Lok Sabha Question No. 3600 (UNSTARRED), answered on 2019-01-02
Subject: Identity Theft
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: SATISH CHANDRA DUBEY

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 3600

TO BE ANSWERED ON 02.01.2019

## IDENTITY THEFT

## 3600.   SHRI SATISH CHANDRA DUBEY:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)   the system available in the form of action mechanism in case of hacking or identity theft keeping in view the fact that   the Aadhaar/UID number, is being used for various types of authentication;
- (b)   the details regarding security mechanism and encryption method being used for security of data and whether it is as per the exisiting industry standards and if so, the details thereof;
- (c)   whether any attempts has been recorded for breach in security or theft of data of Unique Identification Authority of India; and
- (d)   the details regarding each incidence of such security breach and affected identification number along with the action taken thereon ?

## ANSWER

## MINISTER OF STATE FOR   ELECTRONICS AND  INFORMATION TECHNOLOGY (SHRI S. S. AHLUWALIA)

(a): Hacking is only possible on Information Technology assets if they are not properly secured and configured. It is submitted that no incidents of hacking or identity theft have been reported so far in respect of Aadhaar data from Unique Identification Authority of India ( UIDAI)'s Central Identities Data Repository (CIDR).

Aadhaar  is  based  on  three  core  principles  of Minimal  information,  Optimal  ignorance  and  Federated  database ,  and therefore, in its whole lifecycle, an Aadhaar database contains only that much information that resident gives at the time of enrolment or updation. It has resident's name, address, gender, date of birth/age and photograph and core biometrics (10 fingerprints and 2 iris scans). It also has mobile and email, if the resident opts to give. Aadhaar does not receive or store  any  information  such  as  bank  account  or  PAN  or  SIM  etc during  linking  or verifying  any  of  the  services  with Aadhaar. Also, the core biometrics are encrypted at the time of enrolment/updation, are never kept unencrypted and are never shared. When people use Aadhaar for accessing various services, their information remain in silos of federated databases so that each agency remains optimally ignorant.

UIDAI's existing security controls and protocols are robust and capable of countering any attempts or malicious designs of  data  breach  or  hacking.  Security  of  Aadhaar  is  of  critical  importance  to  the  Government  and  UIDAI  has  given  it paramount significance. UIDAI constantly strengthens and reviews its infrastructure and ecosystems in line with the best International security practices and technological standards. UIDAI has multi-layered security and privacy considerations built into the core strategy of Aadhaar with three basic doctrines of minimal data, optimal ignorance and federated database which give higher level of security.

Various policies  and  procedures  have  been  defined,  which  are  regularly  reviewed  and  updated  thereby  appropriately controlling and monitoring any movement of people, material and data in and out of secured and well-guarded UIDAI premises, particularly the Data Centres.

Legal status of UIDAI has further strengthened the security assurance of Aadhaar ecosystem manifolds with enactment of  The  Aadhaar  (Targeted  Delivery  of  Financial  and  Other  Subsidies,  Benefits  and  Services)  Act  2016,  which  has stringent penalties/ punishments for offenders.

In  the  ibid  Act,  Chapter  VI  on  Protection  of  Information  (Section  28  -  Section  33)  &  Chapter  VII  on  Offences  and Penalties (Section 34 - Section 47), specifically relates to protection of information and related offences and penalties to offenders.

(b):  It is submitted that, at UIDAI, Aadhaar data is fully encrypted at all the times i.e. at rest, in transit and in storage. Aadhaar data is stored in CIDR of UIDAI in encrypted format.

Aadhaar data including biometrics is encrypted by 2048 bit encryption key (best in class as per industry standards) at the time of enrolment, transit and thereafter at storage. It is worth mentioning that it may take the fastest computer on the earth, billions of years to break this encryption key by brute force.

- (c): No, Sir. No incidents of breach in security or theft of data have been reported so far in respect of Aadhaar data from UIDAI CIDR.
- (d):  Does not arise in view of (c) above.
- ********