‘Bharat Bluff’: How the dream of Digital India opened the door to scamsters

Let’s rewind to the 1990s. The internet had just come to India, and barely a few had access to it. Early internet culture in India was heavily influenced by libertarian and ‘anarchist’ forms of thinking of Silicon Valley that dreamt of a decentralized internet where people from around the world could connect to one another, find safety in anonymity, and live a life outside of government and society if they wished to.

A lot of this changed in the last 20 years, says Srinivas Kodali, a civic hacker and independent researcher based in Hyderabad. “We started seeing a centralization of software systems in the 2000s, when big money began to flow into technology companies after the 2008 financial crisis in the US and in IT services companies in India,” he says. “In India we also had a series of terrorist attacks, including 26/11 in Mumbai in 2008. These convinced the Indian state and policymakers that we needed a centralized internet, including a national project where people can be registered and tracked.”

In 2009, the then government proposed to create Aadhaar as a solution to not just security issues but also a way to make sure every person in the country, no matter how marginalized, has access to government services by using a unique ID number. In 2010, Ranjana Sadashiv Sonawane from Tembhli, Maharashtra, became the first person to have an Aadhaar number. Today, everyone does.

Privacy activists and other groups protested. There were a number of reasons but the biggest concern was this: What happens to our data? What happens if the system fails? One glitch could stop a citizen from accessing basic government services. “We warned everyone during the Aadhaar phase that the Aadhaar structure is leaky,” Kodali says. “Aadhaar was implemented without any laws. There was no Aadhaar Act.” The Aadhaar Act was passed in 2016 to lay down rules of delivering financial subsidies and other government benefits.

But soon, the Aadhaar project began to get data from every other part of our lives. “This was the time when the state was pushing links between Aadhaar and everything else,” Kodali says. “In the 2010s, there were legal challenges to every kind of linkage, linking to PAN, bank accounts to voting cards, SIM card, income tax, everything.” Over the years, many of these rules to make Aadhaar linking mandatory were rejected by the Supreme Court. But even today, most basic services, public or private, demand an Aadhaar card as default.

The result of this centralization is simple. As opposed to a decentralized internet, we now live in a world where our data is in a centralized system controlled by one entity, the government. A centralized system does make life easier in many ways. With all my data connected to one Aadhaar card, I can quickly access services from any government department, with no need to deal with paperwork or corrupt bureaucrats, with transparency and also from the comfort of my home. But the downside is that a centralized system has no checks and balances. One change in law, one breach, or one policy misstep can mean valuable details of my entire existence can reach in the hands of anyone, including scammers.…

Take UPI… UPI is so successful that Indians do more than 600 million transactions on the network every month and move more than ₹80,000 crore on it every day. It is because UPI is so convenient and widely used that UPI-related scams are also very common in India. … So, is there a way to demand more information, better protection, and make the UPI system more accountable? One way would be to demand this from UPI apps such as Google Pay or PhonePe. But these are private companies and so they will do what they can to protect their business. If their databases are breached, or if they make changes in their terms of service that endanger the data of their users, there are no enforceable rules in India right now to stop such private companies from doing so.

What about the owner of UPI, the National Payments Corporation of India (NPCI)? We all believe that UPI is owned and operated by the government directly. So, if something goes wrong, we can demand that the government fix it and protect us. But, NPCI is a bit of a grey area. Officially, it is a non-government, non-profit entity owned by the RBI and a group of India’s biggest banks. … Also, unlike other parts of the government, NPCI does not fall under the RTI (Right to Information) Act. In 2019, it won a case where it argued that it was a private company and does not fall under the RTI Act. So, ordinary citizens who want to know more about NPCI, such as what it does with our data or how it is preventing frauds, cannot seek more information with an RTI application.

In the last few years, NPCI has expanded to even more government services; it runs RuPay, a card network similar to Mastercard and Visa, the mandatory FASTag system of paying tolls on national highways, and Bharat Connect, an integrated online system to pay government bills like electricity and municipal tax. All of this data is held by NPCI, which says it is a quasi-government body running national infrastructure, but actually acts as a private company.

Other digital public infrastructure (DPI) behaves the same way. DigiYatra, the app using facial recognition to manage passengers at airports is run by a company called the Digi Yatra Foundation, run by the Ministry of Civil Aviation. But it is also set up as a non-government, non-profit company and so, the ministry said in 2023, does not come under the RTI Act. … Even the latest DPI launched by the government, functions like this. The Open Network for Digital Commerce (ONDC) is a UPI-like system for buyers and sellers to come together and transact on an e-commerce platform. The promise of ONDC was that it is a decentralized and fair e-commerce system, better than private companies like Amazon and Flipkart, which dominate our country and are foreign-owned. But, just like NPCI and Digi Yatra Foundation, ONDC is also a non-government non-profit company. Will it remain accountable to the people like a government body? Will it come under the RTI Act? We don’t know yet.