countries take for granted.

Power imbalance

Privacy advocates see such systems as causing a power imbalance between governments and citizens. In 2012, the Electronic Frontier Foundation criticised Argentina's SIBIOS system for "opening the door to widespread privacy violations".

Aadhaar's greatest promise was to reduce fraudulent claims of government welfare payments, says Khera. It aimed to cut corrupt middlemen out of India's right to work scheme, through which all residents are guaranteed 100 days' work a year, paid at minimum wage.

"In the old system someone would work 20 days, but the person at the work site who marks attendance would add another zero and make it look like they've worked 200 days," says Khera. "A higher official would make the payment and they'd share the booty, then he'd give a person 20 days' pay and make them sign for the whole 200."

Direct payments to bank accounts associated with Aadhaar do indeed fix the immediate problem of fraud, by preventing fraudsters from stealing someone's identity and setting up false accounts in their name. Without biometrics, "I don't even know that the bad guys are withdrawing my money", Khera says. "Now you need my fingerprint to authenticate."

Weakest link

But it hasn't worked out as planned, because new problems have sprung up. Corrupt administrators who inflate work claims can simply coerce a worker to withdraw the fraudulent payments from their account, or invite the worker to join them in the scheme.

Malavika Jayaram, a privacy researcher at Harvard University, says Aadhaar makes people who are vulnerable take responsibility for preventing fraud.

"You are shifting the burden of responsibility onto the person who is weakest in the chain, expecting the least sophisticated in the system to make sound technical decisions about when to use biometrics," she says. "It's insane."

There are other problems with relying on biometrics to deliver vital services. People's faces and irises change as they age, and some 15 per cent of people in India have had their fingerprints rubbed off through manual labor. As a result, the Unique Identity Authority (UID) of India, which runs Aadhaar, wants data to be entered into the database at birth, but then have people update their biometrics once they are older. This gives them an opportunity to create a fake identity.

"There are kids who have gone and registered three or four times," says Jayaram, adding that people have managed to get their dogs' faces, rather than their own, registered in the database, or pictures of zombies. These are just spoofs, but they show that the system is vulnerable to fakes that could be used fraudulently.

Supreme ruling

And if someone breaks into Aadhaar and steals biometric data, it's very hard to correct. "With other security systems, if someone gets your password you can change it," says Khera. But you can't make a quick change to your irises or fingerprints.

The Indian Supreme Court has taken a stand against Aadhaar too. In February, the court ruled that the government cannot make it compulsory to join the biometric database in order to use a government service. Aadhaar has always been advertised as a voluntary database, but the ruling took the wind out of the UID's sails, says Khera.

Jayaram is conflicted. In a country with no data protection laws, she says such a pervasive government-run system does not serve the people. Yet it could, if legislation were passed that guards the privacy of the citizens Aadhaar was designed to serve. "Two years ago I would have said I just want the project to die," she says. "Now I say, 'How can we make it better?'"

This article will appear in print under the headline "The eyes have it"

A social election

Narendra Modi's Bharatiya Janata Party won a historic victory last week. The planet's largest democracy cast 528 million votes, sweeping him to victory over the incumbent Congress Party by the largest margin in an Indian election since 1984.

Some 243 million Indians now have access to the internet, and with tens of millions of them on Facebook and Twitter, the candidates made heavy use of social media.

Modi is known for his active online presence – he has more than 4 million followers on Twitter, and in November 2012 he gave a speech concurrently in 26 locations across India using a holographic projection of himself.

Source: New Scientist URL: http://www.newscientist.com/article/dn25593-indian-election-win-threatens-biggest-biometrics-bank.html?full=true#bxdn25593B1