Even as the Unique Identification Authority of India (UIDAI) has proposed the introduction of Virtual ID and face-recognition as extra layers of security for Aadhaar, questions have been raised about the efficacy of these measures in protecting the privacy of the individual from unscrupulous elements.
The Supreme Court is currently a clutch of petitions related to the validity of Aadhaar and its linkage to various documents of citizens.
According to Ankush Johar, Director of Infosec Ventures, which also provides infrastructure security solutions to the government, the UIDAI’s recent measure — to provide facial recognition using images captured from cameras of 3-5 megapixels — may be “too little, too late”.
The face recognition mechanism will augment other forms of Aadhaar authentication currently in place: fingerprint and iris recognition. This will come in handy for those, especially the elderly, whose fingerprints and iris go blurred due to ageing, diseases and a hard lifestyle.
Terming the UIDAI’s latest move a “PR gimmick” to save its skin after accusations of data leaks, Johar said the face-recognition measure would provide “zero” extra security due to the poor resolution cameras used.
“It (face recognition) might not do much good. It is not difficult to replicate as compared to other biometric features... and a major problem lies in the source of the poor images used in the authentication mechanism.”
How secure is facial recognition?
In November 2017, a group of cyber-security researchers had tricked an face-recognition-enabled iPhone into unlocking using a $150, 3D-printed mask, Johar said. While Apple’s face-technology uses infrared-based hardware to capture the 3D image of a person’s face, what chance does Aadhaar, which makes use of inferior cameras, stand, he argued.
Facial recognition in Aadhaar cards would thus be a questionable security measure as an individual’s face, like other body parts, usually undergoes changes, and can also be manipulated as in the iPhone case.
The use of high-definition cameras could have helped, he added.
Similarly, a Virtual ID may not be too much of a help as the card-holder’s number, in many cases, had already leaked to those who could misuse it.