The personal information of more than a billion Indians stored in the world’s largest biometric database can be bought online for less than £6, according to an investigation by an Indian newspaper.
The reported breach is the latest in a series of alleged leaks from the Aadhaar database, which has been collecting the photographs, thumbprints, retina scans and other identifying details of every Indian citizen.
The report in the Chandigarh-based Tribune newspaper claimed that software is also being sold online that can generate fake Aadhaar cards, an identity document that is required to access a growing number of government services including free meals and subsidised grain.
The Unique Identification Authority of India (UIDAI), which administers the Aadhaar system, said it appeared the newspaper had accessed only limited details through a search facility that had been made available to government officials.
It said it would seek to press charges against those who had “misused” the system, but stressed that no thumbprints or retina scans had been made available. “Mere display of demographic information cannot be misused without biometrics,” it said in a statement. “Claims of bypassing or duping the Aadhaar enrolment system are totally unfounded. Aadhaar data is fully safe and secure and has robust, uncompromised security.”
The newspaper report said anonymous people in WhatsApp groups were charging 500 rupees (£5.82) for the details of an account that allowed access to information from the Aadhaar database. This included a person’s name, home and email addresses, photographs and phone numbers.
The newspaper claimed that it purchased a code and was able to gain access to the information, as well as to the software that permits users to print fake Aadhaar cards. The Guardian could not independently verify the report.
More than 200 government websites were revealed in November to have published the Aadhaar numbers of citizens along with the names, addresses and bank details. UIDAI said that in that case the information had been inadvertently published by other government departments and was removed as soon as the breach became apparent.
Aadhaar workers have spent the past four years traversing India taking the names and photographs and scanning the eyeballs and thumbs of more than a billion people. The government says the database will bring vast numbers of Indians into the digital economy, allowing direct access to social programmes in a country where one study has estimated 84% of welfare funds are lost to intermediaries.
But critics argue that the benefits of Aadhaar are overblown and that such an enormous and potentially lucrative database can never be fully secured.
Activists also blame glitches in the rollout of the scheme for the death by starvation of at least two people who were unable to access rations, a welfare programme that now requires Aadhaar authentication.
In August, the supreme court ruled that privacy was a fundamental right guaranteed by the Indian constitution, a decision legal analysts predict could leave parts of the Aadhaar programme vulnerable to legal challenge.
