Hacker News Reader

Comment by firasd | Hacker News Reader

First of all, Aadhaar is not just being used for welfare schemes. It is a giant database getting linked to everything. I wouldn't be surprised if it will soon be mandatory for booking flights. Plus much of the database has leaked. You can find thousands of Aadhar cards online just by googling.

As far as preventing 'leakage'--the best approach would be to not subsidize products but to move to direct benefits transfer (like food stamps in the US.) The government has been doing this anyway, for things like the LGP cooking gas subsidy. But even that has been problematic in terms of implementation. When it comes to solving corruption, we can't let technocratic bureaucrats come up with solutions in air-conditioned offices and hand-wave away the deprivation and other problems their solutions cause on the ground.

View on HN

And how do you provide DBT - direct benefits transfer - to whom? How do you qualify them? Underpinning all this is identity.

A modern state that cannot establish identity is not very useful.

(Wow, I am being downvoted).

The money goes into people's bank accounts which already have many know-your-customer ID requirements. If also requiring Aadhaar for bank accounts was the limit of its mandate there would be a lot less outrage. The creeping, maximalist scope is what causes the increasing discomfort among people about this program.

So the bank was able to fulfill KYC requirements for someone who qualifies for a below the poverty level scheme?

Lack of papers is what Aadhaar is supposed to cure.

You are passing the identity buck. These people are so poor they live their whole lives without a solid roof over their head.

They don't have a birth certificate, a driver's license, a passport. The mere mention of these documents is somewhat of a cruel joke in their economic context.

They would have to give up a significant part of the benefits to middlemen in the old system.

(edited).

Yes, even the very poor in India have voter IDs and the schemes in question already require a ration card. You started off by asking about how to reduce corruption (and I answered that as long as there are subsidies there is going to be leakage) but you keep bringing it back to some airy theoretical concept about 'identity in the state' when Aadhaar is a practical force in the country right now. I haven't linked my Aadhaar to my phone yet and if the Supreme Court hadn't extended the deadline my phone would have stopped working by now. This thing is a real and present menace, not just a political science question.

> I answered that as long as there are subsidies there is going to be leakage

It used to be the case before but is no longer the case. Aadhaar, even by this very article's admission, states that "Officials estimate that taxpayers have saved at least $9.4 billion from Aadhaar by weeding out “ghosts” and other improper beneficiaries of government services."

$9.4 billion is a huge amount of money saved by the exchequer. That is almost 2% of the India's annual budget. In a country with a very small tax base, every rupee saved is an earning in itself.

That is untrue - aadhar introduces the problem of false rejections.

First - Most of the savings which the govt has attributed to aadhar they later walked back and admited it was due to gas price reductions and not because of aadhar.

Second - auth failures result in people not getting their ration- these are then counted as savings by the govt. if they were correctly accounted as a liability not only would the savings vaporize, additional costs would appear.

> airy theoretical concept

This is personal for you - I am not directly affected by Aaddaar. Perhaps you should step back and ponder the question I had posed. Aadhaar strikes a raw nerve among many. Similar to the debate over ACA in the US.

I am simply trying to understand why.

So before Aadhaar, what required govt photo ID or tax ID verification in India?

In the USA for example, you need photo ID & a SSN to open pretty much any financial account or to fly. Many businesses require ID to do business with them on an adhoc basis. I also know in many countries ID is required to open any telecom account.

Is the fact that aadhaar is attached to biometrics and the fear of future genocide the root of the controversy?

We have a PAN-system which was used for all financial transactions, including things like company registrations, tax filings, bank accounts, loans etc.

Now, you must link your Aadhaar with your:

- PAN, before you can file a tax or register a company

- Bank Account, or else it could be shut down (this was pushed down the parliament via a amendment to the prevention of money laundering act)

Most countries have varying KYC-norms. However, Aadhaar is a very-weak KYC-source. It doesn't require proof of citizenship (foreigners can get aadhaar) or residence (you are required to stay for 180 days in India, but UIDAI doesn't verify this). It doesn't verify proof of residence either (it was meant as a identity document for everyone - even those without homes). Add this to the fact that UIDAI has fired half of the agencies on grounds of fraud who were responsible for Enrollment.

There are a lot more issues with Aadhaar: there is a no proper security procedure, no audit reports have been published ever, and despite the numerous breaches, UIDAI refuses to take a proper stance.

> I haven't linked my Aadhaar to my phone yet and if the Supreme Court hadn't extended the deadline my phone would have stopped working by now. This thing is a real and present menace, not just a political science question.

I guess you are attacking this issue keeping privacy in mind. However, from the Government's point of view, the need for linking mobile phones is to have a secured way of authenticating your Aadhaar related transactions. The Government doesn't want to end up in a liability if a situation arises where the OTP was sent to a person who later claims that the number did not belong to him in the first place. The Government is actually trying to protect itself from future litigations.

This is the same reason many services, including banks and credit card companies recommend 2-Factor Authentication. Since Aadhaar is primarily an authentication mechanism and not a tracking mechanism, authentication can only be performed either by scanning your fingerprints or via a trusted device through an OTP (in this case, your verified and trusted mobile number). Since a fingerprint scanner is not ubiquitous but a mobile is, the Government is for now relying on mobile OTP for conducting most authentications.

While your argument is sound (2-way linking with Aadhaar saves the government from litigation), it is not the argument that the GoI has made for SIM linking.

The AG has argued in court that mobile linking is to prevent terrorists from getting Aadhaar. This is on top of the weird order that DoT issued: https://www.huffingtonpost.in/chitranshul-sinha/no-the-supre...

(tl;dr: DoT quotes a Supreme Court ruling which questioned the government on KYC-norms for telecom industry, which the DoT conveniently reworded to mean "Aadhaar"-only)

You can also view it in the context that the previous AG wasn't working in government interest. In fact, there was a hue and cry about removal of the previous AG by Dr. Subramanian Swamy in the 2G scam case: https://m.economictimes.com/news/politics-and-nation/subrama...

The "terrorists" argument always seems like a big red herring in these discussions. But it's an interesting point that if the government decides you are a "terrorist", which maybe they can do without you ever being convicted of anything, you can be shut out of much of society by being deprived of I.D.

On the other hand, somebody the government doesn't suspect can simply sign up for I.D. like anybody else and carry out an attack at their convenience.

Again voter ID or ration card is not unique.

This would be a good argument if it were true.

>It now turns out that almost all the Aadhaar numbers issued till date – 99.97 per cent – have been issued to people who already had at least two existing identification documents.

Even the poorest in India have had ration cards.

[0]: https://thewire.in/law/most-aadhar-cards-issued-to-those-who...

Yes but that is vastly different from the benefits Aadhaar provides. With a ration or voter ID card, it was impossible to qualitatively figure out if the person was truly below poverty line or not. It was due to Aadhaar that 1 crore+ LPG users gave up their subsidy. This was not due to a sudden change of heart for the fellow poor Indian citizen. It was instead the realisation that Aadhaar was linked to all bank accounts and it would become evident to the government how many of those are really poor. That's precisely the reason so many voluntarily gave up subsidy that they were illegally claiming.

A ration card was being issued to every Tom, Dick and Harry before Aadhaar. The purpose of a ration card was only for those below poverty line and during war times. Plenty misused it for commercial purposes. It's so much better to procure subsidized rice at 2 rupees per kg and sell it in the open market for 50 rupees per kg. Government had no way to track this corruption.

You might look at it as just a replacement for voter ID and ration card, but the real difference is felt by that poor man who is finally getting what was due to him.

On benefits because of LPG subsidy: the benefits are vastly inflated in the government press figures. The real numbers are around 200-300cr if you remove the existing initiatives and inactive connections[0]. If you factor in the cost, this is not worth it.

>the real difference is felt by that poor man who is finally getting what was due to him.

The poor man was screwed by the middleman earlier (aadhaar does not solve quantity fraud - your fingerprint matching does not guarantee that the shopkeeper gives you exactly 5kg of your quota of ration) and continues to be screwed by the middleman. At the same time, the DBT scheme has seen intense opposition from people on the ground.

>According to a press note issued by the campaign, Rai did not deny the results of the survey that said 97% of people are unhappy with the new system.

Rai here is Jharkhand’s food minister Saryu Rai

Daily Wage laborers have been most impacted by DBT[1] in their ability to get benefits timely because of exclusion issues with aadhaar, but the government keeps marking these figures off as "savings".

[0]: https://medium.com/karana/lpg-savings-due-to-aadhaar-is-only...

[1]: https://thewire.in/rights/jharkhand-nagri-ration-pds-direct-...

This implementation of DBT sounds crazy.

If the market price of wheat is Rs. 30, and the old system was that the ration shop used to sell it at Re. 1 + the ration coupon, then the value of the coupon was Rs. 29.

If the new system was that you put Rs. 29 into everyone's bank account, then well maybe the ATM is a longer walk than the shop etc. But if the new system is to give people only Re. 1 then no wonder there's a riot!

Am I reading your [1] correctly? The problem is a 30-fold reduction in subsidy, not a new delivery infrastructure?

Going by your example, the government deposits Rs. 29 into the account. The beneficiary has to pay Rs. 1 and withdraw the rest from bank.

You're reading it wrong. You get 29 INR in your bank account, and add another 1 INR to pay 30 to the subsidy to the shop.

But while earlier it was just a walk to the shop and getting your ration card stamped, now you must:

1. Go to your bank (which may not even have a branch in your village)

2. Hope that the network is up

3. Confirm that the money has reached your account. If not, go home and retry (1) on another day

4. Withdraw the money and then go buy your ration at the subsidy shop

Edit: This the relevant quote from the article:

>Earlier, people would take their ration cards [...] and be able to purchase rice at Re 1/kg, with each member of a priority household allotted five kg. Now, [...] – money is first transferred into each household’s Aadhaar-linked bank account. They have to then withdraw this as cash, take it to the local ration dealer and buy rice at Rs 32/kg – of which Re 1/kg comes from the ration card holder [and the rest comes from the subsidy that you withdraw as cash].

OK, thanks!

Sounds like a massive business opportunity for banking. Your village may not have an ATM but I bet it has cellphone signal. Wasn't every Kenyan SMS-ing money around a decade ago?

We're trying this with "Payment Banks". The DBT scheme itself tries to solve it by directly debiting money from your account and crediting it to the shopkeeper's account on a monthly basis automatically, but the real implementation is still cash withdrawls as of now.

The Kenyan-SMS has also led to a monopoly of mpesa in the market, which the RBI is trying to avoid by bringing some decent regulations in the space of digital banking.

OK thanks. So maybe it will get there... with some elephant-sized teething difficulties!

Plus much of the database has leaked.

Honest question: how much does this matter?

For instance, I believe in Denmark your ID number is simply not a secret at all, no more than your name. While in the US, your SSN & address basically seems to let any crook empty your bank account.

Aadhaar number enables identity fraud.

Since paper-aadhaar is still very much accepted as a proof, just having the number is enough (in many cases) to take over someone's identity and get a new SIM issued, which you can then use for emptying the bank account.

There are also phishing scams happening with Aadhaar since it uses OTP as the authentication factor. We have OTPs as 2FA for bank transactions, and it works because the first factor is still secret (credit card number or your banking credentials). However, if your first factor is your Aadhaar number, the security goes down tremendously, since every organization under the sun is now asking your Aadhaar.

I'm tempted to wardrive Aadhaar OTPs sent over unencrypted SMS.

I think you need an OTP to get online Aadhar PDF. So you can't get paper Aadhaar just by knowing the Aadhar number.

What exactly is paper Aadhaar, just a PDF with the number on it, which you print & bring to the phone shop?

Can you forge one with MS Word or is it somehow more secure than that?

Is voter id card something different?

> Since paper-aadhaar is still very much accepted as a proof, just having the number is enough (in many cases) to take over someone's identity and get a new SIM issued, which you can then use for emptying the bank account.

Weird. Maybe it's different from state to state or probably area to area. Atleast where I reside (Telangana), getting a new SIM requires fingerprint authentication followed by SMS OTP to an existing mobile number. If you do not have an existing number linked to Aadhaar, only then a fingerprint scan would suffice. I have also opened a bank account here following the same procedure. I had to get one number ported and that required multiple authentication too.

Where do you get some with verification?

What do you mean by unencrypted SMS. How do you sms is unencrypted?

See https://security.stackexchange.com/questions/11493/how-hard-...

Add to this that the legal encryption limit for GSM is India is just 40 bits and you can easily wardrive SMSs

SMS is not safe as a 2 factor.

The known attacks I have come across in India include the hacker somehow coming across your sim card number and using that to get a new sim card issued in your name. A lot of people have had their bank accounts drained this way (source: social media posts)

There was another thread in an yesterday on this where someone mentioned they could just rent a cell tower in Malaysia at $10 an hour and broadcast your number as roaming there to get your messages. Also mentioned were mobile number porting attacks though I don't know how viable that would be in India.

There are so many apps with the permission to read your messages on Android. I wonder how many of these upload your messages to the cloud. An attacker could simply get the OTP from there. By creating a malicious app or attacking the database of another app uploading your messages. Also possibly your sim card number which I have seen apps broadcasting in the open, unencrypted.

Another scenario - let's say you have a prepaid connection. You go abroad on a vacation without this number or get sick or whatever, and forget to recharge your phone. The provider can stop your services and give your sim to a new user. The new user now gets all your OTPs.

There are probably more attacks. Messages to your phone are just not a safe choice for 2-factor authentication, but sadly that is the base on which aadhar is built upon. Even today one can open a bank account with just an aadhar number and an OTP. Wait till people start taking loans in others' names.

I like my privacy and freedom.

I dont know how people are ok with Aadhar. Recently the aadhar data of widows in Delhi was leaked. You can find their address and various details.

I've been to the local than to register a cyber crime. Their words: "You are lucky you lost only a few tens of thousands of RS. People are losing lakhs and the Cyber cell cant help them."

What leak exactly? What do anyone achieve by getting your number? Does this outweigh it benefits?

Now you want India to stop subsiding poor? Do you even know the level difference between US and India. And history of political/economic systems?

And who should be making solutions, Internet warriors like you ? Comparing US, then bend over and gives his DNA to get a tourist visa. Hay, I gave it voluntary !

Reply on news.ycombinator.com