An anonymous hacker has breached the digital ID numbers and other personal information of approximately 815 million Indians from the Wuhan coronavirus (COVID-19) test data of citizens linked to Aadhaar numbers registered with the Indian Council of Medical Research (ICMR).
In 2021, the Indian government issued 12-digit unique identity numbers called Aadhaar to its approximately 1.3 billion population. Aadhaar, considered the world's largest biometric digital ID system, was originally designed to provide a unique identification number to each Indian citizen and curb issues related to duplicate, fake or stolen IDs in government programs.
Indian citizens are required to provide demographic information, including name, date of birth, age, address and gender, as well as biometric information, including 10 fingerprints, two eyeball scans and a facial photograph to register on the system.
However, Resecurity, an American cybersecurity and intelligence agency, revealed that a hacker using the alias "pwn001" posted spreadsheets with fragments of Aadhaar data on Breach Forums and other underground cybercriminal forums. The agency detected that the hacker provided access to the Aadhaar and passport records of more than 60 percent of the 1.3 billion people enrolled in the Aadhaar biometric digital identity program. These records were verified as valid Aadhaar card IDs upon analysis.
The agency further revealed in a blog post that Hunters Investigators confirmed the hacker was willing to sell the entire dataset for only $80,000. The dataset includes the name, father's name, phone number, other contact details, passport number, Aadhaar number, age, gender, address, district, pin code and state of Indian citizens.
"In one fell swoop, roughly 10 percent of the global population appears to have had some of their most valuable personal identifiable information (PII) compromised. Yet Aadhaar continues to receive plaudits from Silicon Valley," Nick Corbishley wrote for Naked Capitalism.
Bill Gates praises Aadhaar – because he knows it's another tool to control people
In 2019, Bill Gates praised Aadhaar in his blog entitled "Gates Notes," essentially saying that it introduced the "invisible people" in India to the world. Three years prior, in a talk about Technology for Transformation, Gates mentioned Aadhaar as a unique government initiative not seen even in wealthier nations.
However, Security Affairs warned that storing such highly sensitive PII is prone to leaks and digital identity theft. The agency noted that the security vulnerabilities of utility companies, service providers, telecom operators and fintech services commonly lead to data breaches.
Likewise, Biometric Update, a significant industry publication, has warned that India is experiencing a serious issue of "bleeding biometric data."
The discovery of Aadhaar records for sale on the dark web, the exposure of PII on a government website, the issuance of fake Aadhaar cards in a police raid on a brothel, the exposure of biometrics and PII on the West Bengal state government website and the Aadhaar-enabled Payment System (AePS) scam are proofs of the system's security weaknesses. (Related: Several cases of IDENTITY THEFT spark concern over Australia’s national digital ID proposal.)
Moreover, Aadhaar's flaws extend beyond security concerns. Corbishley argues in his book "Scanned" that the system, intended to streamline bureaucracy, has inadvertently granted the Indian government unparalleled surveillance power.
"For a start, it tracks users' movements between cities, their employment status and purchasing records. It is a de facto social credit system that serves as the key entry point for accessing services in India. While the system has helped to speed and clean up India's bureaucracy, it has also massively increased the Indian government's surveillance powers and excluded over 100 million people from welfare programs as well as basic services," Corbishley wrote.
PrivacyWatch.news has more stories related to the implications of digital ID systems.
