IEEE Technology and Society Magazine - March 2015 - 13

conclusions are general. Two years
later in his talk at the World Bank in
April 2013 Mr. Nilekani was to say
that "nobody has done this before,
so we are going to find out soon
whether it will work or not." Some
days later, Mr. Nilekani openly
declared in his speech at the Center
for Global Development in Washington: "We came to the conclusion that if we take sufficient data,
biometric data of an individual,
then that person's biometric will be
unique across a billion people. Now
we have to find that out. We haven't
done it yet. So we'll discover it as
we go along" [4].
So, first, the conclusion; then
they will wait to find out! Some
observers of the project who have
been saying that it is an experiment being conducted on the
entire population, are justified.
The consequences of failure have
not been discussed, although, in a
talk at the World Bank Mr. Nilekani
said in response to a question
about what he thought was the
greatest downside risk to the UID:
"To answer the question about
what is the biggest risk," he said
"in some sense, you run the risk
of creating a single point of failure
also" [5].
The UID project is proceeding
without the cover of law. There is
only the notification of January
2009 that says the UIDAI "owns" the
database, but says nothing about
how it may be used, or what will
happen if it fails or if there is identity fraud, or if some outside agency gains access to the database. A
Bill was introduced in Parliament
in December 2010, after the project had been launched and data
collection had begun. The Bill collapsed in December 2011 when the
Parliamentary Standing Committee
found it severely lacking, and found
the Bill and the project needed to
be sent back to the drawing board.
MARCH 2015

There is still no sign of any protection that the law may offer. Neither
is there any law to protect privacy.
The UIDAI and Mr. Nilekani have
refused to address the probability of surveillance, convergence,
tracking, profiling, tagging, and
intrusions into privacy that is likely to result from the creation of
the database of residents and the
intended convergence. The link
between technology, databases,
governmental power, and corporate involvement in creating,
maintaining, managing, and using
databases has produced various
scenarios of surveillance that we
continue to ignore at our peril.
PRISM is just one example of ambitions that can fuel a state. In the
same period, the state has already
set up agencies such as the Natgrid, NCTC, NTRO, CCTNS, and
MAC, which exploits database integration that the UID makes possible. In April 2011, the government
made rules under the IT Act 2000,
by which it would be able to access
any data held by any "body corporate." More recently, we have been
hearing about the Central Monitoring System (CMS), speaking to a
surveillance and control approach
that will have the state snooping
on us with no oversight, no prior
permission, and no answerability
at any time to anyone.
The companies engaged by the
UIDAI to manage the database
include L1 Identity Solutions and
Accenture. The UIDAI, in response
to a Right to Information (RTI)
request, claimed that they had
no means of knowing that these
were foreign companies awarded
contracts, given the process of
their selection. Yet, a search on
the Internet reveals the closeness
between the L1 Identity Solutions
and the CIA, and that after a 2011
transaction, L1 Solutions was partly
owned by the French government.
∕

IEEE Technology and Society Magazine

Meanwhile it was also well-known
that Accenture was in a Smart Borders Project with the U.S. Department of Homeland Security. Data
security, personal security, national
security, and global surveillance
are all drawn into a ring of concern, but remain unaddressed.

What Is the UID?
UID is an acronym that stands for
"unique identification." But the first
thing we observe is that this is not
an identity scheme; it is a system
that leverages emerging technologies to help various governmental
and commercial agencies identify
and database persons. Second, UID
is not a card, but a number. Some
have mistaken the paper that is
used to communicate the UID number to the resident to be an ID card:
"[f]irst of all, this is not an ID card
project. There is no card. There is
a number. It's a virtual number on
the cloud, and we don't give a physical card. We do send you a physical letter with your number, which
you keep in your pocket, but the
real value of this is the number on
the cloud" [5]. The identification is
to be done by matching the number
to biometrics that are collected and
kept on a Central Identities Data
Registry. The uniqueness of the
number depends on the biometric
system being failsafe; but biometrics is still at an experimental stage.
Third, while a driving licence,
voter ID, and PAN card may be used
as identity cards, the UID number
is different. The UID is synonymous
with the "Know Your Customer"
(KYC) principle. The UID project
proposed a partnership with Authorized User Agencies (AUA), which
may include banks, mobile companies, LPG service providers, insurance companies, departments with
the state and central governments,
hospitals, and so on. When the
AUAs decide to use the UID, they

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2015