MC Explains: What Moody's said about Aadhaar and why India is not pleased

Aadhaar is a 12-digit unique identity number that can be obtained voluntarily by the citizens of India and resident foreign nationals

Aadhaar was the crowning jewel in the Indian government’s push to have other countries adopt digital public infrastructure (DPI) at the recently concluded G20 summit.

Aadhaar, along with other DPIs such as the United Payments Interface, were highlighted as success stories, and many countries have also expressed their interest in adopting such DPIs.

So, when Moody’s, the highly-influential New York-based global investor service came down on Aadhaar, saying it was hobbled by “service denials” and more, the Indian government took notice.

It issued a long clarification late on September 25 evening, declaring Moody’s report on Aadhaar to be baseless.

Let’s take a look at what exactly happened in detail.

Where and why did Moody’s speak out on Aadhaar?

Moody’s, in a report published on September 21, called ‘Decentralised digital identity has rich potential but wider adoption faces obstacles’, made a case for usage of decentralised identity systems, as opposed to centralised ones such as Aadhaar. Unlike other systems, decentralised identity systems enable individuals to own and control their digital credentials.

What did Moody’s say?

Moody’s came down hard on Aadhaar, accusing it of “service denials”, and having unreliable biometric technology apart from alleging security and privacy risks. “The system often results in service denials, and the reliability of biometric technologies, especially for manual labourers in hot, humid climates, is questionable,” the report read.

The correlation that Moody’s has alluded to between India’s ‘hot and humid climate” and biometric exclusion is not clear. People often suffer from Adermatoglyphia, which is the loss of fingerprints, and attributed to a medical cause. But that is not something limited to manual workers. However, there have been recorded instances of people being denied rations because their Aadhaar number was not linked to their ration cards.

“In recent years, the spotlight has shifted toward DID (decentralised identifiers) as a strategic response to the security and privacy vulnerabilities posed by centralised ID systems like Aadhaar. While DID systems are currently in their formative stages, they harbour significant potential to introduce a more robust and private avenue for managing digital identities,” the report added.

Was Aadhaar the only identity system that came under Moody’s line of fire?

The investor service also highlighted Worldcoin, a cryptocurrency currency token and biometric digital identity solution floated by software and hardware development startup called Tools for Humanity. Moody’s said that Worldcoin has faced scrutiny over its data collection practices.

How did the government react?

On the evening of September 25, the Ministry of Electronics and Information Technology criticised Moody’s report and said that it had been put out “without citing any evidence or basis” while making sweeping assertions against Aadhaar. “The report in question does not cite either primary or secondary data or research in support of the opinions presented in it,” said MeitY, in a Press Information Bureau release.

What did the government say in regards to Moody’s accusation that Aadhaar leads to service denials?

“It is evident that the authors of the report are unaware that the seeding of Aadhaar in the MGNREGS database has been done without requiring the worker to authenticate using their biometrics, and that even payment to workers under the scheme is made by directly crediting money in(to) their account and does not require the worker to authenticate using their biometrics,” MeitY said.

How did the government respond to allegations of security and privacy vulnerabilities in Aadhaar?

“The factual position in this regard has been repeatedly disclosed in response to Parliament questions, where Parliament has been categorically informed that till date no breach has been reported from (the) Aadhaar database,” MeitY said.

“Further, Parliament has laid down robust privacy protections in the law governing the Aadhaar system and these are observed through robust technological and organisational arrangements,” it added.

MeitY also noted that Aadhaar’s database is federated and encrypted. Its systems have been certified by international security and privacy standards (ISO 27001:2013 for Information Security Management System and ISO 27701:2019 for Privacy Information Management System), the ministry said.