Much has been said and discussed on this topic already, but clearing all the faff, and when you drill down into the nuts and bolts of this state-of-the-art (yet faulty?) system do some real pain points emerge. Having discussed these challenges with a number of players involved in AADHAR, the team is systematically working on mitigating any issues, following lean and "Kaizen" (continuous improvements) principles.

1. AADHAR:
Quick View on Existing Challenges and Resolutions

2. People
Process
Technology
Legal
► A negative perception has grown around AADHAR - its adoption, security and privacy
► Lack of training and awareness for vendor employees has led to various data leaks of confidential information, illegal as per the
Aadhar Act of 2016
► Multiple middlemen and business are charging customers to print AADHAR in various forms, while as per the act any print out of the
card in any form works for identification
► Enrollment of children: With changing biometrics and often no names provided at birth, logging data of new born is extremely
difficult
► No guidelines on safe maintenance of Aadhaar numbers by AUAs
► Proof of address: While AADHAR is only a proof of identity, the unverified address mentioned is used by most organizations as an
address proof, creating security concerns
► Proof of citizenship: AADHAR is accepted as an address proof for creating a new passport, which is a recognized proof of citizenship,
leveraged by illegal migrants to legitimize their presence in the country
► “Function creep” whereby data collected for one or more reasons is used for others to which the identity holder has not consented
► Sharing information: The 2016 Act does not prohibit those with authority to use AADHAR number for profiling, violation of
fundamental rights
► No clear guideline on the time period for which records need to be maintained and how they should be disposed after
► No well defined and cryptographically sound approval procedure in place for data inspection and investigation
► Data collection process is dependent on vendor employees-quality is often compromised
► Currently there is no process/ certification in place by the UIDAI to authenticate field data verification devices
► Security and privacy frameworks for vendors and authentication agencies must be appropriately defined by legal and technical
means
► Inaccuracies in data, leading to mistaken identity or unjust treatment
► Scaling the de-duplication algorithm to ensure uniqueness & quick verification of biometrics against a data set of 1.2 billion people
► All private keys/hashes are stored somewhere in UIDAI, indicating trust is implicitly assumed-a major design flaw
► Use cases and data format: Various use cases and data formats have not been considered, creating errors when AADHAR data is
matched against older records ( e.g. PAN data)
► Previous instances of hard disk crashes at UIDAI servers, resulting in loss of personal information has raised concerns regarding data
storage security
Current Challenges with AADHAR
1

3. Recommended Resolutions
People
Process
Technology
Legal
► Set up third party pre approved audits (only through computer programs) for UIDAI programs, data collection process, inspection of
devices, certification of programs, business continuity and disaster recovery preparedness, security and privacy of data, storage
standards
► Introduce same data standards for names and addresses across all government ids to allow better cross verification of data
► Ensure all field devices are certified and authenticated by UIDAI auditors
► Review and document additional verification, insider attack, business continuity and disaster recovery use cases, focusing on
incident and problem management processes
► Introduce guidelines for audits, recordkeeping timeline, data maintenance procedures
► Initiate a data privacy policy at the National Level to counter any insecurities of profiling and surveillance
► Identify m-aadhar as a valid id recognized for all government and non-government services
► Educate and remediate all legal/government processes where AADHAR is recognized as an address proof.
► Conduct awareness campaigns addressing citizen FAQs regarding privacy, identification, security etc.
► Ensure adequate training and background checks of vendor employees, with stricter vendor contracts for breach in data security
policy
► Collect data for children and connect the information with parent/legal guardian for detailed verification
► To avoid misuse of biometrics (currently public) demarcate identity verification from authentication
► Cryptographically embed Aadhaar id into Authentication User Agency (AUA)-specific ids making correlation impossible
► Store biometric data in string based hashes on servers
► Introduce and implement additional layers of user based security (tokenization, face recognition) and encourage usage of m-aadhar
► Accelerate pilots for biometric based AADHAR verification across airports, banks, government offices etc.
► Conduct a feasibility study on migrating data to a CIDR controlled private cloud for AADHAR data storage to avoid
► Review prospects and feasibility of a user based –blockchain system for AADHAR to avoid large scale security and privacy breach
2