It's 12 digits long, comes on a card, and sits in 99 percent of adult Indian pockets. Aadhaar, the Indian digital identity project, has existed since 2010. Today, more than 1.2 billion Indian residents carry the card.
The national identity scheme is an interesting case study for other governments. Countries interested in increasing efficiency using ID cards can learn from Aadhaar and other national projects, refining their systems and making them palatable for citizens.
Aadhaar's use of biometrics
Operated by the Unique Identification Authority of India (UIDAI), Aadhaar assigns a unique, random number to a card holder. The number itself doesn't hold any sensitive demographic profiling information. Instead, it is an identifier for information residing in a centralized database, which includes demographic data, along with three types of biometric information: facial images, fingerprints and iris scans.
By collecting three different biometric modalities, the government can dramatically reduce the likelihood of false positives or negatives. A service provider can use more biometric data types to authenticate someone as the service that they are accessing becomes more sensitive.
Aadhaar card holders can use their numbers for online or in-person verification, depending on the service that they are accessing.
Use cases vary, but many of them fall under the banner of ID fraud prevention. Increasingly, citizens in India and elsewhere must present some form of ID when accessing government services, such as benefits.
Applications for other nations
Benefit fraud is big business, affecting areas ranging from pensions to housing benefits. In the United Kingdom, the most recent figures, covering April 2015 to March 2016, show that fraud accounted for the lion's share of a £3.3 billion annual overpayment bill.
In the United States, the federal government won or negotiated more than $2.5 billion in healthcare fraud judgments and settlements in fiscal year 2016. According to the Social Security Administration, there are an estimated $3 billion in improper benefits payments annually. Governments are leaving a lot of money on the table by not verifying claimants properly. In the SSA’s case, the use of biometrics could bring other benefits beyond cracking down on fraud. For example, the SSA could increase efficiency and processing times via a quick biometric scan that verifies and re-verifies people as they visit field offices, eliminating the need for paperwork and breeder documents to confirm identity.
Fraudsters are also known to use fake ID information to collect tax refund money that governments do not really owe them. In the U.S., tax refund fraud hit $21 billion in 2015, due to timing of submissions and the weak proof required to file a return and collect the refund check. Biometrically protected and encrypted social security cards, combined with remote verification techniques and changes in the timing of audits vs. refund issuance, could go some way toward stopping this.
In fact, the Australian Tax Office (ATO) is using speaker verification (voice biometrics) to secure and enhance the remote citizen’s interactions with the Office through their call centers and mobile apps. About 3 million people are enrolled in the ATO service, resulting in significant savings of time and money – both for citizens and the Government – by reducing the average call time by 45 seconds. No estimate of any associated fraud reduction has been cited, but who can argue with faster, more secure, and less costly service to citizens?
There are other applications beyond reducing fraud. Linked with the correct data, digital identity cards could be a useful form of information for healthcare professionals. Plugging in a card to retrieve the holder's necessary information could quickly and easily enable medical professionals to administer appropriate and timely care in critical situations.
One potential benefit of biometrically-enhanced ID documents is their use as platforms for developing a range of convenient services. For example, Aadhaar is already morphing into a payments platform enabling merchants and customers to transact directly on smartphones that scan the customer's fingerprint. This avoids the service charges seen with conventional debit and credit cards.
Biometric ID cards can make it easier to prove identity in any situation where an individual must provide their identity to access a product or service of value. It can help to speed up access to government services ranging from education and training to family and social services, while ensuring that they are more secure. Presenting a card with biometric data could help citizens to access health insurance information, open a bank account or register a car.
Solutions for an Identity-Driven World
Completing personal transactions increasingly depends on positive identification, but traditional forms of ID can be stolen or forged. Biometric matching — verifying a person’s identity through unique biological characteristics such as fingerprint, face or iris – provides more reliable identification than traditional documents.
With biometrics, individuals can more securely and efficiently:
After an initial enrollment and biometric scan, anyone can unquestionably prove their identity with a touch of the finger or a glance at a sensor. Low implementation costs make this convenience attractive to a wide range of government and commercial identity-driven services.
Building safe, citizen-focused ID systems
Governments can encourage citizens to use the card by focusing on its benefits rather than being overly prescriptive.
One critique of Aadhaar focuses on government agencies giving citizens no choice but to enroll in the system to receive benefits. Critics worry that this practice discourages some people from registering, and that connectivity errors can hinder attempts to enroll for the program or collect benefits. Further complicating government plans is a recent ruling by India’s Supreme Court that privacy is a fundamental right under their constitution. Opponents of Aadhaar expect to use this ruling in petitions against the efforts to make enrollment mandatory.
These headwinds on this ground-breaking program illustrate a number of challenges we all must address if progress is to be made. Privacy has to be built-in and the protections conveyed through actions and clear communications. Education needs to be provided so that people know the difference between anonymity and rights to privacy. Communicating effectively and educating thoroughly when implementing a new government program is tough in any case, but especially when 1.2 billion people are involved. In any case, I don’t believe that responsible citizens would advocate for anonymous or misidentified people being able to receive government benefits – their benefits. However, for their parts, governments need to maintain strict security processes and cyber hygiene so that the most sensitive data – the personal biographic information in the databases – is protected from unauthorized access.
This respect for privacy goes beyond simply ensuring that personal data are safe. Cardholders will want to prove their identities using their cards without worrying about external parties tracking them. Privacy by design – the idea of hardwiring privacy into systems from the ground up – will be the law in Europe when the General Data Protection Regulation (GDPR) comes into force.
ID systems can serve as a proof of identity while also protecting privacy. More than 100 countries already hold at least a digital face image in a chip embedded in passports. Border guards then evaluate the face of the person standing before them against the face contained on the passport chip.
Designing biometric ID systems for acceptance
Biometric systems in everyday life aren't so new; governments around the world already use the technology to help identify citizens to some degree. Anyone with a modern cellphone may find themselves using biometrics to log in (such as Apple's Touch ID fingerprint scanner, or 3D Face ID on the iPhone X, for example) and access their most sensitive data, much of which they also share with cloud-based services.
If systems put the citizen's comfort and confidence first, biometric-enhanced national ID systems can reduce the friction involved in offering products and services, while saving money and effort for both public and private sector service providers.
With a little more than one in six of the world's entire population using Aadhaar, the idea has long since evolved past the proof of concept stage, with other countries expressing interest and paying close attention. Regardless of what happens in India, the global move toward more general identification services will proceed.
John is a Vice President and Tech Fellow specializing in biometrics, identity management, and forensics. He uses technology to improve citizen services, homeland security, law enforcement, defense, and intelligence operations.More Content by John Mears