Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1370 Thanks!
[Music]
it was overwhelmingly depressing and the
dealt with you know CIA illegally spying
on people and Julian Assange being under
constant surveillance and you think it
cannot possibly be worse but it can
because our next speaker is going to
tell you about systems for collection of
biometric data and digital identities
and how they can potentially make lives
worse not just for dozens of people but
for hundreds of millions of people or
billions of people so let's hear it for
Kieran Genoa Garda yes
unpacking the compromises of Aadhaar and
other digital identities inspired by it
Kieran is the founder of Khurana
projects an organization examining
identity programs so he's going to tell
us about the most depressing thing
you're going to hear in this room today
thank you thank you Karen
thanks everyone I'm glad to be here so
um let's get started well as always
these things start with an origin story
so in the beginning they do not have
identity cards
everybody knew you by your name or your
face and then things got a little
complicated and we got ID papers and
before long this wasn't me better be
okay come on technology doesn't like
working on it does not work yes so we
are hackers we like to think all
problems can be solved by hacking and a
decade ago in 2009 in India some of our
kind looked at this ID paper problem and
thought there's got to be a better way
and why do papers have a life of their
own what happens if you lose your papers
do you not have a identity anymore what
happens your papers are confiscated does
that change who you are as a person and
how do we think of this in a better way
and so for inspiration you can go back
to the Voyager spacecraft when the why
is the spacecraft left earth for outer
space it carried this image on it now
this is the aliens edition of sign ID
papers you know who are you humans this
is good for outer space then why can't
we do something like this on earth and
so these people started asking why do
you need to see my ID you can see me my
body is my heading so this is nice
but bodies can go online and so you need
to know somehow extract the soul of a
body and take it online and this is not
an idle reference this is in fact how
they think about it and this is the
statement that they make explaining how
they think about this that your soul
your Atma can be uploaded into the cloud
and then exist online and how do you do
this well the approach they took up
to say collect all your biometrics they
take your photograph
they take your fingerprints all ten
fingers they take two iris scans and
they give you an other which means
Foundation which is supposed to be the
foundation of the rest of your life this
is quite literally now have you enter
cyberspace in their vision now if they
want so much data from you what more
could they possibly want and this is
something that worried the judge of the
supreme court of india who went on to
ask say well are you going to do this
next now at this point you'd wonder is
this satire or is a science fiction well
nope the database of the built has 1.25
billion entries in it and this is how
they announce that number with the
Christmas greeting okay so where do you
keep this data as computer programmers
we often struggle to explain technical
concepts to a non-technical audience and
this is sort of what happened in the
Supreme Court of India when a case
against Radha was being heard last year
the Attorney General mr. KK we know
Gopal who was 87 years old at the time
explained data storage to the justices
of the Supreme Court explaining that it
is stored behind in a complex that has
also at 13 feet high and five feet thick
therefore it is safe
so as you can expect the public phone is
very funny and since then 13 football is
meme in India yeah what are you doing
well it's behind a 30-foot wall so
nothing to worry about but this is a few
word jokes so we can go back to Arthur
Clarke who made the statement you know
that any sufficiently advanced
technology is indistinguishable from
magic
your average person does not understand
how technology works so to them
technology is magic and this essentially
then means that we focus who understand
technology our society's magicians you
got a magic wand you wave it and
problems for solid and this is how
people think this is supposed to work
but we know better we actually know how
technology works and we do not we know
when technology does not work and it is
imperative on us to call it out and
that's what I'm here for today to
explain to you why this technology does
not work and what we need to be doing
about it so let's start off to the
basics
what does other actually collect this is
the database structure they collect
biometrics and the collect demographics
in the biometrics they classify them
into two components the core biometrics
which are your fingerprints and your
iris scans are considered extremely
confidential data and will never be
shared
that's the mandate that they offer but
you photograph which is also biometric
can be shared because it is after all
what goes into an identity card the
other part is demographics they collect
your name your date of birth
if it is known a lot of people in media
do not know when they were born your
gender
you can't declare yourself as
transsexual that's accepted in the other
system and then the collective postal
address and this information is what you
submit when you enroll your biometrics
are then sent for deduplication against
the entire database so there are billion
plus records in there if you right
enroll today they will compare your
biometrics with every single record
already in the database to confirm that
it's not already enrolled now this is
the process that takes roughly about 45
so that's how long it takes for them to
confirm that you are a new enrollee and
you can now have another number that's
guaranteed unique and anybody can apply
the only requirement is that you
physically present in India the law says
you have to be there for 180 days but
nobody checks so you can just walk into
any other enrollment center sign up and
you will have an ID the number when it
is assigned to you is sent you by post
you do not get notified online and the
letter that they give you it looks like
this is essentially the way the confirm
finally that your address is actually
real because if this was you address
you're supposed to receive the card and
therefore you proof of address is
confirmed this as you can expect is a
serious problem for migrant workers so
cannot guarantee where they're going to
be when the letter arrives but we'll get
to that later so the API started
available there are three basic api's
there is a demographic identification
api which unfortunately mistakenly
called an authentication api even though
it's not in what you do is api is if
you're calling the API you submit an
other number and you submit a piece of
demographic information like you say
this other number and this name do they
match and you vary yes or no answer you
do not get any information back or you
can do this with fingerprint
authentication you actually upload a
scan fingerprint and another number and
say do these things match and you get a
yes or no or if you cannot take a
fingerprint for whatever reason you can
ask for a password to be sent to the
phone number that has been registered
and you get a six digit number give it
the number and the other number and say
do the match and then you were afraid
that somebody gave you the right
one-time password and therefore you
authenticated into their account all
three of these ApS do not give you any
information from the database
except there's another one called the
electronic know your customer database
which is used for ID checks for
institutions like banks where you do get
the information back but we'll get into
that again later now if you take just
this minimalist API see very little data
collection apart from biometrics made a
little demography connection and nothing
is ever written back
outside of the KYC api so on the basis
of this minimalism the unique
identification Authority of India claims
that it cannot be used for surveillance
because it does not know anything okay
this is the public claim the repeated
limit except for one little detail the
other number itself is now a universal
foreign key because that's what you use
to authenticate with other into some
other database and who runs those
databases as it turns out it's a
government again most of them are run by
the conrod so if you have a government
that is really interested in
surveillance and a department of the
government runs an ID program which it
claims cannot be used for surveillance
what should the government do when it
really wants to use it for surveillance
but they make it mandatory for
everything and that gets you a situation
where other is officially voluntary but
in practice mandatory which leads to the
next minion idea other is voluntarily
mandatory so let's look at what it's
mandatory for it is mandatory to collect
any welfare benefit it is mandatory if
you want to pay tax or rather pay a file
your tax returns I mean nobody will ever
dare say we will not take your tax money
yeah to file your tax return you need
other if you do not earn enough to file
taxes and you collect welfare you need
other so that's like everybody's covered
to get a birth certificate for a newborn
baby you need an other for the baby to
get a death certificate for someone
who's died you did an other number for
the person who died if you want to get
married well both parties have to
provide an other number and this point
is like what's left who is it optional
for now the death certificate path is
interesting how do you verify the other
number of a dead person
you can't take the fingerprints I mean
the dead can't consent
appart from the fact that your
technology will stop working once the
body gets cold you can't send a one-time
password to a dead person's mobile phone
because that's indistinguishable from
theft my phone has been stolen and
somebody declared me dead I mean he said
is that acceptable so they in fact do
not have any authentication for dead
people someone's dead
you can't get that certificate without
providing an other number and but they
didn't find four other in their lifetime
so what do you wanna do now you just
submit any random number sometimes you
submit your own number sometimes the
coroner submits their number and so now
what you get here is your first instance
of a database that is supposed to be a
biometrically secured and authenticated
completely filling through its purpose
because this is a use case I was
completely not considered yeah this is
not unusual okay the APS I just
described require a license that license
is almost impossible to get so what do
most people do well they just take an
other number and put in the database
they don't bother to check anything
about it so part of what happens here is
in the implementation of other there is
this recurring confusion between three
very different concepts identification
authentication and authorization the
fact that you can accept my ID and
confirm it's legitimate is not the same
thing as confirming that I am the holder
of your identification and it's not the
same thing as me saying I'm okay with
you doing something in my name these are
three different things then I'll give
you an example of where this can go
massively wrong in 2017 the telecom
regulator issued an order asking telecom
companies to authenticate all of their
customers to make sure that there were
no sim cards issued to people that they
do not know who they were issued to so
they forced an exercise across the
country asking telecom operators to go
find their customers and get
them to authenticate with other telecom
companies have become so big in India
than they're turning into banks and so
this happened with one of them and after
this exercise a lot of people started
complaining that they were not receiving
welfare benefits anymore
I mean you authenticate it your phone
connection and your welfare stopped what
happened so this is the stranded a bit
of a scandal and even Swilley we
discovered what had happened all of them
had opened new bank accounts that they
did not know existed and the welfare
money was going to the new bank account
here is how much the external fraud was
and this is just one telecom operator
the telecom operator had obtained a
banking license and they were desperate
for customers so when you went to
authenticate your phone connection they
use that authentication as authorization
to open a bank account and reroute your
subsidy money and you would not even
have been aware of that then and so this
can essentially stole 1.9 billion rupees
from 310 thousand individuals for one
telecom operator alone I think the
numbers wrong it's not three hundred ten
thousand it's 3.1 million I'm sorry I'm
off by one zero so how do you make a
mistake this fundamental in your design
and for this you have to go back to the
Attorney General sure you know the same
day that he said that it's protected by
a 13-foot wall he also went on to
explain what the whole point of other
was and as you can see the assumption
made in other is the individual is
fraudulent unless the proved that they
are not that is the fundamental design
assumption of other so what it has
essentially done is that it's very
carefully replaced your rights as a
citizen with privileges granted by the
state for good behavior
and that should have been a violation of
the Constitution yeah it takes people a
while to realize so this is a very
subtle change that they made that you
were entitled to welfare under the
Constitution of India it was the state's
responsibility to give it you if you
deserved it
but what they did was flip it around and
say you have to be the person who proves
your legitimacy to receive what is
actually due to be you okay and they may
have a term for this they call it the
self-cleaning database this is a
reference I found in a book the first
time I found an expression of how they
thought about this so essentially for
the state to hold you up to your rights
requires considerable resource on the
part of the state and if the state's
running a budget deficit well they're
not going to deliver on your rights as
they're supposed to and this is the
fundamental problem of most developing
economies that you may have rights but
the state doesn't know to give it you
because they're lacking the capacity
so what other does to solve the problem
is to say well if the state can't do its
thing you must do it as a citizen this
is your duty as a citizen now to behave
like a good citizen and show to the
state that you are keeping your data
clean this is not a wavered reference
while this is an author in a book
pointing this out in fact this is how
the state explains this in the
Parliament of India the other system has
a mechanism of self cleaning the data
during course of time so what happens
when you untwist people like this if you
insist
that to collect your subsidies to
collect your rations which is food that
you your duration food if you want to
collect it you must authenticate
biometry team and the technology does
not work for whatever reason your
fingerprints don't scan there is no cell
phone connection say something else has
gone wrong what do you do well it goes
to bizarre extents this is a new story
where a remote village in India did not
have a good mobile connection but
somebody discovered that the top of the
tree there was an internal connection
and so they put a fingerprint scanner on
the tree and now you climb up and put
your finger there and only then you're
given food but this is one example but
obviously there are lots of this so what
happens we can't do this well this is a
diet this is a compilation of reports of
how many people have died because the
technology failed these numbers have
been growing fortunately last year's
Supreme Court insisted that if the
technology doesn't work it is not the
citizens fault and you must provide an
alternative and I don't know what the
current numbers are I don't expect them
much better than this it's probably as a
decimal as it is because the state that
really has no interest in you know
upholding rights so ironically enough
the database design has no feature for
reporting a death the official FAQ says
somebody you're related to has died how
do you report it well we don't know how
the recorded death so just ignore it so
what happens to dead people you know we
have we start off this talk of how your
soul your Atma is uploaded into the
cloud as it turns out now you become a
ghost in the system and you continue to
exist as a fictional entity in a
database because they do not know how to
record that you have died this URL has a
list of possibilities and problems that
arise out of the fact that they do not
recorded it so why are they doing all
these things again and the logical
purpose you know what is it supposed to
do it's supposed to fix a corruption
problem in welfare distribution by
ensuring subsidies are not misrouted and
deliver to someone who did not deserve a
subsidy so the way they do this and this
is a
employee manual from 2014 this is an
extract and the basic idea that is part
of the training for government employees
is that you must record another number
for every person in your database so if
you got like a hundred million welfare
welfare recipients you are required to
collect a half million other numbers how
do you do this well one you can go
door-to-door and collect everybody's
numbers yeah or you can do what's called
an inorganic CD and they use a term
ceding to describe the act of collecting
other numbers so we have what's called
an organic feeding where the beneficiary
comes to you and says here's my other
number and then they have the inorganic
sealing where you take it with other
concept okay it's in the manual so they
also claim this is foolproof because
beneficiaries were claiming benefits in
the names of others such persons will
not be able to authenticate themselves
after all you're supposed to do a
biometric authentication before you take
their name in the database but when you
bring it in organically you are not
doing a biometric authentication and so
what happens where is they also point
out that it is possible for the
government employed to get it wrong and
they just you know possibility of life
so essentially thumbs up to the state
thumbs down to the citizen that's the
design okay and of course bullying a
person to comply is not the same thing
as technology that actually works and
fraud exists as a violation the
technology itself here's a case where an
other number was issued to a guard and
the letter was printed it was dispatched
and the postman had to return it saying
I do not know where to deliver this so
how did this happen as it turns out the
hackers who built this who was so proud
of their biometric deduplication
completely forgot about document
verification and you can put a real
person's fingerprints
and upload a picture of a god or a dog
or whatever else there have been other
numbers issued to cows to trees to gods
and nobody checks those documents you
can be anybody you feel like you can
also get around it but not submitting
your biometrics because but there are
people who don't have fingers or who
don't have eyes or ozai so on scan and
what do you do about them so in your
technical design you offer a biometric
exception all it requires is an
enrollment agent who is willing to
accept that you have an exception and
must feed in the system how many cases
of fraud have happened using the
exception route nobody knows me out of
the 1.25 billion enrollments of the
claim how many of this of fraudulent
nobody knows because nobody checks these
documents you can get a document in the
name of a God if you like now it gets
even more bizarre so this is from a news
report and this news report very
conveniently publish the other number
itself which is a 12-digit number up on
top ok other numbers are supposed to be
confidential they're like credit card
numbers you know if you have the number
you can claim to a given website to
someone so you do not publish your
number in public so this went out in the
press and someone else built on this and
got himself a gas connection with
subsidies so Lord Hanuman the cord has
an other number and also buys cooking
gas from the state I could just go on
and on with these stories like any
manner of fraud you want it's in the
system it's been exploited and the
ultimate price obviously is if you can
steal biometrics itself and that too has
happened so this is the case in the
state of Uttar Pradesh where the police
found a gank trading in stolen
biometrics yeah there's a little bit of
side story over there you know we're at
the top they refer to them as a gang and
then below they become hackers ok and
this shift in usage is not innocent
they use gank to refer to low
intelligence thugs for operating on the
state and then we use the word hackers
to refer to people doing a higher level
act in this case this part became a
extremely interesting story for us to
investigate because we discovered how
bad the involvement software itself was
the when you enroll the enrollment agent
is required to first authenticate
themselves and then accept an
authentication on behalf of the
individual who's trying to get enrolled
and the enrollment agents ID is used to
ensure there is a quality check so you
know if this fraud you know who was the
source of the fraud it turns out that
the enrollment client is built in Java
and the bunch of jar files and the
authentication module is a jar file if
you do not want indicate you replace a
jar file with something else or offers
the same API but does not authenticate
and that's it you enroll that's the
quality of the software so when you
bring these issues up with the UI da
this is what they do they are the
Ministry of denial every single time you
report a story like this and say we have
discovered a data breach you will
discover a vulnerability we have
discovered something going on well you
see well the data that we have in our
database is safe is your copy that's
stolen yeah it's effectively this the
CIDR is the central identities
repository and the CIDR remains safe and
secure nobody has managed to break in
nobody can use your other number without
authentication official response every
single time you report a problem like
this yes
it's gotten so bad that the former boss
of your idea is a man named ramsevak
Sharma who's currently the chairman of
the Telecom Regulatory Authority issued
a public challenge saying hack me I
guarantee you you cannot now this is
incitement to a criminal act
it is also a violation of the law to
publish your own other number but he's
the boss he does it nobody says anything
to him you know it's a statement of his
privilege more than anything else so he
went on to promise that he will not take
action against anyone who hacks on but
how the hell does a private citizen
offer you immunity against a criminal
act
so obviously nobody took him on and he
went on to declare victory and all we
could do is make cartoons yes we did
this literally was the only way to
respond to a provocation like that so
once again you're a stop and ask how is
it possible for such utter incompetence
the commodified democracy
I mean democracy is supposed to have
checks and balances that prevent this
kind of thing from happening how did
this happen and one way to understand it
is maybe other was never would welfare
at all maybe it was never about giving
people identity maybe it was always
about the state wanting to make it
convenient to identify people and once
you look at the timeline of other where
did this project come from how did how
did you create a project that goes on to
enroll a billion people I mean it can't
happen just because people voluntarily
came and said I love it I'm signing out
yeah it had to be forced from them what
forced them to do it so the larger
timeline is this completely apart from
where this came from
and it goes back to 1999 but was a year
when India went to war with Pakistan
over a conflict in a region called
Kargil in the state of Jammu and Kashmir
and what the government of India figured
is some people from Pakistan came into
India passed off his Indian citizens and
caused this to happen and so you can't
let this happen you can't have
non-indians wandering around the streets
of India how are we going to stop them
well so the government's solution was
but which is going to integrate every
single result of this country and find
out they're Indian or not so they call
this project the National Population
register it was meant to be a database
of every single citizen of India this is
after the 1999 incident not recently
and then they had a second project
called the national registry of citizens
where you take the NPR data and go back
and integrate everyone and say are you
Indian or not okay with all 1.2 over 1.3
billion people and then they lost
elections so 2004 they lose elections
the project basically doesn't move
forward and the new government appoints
a technocrat who gives it the new
marketing spin saying look this is not
about surveillance at all this is about
welfare and you're going to make
people's lives better and he goes on to
create a fairly fantastic media profile
to the point where the Economist thus PR
for him
you saw what goes wrong with other
everything that goes wrong and this is
the Economist last week essentially
saying Africa should import this from
India its Economist you can look it up
so you have one PR campaign running like
this about how it's all for welfare and
you have the government that sponsored
this PR campaign who went on to lose
elections again and the party that
originally created the surveillance
database in 1999 is back in poverty not
since 2014 and they're back on the
original agenda and so this month they
passed what's called the citizenship
Amendment Act which provides a path to
citizenship of India if you are from
Pakistan Bangladesh or Afghanistan and
you're not a Muslim that's the condition
the bill explicitly excludes Muslims
from citizenship of India okay now this
is very clearly a violation of the
Constitution of India if I article 14
which is the shirt I'm wearing here this
is my protest shirt essentially says
that the State shall not deny equality
before the law or equal access to the
law to anybody in the jurisdiction of
India it is not restricted to citizens
it is applicable to all persons and the
Act that has just been passed is a
violation of the Constitution now we
have a majoritarian government they can
do what the please the
there is literally no opposition to stop
them which leaves it up to the people
and as a result of this they have been
practiced all over India for the last
month sample of news reports they have
been millions of people on the streets
of India of walking around asking for
otters most people have not figured out
that this is actually based on other
because other is the marketing term for
the project that is meant to surveil and
separate the people of India into
citizens and non-citizens based on their
religion so this is where dense this is
from protest yesterday morning
[Applause]
thank you Karen we have some time for
questions so please line up behind the
microphones and we also have signal
angels who will pass on the questions
from the internet and we're going to
take one right now we're there any data
leaks when the guy posted his number on
Twitter
well multiple data leaks I'll point you
to a fairly interesting one the chairman
of the UI da mr. Nunnelee key thought so
little about data leaks that he
published his other number online many
years ago and after subsequently being
told that maybe this is not the best
idea for you as a chairman of the entity
to leak your own number he finally
deleted it but the internet never
forgets and you can find this on Stack
Overflow today so you just go to stack
overflow search but not then will Akane
you will find this other number yeah
consequences of leaks yes in fact the
estimate of the total number of other
numbers that have leaked in public is
well past 200 million thank you
microphone number two please yeah first
of all thanks for the talk I think that
civil registry and and public databases
or public service databases of all
citizens are definitely a topic that we
should discuss here more the problem
with this one is is very very obvious
but but I'd like just to mention that
many of the privileges that we as a
community being grown up in a Western
let's say stable democracy we derive
from having a birth certificate and
being able to get an identity even if
it's just one in paper and yeah so so I
would I would ask one one thing yes why
don't they use the paper that is being
sent out as sort of an identification
thing like like we have with our ID
cards but a simple reason that
they really believe in this mission and
they do not want people using paper
cards yeah but also in terms of was this
the first ID because you know India
doesn't have comprehensive birth
registration the UI da answered this
question under the Right to Information
Act which is like the equal to the u.s.
Freedom of Information access and in
2015 they explained how many times how
many enrollments happen against other
documents versus the person not having
any documents at all and the percentage
level was in 99.5% had at least two
documents proving the right so this idea
that it gave ID to people who do not
have one is completely false as per
their own admission thank you
microphone number one do you generally
opposed the Aidid idea of a central
identification number or just the
implementation by flailing states like
India that's a slightly loaded question
yes so the state always makes a huge
difference you know the quality of the
institutions of a state make a huge
difference I was in fact having a
discussion with someone here yesterday
who pointed out that distrust and
centralized writing seems to be a common
myth phenomenon yeah the UK doesn't have
one the US doesn't have one but Germany
seems to have one and most civil law
jurisdictions seem to be okay with the
idea of centralized ID as long as it's
well-regulated so yes so the nature of
government makes a huge difference and I
would say I can't speak of the
technology of whether it's being good or
bad separate from whether the governance
of it is good or bad thank you
microphone number two hi Karen thanks a
lot for the talk if I'm not wrong a few
months ago maybe a year ago I read about
this big democracy event going on in
India now there is a few countries that
are considering using IDs for elections
to avoid fro and all the sort of things
and I come from a country that has been
trying really hard to implement an ID
system that is reliable
it helps of combat fraud in elections do
you think this ID system can be somehow
reformed to make the whole democracy
process easier in India we have a case
study of this fortunately so I don't
speak from theory so in India we had a
state carranza Pradesh which split into
two separate states so now they're
called on the position Telangana and
part of what happens when you split a
state is a number of separate elections
for each state and so you need to know
who the voters of your state will now be
in the new state you know previously you
had one voter database we weren't a
state now we have two separate voter
databases and you need to know which
person is in which state so for the
process of separating the database they
went ahead and collected other numbers
and ended up deleting a significant
fraction of the voter database because
they couldn't prove that they were
residents of the state Assam is a
different story so the other position
Telangana story is particularly
illustrative of how if you think you can
bring in a technological solution you
probably are going to make it worse in
fact you guarantee equal to make it
worse
thank you Kiran John Haggadah a round of
applause
[Applause]
[Music]