Stung by privacy concerns, the Unique Identification Authority of India moved in with a layer of protection to firewall Aadhaar. The new concept of a virtual ID, on the lines of a One Time Password, could be generated to validate an individual's identity for a particular period of time decided by the UIAD. This gives the users the option of not sharing their 12-digit biometric ID Aadhaar number at the time of authentication.
The new concept comes as a huge relief and will bring in the much needed security to confidential and private information of individuals. The question that would remain unanswered however would be what happens to the data that is already out in the open?
Effective March, there will be two layers of security between the Aadhaar holder and the authentication agencies while getting access to the number. From June 1 it will be compulsory for all agencies to accept the Virtual IDs from their users. The latest firewall in all fairness appears very secure at least on paper. There is now a three-pronged strategy to secure Aadhaar. The first one is the 16-digit temporary number which can be generated multiple times, retrieved, revoked or replaced through UIDAI's portal, mobile app or the designated centres. The second safety measure would be the UID token which will be sent by the UIDAI upon an authentication request by agencies. Thirdly, the concept of limited KYC will come into play under which UIDAI will only provide need-based or limited details of a user to an authorized agency that is providing a particular service.
On the flip side, the latest security mechanisms are still untested and the biggest worry are the teething problems that come with any new system. Secondly, confidential Aadhaar data leaks are nothing new and despite several instances, including the recent one involving a scribe exposing that data can be availed for a price, the government continued to remain in denial mode. By introducing security layers, it indirectly admitted to the threat and rushed to firewall it, albeit a bit too late. What would it help the crores of people whose IDs have already been leaked when there was a compulsion to share it at various platforms? While the life of the citizens was chained to the Aadhaar numbers with linkages being made mandatory at every stage, from bank account numbers to welfare schemes, the breach should have been plugged long back.
Government should have been very sensitive to reports of data leaks and brought in a control mechanism like this much earlier. On the contrary, government continued to turn a nelson's eye on the several breaches despite it being flashed all over the net. Minister of State for Electronics and Information Technology Alphons Kannanthanam has even admitted in Parliament that approximately 210 websites of the central government, state government departments and some educational institutes were displaying the list of beneficiaries along with other details and Aadhaar numbers for the information of the general public. Why has the government not moved against all such entities that have flouted the laws openly since the very Aadhaar Act entails punishment with up to three years in prison for those displaying or storing these numbers?
