Aadhaar: A Biometric History of India's 12-Digit Revolution

by Shankkar Aiyar

Year after year, governments allocated trillions of rupees, nearly 3 per cent of GDP, towards subsidies, scholarships and pensions, on programmes to improve delivery of health services, and for education. Depending on the policy and the geography, nearly half of it never reached the intended beneficiaries because establishing individual identity was arduous.

In 1986–87 India spent over Rs 37 billion in food and fertiliser subsidies, which was over 1.7 per cent of GDP, and over Rs 59 billion on social sectors, especially health and education.2 3 Yet, very little of the money allocated under various schemes was reaching the intended beneficiaries. A few months later, Rajiv Gandhi toured Rajasthan. The story was not very different there, or in the other states he visited. Over 40 per cent of India’s population was living below the poverty line. The reality was grim. And Rajiv Gandhi put it succinctly: ‘Out of Rs 100 allocated to an antipoverty project only Rs 15 reaches the people.’4

An evaluation by the Planning Commission in 2004 revealed that ‘In 2003–04, 16 states were issued 14.07 metric tonnes of food grain of which only 5.93 metric tonnes reached BPL families’.7 Nobody quite knew what happened to the rest. A Planning Commission Study, in 2005 said that ‘about 58 per cent of the subsidised food grains issued from the Central Pool do not reach the BPL families because of identification errors, non-transparent operation and unethical practices’ in what was designed as the Targeted Public Distribution System.8 Indeed, in 2008, Montek Singh Ahluwalia, deputy chairman of the Planning Commission, revealed that only 16 paise out of a rupee was reaching the targeted poor.’9

The affliction was not limited to the public distribution system for foodgrain. Fuel subsidies – for kerosene and LPG and diesel – had shot up from Rs 62 billion in 2002 to Rs 760 billion in 2009.

This is a bit facetious without taking inflation, population growth, and demand growth into account. ₹122B in 1991 would be equivalent to over ₹750B in 2010.

The diktat of the high-level committee to systemise the process was not necessarily driven by a desire to make life easier for the customer. It was propelled by a promise made in the Prevention of Money Laundering (PML) Act. The Act, passed during the Atal Bihari Vajpayee regime and notified only three years later in 2005, explicitly states in its preamble the need to fulfil an international commitment, to combat money laundering by enforcing customer due diligence.12 Although India had made an express commitment way back in 1990 and then again in 1998, the imperative to legislate the PML Act stemmed from the fallout of the 11 September 2001 terrorist attacks in New York. Soon after 9/11, the world woke up to the fact that illicit funds had financed the terror attack. In a move to curb this, the US government revived the inter-governmental body, the Financial Action Task Force (FATF), which was established in 1989 but was comatose, to combat money laundering, terror financing and threats to the global financial architecture.

In the fifty-fourth year of the Republic, the Vajpayee regime amended the Citizenship Act and inserted a new section to enable the issue of ‘National Identity Cards’. 15 This was tasked to the Ministry of Home Affairs under the National Population Register. A pilot was launched in April 2003, in thirteen states. The first set of national identity cards under the ‘pilot project on Multi-purpose National Identity Card (MNIC)’ was handed over to the citizens of Pooth Khurd in Delhi’s Narela area on 26 May 2007, by D.K. Sikri, then registrar general, India & registrar general of citizens registration.16 The government told Rajya Sabha MP Rama Muni Reddy that the delay was due to ‘complex process and technological issues’.17 India continued to be haunted by ghosts of the past and present which refused to allow the birth of a unique identification for every individual. Solutions were wracked by a confounding circular challenge. To get a document you needed to prove identity and to prove identity you needed some document.

Over dinner that night Nilekani told Krishnan, ‘All that is needed is to induct technology to establish that you, K.P. Krishnan, are K.P. Krishnan and issue a unique identity number that can be validated across the country.’ Once this is established, the other factors will follow – whether it is customer due diligence or beneficiary due diligence. Krishnan agreed. It was the mother of all solutions but easier said than done.

The Multi-Purpose National Identity Card had a rocky start. It was started during Advani’s tenure as home minister, it was seen as his idea, therefore tagged as a BJP project. The Bihar government, in 2003, then led by Rashtriya Janata Dal (RJD) with Rabri Devi as chief minister had refused to implement the ID card project.18 RJD was now part of the United Progressive Alliance (UPA).

The kernel of thought stayed with Nilekani. In 2008, he expanded on the idea in his book, Imagining India – Ideas for the New Century. The book itself was born out of a romance with the idea of building new instruments for a modern state, after his involvement in promoting ‘India Everywhere’ at Davos in 2006.

In May 2004, the Congress came to power with the Left Front riding shotgun.

The declaration was triggered by the political and economic repercussions on account of poor delivery on one side of the equation and rising costs of welfare programmes and subsidies on the other side. In March 2006, the government announced a grand plan, ‘Unique ID for BPL Families’, and tasked the Department of Information Technology in the Ministry of IT and Communications to get it implemented by the National Informatics Centre. The project was to be implemented within – hold your breath, drum rolls – twelve months.20

In July 2006, a processes committee in the Planning Commission was set up under Arvind Virmani, its principal adviser, for modification, updation, addition and deletion of data fields from the core database to be created under the UID for the BPL Families project.21 A ‘Strategic Vision on the UID Project’ was prepared in consultation with Wipro as the technology consultant. The flyover fix, to overcome issues of enrolment and to kickstart creation of UID for BPL families, was to link it to the ready database of election rolls.

By August 2007, the processes committee, which included officials of seven departments, had held seven meetings and put up a proposal ...

Inevitably the issue of who would do what, why and how – the matrix of turf control in government – came up. The matter was duly referred to the prime minister to be taken up in the cabinet, which now involved the IT minister, who was from the Dravida Munnetra Kazhagam (DMK), the home minister, who was from the Congress and the deputy chairman of the Planning Commission, a technocrat. Prime Minister Manmohan Singh, recognising the complexity of issues, created an Empowered Group of Ministers (EGoM) on 4 December 2006, headed by the redoubtable Pranab Mukherjee, formerly the external affairs minister and, as of 25 July 2012, the thirteenth president of India.

In its second meeting on 28 January 2008, the EGoM decided to create a Unique Identification Authority of India (UIDAI) under the Planning Commission

The deadline for the first UID to be made available: December 2009.

The decisions were not easy – particularly since the contesting ministry was the Home Ministry. The Home Ministry, housed in North Block on Raisina Hill, was and is still seen as a government within the government. And it was totally opposed to a body being created for collecting and securing a database on Indians. A lesser politician would have found it tough to mobilise consensus in the face of such stiff opposition. But Mukherjee, who has had a ring-side view of history and power politics since the 1960s, is regarded across party lines as the encyclopaedic authority on government and Parliament with an institutional memory few dare contest.

Biased? Or genuine?

On 28 January, UIDAI was notified, to be housed and hosted by the Planning Commission. The fifty-two-page notification listed its responsibilities and organisational structure.22

On 2 March 2009, it announced the schedule for elections to the Fifteenth Lok Sabha. The idea of UIDAI was put on hold; its birth would have to await electoral coronation.

16 May, a few hours after the 2009 results were out. The Congress had won the polls, and a second term, with an improved seat count – up from 145 to 206. The political air was thick with ambition and optimism.

He spoke with Manmohan Singh a week later. He had a second thought – the UIDAI project had been cleared; it afforded an opportunity to get into government and actually deliver change. Manmohan Singh had a similar thought.

He knew rank and hierarchy mattered and asked for cabinet rank.24 He ensured he would report to the prime minister and that the announcement of his induction would be in his words – it was critical that he be ‘invited’ to join government. He asked for a special cabinet committee on UIDAI so decisions could be empowered and insulated. He got an assurance that the law bestowing statutory authority to the autonomous body would be prioritised. Manmohan Singh agreed on all counts. More importantly, he passed the baton of process to Ahluwalia, experienced in the art of skirting minefields.

The survey revealed that the ‘share of Central Government expenditure on social services which was 10.46 per cent in 2003–04 had touched 19.46 per cent in 2009–10.26 It also emphasised that the delivery of subsidies and services was wracked by leakages and urged a mechanism to address this.27

On 6 July, Pranab Mukherjee allocated Rs 1.2 billion for the setting up of UIDAI. In his speech, the finance minister said, ‘this project marks the beginning of an era where top private sector talent in India steps forward to take the responsibility for implementing the projects of vital national importance’.28

On 9 July 2009, at 4 p.m., when the techies at Infosys logged out to attend the farewell party of one of the founders, Nilekani told his colleagues with candour, ‘My only identity is Infosys. I leave to lead a programme which gives identity to every Indian. But today I am losing mine.’

Nilekani first met with Ram Sewak Sharma. The postings held by Sharma, a 1978 batch IAS officer from the Jharkhand cadre, seemed straight out of a Bollywood script. He had been posted in the badlands where people and officers are frequently brutalised by political and other bandits. Sharma’s hobby: writing code. Sharma acquired his first computer in 1985, as District Magistrate (DM) of Begusarai, and a year later he introduced the district to a DCM 10-D computer and wrote a code to track down lost-and-found weapons. Later, as DM of Purnea, where he was looking after the treasury, Sharma wrote a code to enable a public grievance system. Then, as deputy commissioner at Dhanbad, he used it to manage elections. When he learnt that government personnel on election duty were co-opted by the political parties, Sharma deployed his code-writing skills to randomise the posting of people at booths. In 2000, at the age of forty-five, Sharma went to the University of California to acquire a Masters in, well, computer science.

UIDAI now had a chairperson, a CEO, a PS. What it needed was that all-critical component of CFO, not just someone qualified to be a chief financial officer but one who understood the intricacies of oversight and accountability within the multi-layered systems that make up the government. Enter Ganga K., liberal arts major and a technology buff. Way back in 1989–90, as senior deputy accountant general in Chennai, Ganga had been involved in the computerisation of Provident Fund accounts in Tamil Nadu. Those days, the AG’s office had vintage Ascota accounting machines, the ones with keyboards and the kind that add and print out a sheet to be stapled to the ledger. ‘When the systems were changed,’ she says, ‘I was tasked with overseeing its implementation – it was quite an experience and converted me into a tech hobbyist.’ Ganga had just shifted to Shimla in May 2009, as the principal accountant general in Himachal Pradesh. She had heard about the UIDAI project. ‘I was intrigued and fascinated but I didn’t expect to be asked.’ Then Krishnan called her and asked, ‘Would you like to meet with Nilekani?’ A week later Ganga drove down from the hills to meet the UIDAI chairman. Nilekani reviewed her CV in detail and asked her, ‘Can you give five years to this project?’ She said yes, ‘with one caveat. I didn’t want to be just the CFO. I wanted to be involved in the conceptualisation and implementation of the project.’ Nilekani agreed instantly.

Between them, Sharma and Ganga provided Nilekani with a formidable combination. They understood technology and bureaucracy.

Others came to join this eclectic mix of talent and diversity. Ashok Pal Singh was deputy director general with India Post and dreamt of creating a bank account for every Indian. He met with Nilekani and Sharma to suggest how this could be done. He was invited to join and drive financial inclusion.1 B.B. Nanavati, an Indian Revenue Service officer armed with a huge cache of experience in IT procurement, was the author of many requests for proposals (RFPs). Rajesh Bansal, from the Reserve Bank of India, who was on a sabbatical at Duke University in the US, enabled perspective and understanding of regulatory challenges using his experience in designing digital payment systems. There was no dearth of talent. Sharma says, ‘People from different sectors from within the government and outside wanted to join the UIDAI.’ Raj Mashruwala, a senior of Nilekani’s from his IIT Bombay days and a serial entrepreneur in the US, wrote to congratulate him and came on to assist. Nadhamuni, who was one of the first people Nilekani had met and discussed the idea with, joined in to help. Sanjay Swamy, CEO of mChek, wrote to Nilekani about possibilities and got invited to help with the mobile and micro payments push. Pramod Varma, an ex-Infosysian, one of the key finds of Nilekani and among the first five to jump in, was Chief Technology Architect and VP research at Sterling Commerce (now IBM). Varma brought with him expertise in architecture strategies for systems and joined as Chief Architect ...

The work and work space could not have been more typical of a start-up. The core team of UIDAI operated in two different geographies. The tech team and the private consultants initially operated out of Bengaluru from a makeshift office in a fourth-floor apartment in Palm Retreat Towers on Outer Ring Road, before moving into a proper office on Sarjapur Road. In Delhi, the team was squeezed cadre by jowl into a small office in the Planning Commission building called Yojana Bhavan before eventually acquiring its own space in the Jeevan Bharati building at Connaught Place.

Within the officialdom, Sharma faced jibes about working for or under a private sector person. ‘Guys would tell me privately, why are you helping a private guy? I simply said, we are working for the country. It is not that sarkari guys are all dumb or that private guys are all smart. Whosoever has competence has the competence. Rest is all stereotyping.’

The foremost task was to define how UIDAI would identify a person. What demographic data would be collected to define identity? The MNIC under the National Population Register listed sixteen fields: name, sex, father’s name in full, mother’s name in full, date of birth, place of birth, marital status, name of spouse in full, present residential address, permanent residential address, visible identification mark, finger biometrics, date of registration, date of issue, date of expiry and a photograph. Every card would carry a distinct number.3

During ongoing consultations, many departments in ministries wanted UIDAI to expand the data field. They wanted data on blood group, disability, religion, ethnicity, income-related information, and so on and so forth.

UIDAI wanted to keep the form as simple as possible and only ask for the relevant data for the purpose of identity. It was decided that name, age, gender and communication address were sufficient. Email and mobile numbers were optional as was father’s or spouse’s name.

In India, the capture of biometrics faced many a challenge. Expectedly, given the general nature of labour in India, a large number of people have bald fingers; they have no registrable or recognisable fingerprint. This was borne out in early trials. It was recognised that manual labourers – those working on farms and construction sites – could suffer exclusion and it was such people who needed valid identification the most. UIDAI’s team decided on registration of all ten fingers.

To ensure reliability, a technical sub-group was formed to collect Indian fingerprints and analyse the quality. Over 250,000 fingerprints from 25,000 persons were sourced from Delhi, UP, Bihar and Odisha – nearly all from rural regions using different capture devices and through different operational processes. Analysis showed ‘it was possible to obtain fingerprint quality as good as seen in developed countries, provided operational procedures were followed and good quality devices were used’. The report also cautioned that ‘accuracy drops precipitously if attention is not given to operational processes’. Nilekani and his team began looking at using fingerprints as well as iris scan recognition to boost reliability.

If a billion people were to be given numbers, the number would need to be ten digits at least. Eleven digits would cover a population of 99 billion – remember, world population would only touch 11 billion after 2050. The UIDAI team decided they would go with a 12-digit number, and that the issue of numbers would be random – to preclude pattern and detection of gender, geography, ethnicity, religion, and so on.20 The team also decided no number would ever be re-issued, even after the person’s death.

The choice of this 12-digit format has a lot to do with modern computing. Technically, the identity number is chosen from eleven random digits. The twelfth digit is an instrument for detecting data entry errors. The system is similar to the one deployed in credit cards and uses what is called the Verhoeff Scheme.

Unlike the NPR, the UIDAI would not be issuing a card. The political system loves issuing cards – plastic, chip embedded – and that gets entangled in procurement red tape.

The enrolment process was split in two parts. The resident could go to any registrar of choice – the processes were uniform – as per his/her convenience. The operator would collect the information from residents; take biometric impressions of ten fingers and scans of both the eyes. The data would be collected on software provided by UIDAI. The software would be coded for immediate encryption of all data, with a digital signature so no outsider could decrypt it – neither the operator, nor the enrolling agency, not even the registrar. The second phase dealt with the back-end. The data packet, which is around 3 MB, is transmitted to the Central Identities Data Repository. The systems, software and architecture for CIDR were designed in-house and the operations outsourced. The back-end of the server uses multiple automatic biometric identification systems (ABIS) to authenticate whether the resident is unique – that he or she has never been issued a number till then.

At a billion plus people, the math of the de-duplication process is complex. Shah offers to simplify it with a formula – N x N+1/2. At a billion people, the system, it is estimated, would do 700 million billion biometric comparisons.23 Following authentication, the resident would receive a letter at his communication address via India Post.

A few months into enrolment, it was discovered that a large number of iris scans were stumbling at the de-duplication stage, that is, when they were matched with existing scans to rule out duplication. The tech team was puzzled. Careful scrutiny of the position of tear ducts and eyelashes revealed that the images had been spun around. It seemed operators were scanning the eyes upside down, leading to the switching of left and right eye images. Sanjay Jain, chief product manager of UIDAI, charged with ensuring end-to-end process and outcomes, recalls this as one of the many challenges. After much thought, the team concluded that the villain was the software that drives the device. ‘The priority,’ says Jain ‘was to first halt the creation of errors. So the tech team wrote a patch for induction into the enrolment package.’ What were they to do with all the flipped scans? There was no question of going back to the field. Also, there was a lag between the enrolment and the arrival of the data at UIDAI for authentication – theoretically other flipped scans could be on the way. Jain says the tech team rolled up their sleeves to innovate in-situ and wrote software to enable flipping the iris scan for authentication.

The UIDAI team trained over 150,000 persons. At the peak, over 50,000 stations were enrolling over 1.5 million a day.’

What about costs and funding? Via the state governments, UIDAI would pay the enrolment agencies Rs 50 per authenticated enrolment, which meant the payment was released only after the enrolment was de-duplicated at the CIDR and a number was issued.

equipment costs would come up to around Rs 300,000 per enrolment counter.

UIDAI paid the states Rs 50 per issue of number, regardless of what the states paid. Many states issued RFPs and got enrolment done at lower costs. That raised the question of what would be done to settle the accounts. It was eventually decided that the states would set up permanent enrolment centres and information centres with the money. What set UIDAI apart and on the route to scale was the strategic departure from conventional practices, especially the outsourcing of processes. At an operational level, it limited the field of demographic data, it offered choice in when and where to enrol, it outsourced the registrar function to states, it created training modules and certification to enable private participation, it baked processes in-house to stipulate time and costs, it leveraged online facilities from training for the issue of numbers or updating of details.

An elderly Mogiya, Naiya Ram Rathore, put his hand on Pugalia’s shoulder to tell him this was a good idea. And then he added, ‘Agar aap isko vaastavikta mein tabdeel kar sakte hain toh bahut achha hoga. Pehchaan hi toh jeevan ka aadhaar hai.’ (If this idea can be translated into reality, that would be very good. Identity is, after all, the foundation of life.) Naman Pugalia was so struck by the elderly nomad’s statement that he drove through Rajasthan’s desert dust till he found a cell-phone tower and connectivity. He called Shankar Maruwada, who steered the marketing and branding push, and told him about it. ‘Aadhaar,’ he said, ‘Pehchaan hi jeevan ka aadhaar hai.’ Maruwada recalls that moment, and being instantly in sync with the idea. ‘Aadhaar. Identity is the foundation, the very basis, of life.’ He telephoned Nandan Nilekani. Aadhaar it was.

When he received his cheque of Rs 100,000, Pande, a designer by profession, said, ‘I read through their concept notes and knew that I had to create something which is easily recognisable. Any rural person would be able to can recognise the sun and the fingerprint.’ The jury that finalised Pande’s logo said, ‘a sun in red and yellow, with a fingerprint traced across, effectively communicates the vision for Aadhaar. It represents the dawn of equal opportunity for each individual, a dawn that emerges from the unique identity that the number guarantees for each individual.’

UIDAI had declared, right at the start, that it would only issue unique identity numbers. Nilekani had consistently told every audience, including the Cabinet Committee on UIDAI, that there would be no cards. The official printout with the unique number, reaching each successful applicant through India Post, would suffice. Yet, systemic pressure for a card had been mounting from both the bureaucracy and politicians.