The truth about Aadhaar’s biometrics

The opposition to Aadhaar mostly centres on the issues of surveillance and privacy. While these are very important issues, the lofty platform on which Aadhaar stands is supported on the myth that biometric based identity is infallible, robust and safe. None of this is true, which therefore brings into question the very utility of Aadhaar, as also the unforeseen complications it may cause.

1. Need to update biometric information throughout lifetime

This is enshrined in sections 6 and 31(2) of the Aadhaar Act.



a. This flies in the face of UIDAI’s repeated advertisements that Aadhaar enrolment is a “one-time” affair. It is not and will never be!

b. This recognizes the fact that biometrics is a changeable entity. Some of the obviously imaginable reasons are ageing, manual labour, injury, illness, etc. But is there a way whereby a person can look in the mirror or look at his fingers and estimate that he is due for update? There is no objective means to comply with the aforementioned sections.

c. Since the promise of Aadhaar as a unique identity hinges on the uniqueness of biometrics, it would be logical to assume that any update to biometric data should go through the same rigour as a new enrolment. Regulation 19(a) under Chapter IV of the Aadhaar (Enrolment and Update) Regulations, 2016 is pretty clueless here:


What biometric authentication, when the purpose is to update the biometrics? Is there implied expectation that the person is supposed to revisit the enrolment centre before all ten fingers and two irises go out of range?

d. The conditionality imposed here is without precedent or law, not even for the worst convicts. Aside the ethical question, it is potentially a perpetual source of harassment, with no clearly defined solution.

e. Periodic update of biometrics has already been institutionalized for the poorer sections of our society through such things as mandatory Aadhaar authentication for PDS rations. The other India can be easily netted by such things as mandatory eKYC for mobile SIMs from time to time.

2. No access to biometric records in the database

Section 28(5) of the Aadhaar Act disallows an individual access to the biometric information that forms the core of his unique ID.


a. This leaves no room to verify whether the biometrics have been recorded correctly or not in the first place, when that same information forms the basis of identity.

b. This leaves open the possibility of fraudulently replacing a person’s biometric identity. Even the enrolment operator (with a software hack) could upload someone else’s biometrics against another person.

c. This is totally unlike other identity documents (like say passport), where all information necessary to serve as proof of identity is printed on the document itself. It serves as receipt for the information supplied and is in the custody of the individual to whom it matters.

d. As there is no access to the biometrics in the database, there is technically no means to ascertain beforehand whether one or more of the biometrics is due for update. The only way to guess is after facing an authentication failure on the field.

3. Uncertainty of biometric authentication

Under various sections of the Aadhaar Act (sections 4(3), 7, 8 and 57), an individual may be required to undergo biometric authentication as proof of identity.

a. Biometric authentication is essentially a method of image recognition (or pattern matching) and always results in a probabilistic score, rather than a clear match/mismatch. This has been clearly revealed in the security breach case involving Axis Bank, Suvidhaa Infoserve and eMudhra. The source of UIDAI’s suspicion was that several authentication requests yielded the exact same score, which could not be possible if live fingerprints were used.

b. Variability of the matching score is influenced by a variety of reasons, like the way the fingerprint/iris image is captured, different makes of biometric devices and above all, ageing and resultant changes to the human body. Biometric authentication can thus never serve as a fail-safe proof of identity. It must always be supplemented by an alternative proof, which then defeats the very purpose of biometric identity.

c. The entire burden of uncertainty is borne by the individual. If authentication fails on all counts, the only recourse available is to update the biometrics in the database, which is again governed by ambiguous regulations (see part 1).

d. Large scale authentication failures are already a reality across states where Aadhaar authentication has been made mandatory for welfare programmes like PDS and pensions.

e. Authentication using mobile OTP is sometimes advertised as a failure option to biometric authentication. This is a complete antithesis to biometric identity, as it essentially considers a person’s mobile no. to be his unique ID.

f. Mobile OTP in the context of banking transactions is totally different, as it is used as an additional layer of security over and above PIN/password. Here it is being served as an alternative to biometric authentication, which effectively leaves mobile OTP as the only layer of security.

4. Risk of identity theft

Use of biometric authentication as a means of identity presents a persistent and immitigable risk of identity theft. The UIDAI’s defence is on three counts: one, the database is sufficiently encrypted and protected against breaches; two, biometric collection at the authentication end is encrypted (either in software or in hardware); three, there are penal provisions in the Aadhaar Act to deter any unauthorized access. But the technology behind Aadhaar is such that none of these measures is of any worth.

a. To commit an Aadhaar-enabled fraud, it is sufficient to fake the biometric authentication, so the security of the database itself is not a factor to consider at all.

b. At the authentication end, no matter where the biometric image is encrypted, it is always possible to tap the raw signal just prior to that, using a software or hardware hack as may be needed. It is thus easily possible to both skim the biometrics of an unsuspecting user, as also supplant a previously copied image.

c. If the UIDAI’s defence against copied biometrics is to flag exact matching scores through successive authentication attempts, it can be easily fooled by adding a small randomization to the sample each time.

d. Biometric authentication can even be faked externally, without any software or hardware hack. Fingerprints can be copied from a variety of surfaces (even from the surface of the scanner device itself) and used to create a dummy finger. Similarly, iris image could be skimmed from photographs and supplanted on an artificial eye-like object. It should always be remembered that at the other end is a machine, so a few rounds of trial and error are all that would be needed to perfect the fraud.

e. Through all the above, the only assurance that biometrics are captured from a live individual is the honesty of the operator, which is no improvement from the situation without Aadhaar.

f. What makes biometric authentication particularly risky is that biometric identity once breached is unusable for life. Penal provisions to punish anyone are immaterial here. Contrast this with regular authentication systems based on password or PIN. They could be changed as a regular practice, or at least upon knowledge of breach.

g. The potential gains from Aadhaar related fraud are huge, so we should expect people to invest their time, effort and money to stay ahead of the system.

This entry was posted in Aadhaar. Bookmark the permalink.

7 Responses to The truth about Aadhaar’s biometrics

  1. Zac says:

    Have you ever seen Prison Break serial season 5 where the Actor is accused of being a most wanted criminal in the world just by changing his identity by one of his bureaucrats enemy who has power inside the CIA. This kind of things also can happen…

    • Bulletman says:

      Yes, it’s a dangerous situation! But for sure the govt. is on a sticky legal wicket, which is what explains the tearing hurry. If we can hold our nerve for some more time, we’ll really be proud of ourselves.

  2. Pingback: Letter to Supreme Court (Architectural inconsistencies of UID/Aadhaar) | Bulletman Reporting

  3. Pingback: The fallibility of biometrics collected by the Aadhaar programme

  4. Daniel says:

    Is there anything one can do now to resist Aadhar? Or do we finally give in, now that it has been made mandatory for filling taxes?

    • Ram Sharma says:

      Why only filing tax returns? The Modi government has now forced me to enroll for an UID card to even validate my SIM card!

      And since I don’t have all the documents required to apply for an UID card, I have no other go other than to buy a second-hand SIM card to continue using my mobile phone.

      Surely the UID project is the most idiotic & ill-conceived mega governmental scheme (or to be more accurate – scam) in human history.

    • bulletman says:

      It is indeed a precarious situation now. A large part of India actually thinks that Aadhaar is the best thing to have happened in a long time. Though we may care a damn about them, it is for our own sake that we need to educate them now, because the govt. is simply playing on the strength of numbers. We need to present the facts about the technology, than try to scare with privacy/surveillance doomsday scenarios. April 3 is when the next hearing in scheduled in the SC. We need to make as much noise as possible, plus try to get any prominent personality or media house to open their mouth. Again, the arguments should stick to whether or not Aadhaar as a technology is capable of meeting its goals and what conditions it imposes on citizens.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s