BENGALURU: The lack of information security practices in key government websites which hosts Personally Identifiable Information (PII) has left citizens of the country more vulnerable to identity theft and financial fraud, a research paper has argued.
A paper by Amber Sinha and Srinivas Kodali of Centre for Internet and Society analysed four government websites and found that more than 13 crore Aadhaar numbers with related PII were available on the websites, exposing lax security features.
The paper published under Creative Commons is titled ‘Information Security Practices of Aadhaar (or lack thereof): A documentation of public availability of Aadhaar Numbers with sensitive personal financial information’ and was released on Monday.
Sinha and Kodali looked at databases on four government portals -- National Social Assistance Programme, National Rural Employment Guarantee Scheme, Chandranna Bima Scheme, Govt. of Andhra Pradesh and Daily Online Payment Reports website of NREGA, Govt. of Andhra Pradesh.
“We chose major government programmes that use Aadhaar for payments and banking transactions. We found sensitive and personal data and information accessible on these portals,” the report said.
Leaked through portals
“Based on the numbers available on the websites, estimated number of Aadhaar numbers leaked through these 4 portals could be around 130-135 million and the number of bank account numbers leaked at around 100 million.
While these numbers are only from two major government programmes of pensions and rural employment schemes, other major schemes, that have also used Aadhaar for DBT, could have leaked PII similarly due to lack of information security practices,” it said.
They fear that data of over 23 crore beneficiaries under DBT of LPG subsidies could be leaked also. Identity theft and financial fraud “risks increase multifold in India...,” they said.
Aadhaar payments unsafe
In case a financial fraud takes place through Aadhaar enabled Payment System (AePS), the consumer may not be able to assert his claims for compensation due to the terms and conditions around liabilities.
“These terms force the consumer to take liabilities onto oneself than the payment provider..... Regulations and standards around Aadhaar are at a very early and nascent stage causing (an) increase in financial risk for both consumers and banks to venture into AePS,” they added. The authors also pulled up UIDAI for their inability in providing strong legislation against such leaks.
Leaky govt portals
National Social Assistance Programme
PII available - Access to Aadhaar no., name, bank account number, account frozen status 94,32,605
bank accounts linked with Aadhaar
14,98,919 post office accounts linked with Aadhaar numbers.
Though total Aadhaar number is 1,56,42,083, not all are linked to bank accounts
NREGA
PII Details available: Job card no., Aadhaar number, bank/postal account number, no. of days worked, registration no., account frozen status
78,74,315 post office accounts of individual workers seeded with Aadhaar numbers,
8,24,22,161 bank accounts of individual workers with Aadhaar numbers.
10,96,41,502 total number of Aadhaar numbers stored by portal
Other websites
Chandranna Bima Scheme, Govt. of Andhra Pradesh
Daily Online Payment Reports website of NREGA, Govt. of Andhra Pradesh
UGC takes u-turn on making PhD scholars' Aadhaar details public
Aadhaar to be soon compulsory for filings under Companies Act
Link donations to political parties with Aadhaar: Manish Tewari
Bankers’ errors in Aadhaar seeding hurting beneficiaries: Officials
Alive to earlier orders that Aadhaar should be voluntary: SC
Government bats for Aadhaar, says it will curb tax evasion