Amazon Is Asking Indians to Hand Over Their Aadhaar Biometric ID
buzzfeed.com
buzzfeed.com
This whole AADHAAR linking business has been a point of contention in India over the last year as the government is slowly mandating linking your AADHAAR number with all kinds of contracts and services, from rental contracts to telecom providers to bank accounts.
If anyone deserves blame for this kerfuffle, it's the government.
SSN for services is par for the course in the US. My cable company has mine.
Which seems broken too. Why don't they just let you prepay for service such that they don't need any identity information?
So identifying the customer provides the ISP with neither the identity of the person using the internet connection, nor any more information (than the service address) about how to locate the person using the internet connection.
So, even if you believe it is right and proper that ISPs are deputised to track down internet users on behalf of the government: why is it advantageous that they identify their customers?
I'm not sure what logical point you're trying to make. They've identified the user of the Internet connection; the user is the accountholder. The strong identification of that accountholder follows them if they disappear, which is useful for both receivables and security/LEO. That's the advantage.
Nope. In that case you are entirely clear unless you knew their plan in advance and still let them do it.
> Or you lend your friend your car and they go rob a bank with it
Same as above
See the Ryan Joseph Holle case from 2004
I've long since resigned myself to the fact that getting privacy is a struggle and costs money, and most people won't bother.
For cable you'd have to load a prepaid balance into your account, from which the the cable provider could debit by usage. As soon as the balance hits 0, service is shut down.
Most people don't want to deal with that hassle.
Who took them down, you ask? That oh so useless CFPB.
Edit: Here they are. Look at the image of this woman’s loan:
https://www.freep.com/story/money/personal-finance/susan-tom...
Which I consider - independently from this discussion - as a very good idea. Indeed: In Germany when getting a Digital Subscriber Line most providers will also give you the option to rent the router or modem. But nearly all subscribers know that increasing running expenses this way is nearly always a bad idea, so they know that one should better buy some decent router/modem that one owns.
To give an example, a company will hand you a $1K smartphone for as little as $20. The only guarantee they have that you'll pay the remainder is that you have a history of doing so, they gather this history from credit ratings agencies.
In order for you to be uniquely identified they need a unique identifier. Even full name + birth location + birthdate may not be unique given enough data-points.
SSNs aren't fit-for-purpose. But the purpose of uniquely identifying an individual is a valid one and likely a hole that will need to be filled one way or another (and there are many good concepts to replace SSNs).
So no, a national ID is not necessary for the purposes of creating trust.
At best it is simply verification of what the card says in human readable terms (both the short number on the front and the long text on the back).
Only the card in it's entirety is valid authentication of who you are.
The postal service also demands the card, not only banks and the state, though only if you have packages marked 18+ or PostIdent.
You need a birth certificate to get a passport [1]
You need a passport to get a driving license [2]
In order to vote you need a national insurance number [3], which is issued to you on your 16th birthday, via your guardian's/parent's electoral registration information.
Ergo a birth certificate is a de-facto national ID (or immigration documents)
[1] https://www.gov.uk/apply-first-adult-passport/photos-and-doc...
[2] https://www.gov.uk/id-for-driving-licence
[3] https://www.gov.uk/national-insurance/your-national-insuranc...
I don't have a british passport, a british drivers license, but I do have a NI number. I can vote, I can open bank accounts, I can get amazon parcels, I can do normal daily things without them. The only people who have my NI number are 1) the electoral register, 2) my employer, and 3) hmrc (as far as I'm aware at least).
I've not shared it with Amazon (who are the company mentioned in the post), or with my utility provider, or with my broadband provider. I've also not given them my passport or drivers licence, and yet they all seem perfectly capable of verifying I am who I say I am, all without me having any form of national ID.
That was a govt. mandate, they used to.
What the cable company usually does genuinely need is a physical location, which isn't very good for someone with hardcore anonymity needs like a criminal or a spy, but fine for those of us concerned with needless data leakage.
http://www.zdnet.com/article/id-card-security-spain-is-facin...
http://estonianworld.com/technology/possible-security-risk-a...
All tied to the Infineon TPM being broken and apparently nobody bothering to audit it before -- I don't know -- buying cards with it for your whole country?
And to think that people still believe in the secure online voting utopia. As long we will rely on humans to write the code, verify, and patch the online/electronic voting systems, they'll never be secure. So you might as well get them off your mind.
That was the point of the Equifax hack. To push biometrics. They have been itching for the mark since way back. It's getting close.
Did you ever get the felling you're being followed?
Are you not familiar with the Revelations of St.John The final book of the Bible, prophesied the apocalypse
He forced everyone to receive a mark on his right hand Or on his forehead so that no one shall be able To buy or sell unless he has that mark Which is the name of the beast and the number of his name And the number of the beast is '6 6 6'
What can such a specific prophecy mean? What is the mark?
There is still a concern though. If every service that you consume uses Aadhaar as a primary key, it becomes trivial to track the movements and activities of every citizen. I’m certain that for a fee to a shady person you’d get a dossier of places a person has been, where they’ve stayed, who they’ve spoken to, what they’ve spent money on. That’s not theoretical - you can get this info on a Chinese citizen today for less than $100 if you know whom to talk to.
I've also heard Verizon, or maybe another American company, also offers access to SMS via the website? That's a disaster waiting to happen.
Aadhar is not the same as SSN.
https://cis-india.org/internet-governance/blog/aadhaar-vs-so...
https://scroll.in/article/823570/despite-the-comparisons-ind...
If so, then that basically means the government knows who you are shopping with. That's all sorts of overreach. Unless it's for tax purposes, I don't see why the government needs to know who you choose to buy from. What if someone buys from a controversial source - does the Indian government really need to know what sort of porn companies someone purchases from?
And if it's just an ID, then how does Amazon know that someone hasn't stolen the ID and just provided it for identity fraud? Or do you also have to provide some sort of biometric verifier also? Either case sounds pretty fraught with difficulty.
In Australia, everyone has a Tax File Number. It's not that well known, but retailers who ask for the TFN are breaking the law and will be fined a huge amount of money.
You can just not give your employer your TFN, and they'll withhold your tax at the maximum rate, and you can get a bunch of money back after your tax return. Your TFN is just a way for the ATO to figure out how much tax to withhold so your tax return is more correct.
Anyway, Australia and New Zealand are interesting, in that there is no single number that maps to a person. You can use your drivers licence number, or your passport number, or your TFN/IRD number, depending on the situation.
When they introduced photo drivers licences in New Zealand, there was concern in them turning into a de facto national ID card.
Section 8 of the Privacy (Tax File Number) Rule 2015:
TFN recipients must only request or collect TFN information from individuals and other TFN recipients for a purpose authorised by taxation law, personal assistance law or superannuation law.
(2) When requesting an individual’s TFN, TFN recipients must take reasonable steps to ensure that:
(a) individuals are informed:
(i) of the taxation law, personal assistance law or superannuation law which authorises the TFN recipient to request or collect the TFN (ii) of the purpose(s) for which the TFN is requested or collected (iii) that declining to quote a TFN is not an offence (iv) about the consequences of declining to quote a TFN
(b) the manner of collection does not unreasonably intrude on the individual’s affairs, and
(c) the TFN recipient only requests or collects information that is necessary and relevant to the purpose of collection under applicable taxation law, personal assistance law or superannuation law.
> retailers who ask for the TFN
Either way, the whole biometric scare in this case is nonsense.
In Brazil we have a tax number (CPF) and one or more personal ID numbers (state police RG, federal drivers license, passport, etc) which are roughly on the same level regarding personal identification, but which don't matter for tax purposes.
It is mandatory to give your CPF to merchants when they have to invoice the customer, as you (or your CPF) will be one of the parties in that commercial contract. In the case the customer is present in a retail transaction, the retailer can just give you an anonymous receipt. In some states, the customer can give their CPF in order to get some tax refunds.
In either case, an electronic copy of the invoice is sent to the government to account for the taxes, and the invoice must detail exactly what was traded between merchant and customer.
Besides all that, usually you have to identify yourself with both CPF and a personal ID, perhaps leaving a photocopy of both documents, as the CPF number just says you are a taxable personal entity, but it doesn't positively identify a person, as the tax authorities doesn't store any biometric information. The polices (state and federal), on the other hand, have photos, signatures and fingerprints.
There are multiple issues with this identity. The Govt is using private players to enrol the residents into this platform. There were multiple instances where people paid bribe to get multiple IDs in different name. And, the enrolment agencies with MoU with Govt can keep the data of residents, including biometric data. There is even a search facility available with around 1500 users who can search any details about 1bn+ people.
Above all, if your ID is misused, you can't approach courts. You can lodge a complaint with Govt call center. Only Govt, after investigation, can approach a court on your behalf. Other option is to approach a constitutional court directly, which is expensive.
The Supreme Court is supposed to take up this issue sometime in the near future.
So 'Amazon asked my biometric data' is just complete bullshit. It didn't.
On the other hand, it's the government that has normalized the association of Aadhaar to every aspect of your life. The fact that it's been contested in the SC does not change that. It's in that sense that I am giving them blame.
In today's world not only is SSN vital to everyday life, it is also ironically one of the least secure means to establish ID. Having your SSN out in the public is potential financial ruin, and we generally need to hand out that number to various private organization, and individuals. And if the Equifax leaks are any indication SSNs are the weakest link in society.
I'm not sure what country you live in, but US citizens most certainly are not required to give their fingerprints to the DMV or Customs/Immigration when flying internationally.
"Fingerprints, including thumbprint, are collected by DMV for added security to your driver license information"
-- https://www.dmv.ca.gov/portal/dmv/detail/dl/how_info_shared
If your experience is different (I may be misreading your response), maybe it varies by office or it's been a while since you've registered in a DMV office in CA?
But anyway, off the top of my head:
http://www.nytimes.com/1989/02/05/us/3-accused-of-murder-in-...
>The police later discovered that a thumbprint from the corpse did not match the one on Mr. Hanson's California driver's license.
Biometrics can be trusted only as far as one can trust the source of the biometric info being provided. If you're getting biometric info as digital images, you'd have to be sure the images came directly from the person, only for this validation, and (if you want to use this validation for authentication) voluntarily.
The first two can be achieved only if the biometrics are given straight to the government's biometric verification authority, instead of whatever service needs to verify your id taking them and passing them on to the government. The latter is like giving your Facebook username and password to a third-party just so they can verify your Facebook account, the former is like an SSO service.
I have not seen a single SSO-like implementation of biometric Aadhaar verification in India.
And, of course, the third requirement cannot be fulfilled; biometrics are not passwords.
As for the later part I feel that, again, the DMV already takes our biometric data, and I would think the same could apply for people in India. Someone is issuing passports, someone has to create valid means of identification. I mean how else is the government dispensing welfare, social aid, or making sure they're accounting for taxes properly.
Looking at how the Aadhar authentication process works indeed the biometric data is being validated by the government.
So, yes, clickbait article.
In their own words: https://twitter.com/UIDAI/status/934731727808774144
This whole FUD about Adhaar is really sad to see. It's a useful service and we desperately need a national ID. Until now different things require different IDs. Voting card, ration card, PAN card, Passport, Driving license, and so on. With Adhaar we finally have the chance to move to one unique ID for every citizen. Of course like everything done by government, there are inefficiencies and bureaucracy, but it's markedly less than what we face in other IDs.
No, that would be a ridiculous thing to be confident about.
> Are we prepared to face such situation?
I hope so. I have trust in this admin a bit more than previous ones. But long-term, I don't know.
> Would the government let you know if the database ever got hacked?
They are bound to respond to an RTI inquiry.
> What guarantees do we have that the politicians won't use it for their advantage?
None, just like anything else. Just the assurance that we all get to vote them out if we want.
Their past behaviour has not been good [1].
Trust is the whole problem. Many like you trust this government (why is something I can't understand, other than their effective propaganda, but let's leave it at that). But there are many who don't. It's not just about privacy, it's also about things like fear, religious profiling, autocratic tendencies, curbing of freedoms. It's also not about just the current government, but of governments to come. A non-mandatory aadhar would give those who don't trust the system a choice to remain out of its programmes and perhaps voluntarily pay higher costs or forego any benefits. But this government has not given any such choice. It's deeply discomforting to be forced to give all this information to an entity one doesn't trust.
[1]: https://thewire.in/146791/uidai-invokes-national-security-re...
Treating the Aadhar authority as a partisan object is to make a mistake.
It was conceived by the Congress, and as an agency, it is designed to survive all normal parties which come to power.
It is more an arm of the Government of India, its bureaucracy and underlying machinery - than a political function of whoever is the ruling party at the time.
To discuss of it in terms of parties, is to pretty much fall into one of its defensive design patterns - because this agency is designed to appeal to any party in power.
A significant amount of design and political thought has gone into this agency, and in the way it has strategically expanded its remit and powers.
In short - UIDAI was designed from to avoid the political pitfalls of modern India and exist forever.
Its only real weakness is scrutiny of its results and methods, and its eventual necessity to handle actual crisis.
Do note, that this has already been planned for, because the Agency is designed to push responsibility away from itself, - instead it gives people the ability to use their APIs and take the responsibility on themselves.
1. This Govt. has, in a recent affidavit to the Supreme Court, claimed the Aadhaar database has never been hacked.
2. Other government agencies — including state governments and the National Informatics Centre have made Aadhaar details and data public, or accessible publicly.
In the case of the National Informatics Centre, supposed to be "the premier science & technology organisation of Government of India in informatics services and information and communication technology (ICT) applications" and is "a part of the Indian Ministry of Electronics and Information Technology's Department of Electronics & Information Technology", an API proxy to the Aadhaar eKYC service was made available on the public internet:
i. With an HTTP, not HTTPS, endpoint;
ii. With a single auth-token, used for all calls to this API proxy, embedded in an Android app the NIC put out;
iii. That was abused publicly by someone for their Android app providing access to "demographic data like name, address, phone number of individuals" without any authorization required.
3. There are no existing data privacy laws. There are no laws to punish, or even state what can be done, in situations of data breach.
4. The Govt. is just now in the beginning stages of forming data protection laws.
The agency itself disclosed Aadhar data at some point, so it remains to be seen if they will take themselves (or anyone at this point) to court.
Source?
> 2. Other government agencies — including state governments and the National Informatics Centre have made Aadhaar details and data public, or accessible publicly.
So that means the government has been truthful? As soon as they start lying we'll have the recourse of suing. Don't worry.
Ineptness of government agencies is there in everything. Trains run late and the bathrooms smell. Doesn't mean we need to shut it all down. We carry on and try our best to improve things. Laws will slowly but surely catch up. Enforcement will catch up. This is the only way we can progress.
I made no such assessments; I only laid out the facts as I found them. If you ask me for such an opinion, I'd call it technically correct and disingenuous; like claiming the left hand didn't steal what the right hand did, when the person themself is suspected of thievery.
> Laws will slowly but surely catch up. Enforcement will catch up.
Sure. But the mad rush to get everyone on the system by force should come strictly after these.
> Doesn't mean we need to shut it all down.
I did not call for anything in the slightest to this effect. I was merely laying out the facts.
Please do not make the mistake of conflating the ruling party with the machinery of the Government of India.
Aadhar is a child of the GoI. It has enjoyed support by both parties, and was the brainchild of the previous Majority member in the coalition.
I assure you, that any and all hopes vis-a-vis aadhar, placed on the ruling party are in vain.
This is exactly the kind of scenario that Americans would be afraid of - a shadowy government organization, which runs constantly, despite any person or party who is in or is not in, power.
That is what the Aadhar authority is, and always has been.
They have a product they can offer all successive governments, which will ensure its continued survival.
The party in power is irrelevant.
I know how partisan political discussions get, which is why I am highlighting this point. IT doesn't matter who is in power.
Agree 100%. Adhaar is good for the people no matter who is in power.
You can't. Just like you can't delete info from the RTO databases.
What was this desperate need you talk of? Its original vision was to plug leakages and pilferage in governmental social welfare and subsidy programmes, and not as a mandatory national unique ID. It was targeted at only people who wanted to participate in those welfare and subsidy programmes, and not for every citizen.
It hasn't replaced any of the other IDs - we needed n cards earlier, we still need those n cards. If a person didn't have any intention to travel outside India, there was no mandate to go get a passport. If a person didn't want subsidized rations, there was no mandate to get a ration card. But now we need this additional n+1 card and as much additional effort to link all the others to this card. How can the effort be markedly less when it requires every citizen to get their cards linked to everything else under duress of having some service cut, but with limited service centres and their employees very aware of the opportunities to extort money from desperate people?
Name, UID, gender, age, address these are not biometric info. In fact they are part of your ID.
> What was this desperate need you talk of?
I explained it in my comment.
> Its original vision was to plug leakages and pilferage in governmental social welfare and subsidy programmes, and not as a mandatory national unique ID. It was targeted at only people who wanted to participate in those welfare and subsidy programmes, and not for every citizen.
Vision and purpose can change. Nothing to worry about. Originally the purpose of cellphones was to talk and text. Now you watch Netflix on it.
> It hasn't replaced any of the other IDs
It will. Eventually there will be no need to link it to other cards because UID will be enough for everything.
I’m sorry you can’t see the privacy implications of Aadhaar. If it’s easy to track every single place you go and every rupee you spend, it affects you in a few ways
Citizens start self censoring themselves. They subconsciously stop engaging in activities that are legal but might be traced back to them. I’ve personally done many things that I’d rather people didn’t know about. I might have dabbled in substances, for example. Maybe I might not have done that if I had known that the eye of Big Brother was watching.
You say elsewhere you’re confident that whatever the abuses of the government, we’d be able to vote them out. With the tracking ability they’ll have in a couple of years, that might no longer be possible. Who would show up to a protest if they knew the govt would be able to track them there?
Ultimately it comes down to this - Indians enjoy a lot of privacy and anonymity because they’re one amongst 1.3 billion people. Paradoxically they don’t value this much at all. Given a chance they’d gladly trade privacy for wealth. It’s not my place to say if that’s a good trade or if they should make it, but you don’t really know what you got till it’s gone.
How so? How can it make it easy to trace the ₹13 cash I used to buy a cig?
> I might have dabbled in substances, for example. Maybe I might not have done that if I had known that the eye of Big Brother was watching.
How does having a UID help the government in tracking your weed smoking habits?
> With the tracking ability they’ll have in a couple of years, that might no longer be possible.
This is the point we go off the rails. You're delusional.
I'm sorry you think so. I agree that I could have made my case better, and normally I'd take a stab at it now that I have a full keyboard in front of me. But your ad hominem attack makes it not worth my time.