India’s First Metadata case: Mass Surveillance, Mass Spying and Unending Census Part 3 | Gopal Krishna

The forthcoming Census could be the first Digital Census in the history of India. For this monumental and milestone-marking task, I have allocated ₹ 3,768 crores in the year 2021-22.
—Nirmala Sitharaman, Union Finance Minister, February 1, 2021, Lok Sabha

The Census 2021 and the related field activities have been postponed until further orders. The forthcoming Census is to be the first digital Census and there is a provision for self-enumeration. Mobile Apps for collection of data and a Census portal for management and monitoring of various Census related activities have been developed. The intent of the Government for conducting Census 2021 was notified in Gazette of India on 28th March, 2019. Subsequently, a notification under Citizenship Rules was published in the Gazette of India on 31st July,2019 to prepare and update the Population Register along with the first phase of Census i.e. Houselisting and Housing Census. However, due to outbreak of COVID-19 pandemic, the conduct of Census 2021, updating of National Population Register and the related field activities have been postponed until further orders.
—Nityanand Rai, Union Minister of State in Ministry of Home Affairs, February 7, 2023, Lok Sabha

The Office of the Registrar General (of National Population Register) and Census Commissioner of India has informed that there is no plan to use Aadhaar data for census.
—Rajeev Chandrasekhar, Union Minister of State for Electronics and information Technology, April 5, 2023, Lok Sabha

The UIDAI will also partner with the Registrar General of India (RGI) – whoa will prepare the National Population Register through the Census 2011 – to reach as many residents as possible and enrol them into the UID database. This may require incorporating some additional procedures into the RGI data collection mechanism, in order to make it UID-ready.
—p.17, UIDAI Strategy Overview: Creating A U nique Identity Number for Every Resident of India, Unique Identification Authority of India, Planning Commission of India, April, 2010

There are three references to “census” in the 547 long landmark unanimous verdict of the 9-judge Constitution Bench delivered on August 24, 2017 in the Unique Identification (UID)/Aadhaar Number scheme related case. Its leading order was authored by Dr. Justice D Y Chandrachud. The Court has recorded that Tushar Mehta, the Additional Solicitor General mentioned the Census Act, 1948 to argue that this statute already protects the privacy rights of individuals, therefore, it is unnecessary to read a fundamental right of privacy into Part III of the Constitution.

The word “census” has been mentioned on nine occasions in the 1448 page long order dated September 26, 2018 on UID/Aadhaar Number database scheme delivered by a 5-judge Constitution Bench. The order includes the majority order authored by Justice A. K. Sikri (now retired), the concurring order by Justice Ashok Bhushan (now retired) and the dissenting order by Dr. Chandrachud. Recognising that some of the concerns raised by the Aadhaar scheme have arisen for the first time in India, comparative jurisprudence and judgments of foreign jurisdictions on census has been deemed appropriate because many of the measures prescribed under the Aadhaar Act are similar. Dr. Chandrachud’s 481 page long order draws on the decision of the Federal Constitutional Court of the Federal Republic of Germany which dealt with a challenge to the German Federal Census Act, 1983, which paved the eway for unlimited census. His order has been vindicated by the decision dated November 13, 2019 by a 5-judge Constitution Bench in Rojer Mathew v South Indian Bank Ltd. Notably, Justice Bhushan’s order also dwells on the decision of the German Court in the matter of unlimited census.

This German law provided for collection of citizens’ basic personal information, including, inter alia, source of income, occupation, supplementary employment, educational background and hours of work. There were certain provisions in the law which provided for transmission of statistical data to local governments for the purposes of regional planning, surveying, environmental protection, and redrawing of election districts. The German Court struck down provisions permitting transfer of statistical data to local authorities on the ground that they enabled authorities to compare census data with local housing registries. The German Court observed that the combination of statistical data and a personalized registry could lead to the identification of particular persons, which would lead to a chilling effect upon individuals’ right to informational self-determination.

The German Court observed that distinct silos of data “can be pieced together with other data collections particularly when individual integrated information systems are built up – to add up to a partial or virtually complete personality profile”. This creates an architecture wherein the person concerned has “no means of controlling its truth and application.” It took note of the the technical means of storing individual statements about personal or factual situations of a certain or verifiable person with the aid of automatic data processing. It implies that the extent of processing individuals’ data is unlimited and the data can be retrieved in a matter of seconds irrespective of the distance.

Tracing the origin of the Unique Identification (UID)/Aadhaar project, in his verdict, Justice A. K. Sikri (now retired) refers to Planning Commission’s Processes Committee that was set up on July 3, 2006 to suggest the process for updation, modification, addition and deletion of data and fields from the core database to be created under the Unique Identification (UID) for BPL Families project. The Processes Committee, on November 26, 2006, prepared a paper known as “Strategic Vision Unique Identification of Residents”. The fact is that it is one of the earliest documents which refers to UID. It is a 14-page long document titled ‘Strategic Vision: Unique Identification of Residents’ which was admittedly prepared by Wipro Ltd and submitted to the Processes Committee of the Planning Commission. The Processes Committee did not prepare it. This document envisaged the close linkage that the UIDAI would have with the electoral database. On December 4, 2006, the Prime Minister Manmohan Singh had constituted an Empowered Group of Ministers (E-GoM) comprising of A Raja, the then Minister of Communications & Information Technology, the minister-in-charge responsible for UID and related others on the basis of this strategic vision document. Therefore, factual misrepresentation in the order with regard to the origin of Unique Identification (UID)/Aadhaar project assumes great significance.

The use of electoral database mentioned in Wipro Ltd’s document remains on the agenda given the fact that aggressive attempts have been made to link Voter ID Number with UID/Aadhaar Number. Justice Sikri’s order does not refer to Wipro Ltd which prepared the vision document although this vision document was submitted by the government in the course of the judicial proceedings. Prior to the hearing in the court, this vision document was not in public domain. Its vision statement reads: “Creating a unique identification system of all residents in the country for efficient, transparent, reliable and effective delivery of various welfare and private services to the common person.”

The cover page of the vision document mentions the names of institutions and the private firm namely, National Institute for Smart Government, Department of Information Technology and Wipro Consulting and states that Wipro Ltd is the consultant for the design phase and program management phase of the pilot UIDAI project, the ‘Strategic Vision on the UIDAI Project’. This is the first document of November 2006 which refers to UIDAI for the first time. UIDAI took birth in January 2009.

What is stated in the Wipro‘s vision document with regard to electoral database finds echo in Justice SIkri’s order wherein it is stated that “A core group was set up to advice and further the work related to UIDAI….Meetings of the core group took place from time to time. The core group, inter alia, decided that it was better to start with the electoral roll database of 2009 for undertaking the UIDAI project.” It further states “This and other steps taken in this direction culminated in issuance of Notification dated July 02, 2009 whereby Mr. Nandan Nilekani was appointed as the Chairman of UIDAI for an initial tenure of five years in the rank and status of a Cabinet Minister. He assumed charge on July 24, 2009. Thereafter, the Prime Minister’s Council of UIDAI was constituted on July 30, 2009 which held its first meeting on August 12, 2009 where the Chairman of UIDAI made detailed representation on the broad strategy and approach of the proposed UID project.” Interestingly, only within 20 days of joining UIDAI after resigning as CEO, Infosys Ltd, he became competent enough to give “detailed representation on the broad strategy and approach of the proposed UID project.” His appointment letter addressed him as CEO, Infosys Ltd. Later, Nilekani headed Technology Advisory Group (TAGUP) recommended setting up of National Information Utilities (NIU) to deal with complex Information Technology (IT) systems and projects. This TAGUP report refers to UIDAI Strategy Overview document prepared by WIPRO technologies Pvt and published by UIDAI.

Notably, Infosys Leadership Institute (ILI) had set up Jawaharlal Nehru Leadership Institute (JNLI) in 2008 for training Indian Youth Congress (IYC) and National Students’ Union of India (NSUI) with GK Jayaram as its chief mentor. Jayaram’s Bangalore based Institute of Leadership and Institutional Development (ILID) was a consultant to Rajiv Gandhi Foundation and Rajiv Gandhi Institute of Contemporary Studies. Subsequently, a web-based Pehchaan (identity) platform was set up "as a mechanism to identify and promote elected office-bearers (EOBs) at every level." The text of a resolution in this regard reads, "Every EOB is allotted a unique ID and password and given the opportunity to share their work and connect with the organization at various levels." Jayaram, the chief mentor for training IYC and NSUI was formerly associated with the US Navy Post-Graduate School and worked in US firms like AT&T. It may be noted that in 2006, the Electronic Frontier Foundation lodged a class action lawsuit alleging that AT&T had allowed agents of the National Security Agency (NSA) to monitor phone and Internet communications of AT&T customers without warrants in violation of the Foreign Intelligence Surveillance Act of 1978 and the First and Fourth Amendments of the US Constitution. It is apparent that those who pushed the idea of unique identity before the ruling political leadership have been involved with foreign defence and private firms whose past merited deeper scrutiny. Justice Sikri could not see through the incestuous relationship between domestic and foreign private firms with UIDAI because he has refrained from naming the firm which conceptualized its strategic vision.

Notably, Comptroller and Auditor General has reported in August 2016 that Wipro, India’s third largest software exporter has been given “undue favours” of Rs 4.92 crores by the competent authority in UIDAI. Wipro was given a contract by UIDAI in May 2011 for Rs 134 crore for installing security systems etc in the data centres of UIDAI in Bengaluru and Delhi/NCR region. Besides undue favour garnered by Wipro, it is apparent that it created business for itself through its preparation of the Strategic Vision on the UIDAI Project, a classic case of manifest conflict of interest.

Given the fact that Prime Minister’s Council of UIDAI was directly overseeing the execution of the UID/Aadhaar project, it is pertinent to note what the then Prime Minister said. He observed, "We live in a world of uncertainty and ex-post whether it is the Comptroller and Auditor General, whether it is a Parliamentary committee then they analyse post facto. They have a lot more facts which were not available to those who took the decision." In the face of several years of the existence of a controversial public institution like UIDAI, the Justice Sikri should have asked the "Comptroller and Auditor General" of India to "analyse post facto" the work of UIDAI and the involvement of its key office bearers in awarding contracts to private firms, some of which have already come under CAG’s scrutiny instead of deliberately omitting the role of private firms like Wipro in his order. Wipro’s case is just the tip of the iceberg which got detected and caught by CAG.

The concerns over the breach of citizens’ data prompted several state governments to halt the ongoing data collection process for a National Population Register (NPR). The fear is that the information sought under NPR is much wider in scope and could potentially be used to target any section of society.
 
What the anti-NPR advocates did not realise is that there are more solid reasons to fear the NPR because it is not just a census exercise, but a larger data convergence scheme. NPR’s linkage with Aadhaar number plays a central role here. In fact, NPR of Ministry of Home Affairs and UIDAI’s CIDR of UID/Aadhaar numbers under Ministry of Electronics and Information Technology (MEITY) are aimed at creating an architecture for indiscriminate mass surveillance of the present and future voters. They are being structurally coerced to give their consent to the immoral and illegitimate exercise of their profiling for unlimited times.
 
Both these exercises have turned every newborn citizen into a suspect. There is a file being created to track and profile him/her for good. Like Indian National Security Adviser’s threat to his adversaries about having a file on them, having a UID/Aadhaar number and NPR automatically creates a file of all the residents of India. Even infants are not spared in this cruel scheme of things.
 
Here are some reasons for scrapping Aadhaar databases scheme and repealing Aadhaar Act:
 
1.  The majority order of the Supreme Court’s 5-Judge Constitution Bench on September 26, 2018, has pointed out that the UID/Aadhaar Number project and NPR project are part of the one database convergence scheme. NPR has been mentioned at least on eight occasions in the order to underline the same. A centralized database is the most vulnerable entity in the digital world. The leakage of the database of UK’s children has revealed the old maxim, “If you have nothing to hide, you have nothing to fear, has been given a very public burial”. This has been thoroughly debunked. This maxim is attributed to Nazi propaganda minister Joseph Goebbels. Database State, a report from the UK, states: ‘In October 2007, Her Majesty’s Revenue and Customs (Department) lost two discs containing a copy of the entire child benefit database.’ Only blind faith in a Utopian State can persuade people to think that they have nothing to fear after trusting their personal sensitive information to a Database State and non-State actors like Safran, Ernst & Young and Accenture.

 2.  One of the earliest documents that refer to UIDAI, a 14-page document titled ’Strategic Vision: Unique Identification of Residents’ prepared by Wipro Ltd for the government envisaged the close linkage that the UIDAI’s Aadhaar would have with the electoral database. The use of the electoral database mentioned in Wipro’s document remains on the agenda of the proponents of UID/Aadhaar.

3. The 41-page Wikileaked document titled ’Creating a unique identity number for every resident in India’ that declared itself to be a ’Confidential- property of UIDAI’ reveals that from day one the Union government wanted to create a file on each of "1.2 billion residents", the division of work between Ministry of Home Affairs (MHA)’s NPR and Ministry of Electronics and Information Technology (MEITY)’s UID/Aadhaar was/is merely an attention diversion tactics to outwit citizen’s scrutiny.

The ongoing merger of the electoral database with UID/Aadhaar number debunks UIDAI’s claim in the confidential document that UID/Aadhaar number "will not contain intelligence" and "the location of the person."From these disclosures, it seems that the government has adopted an adversarial role vis-a-vis Indians and acting beyond its constitutional mandate in order to pander to the interests of the commercial czars, non-state actors and foreign intelligence companies.

4. In an RTI reply dated October 25, 2013, UIDAI shared a truncated contract agreement with Ernst & Young. The contract agreement states that "the Unique ID will be a random 12-digit number with the basis for establishing uniqueness of identity being biometrics". It announces that "we will provide a Unique Identity to over 113.9 crore people."
 
This is evidently a fraudulent announcement because UIDAI with which the agreement has been signed had the mandate to provide Unique Identity to only 60 crore residents of India, and not to 113.9 crore people.

It is evident that while the government kept Ernst & Young informed about its motive, it kept states, citizens, the parliament and the Supreme Court in the dark. The contract agreement reveals that "biometric systems are not 100 % accurate" and "uniqueness of the biometrics is still a postulate." This admission pulverizes the deceptive edifice on which MEITY’s UID/Aadhaar and MHA’s NPR rests.

5. Section 57 of un-amended Aadhaar Act, 2016 stated that "Nothing contained in this Act shall prevent the use of Aadhaar number for establishing the identity of an individual for any purpose, whether by the State or any body corporate or person, pursuant to any law, for the time being in force, or any contract to this effect".
 
It implies that UID/Aadhaar of "over 113.9 crore people" has been shared with foreign private body corporates like Ernst & Young. It is only after the horse had escaped the barn that the door was closed through Section 25 of Aadhaar and Other Laws (Amendment) Act, 2019 in compliance with the Court’s order dated September 26, 2018.

Section 25 of the Amendment Act 2019 states that Section 57 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 has been omitted with effect from July 24, 2019.

6. At paragraph 8 of the majority order authored by Justice A K Sikri, it is recorded that "a Processes Committee was set up on July 03, 2006, to suggest the process for updation, modification, addition and deletion of data and fields from the core database to be created under the Unique Identification for BPL Families project.

This Committee, on November 26, 2006, prepared a paper known as ’Strategic Vision Unique Identification of Residents’. Based thereupon, the Empowered Group of Ministers (EGoM) was set up on December 04, 2006, to collate the National Population Register under the Citizenship Act, 1955 and the Unique Identification Number project of the Department "of Information Technology.
 
Subsequently, "a Committee of Secretaries was formed. The said Committee gave its recommendations which were discussed by EGoM. After approving the Aadhaar Scheme in principle, it instructed the Cabinet Secretary to convene a meeting to finalise the detailed organisational structure of the UID.
 
After considering the recommendation of the Cabinet Secretary, Notification No. A-43011/02/2009-Admn.I was issued on January 28, 2009, by the Government of India which constituted and notified the UIDAI." Annexure 1 of this notification that constituted UIDAI deals with the Role and Responsibilities of UIDAI. The fourth point in this notification reads: "implementation of UID scheme will entail" taking "necessary steps to ensure collation of NPR with UID (as per. approved strategy)".
 
7. The minutes of a meeting of the Committee of Secretaries held under Chairmanship of Cabinet Secretary November 23, 2015 talks of "integrating the twin approaches under NPR and Aadhaar."
 
The "integrating the twin approaches under NPR and Aadhaar" which is referred here is the same as taking "necessary steps to ensure collation of NPR with UID (as per. approved strategy)" underlined in the notification mentioned in the Aadhaar Act.

8. A Ministry of Home Affairs communication dated July 19, 2019 states that "The National Population Register (NPR) thus prepared, was seeded with Aadhaar number during its updation exercise in 2015 along with a collection of demographic details of new household members. Approx. 60 crores Aadhaar numbers have been seeded in NPR Database."

This communication discloses that "It has now been decided by the Ministry of Home Affairs to update the existing NPR database during April 2020 - September 2020 along with House listing & Housing Census phase of Census 2021. While updating the NPR, the Aadhaar number of all the individuals whose Aadhaar number is not available in the NPR Database will also be collected along with various other items. Necessary notification for updating NPR in 2020 will be issued shortly."
 
9. The Court’s order reveals that "A core group was set up to advise and further the work related to UIDAI...The core group, inter alia, decided that it was better to start with the electoral roll database of 2009 for undertaking the UIDAI project." If an UID/Aadhaar-enabled Biometric Attendance System is indeed a ‘digital equivalent’ of an ‘age-old attendance register,’ why did the National Human Rights Commission object to a radio collar which can also be argued by sophists to be a ‘digital equivalent’? It may be recalled that the Union Ministry of External Affairs had agreed with the NHRC’s assessment. The Union minister of external affairs informed Parliament that some 18 students were detained and released in the US with radio monitoring devices on their ankles, pending completion of investigations for possible involvement in irregularities. ’We have also strongly protested the radio collars as unacceptable, which should be removed immediately.’ If the ‘digital equivalent’ means biometric equivalent as well, then radio collar and DNA-based identity and attendance will also be deemed equivalent to ‘age-old attendance register.’ It is quite evident that such claims are deeply misleading.

10. The reference to ‘such other biological attributes’ in Section 2 (g) of Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, and the definition of ‘biometrics’ under the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 under section 87 read with section 43A of Information Technology Act, 2000 underlines that it includes ‘the technologies that measure and analyse human body characteristics, such as “fingerprints”, “eye retinas and irises”, “voice patterns”, “facial patterns”, “hand measurements” and “DNA” for authentication purposes.’ It is abundantly clear that the plan of UID/Aadhaar-based surveillance does not end with the collection of fingerprints and iris scan, it goes quite beyond it.

The confidential document of UIDAI reveals that "One way to ensure that the unique identification (UID) number is used by all government and private agencies is by inserting it into the birth certificate of the infant. Since the birth certificate is the original identity document, it is likely that this number will then persist as the key identifier through the individual’s various life events, such as joining school, immunizations, voting etc." Notably, there has never been any occasion wherein there was an all-party meeting to seek the consent of all the political parties with regard to merger of UID/Aadhaar database with "electoral roll database". It is evident that the provision of Electoral Bonds in the Companies Act, 2013 and the merger of Voter-ID Number and Aadhaar Number through amendment in Aadhaar Act is an exercise in merger of electoral database and Aadhaar database which will lead to extinction of political and civil rights of present and future generations. 

Justice Sikri authored order of Supreme Court’s Constitution Bench missed the opportunity to save present and future Indians from the dictatorship of faceless donors created through Finance Act 2017 and Finance Act 2018 which has compromised national security and almost all the public institutions. He has made citizens and natural persons residing in India naked and transparent in a legal system in which artificial persons, the opaqueness of body corporates has been legalized. The order committed a Himalayan blunder by ruling that right to have natural and human rights of citizens can be made conditional. This is being done by the government at the behest of the beneficial owners of ungovernable technology companies who have turned ruling political parties into puppets through their limitless and anonymous transnational donations. 

This creates a compelling reason for the States to un-sign the MoUs they have signed with UIDAI and discontinue both UID/Aadhaar and NPR exercise. This is required to resist the emergence of an unlimited government, unlimited by the Constitution of India and Constitutionalism. Aadhaar database scheme is an unlimited census in disguise. It is naturalising mass surveillance and mass spying in myriad disguisesand through diverse kinds of fish baits.

There is a compelling logic for setting up a High Powered Commission of Inquiry to probe the ongoing bartering of citizen’s databases and transfer of national data assets to foreign entities. In the face of assault on citizens’ rights and the emergence of a regime that is making legislatures and judiciary subservient to automatic identification, big data mining and artificial intelligence companies, the order of Justice Sikri undermined the Constitution and the sovereignty of the citizens who framed it. If the flawed order is not reversed by the 7-judge Constitution Bench, India’s social policies will be guided by biometric and genetic determinism and eugenic thinking of beneficial owners of unaccountable and admittedly undemocratic institutions.

In a country where no intelligence chief or official has been held accountable for the assassination of three of its Prime Ministers and for betraying the nation’s secrets, can it be hoped that all those who have compromised India’s data security will be made liable for their treacherous acts of transferring the sensitive data of present and future citizens including ministers, legislators, soldiers, and judges?

(Author: Dr. Gopal Krishna is a lawyer and law and philosophy researcher. He had appeared before the Parliamentary Committee that examined the National Identification Authority of India Bill, 2010 that was withdrawn in 2016 and enacted later as Aadhaar Act 2016)