杏吧原创

A schoolgirl arriving for class presses her thumb against a fingerprint scanner, verifying her presence. Since April, this has been the scene at a handful of schools in the state of Jharkhand in eastern India. There, the attendance of students and teachers has been tracked using biometrics that are linked with India鈥檚 huge national database, Aadhaar. It is the world鈥檚 largest biometrics database, but now it is under threat.

Started in 2009, holds the fingerprints, iris and facial scans of 600 million Indians. Besides school attendance, the database is used to provide natural gas subsidies to India鈥檚 rural poor, and to send wages directly to people鈥檚 bank accounts. It is a way of providing identification to people who may not even have a birth certificate, and has been trumpeted by the national government as a way to stamp out fraud.

Aadhaar was the flagship programme of India鈥檚 Congress Party, which lost to Narendra Modi鈥檚 Bharatiya Janata Party (BJP) on 16 May in the country鈥檚 general elections (see 鈥�A social election鈥�). The BJP slammed Aadhaar in the run up to the election, calling it a failure and a waste of money. 鈥淭hey鈥檝e been speaking out against it publicly,鈥� says Reetika Khera, an economist at the Indian Institute of Technology in Delhi. 鈥淭hey鈥檝e been trashing it.鈥�

India isn鈥檛 the only developing country with a national biometrics programme. There are more than 1 billion people enrolled in biometrics schemes across the developing world. Governments claim the systems are filling an 鈥渋dentification gap鈥� left by a lack of official documentation, such as birth certificates, that citizens of rich countries take for granted.

Power imbalance

Privacy advocates see such systems as causing a power imbalance between governments and citizens. In 2012, the Electronic Frontier Foundation criticised for 鈥渙pening the door to widespread privacy violations鈥�.

Aadhaar鈥檚 greatest promise was to reduce fraudulent claims of government welfare payments, says Khera. It aimed to cut corrupt middlemen out of India鈥檚 right to work scheme, through which all residents are guaranteed 100 days鈥� work a year, paid at minimum wage.

鈥淚n the old system someone would work 20 days, but the person at the work site who marks attendance would add another zero and make it look like they鈥檝e worked 200 days,鈥� says Khera. 鈥淎 higher official would make the payment and they鈥檇 share the booty, then he鈥檇 give a person 20 days鈥� pay and make them sign for the whole 200.鈥�

Direct payments to bank accounts associated with Aadhaar do indeed fix the immediate problem of fraud, by preventing fraudsters from stealing someone鈥檚 identity and setting up false accounts in their name. Without biometrics, 鈥淚 don鈥檛 even know that the bad guys are withdrawing my money鈥�, Khera says. 鈥淣ow you need my fingerprint to authenticate.鈥�

Weakest link

But it hasn鈥檛 worked out as planned, because new problems have sprung up. Corrupt administrators who inflate work claims can simply coerce a worker to withdraw the fraudulent payments from their account, or invite the worker to join them in the scheme.

Malavika Jayaram, a privacy researcher at Harvard University, says Aadhaar makes people who are vulnerable take responsibility for preventing fraud.

鈥淵ou are shifting the burden of responsibility onto the person who is weakest in the chain, expecting the least sophisticated in the system to make sound technical decisions about when to use biometrics,鈥� she says. 鈥淚t鈥檚 insane.鈥�

There are other problems with relying on biometrics to deliver vital services. People鈥檚 faces and irises change as they age, and some 15 per cent of people in India have had their fingerprints rubbed off through manual labor. As a result, the Unique Identity Authority (UID) of India, which runs Aadhaar, wants data to be entered into the database at birth, but then have people update their biometrics once they are older. This gives them an opportunity to create a fake identity.

鈥淭here are kids who have gone and registered three or four times,鈥� says Jayaram, adding that people have managed to get their dogs鈥� faces, rather than their own, registered in the database, or pictures of zombies. These are just spoofs, but they show that the system is vulnerable to fakes that could be used fraudulently.

Supreme ruling

And if someone breaks into Aadhaar and steals biometric data, it鈥檚 very hard to correct. 鈥淲ith other security systems, if someone gets your password you can change it,鈥� says Khera. But you can鈥檛 make a quick change to your irises or fingerprints.

The Indian Supreme Court has taken a stand against Aadhaar too. In February, the court ruled that the government cannot make it compulsory to join the biometric database in order to use a government service. Aadhaar has always been advertised as a voluntary database, but the ruling took the wind out of the UID鈥檚 sails, says Khera.

Jayaram is conflicted. In a country with no data protection laws, she says such a pervasive government-run system does not serve the people. Yet it could, if legislation were passed that guards the privacy of the citizens Aadhaar was designed to serve. 鈥淭wo years ago I would have said I just want the project to die,鈥� she says. 鈥淣ow I say, 鈥楬ow can we make it better?'鈥�

This article will appear in print under the headline 鈥淭he eyes have it鈥�