Now, even the fingerprints of urban Indians are failing during Aadhaar authentication

Bengaluru resident Shashidhar Rao went to an Airtel store last month to get his Aadhaar number linked to his mobile connection. He had received repeated reminders from the telecom operator, which, along with other carriers, have been warning users to re-verify their connections by linking them to their 12-digit unique identity numbers to avoid discontinuation of services.

But when Rao placed his fingerprints on the reader, they showed up as invalid. “I tried a thousand times, with every single finger,” said Rao. Nothing worked.

Employees at the Airtel store told him he would need to get his biometrics updated. But when Rao went to an Aadhaar enrolment kiosk operated by BangaloreOne, a company set up by the Karnataka government to help citizens with technology-related matters, he ran into a different problem. “They told me that they are not able to capture my fingerprints, and asked me, ‘What do we do?’. I said to them, ‘You tell me what to do.’”

When he called the Aadhaar helpline, an agent asked him for his enrolment number from when he applied four years ago. Rao said the agent then told him, “We don’t have any records for you.”

Biometric authentication lies at the heart of the Aadhaar project. The government has argued that by creating a database of citizens’ biometrics, which can be used to verify their identities, Aadhaar helps prevent leakage of funds in welfare schemes like subsidised food ration supplies.

But authentication failures – because of incorrectly captured fingerprints, poor internet connectivity or a change in biometric details because of old age or wear and tear – have already caused disruption in rural India. Cases of vulnerable people being left out of the ambit of welfare schemes because of Aadhaar have been widely reported over the last two years.

Within urban India, until this year, the debate over Aadhaar was limited to security and privacy concerns related to providing biometric data to the government. But now, with the government asking people to link their banks accounts, mobile phone connections and Permanent Account Numbers used for income tax purposes with Aadhaar, the practical difficulties of biometric authentication have begun to pinch even affluent urban Indians.

Can’t put a finger on it

When Pune resident Yogesha S, who works for a public sector company, tried to link his bank account to Aadhaar, he was informed that his 12-digit number had been deactivated because of biometric mismatch issues. “I went to get a SIM card also and got the same error,” he said.

He went to an Aadhaar enrolment centre to get his fingerprints updated twice. Both times, he was sent a new Aadhaar card, indicating the process had been successful. But when he tried to link his PAN with his Aadhaar number and phone number, his Aadhaar card still showed up as deactivated. He said he contacted an Aadhaar helpline two months ago but there has been no movement on his complaint since.

In Delhi, Priya Talwar, who had moved to the city with her family recently, also faced trouble with biometric verification when she tried to get her daughter’s address changed on her Aadhaar card. “My daughter has a condition called hyperhidrosis, which makes her palms and fingers sweat a lot, so her fingerprints did not work with the scanner,” she said.

Talwar said that the enrolment centre did not give her daughter the option getting her iris scanned for biometric verification, even though the Unique Identification Authority of India takes both fingerprints and iris scans from citizens signing up under the Aadhaar project.

Talwar said her daughter will turn 16 soon and needs to update her Aadhaar information to apply for documents like driving licence and passport. “She does have other ID documents, but seeing how important Aadhaar has become, I thought it would be useful to get it updated.”

Talwar’s mother also faced a similar problem while trying to get her mobile number linked with Aadhaar – the biometric scanner could not authenticate any of her fingers. The person operating the scanner said that her fingerprints could have faded because of age, a problem that many senior citizens have faced. In light of such complaints, the government has reportedly recommended a one time password-based authentication system or iris scans for the elderly for linking their Aadhaar numbers with their mobile phones.

Biometric authentication failures

In an interview to the Hindu Business Line, Nandan Nilekani, the first chairman of the Unique Identification Authority of India, said that when seeding and authentication are done properly, biometric verficiation is always successful.

Critics argue otherwise. In a lengthy rebuttal to the interview, software engineer and privacy activist Anand Venkatanarayanan pointed out that even if the mismatch rates are low, they usually “cluster around” vulnerable groups of citizens, like old people or labourers with worn out hands and cracks in their skin that make fingerprint authentication a problem.

Supreme Court order misunderstood

The problems with biometric authentication have only become amplified since mobile carriers have started requiring users who signed up with ID other than an Aadhaar number to begin linking their Aadhaar too. This followed a government notification which said that the Supreme Court had ruled to require Aadhaar linking of all mobile connections.

This is not true. The Supreme Court only observed that a system for verifying mobile connections would have to be created in the following year but did not mandate the use of Aadhaar numbers for such verification. The Department of Telecommunications then interpreted this as a “direction” to link Aadhaar numbers and issued a notification ordering to telecom providers to comply.

In turn, telecom providers are incorrectly stating in their warning messages to customers that the Supreme Court itself has ordered that their Aadhaar number be linked to their mobile connections. The Court’s judges have been personally witness to the misinterpretation of their judgement – in a recent hearing, when the government tried to argue that the existence of such false SMS messages were hearsay, Justice Sikri responded, “We all know what’s happening. We are seeing those messages too.”

The court is currently hearing a petition seeking the quashing of the Department of Telecommunication’s notification on linking mobile numbers with Aadhaar. The Department has said it will not take action against any customers for not linking their numbers till the case is concluded.

Telecom operators on their part claim they are following the Department of Telecommunications’ orders on getting phone numbers linked with Aadhaar. While the Supreme Court has taken up the case, it has not ordered a stay on the linking process.

Though the threats by banks and telecom companies are continuing, recent messages reviewed by Scroll.in have updated their wording to remove the reference to the Supreme Court. Not all of them, however, are complying with a more recent Supreme Court order to clearly mention the deadline of February 6, 2018, for linking Aadhaar with mobile phones and December 31 this year for bank accounts.

Why not OTPs?

From December, the Unique Identification Authority of India has announced that one time passwords can be used in place of biometric authentication for verifying mobile phone numbers using Aadhaar. One-time-passwords sent through SMS, while riddled with their own security problems, seem to be a less exclusionary alternative to biometric authentication. Venkatanarayanan, the privacy activist, however, pointed out that this may not always be true, since India has low teledensity.

But that’s a problem that biometric authentication has as well, since fingerprint readers need to have Internet connectivity to confirm citizens’ biometrics. As several news reports have highlighted, rural citizens are literally climbing trees to authenticate their ration entitlements. Unlike biometric authentication, however, one time passwords don’t require citizens to visit a physical bank branch or mobile carrier’s store.

For now, most people facing Aadhaar authentication troubles have pinned their hopes on the Supreme Court. It is currently hearing a batch of petitions challenging the mandatory linking of Aadhaar with PAN, bank accounts and mobile connections. Asked what he planned to do next, Rao, the Bangalore resident who had been turned away by Airtel as well as an Aadhaar enroller, said: “I’ll wait for the verdict.”