UIDAI - IIT Bombay Partner to Develop Touchless Biometric Capture System

Unique Identification Authority of India (UIDAI) has joined hands with Indian Institute of Technology, Bombay (IIT-Bombay) to develop a robust touchless biometric capture system for easier usage by people anytime, anywhere.

As part of the memorandum of understanding, UIDAI and IIT Bombay will carry out joint research to build a mobile capture system for fingerprints along with liveness model integrated with the capture system.

UIDAI is statuary body that issue Unique Identification numbers (UID), named as "Aadhaar", to all residents of India, and Aadhaar is termed as most sophisticated & world's largest biometric ID system. 

Under the partnership with IIT Bombay, the touchless biometric capture system, once developed and operational, will allow fingerprint authentication from home alike face authentication. The new system is expected to capture multiple fingerprints at one go and aid authentication success rate further. The new system once in place will be an addition to the existing facilities available in the Aadhaar ecosystem.

Such a system will use an intelligent combination of signal/image processing and machine learning/deep learning with a common mobile phone available to most citizens with a good user experience. This will be a step forward in making Universal authenticator a reality.

The collaboration between UIDAI and IIT Bombay through its National Centre of Excellence in Technology for Internal Security (NCETIS) will lead to joint engagement in research and development (R&D) for development of a system for UIDAI.

Aimed at developing indigenous technology solutions for Internal Security forces in broad areas Electronic System Design and Manufacturing, the NCETIS is a joint initiative by IIT Bombay and the Ministry of Electronics and Information Technology (MeitY), under its flagship Digital India Programme.

Last year in December, The joint efforts of several entities including NCETIS and Pune based SrivisifAl Technologies for developing an AI-based Video Analytics Solution had won the 25th National E-Governance Gold Award in Outstanding Research on Citizen-Centric services by Academic/Research Institutions. The project was led by IIT Bombay professor Ganesh Ramakrishnan. 

Aadhaar Issued to Over 90% of Population: Dhotre

Biometric identifier Aadhaar has been issued to over 90 per cent of the population as of February-end, Parliament was informed on Thursday.

In a written reply in the Rajya Sabha, Minister of State for Electronics and IT Sanjay Dhotre said the UIDAI does not maintain urban/rural bifurcation of the Aadhaar holders, and hence information in this regard is not available.

"As on 29 February 2020, Aadhaar has been issued to 90.1 per cent of the population," Dhotre said.

The UIDAI also does not collect information about financial position of residents.

"In accordance with provision contained in...Aadhaar Act 2016, Unique Identification Authority of India (UIDAI) does not collect information regarding financial status of the resident. Hence, such information is not available," he said.

To another question on whether there are instances of states sharing Aadhaar data with private companies for identification of beneficiaries under various welfare schemes, Dhotre said, "No such instance has come to the notice of UIDAI."

"Unique Identification Authority of India (UIDAI) data is fully secured/ encrypted at all times that is at rest, in transit and in storage. UIDAI has a well-designed, multi-layer robust security system in place and the same is being constantly upgraded to maintain highest level of data security and integrity," he said.

The architecture of Aadhaar ecosystem is geared to ensure security and privacy, which is an integral part of the system from the initial design to the final stage, he said.

"Comprehensive Information Security Policy and Procedures are in place which are reviewed and updated regularly, ensuring appropriate monitoring and control on movement of people, material and data in and out of UIDAI premises, particularly the data centres," he said.

Security audits are conducted on regular basis, he said, adding that security assurance of Aadhaar ecosystem has been strengthened with Aadhaar and Other Laws (Amendment) Act, 2019, which includes stringent penalties and punishment for offenders. PTI MBI

UIDAI’s Aadhaar Software Hacked, Anyone Across the World can Enroll, Confirm Experts

The credibility, authenticity and security of India's Aadhaar has long been questioned but the stubborn, ignorant Indian government never accepted that Aadhaar system might need a big overhaul and despite plenty of evident and obvious proofs both UIDAI and central government always ran for cover-ups.

Eventually in a latest unfortunate and biggest incidence of all, personal information of over 1 billion Indians, has been compromised by a software patch that disables critical security features of the software used to enroll new Aadhaar users, revealed an investigation by HuffPost India.

The software patch that hacked Aadhaar's software is freely available for mere Rs 2,500 -- a bonanza for million of other hackers -- that allows unauthorized persons, based anywhere in the world, to generate Aadhaar numbers at will, and is still in widespread use.

Skilled hackers have disabled the security features of Aadhaar enrollment software and even circulated hack on Whatsapp, said the report.

Ironically, a 'Patch' is defined as a set of changes to a computer program or its supporting data designed to update, fix, or improve it. However in case of Aadhaar, the culprit patch allegedly hacked the whole system putting the database of over 1 billion citizens at stake and in more worst scenario about same numer of bank accounts as well is also in serious threat.

This comes within few weeks after a petition was filed against UIDAI as well as the central government of India, alleging that the fundamental right to privacy of all Indians with an Aadhaar card has been violated because of Aadhaar data breaches that occurred on numerous occasion.

The hack, which indeed has significant implications for India's national security, comes at time when when the Indian government has sought to make Aadhaar numbers the gold standard for citizen identification, and mandatory for everything from using a mobile phone to accessing a bank account.

Also Read - India Is About To Privatize 100 Terabytes of Its Citizens Data

According to HuffPost India, the patch is in possession of it and the online portal had even got it analysed by three internationally reputed experts, and two Indian analysts, to confirm that the database has indeed been hacked.

About 1,224,222,809 Aadhaar (122 Crore or 1.22 billion) has been generated till the writing of this article, as per the UIDAI website.

According to the experts, the patch lets a user bypass critical security features such as biometric authentication of enrolment operators to generate unauthorised Aadhaar numbers. It disables the enrollment software's in-built GPS security feature (used to identify the physical location of every enrollment centre), which means anyone, whether he or she is an Indian or not, can use the software to enroll in Aadhaar system.

Moreover, the patch reduces the sensitivity of the enrolment software's iris-recognition system, making it easier to spoof the software with a photograph of a registered operator, rather than requiring the operator to be present in person.

According to a 2012 news piece of Economic Times, The Aadhaar number repository and its IT infrastructure is run run by HCL Infosystems, which won the contract worth 2,200-crore from the UIDAI, in March 2012.

In July this year, the Aadhaar data of the chief of Indian telecom watchdog, TRAI, got leaked when he pose a challenge on Twitter to hack his Aadhaar details.

Last year in July, the government was warned about the vulnerability of Aadhaar when Indian apex court discussed privacy issues with regard to the Aadhaar card. At the same time, a report from the Center for Internet and Society suggests that the records of about 135 million Indians may have been leaked from four government portal due to lack of IT security practices. Additionally, a loophole was also identified that allows all records in Aadhaar to be accessed by anyone though hackers can find other routes.

To recall, UIDAI has recently announced that from 30th of September, the face recognition feature will be rolled out in phased manner, starting with telecom service providers.

India's ​First Ever Data Privacy Suit Questions Indians' Fundamental Right to Privacy Amid Aadhaar Data Breaches

On an auspicious day of Tuesday, 21 August, Delhi High Court (HC) had issued notice to world's largest biometric ID system -- Aadhaar's issuing body Unique Identification Authority of India (UIDAI) as well as the central government of India on a petition alleging that the fundamental right to privacy of all Indians with an Aadhaar card has been violated because of Aadhaar data breaches that occurred on numerous occasion. And, with this the petition accepted by Delhi HC becomes India's first ever data privacy suit.

The petition filed alleged a violation of the fundamental right to privacy as guaranteed under Article 21 of the Constitution and, as affirmed in one of earlier court case, due to Aadhaar data breaches.

A bench of justices S Ravindra Bhat and Anu Malhotra issued notice and sought reply of the authorities on the plea which also urged the court to direct the Centre to either allow people to opt out of the system or delete the entire existing UIDAI data in view of the security breaches.

The bench has instructed -- the UIDAI, Union of India, National Informatics Centre, and Ministry of Communications and IT -- to submit their response within the next six weeks.

The bench listed the matter for further hearing on November 19.

Also Read - India Is About To Privatize 100 Terabytes of Its Citizens Data

Although there were numerous occasion when it was evidently proved that Aadhaar biometric system is not at all safe and nor maintained securely by its statutory authority UIDAI or Ministry of Electronics and Information Technology (MeitY), govt. of India. But because of embedded journalism, neither mainstream media nor common citizen had so far filed a petition for consistent privacy breach hapenning through over-glorified Aadhaar cards issued to 1.05 billion people till September 2016.

What Does the Petition Asks -

The petition asks the Delhi High Court to do the following:

• Direct the authorities to ensure compliance with all relevant rules for security, including publication of a privacy policy and creation of an information security policy for the UIDAI.



• Direct the authorities to reveal the number of data breaches since the inception of the Aadhaar programme, along with details of how Basheer’s own data has been compromised.



• Appoint an independent investigative/audit committee to investigate all breaches.



• Appoint a neutral ombudsman/verification authority for addressing complaints relating to Aadhaar or other data breaches as well.



• Direct the authorities to provide the option of opting out of the Aadhaar system.



• Award exemplary damages for the failure to adhere to security practices, so as to deter the government and authorities like the UIDAI from being negligent with the rights of citizens again

.

• In the alternative, direct the Centre to delete all existing Aadhaar numbers.

The Petitioner

[caption id="attachment_125742" align="aligncenter" width="700"] Shamnad Basheer | Image - Lawctopus.com[/caption]

The petitioner who filed the suit is a Kerala-based lawyer named - Shamnad Basheer, who's a quite an influential man even before filing the petition else no common men have that much of courage to stand against stubborn and "pro-lynching" government of India the country has today. Besides being an an Indian lawyer, Shamnad Basheer was also a Ministry of Human Resource Development Chaired Professor of Intellectual Property Law at the West Bengal National University of Juridical Sciences, Kolkata, and the Frank H. Marks Visiting Associate Professor of Intellectual Property Law at the George Washington University Law School.

Speaking to The Quint, Basheer said that the court’s decision was a very welcome one, since the judges had rejected the UIDAI’s attempt to conflate this case with the challenge before the Supreme Court, recognising that redressal of security breaches is important.

Basheer also the founder of SpicyIP blog, which is one of India’s leading blogs on intellectual property (IP) and innovation law/policy.

Content sourced from [with addition and editing] these sources - Economic Times, The Quint, WikiPedia.org/Aadhaar, Wikipedia.org/Shamnad_Basheer

[Top Featured Image - arvin febry]