Lax state govt officials compromise UID data

In a shocking lapse, many state government departments are storing and using the 12-digit Aadhaar number against the rule book, stoking concerns on the security of citizens’ biometric information.

In a five-page circular dated July 9 to the heads of all departments, Chief Secretary T M Vijay Bhaskar has expressed concern that many departments might have printed complete Aadhaar numbers in their MIS (Management Information System) reports and uploaded them on the website in violation of regulation 6 of Aadhaar (Sharing of Information) Regulations, 2016.

The Chief Secretary has also listed many lapses in storage and handling of the unique identity number. Aadhaar numbers, once collected, are to be stored in a Data Vault, a secure encrypted centralised storage for all Aadhaar numbers. “The Department officials are not aware of how to create such vaults and may end up storing the Aadhaar number against Unique Identification Authority of India (UIDAI) guidelines,” he stated.

“Even while printing or showing the Aadhaar on the website, most of them in the departments are not aware that the whole Aadhaar number cannot be printed. There may be many MIS reports where Aadhaar is fully disclosed,” he stated. However, Vijay Bhaskar has not said that there were any instances of data leak from any department.

The Chief Secretary expressed his concerns even as the state government is making preparations to implement its own Aadhaar Act — the Karnataka Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2018, which will come into effect from August 1 this year.

Almost all the departments that are implementing subsidy schemes like Revenue (providing social security pensions), Food and Civil Supplies (supplying food grains) and Education (Students’ Achievement Tracking System) have been collecting Aadhaar numbers from the beneficiaries. Interestingly, some of these departments have even made it compulsory for citizens to submit the 12-digit number without any legal backing.

Departments unaware

The Chief Secretary has further said that most of the departments do not know how to seed Aadhaar into the database. “When the Aadhaar number is keyed into some type of software, many a time the number of digits may be more or less than 12. Whether the number is as per Verhoeff protocol or whether the Aadhaar number belongs to that beneficiary is also not checked,” he pointed out, adding that at least 50% of the seeded database (between the name of the beneficiary and the Aadhaar number) would fail to match.

The Chief Secretary has, therefore, laid down a set of 13 guidelines for all the departments on collecting Aadhaar numbers, storing them and seeding them for implementing government programmes under the State Aadhaar Act. He has also decided to form an expert committee under the Department of Personnel and Administrative Reforms (e-Governance) to vet notifications to be issued by the departments under the State Aadhaar Act.