UID and Implications for other Countries

I. Introduction
Title of the study
UID and Implications for other Countries.

Why this topic was chosen?

India has embarked on an ambitious new program to provide its citizens and residents
a unique, official identity. The UID program aims to improve the delivery of government
services, reduce fraud and corruption, facilitate robust voting process, and improve security. It
is by far the largest applications of biometric identification technology to date and will have
far-reaching implications for other developing countries that are looking to adopt national ID
programs to further social and economic development.

Objective and Scope

This project discusses the nature of the UID program, the innovative organization and
path breaking technology behind it, how it is being rolled out, how robust ID is beginning to
be used and also draws lessons for other countries.

Summary
A crucial factor that determines an individuals well-being in a country is
whether their identity is recognized in the eyes of the government. Weak identity limits the
power of the countrys residents when it comes to claiming basic political and economic
rights. The lack of identity is especially detrimental for the poor and the underprivileged, the
people who live in Indias social, political and economic periphery. Agencies in both the
public and private sector in India usually require a clear proof of identity to provide
services. Since the poor often lack such documentation, they face enormous barriers in
accessing benefits and subsidies.
For governments and individuals alike, strong identity for residents has real economic
value. While weak identity systems cause the individual to miss out on benefits and services,
it also makes it difficult for the government to account for money and resource flows across
a country. In addition, it complicates government efforts to account for residents during
1

UID and Implications for other Countries

emergencies and security threats.
However in India, the goal of issuing a universally used, unique identity number to
each resident poses a significant challenge. A project of this scale has not been attempted
anywhere in the world, and requires an innovative model, distinct from what we have
witnessed in identity systems so far.

The UIDAI Approach

In 2007, the Planning Commission had recommended an approach to issuing unique
identification numbers, where the enrolment into a Unique Identification (UID) database
could be speeded up by using existing resident records in the databases of the Election
Commission, PAN etc. This approach would speed up enrolment for those residents present
in one of the aforementioned databases. These databases however, may contain
inaccuracies.
The model envisioned by the Unique Identification Authority of India (UIDAI)
takes into account the inputs of the Planning Commission, as well as learnings from the
previous approaches to identity.

UID and Implications for other Countries

II. UIDAI Structure

The structure that the UIDAI envisions will have the reach and flexibility to enroll
residents across the country.
The UIDAI, as a statutory body, will be responsible for creating, administrating and
enforcing policy. The Authority will prescribe guidelines on the biometric technology, the
various processes around enrolment, and KYR verification. The UIDAI will also design and
create the institutional microstructure to effectively implement the policy. This will include a
Central ID Data Repository (CIDR), which will manage the central system, and a network of
Registrars who will establish resident touch points through Enrolling Agencies.
The Central ID Data Repository (CIDR)
The CIDR will be the central data repository, and will function as a Managed Service
Provider. It will implement the core services around the UID it will store resident
records, issue unique identification numbers, and verify, authenticate and amend resident data.
The CIDR will only hold the minimum information required to identify the
resident and ensure no duplicates. This will include:
i) Unique Identity Number: The Unique ID or UID will be a numeric that is unique
across all 1.2 billion residents in India.
The UID number will not contain intelligence. In older identity systems, it was
customary to load the ID number with information related to the date of birth, as
well as the location of the person. However this makes the number susceptible to
fraud and theft, and migration of the resident quickly makes location details out of
date. The UID will be a random number.

UID and Implications for other Countries

ii) Identity fields: The fields associated with the UID number will be:

Name
Date of birth
Place of birth
Gender
Fathers name
Mothers name
Mothers UID number (optional for adult residents)
Address (Permanent and Present)
Expiry date
Photograph
Finger prints

The UniqueID agencies

The UIDAI will partner with a variety of agencies and service providers to enroll
residents for UID numbers and verify their identity.

Figure 2.1 Structure of UID Agencies

4

UID and Implications for other Countries

The Structure of these UID agencies will be as follows:
Registrars Registrars will be state governments or central government agencies such as
the Oil Ministry and LIC. Registrars may also be private sector participants such as banks
and insurance firms.
The UIDAI will enter into agreements with individual Registrars, and enable their onboarding into the UID system. The Registrars may need to make changes to their processes
to be UID- ready. The UIDAI will support them in this, and in linking to the CIDR,
connecting to the UID system, and adding UID fields to their databases.
The Registrar will take on the responsibility of ensuring that clean and correct data
flows into the CIDR. Their key role in the system will be in aggregating enrolments from
sub-registrars and enroling agencies and forwarding it to the CIDR. Each Registrar will
adopt UIDAI standards in the technology used for biometrics, as well as in collecting and
verifying resident information, and submitting to audits.
The UIDAI will also enter into agreements with some Registrars for using the CIDR
solely for authentication purposes. The service providers who will adopt the UID system for
identity authentication during service delivery will follow certain processes and standards,
and may need to re-engineer their internal processes.
Sub-Registrars These will be the departments/entities that report to a specific Registrar.
For instance, the line departments of the state government such as the RDPR (Rural
Development and Panchayati Raj) department would be sub-registrars to the state
government Registrar.
Enrolling Agencies Enrolling agencies will directly interact with and enrol residents into
the CIDR. For example, the hospital where a baby is born would be the enrolling agency
for the babys UID, and would report to the municipality sub-registrar.
Outreach Groups The UIDAI will also partner with civil society groups and
community networks which will promote the UID number and provide information on
enrolment for hard to reach populations such as rural women, tribals and others.

UID and Implications for other Countries

III. Enrolment into the UID

A critical aspect of the UID enrolment process is that enrolment will not be
through a mandate, but will be demand driven. The momentum for the UID will come from
residents enrolling in order to access the benefits and services associated with it.
The basic advantage of the UID that can drive this demand, which is to be
communicated while promoting enrolment, is that the UID will be one number, which can
be used to prove identity for life. Once the resident gets the unique ID, it may be accepted
as identity proof across service providers.

The Enrolment Process

The enrolment process for the UID number will begin with a resident submitting
his/her information to the enrolling agency with supporting documents. This information will
be verified according to established Know Your Resident (KYR) standards. To make sure the
poor are not excluded, the UIDAI will also prescribe guidelines for applicants without
documents.
Once the enroller verifies the residents information, it will submit the application
request either singly or in batches through the Registrar to the CIDR. The CIDR will then
run a de- duplication check, comparing the residents biometric and demographic information
to the records in the database to ensure that the resident is not already enrolled.
Owing to the large number of records in the database, the de-duplication may take
place in two stages. De-duplication may first be carried out within a specific boundary of
the data, such as within the local area (district/state) the resident lives in. If this check
succeeds, a UID number is assigned to the resident, and the new record is added to the
database. The localized check will also speed up the de-duplication process, which would
allow Registrars to issue their cards with less turnaround time.
The system will however, after issuing the UID, continue to run a 1:N de-duplication
check of the residents demographic/biometric details against the entire database. If the
resident already holds a UID number but has now received a second one, the older record will
be discovered during this full search. In this case, the second UID number will be cancelled,
and a dispute resolution mechanism will determine whether the duplication is because of fraud

UID and Implications for other Countries

or technical error. If it is revealed to be fraud, the Authority may consider penal action.
Since the de-duplication also compares biometric records, it would catch individuals
enrolling with a different set of demographic details. The fact that the UID system is both
de- duplicated and universal will discourage residents from giving incorrect data at the time
of enrolment.

Figure 3.1 Enrolment Process

UID and Implications for other Countries

Issuing the UID Number
Once the UID number is assigned, the Authority will forward the resident a letter
which contains his/her registered demographic and biometric details. This letter will also
have a tearaway portion which has the UID number, name, photograph and a 2D barcode
of the finger print minutiae digest. If there are any mistakes in the demographic details, the
resident can contact the relevant Registrar/enrolling agency within 15 days.
If the Registrar issues a card to the resident, the UIDAI will recommend that the
card contain the UID number, name and photograph. They will be free to add any
more information related to their services (such as Customer ID by bank). They will also
be free to print/ store the biometric collected from the applicant on the issued card. If more
registrars store such biometric information in a single card format, the cards will become
interoperable for offline verification. But the UIDAI will not insist on, audit or enforce this.
All data entry that the enrolling agencies take up on behalf of the Registrars will be
done in English. It can then be converted into the local language using standard
transliteration software, and verified for accuracy by the Registrar. The letter the UIDAI
sends the resident will consequently contain all demographic details in English as well as
the local language of the state in which the resident resides. In this regard, the UIDAI will
follow the precedent set by the Election Commission of India.

UID enrolment strategy in rural and urban India

The approach of the UIDAI to enrolment will be a pro-rural/pro-poor one. The
Registrars targeted for rural India the NREGA, RSBY and PDS will be government
agencies with large rural networks and significant bases among the poor. As a result, the
Authority expects initial enrolment to be fairly rapid in both large and small rural areas.
The enrolment strategy for urban India will include organizations which dominate
services for urban residents, such as LIC and Passports. In addition to these enrollers, the
UIDAI will also partner with the Registrar General of India (RGI) who will prepare the
National Population Register through the Census 2011 to reach as many residents as
possible and enrol them into the UID database. This may require incorporating some
additional procedures into the RGI data collection mechanism, in order to make it UID-ready.

UID and Implications for other Countries

A focused effort to enrol the poor and hard to reach groups
While the UIDAI intends to target Registrars that have large networks among the poor
and rural communities in India, it will also emphasize multiple approaches to reach
specific, frequently marginalized groups.

Urban Poor
The urban poor are among the most ignored and disadvantaged people in India. The
main challenges in enrolment here exist because this group consists mainly of migrant
workers with temporary or seasonal jobs. The following may be ways to get them enrolled
into the UID system.
Co-resident enrolment: Many of Indias urban poor work as drivers, maids, or as workers
associated with a family or a business. One approach to reach them could be for the head of
the family or business to enable these members (who are co-residents/co-workers) to get
enrolled into the UID with the same address proof the business or family uses. There can be
a host of financial incentives offered to enrol such co-residents.
Financial institutions: The urban poor often borrow from micro-finance institutions and other
sources and these could serve as enrolment points for them. There are established chit funds
that can also act as enrolment points for the UID to improve coverage.
NGOs and Non-profits: There are several established non-profits working in urban slums in
education, healthcare and social empowerment. They can be used to educate the poor on
the benefits of the UID, for actual enrolment and to help endorse identity for people who lack
documentation.

Children
India is a young country with over 400 million residents below the age of 18. While
family- based government schemes will as Registrars, help enrol children, this population
may need to be specifically targeted.
ICDS: ICDS is one of the worlds largest integrated early childhood programs, with over
40,000 centers nationwide. The program covers over 5 million expectant and nursing mothers
and 25 million children under the age of six. These centers can be information or enrolment
points for non-school going children.
School admission: It may be mandated that at the time of joining school (first standard) it is
necessary for children to have a UID or to enrol for one. This way the child can be tracked
9

UID and Implications for other Countries

for progress and targeted for direct benefits.
The SSA program could also help enrol children in the 6-14 age group into the UID,
which would also enable better child tracking and improvements in the mid-day meal schemes.
For children, the advantages from the UID would be significant. Child-related
programs in India have relied on often inaccurate, aggregate data at school/cluster/block
levels, making these programs ineffective. The concept of Universal Child Tracking the
ability to track every child and ensure their all round development is gaining ground.
An accurate database of children with UIDs would be immensely beneficial to programs
within the Women and Child welfare as well as the Education departments, which track
development in anganwadis and progress of children in government schools, and work to
eliminate child labor.

Women
Apart from enrollers that are family-based government services in both urban and rural
India such as PDS, RSBY etc, there needs to be a strategy to cover women outside this net:
Financial institutions: Robust collectives of women exist within micro-finance institutions
and self-help groups across the country. These would be important enrolment points for
women.
Organizations like Mahila Samakhya in the 9 states of Karnataka, Kerala, Andhra Pradesh,
Gujarat, Uttar Pradesh, Uttar Khand, Assam and Jharkhand. They work in several thousand
villages to help women and can act as touch points for education or enrolment of women.
The National Commission for Women: This is the apex national level organization of India
for protecting and promoting the interests of women. They have a massive outreach
program that can reach out to disadvantaged women and get them to enrol. The UID can
subsequently be used as a unique handle for a variety of services to be rendered to these
women.

Differently-abled people
It is estimated that India has over 60 million differently-abled people, and identity for
this population is a massive challenge. The Disability Act of 1995 mandates a certain
percentage of employment for the differently-abled, but without the clear identification of
such individuals, it is difficult to enforce the law. There is an obvious incentive for
organizations like National Center for Promotion of Employment for Disabled People
10

UID and Implications for other Countries

(NCPEDP) to promote the UID, and enable residents with disability to register for a range of
benefits. The NGOs and rights groups associated with NCPEDP would also be good
mechanisms to reach out to this section of the population.

Tribals
India has a significant tribal population of approximately 90 million tribals, mostly
concentrated along a few states. The Government has many programs for the 697 notified
tribes, which can be used for enrolment and information dissemination. In addition, NGOs
and governments in states with high tribal populations can be Registrars for tribal groups.
The above mentioned approaches are merely indicative of the strategy that the UIDAI
will follow to reach marginalized groups. In addition, the UIDAI will reach out to other
marginalized groups such as homeless people, individuals in shelter homes, remand homes,
asylum, etc.

Enrolment Costs
Based on initial estimates, the enrolment of each resident may cost between Rs. 20
and Rs. 25, leading to a potential total enrolment cost of Rs. 3,000 crore. The enrolment
strategy will explore the possibility of various beneficiaries funding the enrolment cost.
The Registrars have the option here of charging for the cards they issue residents to offset
enrolment costs. The UIDAI may issue guidelines around such pricing.

Ensuring clean enrolment data from registrars

The UIDAI will periodically carry out a process audit of the information that comes in
from the Registrars, to ensure data quality and that agencies are following guidelines
recommended by the UIDAI. The audit would be on a random sample of residents, carried
out either directly by the Authority or through appointed agencies. The audit might focus on:
Verification against scanned documents The data contained in the resident records will
be verified against the scanned documents.
Physical document verification The physical documents that are held by the Registrar
will be validated against the electronic copies.
Periodic process audits Periodic audits will be carried out to at the enrolment sites, of the
processes and software.

11

UID and Implications for other Countries

Updating UID details
Updating information with the UIDAI
The UID number is a lifetime number, but the biometric information contained in the
central database will have to be regularly updated. Children may have to update their biometric
information every five years, while adults update their information every ten years.
From time to time, the demographic information that the CIDR holds on the resident
may also become outdated. Fields that are susceptible to change could be the present address
field, as well as the residents name (after marriage). There might also be an error in the
fields that occurred during enrolment into the UID.
If a service provider authenticating or enrolling a resident finds, through its KYR
process that the information provided by the resident (address, name, etc.) does not match
with the UID record, or that the biometrics need to be renewed, it can ask the resident to
update their information in the UID database. The service provider may make the update a
condition for the resident to receive the service/benefit.
Enrolling agencies and Registrars can serve as points where the resident can update
their UID fields. The resident will have to submit their new information at these updation
points with the required documentary evidence. This may also include a biometric
authentication prior to processing the request.

12

UID and Implications for other Countries

Figure 3.2 Updating UID Information

Reaching critical mass in enrolments

The UIDAI will have to focus on generating demand from both Registrars and
residents. However, once the critical mass is achieved, it will generate a network effect
that drives demand and accelerates adoption among service providers and residents. And as
more service providers across the country require the UID to dispense their services and
benefits, adoption will ramp up rapidly. In four years, the Authority estimates that it will issue
600 million UID numbers.

13

UID and Implications for other Countries

Tracking enrolments across the country
The UIDAI will employ a GIS internet-based visual reporting system to track
enrolment trends and patterns across India, as the project is rolled out across various Registrars
and states.

Figure 3.3 Tracking UID Enrolment

The GIS system will show all UID enrolments by state, as well as by Registrar.
The system will also be able to drill down within states and into districts.

Reaching a sustainable, steady-state in enrolment

A challenge for full enrolment is registering the approximately 60,000 babies
that are born in the country every day. Over the next several years, the UIDAI expects
to enrol close to the entire Indian population. Once that goal is achieved, enrolment
will reach a steady state, where only births (and deaths) as well as immigrants need to
be recorded.
There are however, some challenges in registering new births. First, since their
biometrics is not stable, they have to be re-scanned at a later age. Second, names are
often not given in India at the time of birth registration.
14

UID and Implications for other Countries

The UID in the birth certificate
One way to ensure that the UID number is used by all government and private
agencies is by inserting it into the birth certificate of the infant. Since the birth
certificate is the original identity document, it is likely that this number will then persist
as the key identifier through the individuals various life events, such as joining school,
immunizations, voting etc.
Since the name is a mandatory field in the UID database, it is essential that the
child be given a name before applying for the UID number. This would ensure that the
UID can also be allotted at birth.
In the case of urban births, the municipality will be the enrolling
authority and the UID Registrar can be the Registrar of Births, Deaths and
Marriage at the state level.
In rural areas, births take place at district or block level hospitals, in health
care centers and at homes in the village. The village accountant is the Registrar of
rural births, and he/she also issues the birth certificate and updates the information
through an enrolling agency.

Figure 3.4 UID in Birth Certificate

15

UID and Implications for other Countries

Biometrics and infants
The recording of unique individual biometrics in the UID database is a challenging
one for infant records. The solution to this is to record the UID and biometric of the parents
in the childs record.
The childs biometrics need to be taken at around 5 years of age, and updated in the
UID system every 5 years until the age of 18 (the exact details will be specified by the
biometric committee). This will be enforced by an expiry date attached to the UID number,
which will become invalid after that date. Until the time the biometric of the child stabilizes,
any one of the parents/guardian will need to provide their biometric information for
authentication.
Recording deaths in the UID system
It is also necessary to record deaths in the country, and the birth and death
registration act provides for such registration. The same institutions that record births can
be in charge of updating deaths in the UID system. The UID system will not remove
a record upon the persons death; it will simply mark it as deceased and hence will
render it inactive for the purposes of authentication.

16

UID and Implications for other Countries

IV. UIDAI Authentication

The real test of reliability for the UID system will be during identity
authentication. Confirming you are who you say you are remains the primary, often
elusive goal of all identity systems.
The UIDAI approach which will be online authentication, with biometric check
creates a very strong authentication system, and gives the UIDAI significant ability to confirm
an individuals identity.

The Authority will support the Registrars in building the

infrastructure and systems necessary to authenticate residents in different parts of the country.
This will be especially critical for Registrars working in rural areas and among the poor.

Enabling adoption of the UID for authentication

The speed of UID adoption in India depends on whether the number can help in
eliminating poverty and marginalization, and in enabling greater transparency and efficiency
in service delivery. If it succeeds in these goals, the number will become indispensible for
residents in accessing services.
While the UID can provide the strongest form of pre-verification and identity
authentication in the country, it cannot ensure that targeted benefit programs reach intended
beneficiaries. The pro-poor impact of the UID, consequently, will not gain traction unless
there is a mechanism to link the UID process with actual service delivery.
A clear adoption process can overcome this gap by helping introduce the UID method
of authentication at every point of service delivery. To ensure this, the UIDAI will not only
work with Registrars who do enrolment, but also with non-enrolling, service delivery
agencies. Such agencies involved in the delivery of services and benefits will be encouraged
to partner with the Authority for authentication. Once they authenticate a residents identity
against the UID database every time they carry out a service transaction, they will be able to
deliver services far more effectively.
In order to accommodate this authentication, agencies may need to re-engineer
their business processes to be UID-enabled. The most basic requirement for change will be in
incorporating the UID method of authentication into their systems. Agencies will have to
adhere to norms and procedures specified by the UIDAI for fingerprint capture and
17

UID and Implications for other Countries

verification, and introduce a robust biometric authentication process at every point of sale.
There is tremendous value to be gained from widespread adoption of the UID for
authentication, especially for residents. While enrolment in the UID database will ensure that
residents are not denied access to fundamental services and rights because they cannot present
positive proof of identity, adoption in authentication could go one step further, and ensure that
residents consistently receive these services. This can include a wide range of benefits such
as education, health coverage, old-age pensions and subsidized food grains, thereby fulfilling
the UIDAIs pro poor agenda.
The UIDAI is only in the identity business. The responsibility of tracking beneficiaries
and the governance of service delivery will continue to remain with the respective agencies
the job of tracking distribution of food grains among BPL families for example, will remain
with the state PDS department. The adoption of the UID will only ensure that the uniqueness
and singularity of each resident is established and authenticated, thereby promoting equitable
access to social services.
The adoption of the UID during authentication will also have a direct correlation with
subsequent enrolment. Greater enrolment comes from the value a resident derives from the
UID, which in turn depends on the rate of adoption. There is a positive cycle here, created
from the relationship between adoption and enrolment the greater the adoption, the faster
the enrolment and vice versa. The twin approaches of enrolment and adoption will result in
greater influence and traction for the UID among residents in the country, and establish the
UIDAI as the only genuine identity authenticator in India.

Types of authentication
There are multiple forms of authentication that the UID authority can offer. Certain
types of authentication would have low to medium assurance if there is the possibility that the
card is forged. Here we summarize the main forms of authentication, depending on the
situation and equipment available.
Online authentication is supported by the UID system. This can include
- Online demographic authentication where the authenticating agency compares
the UID number and demographic information of the UID holder to the information
stored in the UID database. The assurance level here is medium.
18

UID and Implications for other Countries

- Online biometric authentication where the biometrics of the UID holder, his UID
and key demographic details are compared to the details in the CIDR. The assurance
level in this case is high.
- Online demographic/biometric authentication with API where the Registrars
backend system makes a programmatic call to the authentication APIs exposed by
the UID system to perform authentication. The assurance level here may be mediumhigh depending on whether the check used demographic or biometric inputs.

Offline authentication may be supported by the Registrar, and does not use the authenticating
service provided by the UIDAI. This may come in two forms:
- Photo match authentication where the photo on the card is compared with the
cardholder. This is the most basic form of authentication. The assurance level here is low.
- Offline biometric authentication compares the scanned fingerprint of the cardholder
to the biometric stored on the Registrar-issued card. The assurance level here is medium.

Figure 4.1 UIDAI Authentication

19

UID and Implications for other Countries

Authentication and the UIDAI revenue model
The ability of the UIDAI to offer agencies across the country strong, reliable
authentication is the key to its sustainability. The UIDAI will offer resident authentication
services for a fee to governments and private sector firms.
The agencies which request a resident authentication service will have to be registered
with the UIDAI and follow strict guidelines in using the service as well as in managing
resident information.
Basic identity confirmation
Basic identity confirmation from the UIDAI would be free. In this transaction,
the authenticator will provide the UID number, name and one other parameter such as date of
birth of the person, and the central database will confirm the identity as a Yes or No
response.
This type of transaction will be carried out in large numbers and will need quick
response times. An example of this is an airline check-in.
Chargeable authentication services can be of two types:
Address verification
For security purposes, government agencies as well as private sector firms require
address proof from Indian residents before providing them with benefits and services.
However, agencies often complain of the difficulty of address verification you try to verify
an address in India, and you enter a labyrinth. The service provider usually verifies
address through a physical visit, as well as an enquiry to confirm the other information
provided. This process is expensive and costs between Rs. 100 and Rs. 500 per verification.
The address authentication service the UIDAI will offer these entities would
consequently be a valuable one. In the proposed transaction with the UID Authority, the
agency will submit the UID, name and address of the resident to the CIDR, which will confirm
the address. As a result, the agency will not have to do physical address verification.
Biometrics confirmation
Services such as issuing a credit card or granting a loan need the confirmation
of the residents identity. This process for the resident involves the submission of photographs
and other documentation confirming their identity. In the proposed transaction with the UID
Authority, the agency can send the scanned photograph or fingerprint (based on the security
20

UID and Implications for other Countries

level required) together with other demographic details to confirm the identity of the person.
Revenue projections from authentication services
The following revenue model for the UIDAI is an illustrative one. It has been designed
while keeping in mind the value the agency requesting authentication would derive
from the service. The table below summarizes the kind of transaction, potential user
agencies and the proposed transaction fee. Government agencies could be provided these
services from the UIDAI at a subsidized rate.
The authentication service from the UIDAI can begin after the initial bulk on-boarding
of Registrars. The revenue estimates for the UIDAI are based on the current expenditure of
various agencies on KYR processes, which would be replaced by the Authoritys
authentication services. It also takes into account expected growth in demand for mobile
connections, bank accounts, etc.

21

UID and Implications for other Countries

V.

Technology Architecture
The technical architecture of the UIDAI is at this point, based on high-level

assumptions. The architecture has been structured to ensure clear data verification,
authentication and de- duplication, while ensuring a high level of privacy and information
security.

System architecture
The Central ID Data Repository will be the central database of all residents, containing
the minimal set of fields sufficient to confirm identity. The federated set of databases
belonging to the Registrars may contain additional information about the resident, and can
use the residents UID as the key.

Figure 5.1 System Architecture

The key technology components of the UID system are:

The UID Server, which provides the enrolment and the authentication service.
These services will be available over the network for the various Registrars and their
22

UID and Implications for other Countries

authenticating agencies to use. The backend servers need to be architected for the high
demands of the 1:N biometric de-duplication as well as the large peak loads from
authentication requests.

The Biometric sub-system is central to the UID system for enrolling as well as
authenticating residents. It is likely that a multi-modal biometric solution will be used
to achieve a high level of assurance. The 1:N de-duplication envisioned will be by far
the most computing-intensive operation of the UID system. Innovative techniques of
hashing, indexing, distributed processing, and in-memory databases using multiplebiometric-modes need to be employed to get acceptable performance.

The Enrolment client application will capture and validate demographic and biometric
data. This client needs to work in an offline mode in the village setting when there
is no internet connectivity, and upload batch files to the server for processing.
The client application will be deployed on a standard enrolment workstation.

The Network is a critical aspect of the system, since all UID enrolment and
authentication services will be available online. UID services could work over secure
WAN networks, the vanilla internet or over mobile SMS channels. It could also
potentially work over existing networks such as credit-card POS (point-of-service)
devices.

The Security design secures all the above components from logical/physical attack.
This includes
o

Server Security firewall, intrusion prevention and detection systems (IPS,

IDS)

o Network, Client Security Encryption, PKI etc

The Administration system will help administer the UIDAIs operations. This includes
o

Account setup creation/modification of Registrar, enrolling and authenticating

agency accounts.

o Role based access control Assign rights over UID resources based on role.
o Audit trailing track every access to the UID system.
o Fraud detection detect identity theft and cyber crimes using audit trails
o Reporting and Analytics Visual decision support tools GIS, Charting etc.

23

UID and Implications for other Countries

VI. Data Security And Fraud

Protecting personal information of residents
Even as the UIDAI stores resident information and confirms identity to
authenticating agencies, it will have to ensure the security and privacy of such information.
By linking an individuals personal, identifying information to a UID, the UIDAI
will be creating a transaction identity for each resident that is both verified and reliable. This
means that the residents identity will possess value, and enable the transfer of money and
resources.
The UIDAI envisions storing basic personal information, as well as certain
biometrics. However, limiting its scope to this, and not linking this information to
financial/other details does not make the resident records in the database non-sensitive.
Biometric information for example, is often linked to banking, social security and passport
records. Basic personal information such as date of birth is used to verify owners of credit
card/bank accounts and online accounts.

Such information will therefore, have to be

protected. Loss of this information risks the residents financial and other assets, as well as
reputation, when the resident is a victim of identity theft.

Figure 6.1 Security Framework

24

UID and Implications for other Countries

Fraud scenarios
The Authority will concern itself only with identity fraud, which is distinct from
document fraud. Document fraud the use of counterfeited/misleading documents to enter
incorrect personal information will be the responsibility of the Registrar enrolling the
resident. The Authority will have clear response mechanisms in place for identity fraud, where
an individual deliberately impersonates someone else, either real or fictitious. Since the CIDR
will store the biometric of residents, identity fraud will be easier to control. The only form
of fraud that may go undetected in the UID system is if a person registers his/her details and
biometrics under an entirely different name, with forged supporting documents. However, the
person will have to exist under this name across systems, in the lifetime of his/her interaction
with the government, private agencies and service providers. Such instances are therefore,
likely to be rare. Some of the potential fraud scenarios are:

Table 6.1 Fraud Scenarios

25

UID and Implications for other Countries

VII. Future Applications

Currently, millions of citizens across India who lack identity documents are
unable to participate in various simple banking services, such as obtaining a bank account.
Without proper and legitimate papers, these citizens exist as the unbanked of India.
Lacking such access to basic financial institutions has far reaching consequences for
citizens as well as for the financial sector. An added benefit of creating a unique
identification database is that it would provide those with UID numbers access to day-today banking functions, as well as allowing banks to avoid the hassle of either asking for
supportive documentation or turning away citizens with no identification whatsoever. The
State Bank of India recently issued an Expression of Interest for this purpose. Already,
the UIDAI has begun implementing an Aadhaar-based payment system in 50 districts
across India.
To financial service providers, the UIDAI project represents an enormous
opportunity to extend financial inclusion to the poorest citizens of India. Currently, just
25% of Indians have bank accounts. With the UIDAI enrollment, the opportunity to
provide bank accounts to all has suddenly become possible. Every citizen enrolled for
a UID can consent to providing his/her information to be used for opening a bank
account. As a fully legitimate substitute for KYC regulations, a UID ensures that the
cost and effort currently expended during the customer acquisition process is drastically
reduced. Having the UID as a means of authentication also eliminates the need for smart
cards for the most basic customers who will not be using ATM machines, etc., another
significant reduction in cost from an operational perspective. The financial incentives
provided by the UIDAI to enroll residents (Rs. 50 per enrollment) also serve as an
incentive for banks to act as Registrars in the enrollment process. For customers with
low revenue potential, banks can actively manage the costs of serving them by only
providing essential services.
From the perspective of education, UID authentication could also act as an
enabling tool to monitor children in India. The Right of Children to Free and Compulsory
Education Act ensures that every child aged six to fourteen has the right to free and
compulsory education until the completion of elementary school. Currently, the Primary
26

UID and Implications for other Countries

Education System in India faces inflated enrollment figures at the elementary school level.
The effects of this inflated enrollment include lack of books, meals, scholarships, and
uniforms. A UID based system would allow the government of India to accurately assess
enrollment needs across all areas. Multiple enrollments would be eliminated, and UID
portability would ensure that migrant children are admitted to schools in various districts.
Another area where the benefits of a unique identification number are plainly
evident is public health. India faces a number of challenges related to public health.
Because much of the population remains unidentified, there is no target population whose
needs can be assessed and addressed via rural and urban health care systems. The lack of
an identified target population also contributes to poor tracking of health conditions and
an inability to introduce national health insurance schemes on a scalable level. The
government cannot track newborn children or ensure vaccination for them, and only 47%
of Indian women give birth in institutions. The need to have infrastructure in place that
can track disease and mortality is absolutely critical to ensuring positive health outcomes
and increasing life expectancy for Indias population. The current method of capturing
data on disease conditions involves sporadic national or state surveys. The health
insurance program for the poor (called RSBY) already uses a biometric based smart card
and adding UID-based authentication could provide useful information to Indias
population on routine disease conditions and possible epidemics.
The UID will of course help to put accountability into the huge subsidy schemes
run by the government, among which is the National Rural Employment Guarantee
Scheme (NREGA), which provides guaranteed employment of up to 100 days per
household. The NREGA has met many of its milestone goals, but is still plagued by
corruption and diversion of funds. Reports from every state of workers being denied
guaranteed wages represent a particular challenge for NREGA. This is primarily due to
stolen identities and people double-dipping, as well as unverifiable records and weak
accountability systems.
If work sites verify the identity of their workers, and those were ticked off against
a database of eligible people, this problem would be overcome. The UID enables this as
attendance could be recorded utilizing biometric identification and workers could be paid
through UID certified bank accounts. Reported work hours of both workers and their
27

UID and Implications for other Countries

official supervisors would need to match, and fraud such as ghost beneficiaries or officials
over reporting hours would be eliminated.
On the PDS side, because the UID can be authenticated online and in real-time,
any Fair Price Shop (FPS) can confirm the identity of any beneficiary in real time, ensuring
that the rations go to the correct person. To prevent fraud, the Government of India can
utilize UID authentication as a barometer by which to measure out future allocations to a
particular FPS. In other words, to ensure that FPS managers authenticate their
beneficiaries, allocations of supplies will be determined by how many beneficiaries have
been authenticated. An FPS with fewer authentication requests will receive fewer supplies.
This gives FPS managers within the PDS an extremely strong incentive to properly
authenticate their beneficiaries. It also allows more flexibility in the way the PDS is
administered. For example, the government could create an online food account, whereby
residents could choose to obtain entitlements on an as needed basis, or enable electronic
based benefit transfers, thereby allowing the government to impart goods entitlements
directly to residents, and tailor those entitlements more directly.
Finally, the UID could also insert greater accountability into the supply chain, and
enable farmers to have access to information on grain requirements, and better manage
distribution and storage. By having specific information on who and how many people
need what types of food aid and where they are located, the government could assess the
supply and demand curve across numerous states, and work to ensure adequate
availability. The UID project will also cut down on rampant electoral fraud by ensuring
that people are who they say they are, and that single individuals do not cast multiple votes.
Lastly, on a very basic level, the UID project will serve as a barometer by which to measure
population levels and growth.
Through increased vigilance and better documentation, state and federal
governments will be able to better keep track of illegal immigrants, and will better be able
to foresee terrorist threats and manage internal security. The possibilities that the UID
engenders are truly endless.

28

UID and Implications for other Countries

Already, according to a study conducted by NYU Stern Professor Arun Sundararajan
and Professor Ravi Bapna of the University of Minnesota, the UID is demonstrating its
potential for inclusion and is having an impact on peoples ability to access services and gives
the previously undocumented access to the mainstream system for the very first time. A press
release dated 24 April 2012 highlight the results of the initial phase of their study:

Fewer than 30% of Indian households have even one

resident with any one form of portable ID; those
households with portable ID have substantially higher
incomes and likelihood of a college-educated resident
than those without.

The remaining households are forced to rely on documents

like ration cards of the government fundedNREGA cards,
which have limited geographic portability and do not easily
facilitate inclusion among those without portable ID.

The UID rollout is creating an entirely new segment of

included residents, those who are attaining portable ID
for the first time ever. If enrollments continue according to
projections, the professors estimate that this segment will
number around 300 million people (25% of the population)
by the end of 2012 and continue to grow in 2013.

Early UID adopters represent a segment distinct from the

18% of the population that rely on the NREGA
programThe early adopter profile validates Aadhaars
potential beyond its use for welfare disbursements and
suggests considerable promise for early UID-enabled
commercial services, in which numerous pioneering
corporations (like ICICI and Visa) are investing.

All this being said, it cannot be stressed enough however, that despite the great
potential that the UID presents, the program is still in its nascent stages and it remains to
be seen how these authentication options ultimately come on line and to what extent they
interface with, and rely upon, the UID database.
29

UID and Implications for other Countries

VIII. Relationship To Other Indian ID Programs

The process for obtaining ration cards under the original Andhra Pradesh program
that is referenced earlier and that is the subject of the Annex, has been integrated into the
UID process. Identity verification for other government services is also now beginning to
be established through the UID process, including NREGA and programs for old age
pensions and scholarships. Other programs, such as the World Food Programme project
in Orissa, that utilized iris, continue to operate but it is expected that they too, will
ultimately rely on the UID for verification of identity.
As the program gets rolled out, however, one of the biggest sources of confusion
remains the governments original policy decision to separate the UID mandate of issuing
identification numbers, from the National Population Registers (NPR) mandate to issue
national identity cards to Indian citizens. The result has been the two programs essentially
competing with each other to enroll as many people and in effect, creating two databases.
One main issue is that as the UIDAI enrolls people, numbers may be issued to noncitizens. From the UID perspective, their mandate is strictly to provide ID numbers to all
Indian residents. Other agencies, including the NPR, would have to conduct their own
adjudication, leveraging the UID database to establish the identity of people applying for
benefits including national ID cards. Ultimately, it is an issue of purpose and mandate. NPR
views its mandate from a security and immigration perspective, which could be at odds
with a philosophy of inclusion and mobility of identity.
Recently, in an effort to establish a Compromise between the two agencies and to
speed up the enrollment process, the Congress-led UPA government voted to allow the
UIDAI to continue the enrollment process for an additional 400M people beyond the 200M
already enrolled. The UID will continue to enroll the population in its stronghold areas of
operation, while NPR will continue to focus on enrollment in the coastal areas. Recently,
the Economic Times of India reported that Aadhaar numbers were a prerequisite for NPR
enrollment. Since Aadhaar is a prerequisite to any NPR enrollment, NPR enrollments are
carried out through the UID system, utilizing Aadhaar as a prerequisite. As a result, there
is no worry of duplicative enrollments.

30

UID and Implications for other Countries

As part of the compromise agreement between the two agencies, the UID is viewing
its enrollment procedures in response to the security concerns raised by the NPR,
Specifically relating to the introducer model and the potential that some people may
provide introduction letters in exchange for bribes. Evidently, the UID vs. NPR debate has
yet to be settled.
In some ways, the dispute is misguided. It is important to understand again,
however, that the UID is an identity infrastructure designed to establish a persons identity,
not to confer rights and privileges. NPR is an example of an agency that would establish an
individuals right to citizenship in the country and all the benefits that go along with that.
The authentication mechanism at the time of service would still occur via the UID system.
Another concern as the use of the UID gets rolled out for authentication application
is the use of the fingerprint for authentication. Given that such a large portion of the
population are day laborers and therefore have poor fingerprints, it will be interesting to
see whether iris will become the biometric of choice in the long run for authentication, or
if there will be another way to overcome this potential challenge.

31

UID and Implications for other Countries

IX. International Parallels

Case of USA
US government faced a crisis in its health care department around early 1990 and
proposed use of IT to solve it by making medical database of its citizens. US has dual
citizenship; one at the national level and other at state level, which made things more complex.
Major concern was raised about how US was going to protect the privacy of the information
stored about its citizens.
Aftermath: USA never implemented the National ID and still uses passport as the most legally
accepted document.

Case of National ID cards in UK

This is a classic case of failure of National Cards. In 1995 the British government
revived a proposal to issue multipurpose identity cards. It started a fight between the
government and her citizens. The government marketed the benefits to the public of a National
identity card for overseas travel, proof of age etc.
Concerns were raised about: 1) Cost to the public exchequer 2) Potential breaches to privacy.
Public private partnership was proposed to manage the implementation costs. Also data
gathering was voluntary.
Aftermath: National ID act was passed in 2006, by linking people to a national identity
register with 50 specific information fields. Even in early stages leaked e-mails revealed that
the program was facing difficulty. Maintaining it proved to be an escalation of commitment.
The program needed high costs, an initial data collection cost of 12 billion and annual
data security and maintenance costs of 584 million. The lib-con coalition government formed
in 2010 decided to scrap the program and mandate the destruction of all data by Feb 11 2011.

32

UID and Implications for other Countries

Implications for other countries
The India UIDAI project has received enormous attention around the world. For
one thing, it has given other governments the confidence that they too, can implement a
similar program. Media reports mention Mexico, Brazil and Argentina, as but a few that
have been contemplating changes to their national ID program plans based on the UID.
Indonesia also has recently revamped its national ID system to include face and iris,
similar to the UID. And the UIDAI itself is assisting the Government of Papua New
Guinea in starting its own national ID scheme using biometrics. The India UID project is
ambitious not only for its size and scope, but it is one of the first national ID projects to
have been designed in a way that has the potential to touch every aspect of a society. This
perhaps is one of the main implications for other countries who may be contemplating
national ID programs, or ones who already have them in place. There are several other
specific areas that have the potential to greatly impact the way other countries think about
and roll out national ID programs:

Unlike many legacy national ID programs, the UID is designed from the
ground up to support authentication applications. The government is
providing the tools to enable public and private sector entities to utilize the system
with biometrics. Most other national ID schemes may use an ID card for
authentication, but without biometrics, there is no proof of identity. And almost
no other government, with the possible exception of South Africa, which recently
opened its national ID system to banks to address bank-related identity fraud, is
actually using the national ID infrastructure to support private and public
institutional needs to verify identity. The fact that the Indian government invested
in establishing the protocols, the APIs and the structure for certification and
empanelment, provides a structure for maximum participation, making it possible
for thousands of authentication points to communicate with a central ID
repository. And in turn, because so many agencies and private sector entities will
be relying on the UID to provide services to the people, not having a UID will be
a major inconvenience. This is the main driver for inclusion. Also, because the
UID will link to the passport, driver license, PAN (tax ID) card, bank accounts,
33

UID and Implications for other Countries

voter ID, etc. it will be very difficult for a person to operate with different names
or addresses. What many do not realize is that the UID is being superimposed on
a number of applications, and instead think that the UID is the starting point for
these applications to be developed. The genius then of the UID (and of course the
main argument against it) is that as an infrastructure for identification and
verification, it is detached from any specific service. This aspect of the UID
contributes to the programs novelty, and ultimately, to its universal
applicability.Countries with existing national ID systems, would do well to create
these types of protocols for the purpose of authentication. This could unleash
tremendous progress in establishing transparency, accountability and trust in
government and act as a source of revenue for the government if set up correctly.
With nearly 114 countries projected to have a national ID system in place by 2015,
only a handful are shaping their plans in a way that allows the government to be
this type of identity service provider.

Because the UID is essentially a portable number, it can be exploited on a mobile

phone, overcoming many of the traditional infrastructure challenges that have
hampered other systems. The cloud-based authentication of the UID ensures easy
integration into an online management information system (MIS), which can be
accessed from any mobile phone. This unique aspect of the UID is particularly useful
as more and more people around the world gain access to cell phones and other mobile
technology. As mobile phone growth explodes in Africa and elsewhere, the value of a
portable number increases exponentially. With nearly 6 billion mobile-cellular
subscriptions as of December 2011, global mobile-cellular penetration has reached an
astonishing 87%. More importantly, 79% of the developing world has mobile-cellular
subscriptions, and mobile exposure is occurring at a torrid pace. There is enormous
potential in utilizing the mobile phone infrastructure to verify identity at point of
service. Several studies are already underway on how best this can be done. The easiest
to envision would be a biometrically-enabled Bluetooth point of sale device which
could use the mobile phone to transmit an authentication request to a central server and
authorize a transaction. There are several makers of such point of sale devices already.

34

UID and Implications for other Countries

Recently, Nandan Nilekani mentioned that the UIDAI is working with the STQC to
certify a mobile scanner that can be plugged into most electronic devices scanners,
laptops, smartphones, tablets. The open architecture that the UIDAI is developing will
allow authentication unencumbered by the burdens of traditional infrastructure. With a
mobile phone, people can be authenticated from remote villages, for small size
transactions, and for a myriad of purposes where previously a computer terminal with
electricity and broadband was required., In this way, the UID can supplement existing
infrastructures and help them expand into more rural areas and touch many more
people, with no need for cards or other offline identifying mechanisms. This leap also
makes it possible to deliver health care, mobile banking, online food ration accounts,
conditional cash transfers, etc. to individuals based on their identity. It also makes it
possible for the first time to analyze who is not getting a particular service, for which
they may be entitled. Delivering government services on the mobile platform is made
possible by knowing who is on the other end. From an election standpoint, this can also
mean verifying people at polling stations and ensuring that they do not vote more than
once, even if they have multiple cards or argue that a polling station list is inaccurate.
It is important to note that not only is mobile technology much of the driving force
behind Aadhaar, it is Aadhaar that has become a catalyst for an increase in mobile
technology growth across India. Aadhaar has highlighted deficiencies of connectivity
in certain areas, and as the UID program reaches critical mass, a small fissure has
emerged between rural and urban governments. Three central ministries have conveyed
reservations with real time online authentication, saying that rural areas do not possess
the connectivity necessary to efficiently process online Aadhaar authentication
requests, and should instead rely on offline smart card based authentication. Despite
these reservations, the UIDAI believes that smart card based authentication is not
cutting edge or efficient enough for Aadhaar, suggesting that it smart cards introduce a
whole new set of challenges like card management, procurement and management of
card readers, etc. Rather than focus on a small part of the countrys lack of connectivity,
UIDAI officials believe that advances in connectivity will spread to those less
connected areas.

35

UID and Implications for other Countries

Multiple biometrics promote inclusion and maximize usage of the UID. One
of the main reasons for including iris biometrics upon enrollment was the
significant increase in accuracy, but the added benefit of maximizing inclusion
among the people is not to be underestimated. Most national ID system rely on
fingerprints only, and in the developing world in particular, this can propagate a
situation of under registration or under utilization of the system as many people
doing physical labor would not be able to be enrolled, or the quality of their
enrollments would be low, subsequently hampering the ability to authenticate them
for services. A secondary biometric alleviates this issue assuming both could also
be used at the point of service.

Industry standards enable scalability and minimize project risk. The insistence
on biometric standards for the collection of the information means that future
changes and accommodations in technology will be possible. It also unleashes the
possibilities for innovation around applications that can leverage the UID. Many
national ID programs use proprietary systems, which make it very difficult and
expensive to upgrade and expand. And finally, the use of three backend database
systems assures that the government is not reliant on any particular vendor.

36

UID and Implications for other Countries

X.

Conclusion
The UID project is a very critical initiative for India and in all possibilities, we would

need to be careful that the project neither faces the same fate as similar other large scale
exercises in the country nor like the national id initiatives of some other countries. Hence, it
becomes critical to analyze the areas of concerns coming up from whatever has been done in
this so far in this initiative.
UIDAI had claimed that 10 crore UIDs would be distributed by March 2011 and 600
million by March 2014. However, as of November 25, 2010, only 153,791 UIDs were
generated (Balaganga, 2010; Khan, 2010; Kushwaha, 2010). This raises serious doubts on the
plan for achieving the optimistic target of generating 10 crore UIDs by March 2011.
It is not that the ambition of providing unique identification to all the residents/citizens
of India is unachievable. The overall exercise needs to be planned meticulously based on
concrete evidences and the efforts and outcomes of the project clearly mapped. Also, the
perceived benefits of such a scheme need to be well quantified in terms of its value and impact
on the society as well as its capacity to generate revenue or save cost. The feasibility of the
claimed benefits and their impact needs to be thoroughly evaluated in consultation with the
respective stakeholders. From the existing reports, it seems that very little effort has been made
towards estimating the total cost of the project and mapping the same with the perceived
benefits. In fact there is no indication of any cost-benefit analysis being conducted by the
government for the UID project. Given the scale and complexity of the initiative, a much
sincere effort needs to be made to estimate the overall cost of the project taking into
consideration various direct as well as indirect components of cost that would ultimately
contribute towards the cost to citizens (including government expenditure). Further, a detailed
cost-benefit analysis needs to be conducted by considering various alternatives for achieving
the perceived benefits (or social objectives) in order to check whether the UID scheme is the
best alternative for achieving the said benefits.

37

UID and Implications for other Countries

XI. Bibliography
Websites Referred:
1. http://uidai.gov.in/images/aadhaar_seeding_v_10_280312.pdf
2. http://uidai.gov.in/
3. http://businesstoday.intoday.in/story/nandan-nilekani-uid-controversy/1/22422.html
4. http://www.businessdailyafrica.com/Corporate-News/India-high-tech-IDproject-to-create-employment/-/539550/1048770/-/y0jr7u/-/index.html

Articles:
1. UID truce burden on taxpayers: The Daily Mail, 29th January, 2012
2. Monitoring the G8 promise to Africa: The Data Report, 25th May, 2010

38