Above: Rachna Khaira’s (left) report on the UIDAI data breach shook the government but her editor Harish Khare supported her

Filing an FIR against the journalist who exposed a serious breach in the UIDAI system created such a furore that the government was forced to go on the back foot    

~By Vipin Pubby in Chandigarh

Ever since the Unique Identification Authority of India (UIDAI) was set up in 2009, the concept of Aadhaar and its security aspects have remained under a cloud. It was the biggest exercise of its kind in the world and a prestigious one for the Manmohan Singh government which roped in no less than Infosys co-founder Nandini Nilekani to make it a success. After running a budget of Rs 9,000 crore and collecting biometric and other details of some 120 crore citizens, the project is here to stay even though the Supreme Court is likely to take a view soon on its security aspect.

The latest exposé involving a security breach in the system by Rachna Khaira of The Tribune is not the only one reported since the scheme was launched. There have been several complaints by individuals but it was the first exposure of middlemen involved in an organised racket.

EASY ACCESS

For Khaira, a no-nonsense journalist who started her career with the marketing team of The Indian Express in Chandigarh, it took just Rs 500, paid through Paytm, to breach the security of the system. The agent, who had been operating through WhatsApp, created a “gateway” for the correspondent and gave her a password and login ID. All she needed was to enter any Aadhaar number and instantly get all the details of that individual. These included name, address, photo, phone number, email ID and postal address. And for a mere payment of an additional Rs 300, the agent provided “software” that could facilitate the printing of the Aadhaar card after entering the Aadhaar number of any individual.

UIDAI promptly denied any security breach and maintained that even leakage of information without access to biometric data would not be of any use to anyone. However, even the non-biometric information could be marketed or abused by vested interests. Nevertheless, it over-reacted and lodged an FIR with the Delhi Crime Branch’s cyber cell under IPC Sections 419 (punishment for cheating by impersonation), 420 (cheating), 468 (forgery) and 471 (using as genuine a forged document), as well as Section 66 of the IT Act and Section 36/37 of the Aadhaar Act. Although the FIR was lodged against unknown persons on the basis of The Tribune report, it stated that some persons “have unauthorisedly accessed the Aadhaar ecosystem in connivance of the criminal conspiracy… The act of the aforesaid involved persons is in violation of (the various sections mentioned in the FIR)…  Hence, an FIR needs to be filed at the cyber cell for the said violation”.

The registration of the FIR, not just an entry into the Daily Diary as is the normal procedure, expectedly raised a storm. It was a classic case of investigative journalism not involving any hidden camera or any other attempt to ensnare any “victim”. It was not a sting operation as conducted by some news channels earlier. The reporter had no hidden agenda nor did she misuse or abuse the information made available to her.

To her credit, she approached UIDAI officers for their version, which they declined. She also made sure that no classified information was brought into the public domain. Further, she did not hold on to the information and the newspaper did well to publish the story the very next day. This would have convinced anyone that it was a case of genuine investigative journalism, but the UIDAI acted in utter haste in registering the FIR.

STORM OVER FIR

This kicked off a storm, with various media organisations, including the respected Editors Guild of India, taking the bull by its horns. The president of the Guild, Raj Chengappa, himself a former editor-in-chief of The Tribune, said that the organisation “condemns UIDAI’s action to have The Tribune reporter booked by the police as it is clearly meant to browbeat a journalist whose investigation on the matter was of great public interest. It is unfair, unjustified and a direct attack on the freedom of the press. Instead of penalising the reporter, UIDAI should have ordered a thorough internal investigation into the alleged breach and made its findings public”. The Guild demanded the intervention of the Union ministry concerned to get the case withdrawn, apart from conducting an impartial investigation into the matter.

The Hindu newspaper said in its editorial that “undercover investigations or so-called sting operations occupy a complex and problematical ethical space in journalism, but it is impossible to fault The Tribune’s exposé… To begin with, the public interest—which lay in showing how easily the database could be breached and drawing attention to the existence of an organised racket to facilitate this—far outweighed, or more than compensated for, the act of unauthorised access”.

There were protests by several media organisations, who described UIDAI’s action as misdirected shooting of the messenger and a direct attack on free public-spirited journalism. The gathering storm forced the government to take note and Union Law Minister Ravi Shankar Prasad said that the “government is fully committed to freedom of the press as well as to maintaining the security and sanctity of Aadhaar for India’s development”. He tweeted that he had suggested to UIDAI to request The Tribune and its journalists to give all assistance to the police in investigation of the real offenders.

Taking a cue, UIDAI also put out a tweet to say that it was committed to the freedom of the press and that it would appreciate if The Tribune and its journalist “have any constructive suggestion to offer”. As for the FIR, the UIDAI clarified it needed to provide the full details of the incident to the police and that this did not mean “everyone mentioned in the FIR is a culprit…”

DIFFERENT STANCE

While the storm may have petered off, questions remain over the breach of security and the apprehensions associated with possible leakage of personal information. Ironically, the BJP had, at one stage, strongly opposed the Aadhaar scheme on security grounds and is now its strongest supporter. Incidentally, even former Union Home Minister P Chidambaram had opposed his UPA government’s decision to launch the scheme. It is also a fact that several countries, including the United States and the United Kingdom, had scrapped such schemes on grounds of security.

The issue is now under the scrutiny of the Supreme Court which is hearing a string of petitions in this regard. The final hearing challenging the constitutionality of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act of 2016 is slated for January 17. Several petitioners have questioned the security aspect as well as denial of facilities to a section of the marginalised population. The issues of identity theft, surveillance and breach of privacy under various sections of the Constitution are likely to be brought before the highest court of the land.

Harish Khare, the editor-in-chief of The Tribune, said in an open letter on January 8: “Our story was in response to a very genuine concern among the citizens on a matter of great public interest.

“We regret very much that the authorities have misconceived an honest journalistic enterprise and have proceeded to institute criminal proceedings against the whistleblower.

“We shall explore all legal options open to us to defend our freedom to undertake serious investigative journalism.”

Former UIDAI chairman Nilekani has said that he was confident of the Supreme Court upholding Aadhaar under the test of the fundamental right to privacy “because it meets the test of the law being proportionate and reasonable”.  However, he must be keenly awaiting the verdict and would hope that it defines what constitutes personal information.

Along with that, the Supreme Court is also expected to call for a comprehensive data protection law. Ideally, it should also lay down guidelines for protection of the media from misuse of laws so that governments refrain from scuttling investigative journalism.