Three days to go for mandatory use of Virtual Aadhaar ID… Who is ready?

In January this year, UIDAI had announced the introduction of the “Virtual Aadhaar ID” scheme to increase the security of the Aadhaar usage eco system.

The introduction stumped the Anti-Aadhaar lobby who were roaring before the Supreme Court when the hearing against Adhaar’s linking to Bank accounts commenced. In our article “It is Y2K moment again in India, with Virtual Aadhaar ID” and “How Aadhaar security reaches a new dimension with Virtual Aadhaar ID” we had highlighted the expected features of the system and why it was a master stroke of UIDAI which frustrated all the arguments against Aadhaar Security mounted under the “Privacy” considerations.

Now the Aadhaar hearing is over but the judgement is reserved. Also the Indian Privacy/Data Protection Act is yet to be finalized.

The UIDAI move of using Virtual ID as a means of authentication where by the Aadhaar user need to reveal only the virtual ID to a service provider for KYC and not the original aadhaar ID ensured that there could be no leakage of an Aadhaar linked information from the user side. At best the demographic data attached to a Virtual ID could be leaked. But since the aadhaar user can change the Virtual ID any time, the demographic data linked to Virtual Aadhaar Id is delinked from the real Aadhaar ID.

UIDAI had in its January circular indicated that service providers should make arrangements for incorporating the use of 16 digit Virtual Aadhaar Id in place of the 12 digit real Aadhaar Id whenever a service request for authentication is sent by them to the CIDR. This was supposed to be tried out between the period March to June period. UIDAI promptly started the issue of Virtual Aadhaar IDs on its website.

The trial period for testing the Virtual Aadhaar ID is coming to an end on June 30, 2018 and according to the UIDAI’s original announcement, they should stop authentication on the basis of real Aadhaar Ids from 1st July 2018.

However, if we look around, I have not yet come  across a single user institution that has implemented the acceptance of Virtual Aadhaar ID instead of the real Aadhaar ID. When I broached this subject amongst many experts in a recent seminar and also checked with one of the Banks, I found that many of the experts were also unaware of the Virtual Aadhaar system and completely blind to the possibility that the Aahaar KYC can come to a grinding halt from 1st July 2018 if they are not ready with the changed authentication API.

It is unfortunate that UIDAI also has not made any efforts to remind the public or the service providers that from 1st July 2018, the AUA/KUAs and their sub agents should be asking only the Virtual Aadhaar ID from the public and not the real Aadhaar ID.

UIDAI has not even put up a prominent “What is New” or a Blurb on “Virtual Aadhaar ID” on its website. It is an effort to search for the link if any body is interested.

As a result of this complete apathy shown by UIDAI, it is doubtful if any of the users are actually ready to switch over from the current 12 digit data filed of the real Aadhaar ID to the 16 digit data field of the Virtual Aadhaar ID.

Even if in the next two days some can push in the new API into their websites and mobile Apps, it is not clear if they would have done enough testing to avoid glitches in the authentication.

We need to watch out how UIDAI reacts to the industry completely ignoring its fiat. Will it take it lying down? or extend the time and try to push the users  until they introduce the new system?

It appears that UIDAI has no alternative but to extend the data of mandatory implementation of the Virtual ID system. But if they donot show seriousness, Supreme Court may consider that the system is only an eyewash and UIDAI is not serious. At least for this sake, UIDAI in the next 24 hours should come up with a warning that the authentication system may stop accepting the real Aadhaar ID from 1st July 2018.

As a via media, UIDAI may extend the time by charging a penal fees for the service user organizations (not the public) for every authentication based on real ID after 1st July 2018.

Looking forward to a response from UIDAI.

Naavi

Also view: moneycontrol.com