4.7 Lakh Aadhaar Cards Cancelled Due to Duplicacy; No Guarantee That Card Holders Are Indian Residents: UIDAI Audited by CAG

The country’s top auditor, the Comptroller and Auditor General of India (CAG), has called the Unique Identification Authority of India (UIDAI) to task over a number of concerns relating to the issuance of Aadhaar cards.

The issues revealed by the CAG cast doubt on the authenticity and uniqueness of Aadhaar cards, lending credence to data privacy campaigners’ concerns about India’s unique identity programme.

UIDAI is the statutory authority founded in 2016 to give Aadhaar cards to all citizens of India. UIDAI had issued 131.68 crore Aadhaar numbers as of October 31, 2021.

CAG examined the UIDAI’s functioning from 2014-15 to 2018-2019 in its first ever performance audit report, dated April 6, and identified a number of concerns with its de-duplication process, as well as how flaws in the biometric capture process led to hundreds of thousands of people paying a fee to update their biometrics. It further chastised the authority for “poor data management,” claiming that data from Aadhaar card users had not been connected with their Aadhaar numbers in some circumstances even after ten years.

It has also criticised the lack of a mechanism to analyse the causes that contribute to authentication problems, and stated that despite having one of the world’s largest biometric databases, UIDAI does not have a data archiving policy, which is regarded “a fundamental storage management best practise.”

“UIDAI supplied free authentication services to banks, mobile carriers, and other agencies until March 2019, contrary to the terms of their own Regulations, thereby robbing the government of income,” the CAG report stated.

It was also discovered that the UIDAI did not have proper arrangements with the postal service, which resulted in a huge number of Aadhaar cards being returned to the government.

The national auditor’s principal findings are as follows:

No guarantee that all Aadhaar holders in the country are ‘Residents,’ as defined under the Aadhaar Act

In India, Aadhaar numbers are only granted to people who have lived in the country for at least 182 days in the 12 months preceding the date of application. This criterion was eased in September 2019 for non-resident Indians with a valid Indian passport.

According to the CAG study, the UIDAI merely requires a “casual self-declaration” to establish this, and there is no procedure in place to check an applicant’s residential status.

“…UIDAI has not defined any specific proof/document or mechanism for establishing whether an applicant has been in India for the necessary period, and accepts certification of the applicant’s residential status by a casual self-declaration. There was no procedure in place to verify the applicant’s statements. As a result, there is no guarantee that all Aadhaar holders in the country are ‘Residents’ as defined under the Aadhaar Act.”

It further stated that, in accordance with the terms of the Aadhaar Act, the UIDAI may establish a procedure and needed paperwork other than self-declaration in order to confirm and authenticate applicants’ residency status.

Aadhaar Card Duplication

The CAG recorded instances of Aadhaars being issued to various individuals with the identical biometric data, showing weaknesses in the de-duplication process and the issuance of Aadhaars based on erroneous biometrics and papers. The UIDAI’s de-duplication method is intended to ensure that no one person obtains two Aadhaar numbers, and that a single person’s biometrics cannot be used to obtain Aadhaar numbers for multiple people.

The CAG report, however, highlights the ineffectiveness of such a de-duplication process, stating, “It was discovered that UIDAI had to cancel over 4.75 lakh Aadhaars (November 2019) due to duplicates. There have been reports of Aadhaars being issued with the same biometric data to various residents, showing weaknesses in the de-duplication process, as well as Aadhaars being issued based on erroneous biometrics and documents.”

The CAG further stated that, despite UIDAI’s efforts to improve the quality of biometrics and offer iris-based authentication capabilities for Aadhaar enrollment, the database still contained flawed Aadhaars that had previously been issued.

Issue of Aadhaar to minor children below age of five- violates Aadhar Act, avoidable expenditure of ₹310 Crore

Aadhaar numbers are issued to minor children under the age of five in India based on information provided by their parents. However, according to the CAG study, this violates the Aadhaar Act’s fundamental principle of confirming the uniqueness of biometric identity.

“Issuing Aadhaar numbers to minor children under the age of five based on their parents’ biometrics without proving the uniqueness of biometric identification violates the basic principle of the Aadhaar Act,” it added.

It was also stated that, in addition to breaking legislative rules, UIDAI incurred needless spending of Rs 310 crore on the issuing of Bal Aadhaars between March 31 and March 31, 2019.

Aside from violating legislative rules, the UIDAI has also incurred needless cost of 310 Crore on the issuance of Bal Aadhaars through March 31, 2019. “A additional sum of 288.11 crore was allocated to states/schools in Phase- II of ICT assistance upto the year 2020-21, largely for the issue of Aadhaars to minor students,” the report continues.

Since the Supreme Court has declared that no benefit will be denied to any child due to the lack of an Aadhaar document, the CAG urged that UIDAI devise additional methods to determine the unique identification of children under the age of five.

All Aadhaar numbers are not backed up by physical papers carrying personal information

According to the CAG, all Aadhaar numbers held in the UIDAI database were not supported by papers relating to the personal information of their holders, and the UIDAI was unable to determine the actual degree of the mismatch even after nearly ten years.

“Though personal information documents were kept in CIDR with the implementation of inline scanning (July 2016), the presence of unpaired biometric data from previous periods suggested insufficient data management,” the research states.

Huge amount of voluntary updates by residents led to capture of faulty biometrics

For a variety of reasons, the Aadhaar system permits users to ‘upgrade’ their fingerprint and iris scans. Some of these upgrades are required, however users can also update their biometrics on their own time. While mandatory updates are provided free of charge to residents, voluntary updates are charged at the rates set by UIDAI.

According to the data, more than 73% of the total 3.04 crore biometric updates in 2018-19 were voluntarily updates performed by residents for defective biometrics following payment of expenses.

“During 2018-19, more over 73% of the total 3.04 crore biometric updates were done voluntarily by residents for defective biometrics after payment of expenses. The large volume of voluntary updates suggested that the quality of data acquired to issue the first Aadhaar was insufficient to prove identify uniqueness “, according to the research.

Data security

The audit report also states that UIDAI should develop a proper data archival policy to reduce the risk of data protection vulnerability.

“Biometric Service Providers may be penalised by UIDAI for inadequacies in their performance in biometric de-duplication (FPIR/ FNIR) and biometric authentication (FMR/ FNMR). If necessary, agreements in this regard should be changed “, according to the report.

To Read Press Release Download PDF Given Below: