Thread by @databaazi

This is another story the UIDAI *really* hopes people have forgotten about. timesofindia.indiatimes.com/business/india…

thehindubusinessline.com/news/national/…

List of sites against which FIRs were reportedly filed:

- aadhaarupdate.com
- aadhaarindia.com
- pvcaadhaar.in
- aadhaarprinters.com
- geteaadhaar.com
- downloadaadhaarcard.in
- aadharcopy.in
- duplicateaadharcard.com

Here are the questions for journalists and MPs to ask:

- Exactly which websites and mobile applications were taken down?
- Promising and delivering what 'Aadhaar-related services'?
- Through what mechanisms?
- Operated by whom?
- From where?
- Since when?

(1/2)

- Having illegally obtained how many unique Aadhaar records?
- With what action taken against the operators?
- With what action taken to inform and compensate Aadhaar holders whose records were compromised?
- With what action taken to reissue compromised Aadhaar numbers?

(2/2)

External Tweet loading...
If nothing shows, it may have been deleted
by @OosiTappasu view original on Twitter

This is yet another huge scandal waiting to break. And the FIRs above are just the tip of the iceberg - the UIDAI has known about organised networks creating complete mirror copies of the records in the CIDR (*including* b/m) under the guise of Aadhaar card printing *for years*.

That's why they issued this public warning two months ago (without disclosing the full context).

scroll.in/latest/867753/…

And why they issued this almost identical warning a year earlier. timesofindia.indiatimes.com/business/india…

The full beauty of this scam?

1. It's self-financing even *before* you use the data (or sell it on).
2. Nothing ever touches the UIDAI's servers during the collection process.

#DigitalIndia

External Tweet loading...
If nothing shows, it may have been deleted
by @databaazi view original on Twitter

indiamart.com/proddetail/pvc…

indiamart.com/proddetail/aad…

How does this work exactly? It's very simple, with the equipment required being freely available to tens of thousands of (now unemployed and aggrieved) Aadhaar enrolment operators who were used to construct the database as quickly and cheaply as possible. (1/8)

First, you set up a very basic 'Aadhaar card centre', requiring just a laptop, a fingerprint scanner, a printer and some basic data capture and card printing software, and start offering locally-competitive 'Aadhaar smartcard' printing services. (2/8)

It can be as simple as a kiosk with a hand-written sign, all of which can be dismantled in 15 minutes. No server downtime, no connectivity issues, no bureaucracy - you offer a cheap, accessible 5 minute service. (3/8)

And to make your service attractive to as many people as possible, alongside PVC 'smartcards' maybe you also offer cheaper paper laminates. Maybe you also offer update and enrolment using cracked software, or maybe you just provide referrals for those services. (4/8)

Then, because giving b/m is synonymous for many people with Aadhaar, you tell your unwitting customers that in order to print their 'smartcard' they need to provide their Aadhaar slip *and* give their b/m, to which many (especially the most vulnerable) unthinkingly accede. (5/8)

The operator then takes (and stores) a copy of the Aadhaar holder's demographic details (which are necessary to print the card), and *also* collects the (matching) biometrics of the Aadhaar holder, giving them *a complete mirror record* of the data held on the CIDR. (6/8)

And not only is this activity totally undetectable by the UIDAI at the point of data capture, it is also unlikely to arouse any suspicion locally, as Aadhaar 'smartcard printing' services are ubiquitous (7/8)

and those running the scam have a clear incentive to offer customers a polite and efficient service at competitive rates (and to maximise the number of records captured before they distribute or exploit them). (8/8)