Monday 27 February 2012

UIDAI and the textbook case study of how not to do it, one for the business schools

The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

It's worked. UIDAI survives for the moment.

But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

The job of the Unique Identification Authority of India (UIDAI) is to use biometrics to identify every resident of India and to issue them with a unique corresponding number, a so-called "Aadhaar number".

"Aadhaar" means foundation or support and the idea is that, once everyone has an identifying number, it will be easier for the various arms of government to build systems on that foundation to provide social security benefits, for example, and to facilitate national security. And beyond government, the banks will supposedly find it easier to authenticate payments.

UIDAI is not without its critics:
  • The Standing Committee on Finance (SCoF), a committee of the Indian Parliament, has considered the National Identification Authority of India Bill, 2010. That Bill would establish UIDAI on a statutory basis if it was ever enacted, but it hasn't been. Meanwhile, UIDAI is operating under executive order only. It's not operating very well according to the SCoF report and it's about time UIDAI came under the control of Parliament.
  • And then there's the Ministry of Home Affairs. They're a properly constituted body and not just a creature of the Executive. And they have a competing identity management scheme, NPR (the National Population Register). Result – a turf war, Aadhaar v. NPR.
SCoF and the Ministry of Home Affairs pressed their case with the Prime Minister but UIDAI proved too adept for them. The Chairman threatened to resign, which would be embarrassing for the prime Minister – good move no.1. Good move no.2 – UIDAI arranged some convenient PR with the compliant Economist magazine. And then they published not one but two reports making unprecedented claims for the reliability of the biometrics used in Aadhaar:
Oops. Bad move. There are five problems here:
  1. Both reports are produced by UIDAI only. There is no sign that they have been audited by any independent expert body.
  2. Both reports quote reliability figures. No other public authority in the world does that. Not operational figures – figures measuring the reliability of biometrics in the field, at the border, for example. They should. But they don't. Now, thanks to UIDAI, they will all come under pressure to quote independently audited figures themselves, figures for reliability, to justify their investment of public funds. It is likely that the public are going to be shocked at just how unreliable the biometrics are, that their governments are using. The public will at last understand why their governments have been so reluctant for so long to quote any figures.
  3. Why is that likely? Because the figures quoted by UIDAI are hundreds of times better than anything anyone else has ever claimed following tests of biometrics. Hundreds.
  4. The second report says that (a) Aadhaar uses flat print fingerprinting and iris scanning, (b) the two biometrics are fused to form one composite biometric, so-called "multi-modal" biometrics, and (c) UIDAI use not one matching algorithm, but three of them. Any large-scale identity management scheme that doesn't do the same, they say – (a), (b) and (c) – is doomed to "catastrophic failure".
  5. The suppliers of biometric technology have never had to give public warranties before. Now they will have to.
Great. Now suppose you're the Australian Customs and Border Protection Service. You've spent millions of dollars of public money deploying smart gates at Australian airports as a security measure. These gates depend on face recognition biometrics. Not on UIDAI's list (a). The Australian (and new Zealand) border security system is doomed to "catastrophic failure". Don't take my word for it. Ask UIDAI.

You've spent years refusing to divulge any figures about the reliability of your technology:
Customs refused to disclose the rates at which the system inaccurately identified people.

"For security reasons, Customs does not disclose the false positive and false negative rates," a spokesman said.
Now UIDAI have released figures, how are you going to hold the line? You can't.

You could say that UIDAI's figures haven't been audited and may turn out to be false. Now you've got a fight with UIDAI on your hands. And what's the best result you can hope for? UIDAI's figures turn out to be a pack of lies and actually the reliability of Aadhaar is just as appalling as the Australian system. Not what you wanted. It doesn't help to explain why you've been squandering your own citizens' tax money on joke technology.

The same applies to the UK, of course, and our planned deployment of smart gates at airports. Another catastrophic failure? And all those states in the US busy incorporating face recognition biometrics into driving licences. These people – the Australian Customs and Border Protection Service, UK Border Agency, et al – are not going to be pleased with UIDAI. UIDAI have let the cat out of the bag and have almost certainly started a fresh collapse of confidence in public administration as a result.

And neither are the biometrics suppliers going to be pleased. How are Morpho going to sell their products now without giving warranties? They're not.

And how are IBM and CSC going to be able to sign any more nine-figure biometrics contracts with credulous governments? They're not.

And how are PA Consulting going to sell any more biometrics assignments? They're not.

UIDAI are going to be persona non grata worldwide. Especially in India, where the Prime Minister may yet regret his decision to carry on funding them. And stop. He may give almost any reason but the big reason, the one several people have pointed out for a long time, is that far from curtailing corruption, Aadhaar was simply going to automate it.

A tragedy with a happy ending, the only people who will be pleased is absolutely everyone else in the world, who can now keep some of their tax money and spend it themselves rather than paying public authorities to waste it for them.

UIDAI's Pyrrhic victory? From now on it's going to be known as an "Aadhaar victory". At least it will when the business schools write it up and teach it all around the world. And when the Economist faithfully report UIDAI's defence, under the heading "Poison pill – that's not the way to do it".


Anonymous said...

How do you explain the joy of millions who will get their pension months earlier because of Aadhaar?

David Moss said...

Show me the unconfined joy of millions first. Then I'll have something to explain.

Until then, remember. A wise government leaves the manufacture of joy to the gods.

You can see why. Presumably the Pensions Department thought joy was going to be delivered with the pension payments they already make. In the event, the payments take six to eight months and the joy never turns up.

The future is imponderable but one thing's for sure, the Finance Ministry's joy will be distinctly confined at the timing difference if pension payments are advanced by six to eight months.

Let a wise government concentrate on its real job – efficient public administration.

It is widely acknowledged that PDS and NREGA suffer from 40% corruption. Aadhaar is supposed to reduce that figure.

Aadhaar will see the creation supposedly of hundreds of millions of bank accounts. Not wise. Bad public administration.

It is conceivable and likely that the new accountholders, like many ghostly NREGA claimants, will not exist. And that corruption becomes easier thanks to Aadhaar. More profitable. The joy of the villains will be unconfined.

And, indeed, the villains themselves will be unconfined.

How do you explain that, Anonymous?

Anonymous said...

"Show me the unconfined joy of millions first."
Please meet Yogesh Harichandra Munde of Mumbai, who was able to open Bank account which had remained illusive since he moved to Mumbai. Or Meet Mangal Bedia, 65, of Ramgarh district in Jharkhand who was able to withdraw her pension without traveling to nearby city office.
Please spend some time with the people who have remained ID-less since birth, understand their plight and then you will see the "unconfined joy" of the millions.

David Moss said...

I am very pleased for Yogesh Harichandra Munde and for Mangal Bedia if their lives have been improved by Aadhaar.

Two success stories do not a summer make, though, and it is arguably rather despicable of you, Anonymous, to suggest that they do. You are using two people as a tool. As a means to an end. A low-down trick of marketing men and politicians the world over. A publicity stunt. Like shroud-waving.

Are you ID-less, Anonymous? Why don't you sign your name? Or maybe quote your Aadhaar number.

Anonymous said...

The debate in the comments is symptomatic of assuming monopoly of speaking for people's welfare. If people see a value in Aadhaar and benefitting from it, dont judge on their behalf. Give people the benefit of making a decision for themselves. The Aadhaar number may not be a panacea for all ills and will have significant implementation challenges but to criticize it ideologically and belittle the importance it may have in people's lives shows intellectual arrogance.

David Moss said...

Anonymous said... The debate in the comments is symptomatic of assuming monopoly of speaking for people's welfare. If people see a value in Aadhaar and benefitting from it, dont judge on their behalf. Give people the benefit of making a decision for themselves. The Aadhaar number may not be a panacea for all ills and will have significant implementation challenges but to criticize it ideologically and belittle the importance it may have in people's lives shows intellectual arrogance.

That takes the biscuit.

• The criticism of Aadhaar is technological, not ideological.

• No attempt is made by me to monopolise the right to speak for public welfare.

• It is you, Anonymous, who attempt to close down debate with the unfounded accusation of intellectual arrogance and the publicity stunt of Yogesh Harichandra Munde and for Mangal Bedia.

You can try to close down debate if you like. But in the rudely healthy democracy of India with its boisterous media, I don't give much for your chances.

Anonymous said...

First you want to know of proof of "unconfined joy of millions". We try to give examples as we cant enumerate millions. Then your argument changes to "Two success stories do not a summer make."
Then we try to argue that we ought not to speak on behalf of ID-less. Are they supporting it? And a good measure is whether they are signing up and whether they are utilizing the UID. Your argument changes to "criticism is technological, not ideological".
You seemed to imply that giving ID to ID-less as well as creating a universal reliable ID verification system is a desired objective. Do I understand you correctly?

As to the question of staying anonymous. I too value my privacy. My decision to give up privacy depends on the cost of giving up the privacy and additional value I receive by giving it up. I am unable to judge the cost of giving up my privacy on your site. And I realize no additional value in giving up that privacy. So I remain anonymous.

May I also make one humble request? Let us focus on the topic and not on individual. I may be an idiot or a crook or despicable chap. But that does not change the argument I make. Likewise, you could the most noble human being on the earth. But that does not make your argument valid.
Does that make sense?

David Moss said...

My dear Anonymous

The article above is about the Pyrrhic victory scored by UIDAI. My prediction is that the organisation will be destroyed by its own defence strategy.

You have not engaged with that subject in your four comments. Instead, you have introduced new subjects in each comment, subjects which I have responded to, thus allowing you in your latest comment to accuse me of changing the subject.

Very neat. But look, I've got an idea. How about you stick to the subject now? With the publication of its two reports on Aadhaar enrolment, do you think that UIDAI has hastened the demise of Aadhaar? If no, why not?

Best wishes

Anonymous said...

I don't because your logic makes no sense.
If UIDAI numbers are correct, more will follow the general model. They will adapt to their needs. Not many countries have 1.2B in population. Like what Indonesia has done and Israel is doing. They will adapt ideas based on their needs. Since UIDAI has published RFP, API, sample code and expected results, they will move faster in their implementation.
If UIDAI numbers are incorrect, no one will know there are incorrect just like no one knows US visit or FBI numbers. They will still continue the way they are.

As for others will be forced to publish their accuracy, you are wrong. India does not publish data about its security programs or law enforcement systems. UID is being published because it is analogous to census. It is not about security.

May I make a suggestion? Indians are sensitive about the Western world giving them advise. Brits are on top of that list of countries they dont want to get advised from. Your comments about UID is hurting UID opponents politically. You will help in demise of UID if you stop writing about UID.

David Moss said...

Response #1 of 4 to the 4 March 2012 06:50 comment made by Anonymous

There you go again, Anonymous, trying to close down debate: “Your comments about UID is hurting UID opponents politically. You will help in demise of UID if you stop writing about UID”.

David Moss said...

Response #2 of 4 to the 4 March 2012 06:50 comment made by Anonymous

On this planet, Anonymous, the acceleration due to gravity is 9.81 metres per second squared.

That’s not a national choice -- it’s not unpatriotic to agree. It’s not a political choice -- socialists don’t champion a different figure. It’s not a sexual preference -- men and women both can agree on 9.81. And it’s not an imperialist imposition -- no-one calls for the yoke of oppression that is 9.81 to be thrown off by a proud and independent people.

The technology of biometrics is in a similar category. Either it meets a certain standard of reliability or it doesn’t.

My comments on Aadhaar are comments on the biometric technology used. You will search high and low for any derogatory comment about India in my writings and not find any. The argument is about technology.

And the technology is international. The same companies are selling the same technology in India, China, the US, Australia, the UK, etc ...

The reliability of biometrics is an international matter and a technological matter.

To pretend, as you do, that it is imperialist is to try, as you do, to divert attention from what looks like governments the world over wasting their taxpayers’ money on the same defective technology.

David Moss said...

Response #3 of 4 to the 4 March 2012 06:50 comment made by Anonymous

You are trying to divert attention from reality, Anonymous: “India does not publish data about its security programs or law enforcement systems. UID is being published because it is analogous to census. It is not about security”.

In reality, the borders between census systems and voting systems and residence permit systems and security systems and public welfare systems and public order systems and banking systems are porous, the scope creeps, and statistics about one are statistics about the others.

The UIDAI has published security statistics. It just has. In two reports. It’s a fact. To deny it, as you do, is to deny reality.

I refer to UIDAI's Role of Biometric Technology in Aadhaar Enrollment and India boldly takes biometrics where no country has gone before by Raj Mashruwala.

And given that the UIDAI has published these figures, it is now legitimate for the Russians, for example, to ask their rulers whether their Sitronics system is as good as Aadhaar. And the Pakistanis may also legitimately want to know how their NADRA system compares. Is it as good? Worse? Better? And the Chinese, with their Golden Shield. The same goes for the US with their US-VISIT scheme. If Aadhaar is better, let’s use Aadhaar, the Americans may say, why waste time and money and threaten our security by using an inferior system?

Mr Mashruwala says in his report that any country that doesn't use the same technology as Aadhaar will find that its identity management system is doomed to "catastrophic failure".

Aadhaar uses iris scans. The UK system, IABS, doesn't. Mr Mashruwala is saying that the system which the UK relies on for biometric residence permits, border security and the safety of the 2012 Olympics is bound to be a "catastrophic failure". His words.

Don't be surprised if the UK asks the UIDAI to support its "catastrophic failure" claim.

David Moss said...

Response #4 of 4 to the 4 March 2012 06:50 comment made by Anonymous

You can call for debate to stop all you like, Anonymous. But it’s too late. Someone should have thought about that before publishing those two UIDAI reports. Now, all other countries have something to compare themselves to, the Aadhaar performance figures. And they will.

Let me give you some British, imperialist, male, Conservative uncalled for and utterly biased advice.

Get those Aadhaar figures checked by every independent, respectable, academic expert on the planet. Quickly.

If they stand up to scrutiny, well and good, David Moss is wrong, who cares, India is a hero and has an excellent product to sell internationally.

If the figures collapse under scrutiny, the government can cancel the Aadhaar project quickly and take the deserved credit for saving taxpayers’ money. And not just Indian taxpayers.

Openness, as so often, is the win-win option. The alternative is sleazy and suspicious.

And while I’m in imperialist mode, let me raise the question again of your identity, Anonymous. Your reservations about the "cost" of revealing your identity are, of course, incomprehensible.

If you presented your credentials, your arguments might have more weight.

Many readers may assume that you are an expert employed by the UIDAI and writing as a patriotic Indian. But we don’t know, do we, you could be anyone.

You could be, for example, a member of the PR department of Morpho. Morpho is a French company, a subsidiary of Safran Group, and the world leader in biometric technology. They say on their website that: "Morpho is in charge of all technological aspects of Aadhaar".

Perhaps Aadhaar is a French achievement, and not an Indian achievement at all.

Best to reveal yourself, Anonymous. Win-win, and all that.

Anonymous said...

It is time for David Moss esq. to take his Jihad against biometrics to another country. Battle in India is over. Winner is Aadhaar.
"Finance Minister Pranab Mukherjee said it is now ready to support payments for the flagship Mahatma Gandhi National Rural Employment Guarantee Act, old age, widow and disability pensions, and scholarships directly to the beneficiary accounts in selected areas."

Try Indonesia where the evil L-1 is implementing biometric based ID system or Mexico where imperialist Unisys is in charge. Mr. Moss has better chance there.

David Moss said...

India loses

Think about it, Anonymous.

Think about medicinal drugs and aircraft.

When a pharmaceutical company develops a new drug, it isn't released onto the market without strict controls. It's tested first. Using the highest standards. Blind trials. Double blind trials. Independent expert reviews. Without that you don't know in advance whether the money spent on the drug will be wasted. The same with new aircraft. Money could be wasted.

UIDAI's reports on their biometric technology are well below the standard of drugs trial reports and airworthiness reports. The trial protocol has not been published. The results have not been independently reviewed.

So why should anyone believe that the technology is worth investing in? Particularly, why should the long-suffering Indian taxpayer believe it?

Answer, according to you:
• because Union Minister of Rural Development Jairam Ramesh has decided that it is safe to base pension payments on Aadhaar
• because Finance Minister Pranab Mukherjee has decided to fund the next 400,000,000 Aadhaar registrations
• and because he has decided that it is safe to base MGNREGA payments on Aadhaar
• because Indonesia uses a similar technology and Mexico, too.

It's not logical, is it, Anonymous?

Aadhaar wins, as you say. Who loses? David Moss? No. India.

Anonymous said...

Dear Mr. Moss,
Please help Gina Rebato from the clutches of biometrics. She will be grateful even when she has to give up half of her money to the local goons today.

Post a Comment