Audit of UIDAI reveals what Delhi High Court is yet to reveal | Gopal Krishna

by Gopal Krishna *

The audit of Unique Identification Authority of India (UIDAI) by Comptroller Auditor General (CAG) of India revealing “flaws in the management of various contracts entered into by UIDAI” reminds one of a case related to a RTI reply that partially revealed the content of MoU/ Contract executed between UIDAI with L1 Identity Solutions Operating Company, currently a subsidiary of French conglomerate Safran Group, Sagem Morpho Security Pvt Ltd, a subsidiary of Safran Group, Ernst & Young, a US company, Accenture Services Pvt Ltd, a US company and ID Solutions company and the tender cost. At the time of award of contract to L1 Identity Solutions Operating Company was a US company.

A reply dated 25 October 2013 from Shirish Kumar, assistant director general and chief public information officer (CPIO) of UIDAI reveals that the value of contract for L1 was Rs33.87 crore and for Ernst & Young it was Rs7.05 crore. With regard to Sagem Morpho Security Pvt Ltd, it states that the “effort is on find the data” about the value of contract awarded. This reply in the matter of Sagem Morpho Security Pvt Ltd is quite intriguing. Notably, L1 has undergone metamorphosis and become part of Safran Group along with Morpho Security Pvt Ltd.

It is relevant to reiterate in this context that Nilekani was given ID Limelight Award at the ID WORLD International Congress, 2010 in Milan, Italy on 16th November wherein Safran Morpho (Safran group) was a key sponsor of the ID Congress. Its subsidiary, Sagem Morpho Security Pvt Ltd has been awarded contract for the purchase of Biometric Authentication Devices on 2 February 2011 by the UIDAI.

Earlier, on 30 July 2010, in a joint press release, it was announced that “the Mahindra Satyam and Morpho led consortium has been selected as one of the key partners to implement and deliver the Aadhaar program by UIDAI (Unique Identification Authority of India).” This means that at least two contracts have been awarded to the French conglomerate led consortium. Is it a coincidence that Morpho (Safran group) sponsored the award to chairman, UIDAI and the former got a contract from the latter?

Nilekani was given the award "For being the force behind a transformational project ID project in India...and "to provide identification cards for each resident across the country and would be used primarily as the basis for efficient delivery of welfare services. It would also act as a tool for effective monitoring of various programs and schemes of the government."

It may also be noted that UIDAI awarded contracts to three companies namely, Satyam Computer Services Ltd (Mahindra Satyam), as part of a “Morpho led consortium”, L-1 Identity Solutions Operating Company and Accenture Services Pvt Ltd of US for the “Implementation of Biometric Solution for UIDAI” on 30 July 2010.

Following Central Information Commission (CIC)’s intervention in the matter of application filed by Col Mathew Thomas, an octogenarian defence scientist, and submissions by the author on his behalf, UIDAI shared its contract agreement with French and US biometric technology companies but crucial pages are missing from the contract agreement after the CIC heard the matter on 10 September 2013. CIC has ruled, “Any agreement entered into by the government is an agreement deemed to have been entered into on behalf of and in the interest of ‘We the people’ in the past.
For long UIDAI refused to share copy of all contracts given to French and US biometric technology companies, namely, L-1 Identity Solutions and Accenture respectively. L-1 was a US company till recently.

Sushma Singh, the Information Commissioner gave UIDAI’s letter written to CIC submitting that "contractual obligation in respect of BSP (Biometric Solution Provider) contracts has expired. Therefore, UIDAI has no objection in sharing the following contract details:-a) Copy of contract of UIDAI with M/s L-1 Identity Solutions for Biometric Technology; and b) Copy of contract of UIDAI with M/s Accenture for Biometric Technology".

After examining these documents with regard to the Accenture for Biometric Technology, it has come to notice that the first 237 pages appear to be in order but after that there is a one pager titled Annexure J Technical Bid (Technical Bid as submitted by M/s Accenture Services Pvt Ltd). The Technical Bid document is missing. After that there is a one pager titled Annexure K Commercial Bid Commercial (Bid as submitted by M/s Accenture Services Pvt Ltd). The Commercial Bid document is missing.

With regard to the L-1 Identity Solutions for Biometric Technology, one noticed that the first 236 pages appear to be in order but after that there is a one pager titled Annexure I non-disclosure agreement as submitted by L-1 Identity Solutions Operating Company Pvt Ltd. But this document is missing. After that there is a one pager titled Annexure J Technical Bid as submitted by L-1 Identity Solutions Operating Company Pvt Ltd. The Technical Bid document is missing. After that there is a one pager titled Annexure K Commercial Bid as submitted by L-1 Identity Solutions Operating Company Pvt Ltd. The Commercial Bid document is missing. UIDAI has been asked for the missing pages from the copies of the contract.

The reasoning of UIDAI in its letter to CIC dated 10 September 2013 stating that "contractual obligation in respect of BSP (Biometric Solution Provider) contracts has expired” is flawed in the light of the previous judgment of CIC.
Under the Right to Information (RTI) Act, the PIO cannot deny information citing commercial confidence for agreements between a public authority and private party.

While giving this judgment, CIC said “The claim of ’commercial confidence’ in denying access to agreements between private parties and the masters of the public authorities—citizens—runs counter to the principles of the Right to Information.” CIC observed, “Any agreement entered into by the government is an agreement deemed to have been entered into on behalf of the and in the interest of ‘We the people’. Hence if any citizen wants to know the contents of such an agreement, he is in the position of a principal asking his agent to disclose to him the terms of the agreement entered into by the agent on behalf of the principal. No agent can refuse to disclose any such information to his principal,” the CIC said in its order dated 27 July 2009.

The Commission was of the view that “The objectives of the RTI Act would be defeated if public authorities claim exemption based on a claim that ‘terms and condition were much more favourable to the government’, and therefore these must be kept away from the Public. In fact public feels that quite often the contrary is the case,” the Commission noted. The CIC observed, “Any so called imaginary moral or reciprocal obligation cannot be permitted to subvert a solemn constitutional and legal obligation” and directed the PIO to provide copy of the agreement.

In the contract agreement between the President of India, as purchaser and L-1 Identity Solutions Operating Company, as a "Biometric Solution Provider" it has been officially admitted that the latter is a corporation of US based in Delaware as of 24 August 2010. L-1 has since been bought over by French corporate conglomerate, Safran Group after the US Committee on Foreign Investment in the United States (CFIUS) was convinced that there are no unresolved national security concerns with respect to the transaction. L-1 Identity Solutions announced agreement to be acquired by Safran on 20 September 2010.

From the contract agreement between the President of India, as purchaser and Accenture Services Pvt Ltd as a "Biometric Solution Provider" dated 1 September 2010 it is evident that it has not been disclosed that Accenture Services Pvt Ltd is a subsidiary of Dublin, Ireland based Accenture plc, a US company. Till 1 January 2001 it was known as Andersen Consulting. As a consequence of French corporate conglomerate Safran’s purchase of US company L-1 Identity Solutions, the de-duplication contracts of UIDAI’s Centralized Identities Data Repository (CIDR) and Home Ministry’s National Population Register (NPR) which was given to foreign companies on 30 July 2010 to three companies now lies with two companies of French and US origin namely, Safran Group and Accenture.

UIDAI has not disclosed whether there has been any fresh agreement between UIDAI and Safran Group and its subsidiaries and who all are the biometric solution providers after the expiry of the “contractual obligations” with L-1 Identity Solution and Accenture. The contract agreement with Accenture Services Pvt Ltd at clause 15.1 it reads: "By virtue of this Contract, M/s Accenture Services Pvt Ltd/Team of M/s Accenture Services Pvt Ltd may have access to personal information of the Purchaser and/or a third party or any resident of India, any other person covered within the ambit of any legislation as may be applicable." The purchaser is President of India through UIDAI.

The clause 15.3 reads: "The Data shall be retained by Accenture Services Pvt Ltd not more than a period of 7 years as per Retention Policy of Government of India or any other policy that UIDAI may adopt in future."

The contract agreement with L1 Identity Solutions Operating Company at clause 15.1 reads: "By virtue of this Contract, M/s L1 Identity Solutions Operating Company/Team of M/s L1 Identity Solutions Operating Company may have access to personal information of the Purchaser and/or a third party or any resident of India, any other person covered within the ambit of any legislation as may be applicable." The purchaser is President of India through UIDAI.

The clause 15.3 reads: "The Data shall be retained by L1 Identity Solutions Operating Company not more than a period of 7 years as per Retention Policy of Government of India or any other policy that UIDAI may adopt in future."
This implies that all the biometric data of Indians which has been collected so far is now available to US Government and French Government.

The audit of UIDAI by CAG reveals that "There were flaws in the management of various contracts entered into by UIDAI. The decision to waive off penalties for biometric solution providers was not in the interest of the Authority giving undue advantage to the solution providers, sending out an incorrect message of acceptance of poor quality of biometrics captured by them."

The audit report also reveals that "UIDAI had not ensured that the client applications used by its authentication ecosystem partners were not capable of storing the personal information of the residents, which put the privacy of residents at risk. The Authority had not ensured security and safety of data in Aadhaar vaults. They had not independently conducted any verification of compliance to the process involved." It implies that UIDAI has put privacy of present and future residents, Prime Ministers, Chief Ministerss, judges, legislators, soldiers, civil servants and intelligence officials and their families at risk.

Something remains rotten in the state of Denmark, says Shakespeare in Hamlet. So is the case with Delhi High Court case on non-disclosure of information on foreign firms like ACCENTURE & SAFRAN Group.

The Writ Petition (Civil) No. 9143/2014 filed by Mathew Thomas in Delhi High Court on non-disclosure of information of foreign firms by UIDAI despite CIC’s order, has been pending since 2014. It came up for hearing before 14 different single judge benches. The first hearing was before Justice Vibhu Bakhru. It was listed again before him on 19 November, 2018.

But instead of Justice Bakhru, on November 19, 2018, another new judge, Justice Suresh Kumar Kait heard the matter and passed the order: “Mr Lalit Bhasin, learned counsel appearing on behalf of the proposed respondent M/s Accenture services Pvt.Ltd. seeks time to file reply to the instant application.Let needful be done within four weeks.On taking steps, let service be affected upon other non-applicants, returnable on 14.03.2019.”

On March 14, 2019, another fresh judge, Justice V. Kameswar Rao heard the matter and passed the order: “Let a copy of the application seeking impleadment be given to the counsels for the proposed respondent Nos.4 and 5. Reply to the application be filed within four weeks.Rejoinder, if any, be filed within two weeks thereafter.List on August 28, 2019.”

On August 28, 2019, yet another new judge, Justice Jayant Nath heard the matter and passed the order: “At request of the learned counsel for the petitioner, adjourned to 11.12.2019.”

So far some 14 judges have heard the case within a span of 5 years. On 11th December, 2019, the case came before Justice Jayant Nath. He passed an order saying, “On the request of the learned counsel for the respondents, adjourned to 01.05.2020”.The matter came up for hearing on March 21, 2022 before Justice Yashwant Varma. The order reads: “Due to paucity of time, the matter could not be heard today. List on 07.10.2022.” The Court’s website has record of 16 such orders since December 2014. There seems to be paucity of time all through April, May, June, July, August and September. The High Court’s website shows that the matter is listed for hearing on October 7, 2022 despite it being an issue of huge national importance.

In the aftermath of the revelations about contracts awarded by UIDAI to Big Data firms by CAG, can one ask Hon’ble Delhi High Court Chief Justice to ask Hon’ble Registrar General as to why this national security related case is not getting the priority it deserves? It is hoped that attempts by Big Data foreign firms which are are subverting all Indian public institutions is being resisted and efforts will be made to transcend the insurmountable impediment of paucity of time.

(Author: Dr. Gopal Krishna is a law and public policy researcher. He had appeared before the Parliamentary Committee that examined the National Identification Authority of India Bill, 2010 that was withdrawn in 2016 and enacted later as Aadhaar Act 2016 )