Centre for Internet & Society

Here's a rundown of the three new features that the UIDAI will introduce to make Aadhaar seemingly more secure.

The article by Alnoor Peermohamed was published in Business Standard on January 25, 2018.

While public pressure over the security of might have forced the Unique Identification Authority of India (UIDAI) to introduce new features such as face authentication, and limited KYC, experts who have worked on the system say such updates are incremental and need to keep happening.

Be it Google, Facebook or Aadhaar, a digital system serving billions of people needs to remain secure for which it continually has to evolve, sometimes adapting to issues that are found. The three new features will certainly help improve security, but many questions still remain over how the will tackle the recently highlighted issue of rogue agents.

An article in the Tribune newspaper which claimed that information of individuals was on sale for as little as Rs 500, sparked off the biggest security scare against the digital identity keeper in a while. Even though the asserted that its systems had not been breached, proof that details of an individual could be bought had been delivered. The agency has also not inspired confidence among public and security researchers with the way it has responded to data that has been put in public domain in violation of privacy of individuals.

"As an economy and an ecosystem, we have to understand that there is no such thing as a 100 percent secure system. When it was on paper it was not secure and now that it is digital, it is not a 100 percent secure. Security gaps may exist, but those should not cause large-scale theft of people's identity or cause significant damage. It's an arms race and this means that has to improve constantly," says Lalitesh Katragadda, former head of Google's product centre in India who has helped build

Here's a rundown of the three new features that the will introduce to make seemingly more secure:

Face Auth

or 'Face Auth' is an additional biometric that the will roll out in order to cut down on the number of failed attempts which is increasingly being highlighted as an issue. By matching a user's face, captured through a camera at the time of authentication to the image of their face which was taken at the time of enrolment, the identity of an individual can be more accurately verified.

Facial recognition in the consumer landscape has once again been popularised by Apple's latest iPhone X device that uses an array of sensors and infrared light to map a person's face in three dimensions. The company claims this is more accurate than its previous fingerprint-based TouchID technology, but this isn't the case with UIDAI's facial recognition technology.

The will utilise webcams and low-end hardware to enable Face Auth and therefore the conscious decision to use a person's face in conjunction to another layer of authentication - fingerprint, iris scan or a one-time password sent to the user's registered mobile device was taken.

How exactly applications built on will utilise this new Face Auth feature is not known yet, and neither are the technical specifications. Srikanth Nadhamuni, the former Chief Technology Officer of Aadhaar, envisions a scenario where a farmer using to get his PDS witnesses a failure to authenticate using his fingerprint, prompting the application to capture his photo and check whether it matches with the existing photo on the UIDAI's database.

Activists, however, point out that it's far easier to fake facial recognition software, which in some cases get fooled into giving out positives by simply holding photos of the user in front of a camera. "At the end of the day your face is again biometric, and that comes with the same host of issues that are plaguing the other biometrics that has so far been used," says Sunil Abraham, Executive at Bengaluru-based think tank Centre for Internet and Society (CIS).

Virtual ID

As its name suggests, gives users a stand-in for their 12-digit number if they're worried that it will be stolen, leaked online or misused in any way. Any user will be able to log into an online portal, visit an enrollment centre or use the mAadhaar app to generate a 16-digit 

By virtue, the has built the to be temporary and a user can ask for any number of Virtual IDs - when a new one is generated, the old one is destroyed and can even be assigned to another user. The key here is that only the will be able to make the link to a and number and no-one else.

After years of arguing that leaking of the number itself wasn't an issue, the is finally giving users a tool that allows them to keep their number private. While Abraham agrees that the feature will make safer, he says its effectiveness will only be valid if a user opts in as it has not been made a feature by design.

Nadhamuni argues on the contrary, that making a mandatory process would hurt more people than it helps. "A lot of people in rural India are using their for authentication of PDS and MNREGA and so on and it's working for them.

You don't want to confuse all of them and ask them to create yet another number. You'd have to make a farmer understand the concept of when he's completely happy with the way things are today," he says.

Limited KYC

The process of KYC (Know Your Customer) through has all along given public bodies and private companies access to a user's details such as name, age, sex, address and photograph. With limited KYC, the will categorise a body seeking details into two buckets, ones that get the full information and ones with whom only partial information is shared.

Realising that not all bodies or companies need all the details, is the biggest change that will bring in. The idea is that the fewer places a person's details are stored, the fewer chances of it leaking. Moreover, by giving only critical services full details the is hoping it will eliminate its problem of having to share details with less secure systems.

will also bring in a tokenized system for agencies to ensure uniqueness while not storing a user's number on their databases. A 72 digit alphanumeric UID Token will be generated at the time of authentication which only will be able to map back to a particular number. However, there isn't clarity on who will be exempt from this as there is word that banks and tax authorities will be allowed to store user numbers.

The UID Tokens will also be backdated, meaning all previous KYC attempts a user had made with a particular body or company will also be migrated to the new system, ensuring that if two databases leak, the perpetrators are not able to easily use numbers to match users and improve the quality of the data they've stolen. Some details on this are still missing though.

Security: Work in Progress

Experts who worked on building say that such features were discussed during the very inception of the national biometric database, but were not rolled out until now to avoid complexity. Katragadda, who has worked on building many large APIs at Google agrees that all large systems avoid complexity during the kickoff and add them based on needs of users later.

Like him, both Nadhamuni and even Abraham agree that the new features will make more secure, while the latter had his reservations on how secure it would be which only the fine print would reveal. The experts also agree that the public discourse which security has taken is a good thing, since the digital security of over a billion people is now public discussion.

"Security breaches are like earthquakes. It's better to have many tiny tremors than be oblivious to gaps in our system and lose everything with that one massive earthquake. So it's better to have our ears close to the ground, have ethical hacking competitions where we ask people to hack the system, find gaps in security. The best APIs in the world do this," says Katragadda.

He adds that India should not be scared to build large digital systems for public good in the fear that there will be security breaches. Even the paper based system before had several security lapses, but were not visible. "Otherwise we need to have this holy grail of a system which is perfectly automated and we're at least 20 years away from full robotics," he adds.