BACKGROUND
:
Over the past few months, Aadhar ID has been under
attack for the following reasons :
·
Some 200 government web sites hosted personal details of Aadhar holders
·
Airtel goofed up in linking Aadhar ID to beneficiaries of Direct
Benefit Scheme
·
Last week , a TRIBUNE journalist revealed that someone has been
selling Passwords to UIDAI database for Rs 500 and , over the past 6 months , data
of millions of Aadhar holders could have leaked out
·
Some over-zealous government officers have started issuing “ orders
“ which require a person to provide his Aadhar ID , in order to ,
# Appear in an exam
# Get school admission for his child
# Get admitted to
a hospital
# Get himself cremated when dead !
·
Supreme Court is asking the government : “ With such proliferation of Aadhar ID , in
the databases of all and sundry , how do you propose to protect the private /
personal data of Aadhar holders ? “
GOVERNMENT RESPONSE :
Last week , UIDAI came up with the introduction of ( from March
2018 ) a 16 digit Random Number called VIRTUAL ID , behind which
the ORIGINAL REAL ID
can hide !
HOW
WILL THIS WORK ?
An existing Aadhar ID holder ( - of which , by now , there
are over 1,000 MILLION
) can log into UIDAI
web site , fill up a form ( - including his bio-metric ? ) , enter his CURRENT
REAL Aadhar Number ( 12
digit ) and press, “ SUBMIT “
Voila !
UIDAI web server will instantly generate a 16 digit “ Random Number “ called VIRTUAL ID - which now you can provide
to any agency in lieu of the REAL ID ! ( - of course , you will need to write it down
in your diary and carry it with you wherever you go , since you are unlikely to
remember it easily ! )
Now , no agency can get to know your REAL ID , nor be able to “
access “ your private / personal data which is linked only to your REAL ID and
not to your VIRTUAL ID
!
And , you can return to UIDAI website again and again and generate
/ obtain a different VIRTUAL ID , by revoking the earlier generated VIRTUAL ID (
- arrangement to silence those privacy maniacs ? )
Hey , this seems neat ! So why are some critiques still not happy ?
Could it be for following practical difficulties ?
·
Already millions of those 1000 Million Aadhar
holders have given out their ORIGINAL / REAL ID to various Agencies in whose
sever databases , these real IDs will remain
·
These means , dozens of banks ( holding some 550 million bank accounts
) and 4 Mobile Service
Providers ( serving close to 850 million users ), have such REAL IDs in their databases ( -
apart from hundreds of other agencies that you do not even remember having
given your Aadhar Number , digitally online or on a piece of paper ! )
·
How many of these persons
will take the trouble to find an internet-connected computer, log into UIDAI web site , generate
a VIRTUAL ID , note
it down in diary and then systematically visit the web site of his Bank / MSP and
enter their VIRTUAL ID to link it with their REAL ID ?
HERE
ARE UIDAI ARGUMENTS IN SUPPORT OF VIRTUAL ID :
·
People don’t have to give their Aadhar Number and can authenticate
using the Virtual Id
·
Aadhar will not come on the front end device unless the customer
gives it by choice
·
Even during activities such as filing for tax returns online, giving
the Virtual Id number in lieu of Aadhar will make the transaction go through
·
Virtual ID limits the
information available to authentication agencies
·
Citizens will also have the
choice for the reverse – which is not to generate their Virtual ID and continue
using their Aadhar Number each time
·
Networks of Service Providers
will not be able to save the information in any form
·
In case the Service Providers
resort to unscrupulous means of retrieving the Aadhar Number, they will be
conducting a criminal offence and will be punished by law
Now , not being a mathematician or a
software geek , I have following stupid questions , which , I hope the experts
( including those of UIDAI
) may want to answer :
·
Are VIRTUAL ID numbers generated using some Random Number Generator ( such as PRNG = Pseudo Random Number Generator / TRNG = True Random Number
Generator ) ?
·
Do both types of Generators
depend upon some software
algorithm ? ( - a somewhat deterministic logic )
·
Considering the Aadhar Virtual ID requirement ( viz : generation of
data encryption keys ) , is it more likely that UIDAI is using TRNG ?
·
If , given a starting number
( original / real Aadhar Number ) , TRNG generates a “ linked “ RANDOM NUMBER , is it possible to REVERSE this process ?
·
Using BIG DATA / DATA ANALYTICS / Artificial Intelligence / MACHINE LEARNING etc , can one figure out the ORIGINAL / REAL Aadhar Number , from
its counter-part Virtual Number ?
Over a period of few months
, it is likely that the servers of those Agencies , may have billions of sets of linked “ Real Numbers / Virtual Numbers
“
Could such a large enough database ( if some hacker can lay his
hand on it ) , be enough for a software geek to design a Neural Network ( backward
propagation / forward
propagation ) , to reverse the process ?
I am tempted to believe that such a scenario
is entirely possible !
Those who have any doubt might want to look up ( on BBC web site ) , last week’s episode of CLICK , where a software geek gave a demo
of a computer , embedded with an improvised ALEXA ( with speech capability )
A person from the audience was invited on
the stage / given a stack of playing cards / asked to pick one at RANDOM ( without showing it to
either the anchor or the audience ) and requested to just THINK about that card ( -
not think aloud ! )
That person did NOT wear any headset , nor was he, in any way connected to ALEXA by wires or wirelessly –
which was some 15 feet away from him !
Then he asked ALEXA to tell everybody , what card he
was “ thinking about “
ALEXA accurately determined and announced
a playing card held by that person !
How long before an Indian Software Geek comes up with ANJANA (- the “ Unknown “ sister of ALEXA ? ) , which will “ read “ the
databases of Service Providers , and figure out the REAL Aadhar Number , given the VIRTUAL Number ?
Or , let ANJANA reside on the mobile of each Aadhar holder and just “ read “ his mind which has
both the Numbers stored side
by side, in the neurons of his brain ?
Privacy :
RIP !
13 Jan 2018
www.hemenparekh.in
/ blogs