India’s ambitious digital ID project faces new security nightmare

India’s all-pervasive digital identity programme Aadhaar appears to be facing a fresh security scare. The concern may also have national security implications, as suggested by material accessed by Asia Times.

The key to the latest security breach comes from a modified Aadhaar enrolment software, known as ECMP, which is being distributed illegally for a cost ranging from Rs 500 to Rs 2,000.

Alerts to the Unique Identification Authority of India (UIDAI) and other government agencies have been acknowledged, but no detail of any follow-up action has been revealed. This has given rise to suspicion that the breach is yet to be resolved.

The ECMP was developed as software that can be used by operators to register people so they can get unique digital Aadhaar numbers. There is an elaborate program that allowed “enrolment partners” to be contracted by UIDAI to sign up citizens and residents across the country. The ECMP software ensures that sensitive personal data of those signing up is securely collected in a prescribed format to generate their Aadhaar number.

However, as reports of enrolment fraud began to surface, the UIDAI blacklisted nearly 50,000 private operators and mandated public sector banks and post offices to carry out the enrolment.

For the erstwhile private operators, the blacklisting was a major blow. Public sector banks were overloaded with the additional work of signing up citizens and residents.  The government has made Aadhaar mandatory for filing taxes as well as having bank accounts and a cell-phone connection. Nearly a billion people were signed up, even as the government was engaged in a slew of litigation in India’s Supreme Court challenging the project.

A number of petitioners have challenged the Aadhaar project on the ground that it enables mass surveillance by the state, violates citizens’ privacy and poses a major danger to legitimate entitlements guaranteed by the Indian Constitution. The slew of cases led to an unprecedented nine-judge constitutional bench of the Supreme Court ruling that privacy was a “fundamental right” under the Constitution. The other petitions challenging the program are still being heard by the Supreme Court.

The ECMP software allowed the operators to collect biometric data such as iris scans and fingerprints, as well as details of address and date of birth, among other sensitive personal data. The software has two major safeguards to ensure that it can not be misused. It asks for the biometrics of the authorized operator and seeks the geo-location to ensure that not only is the data being collected by someone authorized to do so, but to also ensure that it is being done at a secure and mandated location. There are many videos explaining how this software can be downloaded and installed.

Software ‘compromised to bypass safeguards’

But material gleaned from group WhatsApp messages of erstwhile private operators and complaints to the UIDAI reveal that the software has been compromised. This allows illegal access to the Aadhaar database by by-passing the biometric and geo-location safeguards.

Messages posted in several WhatsApp groups among Punjab-based operators began to surface at the end of last year, offering to sell a “jailbreak” version of the software. This version, to be installed on the laptops of anyone willing to pay the amount, could bypass the biometric and geo-location safeguards. This basically meant that anyone posing as an “authorized operator” could make changes to the data and enrol new people from anywhere and pass their information off as legitimate. This is easier as the number is only proof of residency and not citizenship.

Two information security professionals who looked at the compromised software confirmed to Asia Times that the safeguards had been bypassed. “(The) Aadhaar Enrolment client can be installed on any laptop and is available for public download. It needs to be configured for use by a  registrar (Banks, State governments) by importing registrar data and user credentials of the registrar”, the information security professional said, on strict condition of anonymity.

According to a second information security professional, enrolment and updates are possible only if an operator’s credentials match with their biometrics. However, the illegal enrolment software has been patched to bypass biometric checks and comes preconfigured with user credentials of various registrars. “The GPS module to track the location of the enrolment has also been disabled through a patch,” this expert said. “This allows anyone to become an Aadhaar enrolment operator, thereby violating all the security protocols that UIDAI has put in place for enrolment, including document verification such as proof of identity, proof of address. It also allows anyone to update their proof of identity or address details without any checks whatsoever.”

According to the experts, disabling or ‘spoofing’ the GPS checks gives rise to the possibility of the enrolment happening anywhere in the world, thereby allowing even foreign nationals who have never visited India, to enrol in Aadhaar.

None of these hacks are new. On February 23 this year, UIDAI authorities from the city of Chandigarh filed an official complaint with the Haryana Police. The case found a group of people working in the district of Hisar, using fake rubber thumbprints to bypass the biometric safeguards of the operator. This group was illegally accessing the database, as well as carrying out enrolments.

In the neighboring state of Uttar Pradesh, the police registered an official complaint in the capital Lucknow in August 2017. In this case, the UIDAI found operators who had managed to bypass the biometric safeguards as well.

‘Hostile’ UIDAI

These details and possibilities were brought to the UIDAI’s knowledge by email by an operator from Punjab. Bharat Bhushan Gupta sent them several warnings, which were acknowledged by UIDAI. But he was never informed about any follow-up. Gupta said he was willing to help the UIDAI access the compromised software and enable officials to examine the bypass in detail. But he never heard from them again.

Subsequently, a Punjab-based journalist with a major newspaper also accessed details of the compromised software and promptly alerted the UIDAI in writing in mid-April. This was also acknowledged, but no details of any follow-up action were shared.

To ensure good cybersecurity, the discovery of vulnerabilities depends largely on voluntary disclosure from hackers and information security professionals. However, despite being in existence from 2009, UIDAI lacks a responsible disclosure program, and in fact adopts a hostile stance against any disclosure. In the past, the agency has filed police complaints, not even sparing journalists who only reported on similar vulnerabilities. As a result, most experts shy away from informing the UIDAI about such problems. It continues to claim that their database is safe, despite mounting evidence to the contrary.

Asia Times sent the following queries to the CEO and chairman of UIDAI, to seek a response to these issues. The story will be updated as and when they respond.

1. Is it true that the Enrolment Client Management Platform (ECMP) software, being used for off-line enrolment has been found to have vulnerabilities, which can be exploited to bypass geo-location and biometrics?

2. Is the UIDAI aware that a group of illegal operators are using this software and installing it for a price, enabling people to carry out illegal enrolment and updates?

3. What is the progress on the UP Aadhaar hack – illegal enrolment case, where the Enrolment software was hacked as per the registered First Information Report in September 2017?

4. Was the ECMP software sufficiently hardened so that the above vector of patching the software to bypass an operator’s biometrics cannot happen?

5. If yes, what are the technical measures put in place to plug this vulnerability?

6. A similar incident was reported by operator Bharat Bhushan Gupta from Jullundur on Feb 1, 2018, which the UIDAI has acknowledged. What was the resolution of that incident and details thereof?

7. The same vulnerability was reported by Ms Rachna Khaira and also reported to the National Critical Information Infrastructure Protection Center on April 15, 2018. What is UIDAI’s response to this?