Friday, 8 March 2019

Information Technology in the service of disenfranchisement

Like many other Indian citizens, I and my wife were disenfranchized in the 2014 elections, allegedly since we moved house (we moved up a few floors in the same building).  Apparently the EC is very efficient in deletion, but cannot do the same for additions.   It was alleged then that one political party had ensured deletions in middle class areas that were likely to vote for another party (you can guess which the latter was). 

In this cycle, we registered on form 6 online in January, but are yet to see any action (status shows as pending verification).  A colleague who did the same says he was asked to bring his neighbours voter ID card as proof of his  residence, and refused to do such an unreasonable act, and ended up getting rejected.

And now we have news from Hyderabad police claiming that Andhra removed people from voter lists based on a government funded survey which included a question on political affiliation.  But the same news also said that natives of Andhra who reside in Hyderabad were deleted from Andhra, begging the question, so what?  If they reside in Hyderabad, don't they have the right to vote there, regardless of their native place?   And we have a Telangana vs Andhra war ensuing. There is also news of parties filling in form 7 to drop voters from the rolls, on a mass scale.  Note that EC does not do even the basic courtesy of notifying pending deletion, and giving people a chance to contest it.   In 2018 the Telangana EC even admitted to mass deletion.

So now we have a situation where a right to vote has been turned into a favour, which we have to earn  by jumping through hoops, and even after all that we may not be added to the electoral rolls.  The feeling of helpless only helps us understand how the poor who depend on government subsidies feel much more often.  And all this is enabled by IT in a pretty strong sense.  We are forced to fill forms, only to see a nameless and faceless administration reject our applications without giving any reason.  (My wife and I applied online for aadhaar address change and PAN card address change a while back.    Our PAN changes were rejected for flimsy reasons, and her Aadhaar address update similarly was rejected for no reason.)

Contrast this with how things worked a few decades back.  Before elections (don't recall if for each election, or once in some number of years) EC staff would go door to door to create a list of voters, and your booth information would similarly be delivered at your doorstep by EC or by party agents. 
Today one has to struggle to find this information online if one is luck enough
to be on the rolls.

Why can't EC do this today?  All this focus on enabling Indian citizens abroad to vote forces us to ask the question, why are you not allowing Indian citizens in India to vote? 
   
Why can't you make the electoral lists on the basis of Aadhaar, and then do a  door-to-door check to verify and make required deletions and additions (e.g. of those who don't have Aadhaar cards, or whose Aadhaar addresses are not up to date)?  Why can't you send provide booth information in the same step, and send other details by SMS to the aadhaar linked mobile number? 

 Why, instead of allowing people to choose their leaders, and you allowing "leaders" to choose their voters?   Time to clean up your act, Election Commission of India!

Tuesday, 19 December 2017

Fake science in the "Science Channel"

We are now drowning in a sea of fake news.  So many whatsapp forwards that are fake, and designed to arouse passions.   Biased media, especially TV news, whose goal it is to arouse peoples  basest instincts, faking news when required (which is very often).

The latest fake news assault on science is from the "Science Channel", with its trailer about Ram Sethu being built by humans.    Most people I know who have seen it believe it totally, since they already "knew" that Ram built that bridge, and are happy to see confirmation from the West. 

What they are not aware of is, that Indian scientists have studied the geological formations and thoroughly debunked the human construction myth.   See this very well written article from the Hindu Frontline:

    http://www.frontline.in/static/html/fl2419/stories/20071005500500400.htm

But what about the amazing discoveries from the "Science Channel"?  Well, this channel has gems such as:

It's infamous for getting TRPs in the US by fake science.    They are now doing the same in India.  Folks, don't get conned by them.

Saturday, 2 December 2017

Automation of Citizen Harassment?

Our government has mandated Aadhaar update on everthing in life, and in the afterlife. Here are some examples of the joys of that process:

1) Citibank insists on updating Aadhaar for my credit card.  Their website even says:
     As per the Prevention of Money Laundering Second Amendment Rules issued dated June 1, 2017, it is mandatory to          update your Aadhaar number across all financial products, including bank accounts, credit cards and personal loans. 

  At the same time ICICI insists that there not only is there no need to updated Aadhaar, but there is no way for them to update Aadhaar for my credit card.  I checked with several people in their branch, same reply!

How can two of the major credit card companies have two interpretations of the rules?  Will credit cards get blocked on Jan 1st, when many people (including me) may be travelling and left stranded?
De-cardization?

2) Citibank offers an online portal for uploading documents for aadhaar updation.  The portal will not take documents above some tiny size, and offers no advice on how to shrink documents. 

3) Further digging shows that Citibank has an email address for sending documents.  Sent email, replies with no explanation saying:
we are unable to update your Aadhaar number on your Citi Card ending xxx due to a mismatch between information in Citi and UIDAI records. Please re-submit the request with the correct details
I can only guess that this may be because my first name is an initial with citibank, but couldn't they have given some advice?

4) Citibank also offers aadhaar update via SMS.  No reply to repeated SMSs except one message saying "We cannot process your request right now"

5) LIC has a portal, but won't let me log in with my ID.  After wasting a lot of time, I find a link saying if you are having trouble, use the old portal.  I can login there, but no link to update aadhaar.

6) Google leads me to a different site for LIC aadhaar update.  Works very nicely till the last step, where I get an error saying "GET method not supported".   GET should NOT be used for updates.  I hack the javascript source to replace GET by POST, and voila get a success message.  How can LIC release a portal where the front end does not match the backend?  What sort of testing do they do?
Will my update request work or just be ignored?  Have to wait (and wait, ...) and see.

7) My elderly housekeeper goes for Aadhaar linking for her mobile phone, but finger prints can't be read.  What is she supposed to do?  Give up on a critical resource in life?  Didn't the government (or supreme court) think about this earlier (there is some note sent recently on this topic, close to the deadline, but very unclear).  (Luckily for her, she went again and got a fingerprint read the second visit, but what about other old people.)

My conclusions based on these experiences and others: automation has made it easy for the government to force people to jump through hoops, while pathetic implementation has made jumping through those hoops extremely painful in many many cases.

We need a citizens charter of rights in this context, where citizens will not be required to jump hoops unless and until certain conditions are satisfied, such as all corner cases taken care of, and the process eased greatly for everyone.





Friday, 24 February 2017

Replay attacks with Aadhaar identification


Biometric authentication using Aadhaar is great boon for identifying people who
are physically present.   It's great to see how Aadhaar is easing the KYC process for
mobile sim card activation, which is great step forward from the present
photocopy of ID proof based methods.

However, Aadhaar cannot be a safe method for remote authentication using
untrusted devices, since biometric authentication  is clearly vulnerable to replay attack.
Here's a case where it was detected.
   
   http://economictimes.indiatimes.com/news/economy/policy/probe-against-3-firms-for-illegal-use-of-aadhaar-biometrics/articleshow/57325951.cms

It's good to see from the article that Aadhaar does have a mechanism to detect replay attacks.
But it cannot be 100% safe since attackers can store multiple scans for later attacks.
Or even just introduce minor distortions/noise into the readings, which will fool
duplicate detection.

For the longer term, even for in person authentication, one depends on trusting
the agent who is doing the verification.  Since they cannot always be trusted,
safeguards  are needed to ensure the agent is also securely identified in each transaction,
and their identity (e.g via joint photos to establish physical presence)
stored, so in case of replay attack by an agent, the identity theft victim
has some way to show  that their identity was stolen.   Without it a victim will
be in deep trouble, since there is no way to show they were not present.

UIDAI badly needs to issue guidelines for this task.
They do have some guidelines regarding trusted devices:
  http://economictimes.indiatimes.com/news/economy/policy/uidai-registration-for-all-aadhaar-authentication-devices-soon/articleshow/56734738.cms
but I don't see how they can verify if malware infects such a device.
Backup mechanisms are needed.