Global rating agency Moody's Investors Service recently raised concerns about security and privacy vulnerabilities in biometric technologies like the Aadhaar programme in India. The New York-headquartered rating agency in a report on “Decentralized Finance and Digital Assets” issued on September 23, acknowledged Aadhaar as “the world’s largest digital ID program” that assigns unique numbers to over 1.2 billion Indian residents using biometric and demographic data. However, it questioned the reliability of biometric technologies (especially Aadhaar) in humid climates.
Here's what Moody's said about India's Aadhaar technology:
- The Unique Identification Authority of India (UIDAI) administers Aadhaar, aiming to integrate marginalized groups and expand welfare benefits access. However, the system faces hurdles, including the burden of establishing authorization and concerns about biometric reliability.
- UIDAI-Aadhaar system often results in service denials, and the reliability of biometric technologies, especially for manual laborers in hot, humid climates, is questionable.
- Moody's report also stated, "Certain categories of digital ID, especially those under central or federated control, are susceptible to misuse or exploitation – a concern that becomes particularly salient when sensitive biometric data like fingerprints or facial recognition information are involved".
Also read: India reaffirms confidence in Aadhaar technology, calls Moody's opinions baseless
- Moody's report highlighted concerns regarding the decentralised digital identity saying the widespread use of this technology also faces other hurdles. "Decentralised Digital (DID) brings potential solutions to current ID issues but also presents challenges, including technical complexity, cyber risks, interoperability issues among different frameworks, the potential for data exploitation, and possible social repercussions".
- Further, Moody's report stated that a lack of suitable policies and regulations can discourage the use of reusable credentials and create obstacles for this technology. " It is unlikely that Decentralised identity (DID) will be widely adopted across different global systems without new regulations and laws," Moody's mentioned in its report.
- The lack of well-defined and universally accepted standards for various components within the Decentralised digital (DID) architecture – such as data formats, communication protocols, cryptographic methods, and verification procedures – hinders the ability of different DID systems to work together efficiently and seamlessly, known as interoperability.
How did India respond to Moody's report?
The Ministry of Electronics & IT has called Moody's viewpoints on the Aadhaar-UIDAI system 'baseless'.
The Union Ministery said, "The report in question does not cite either primary or secondary data or research in support of the opinions presented in it. The investor service did not make any attempt to ascertain facts regarding the issues raised by it from the Authority".
The ministry also said that the report has incorrectly mentioned a number of Aadhaar users.
The report ignores that biometric submission is also possible through contactless means like face authentication and iris authentication. In addition, the option of mobile OTP is also available in many use cases, said the ministry.