Aadhaar: TRAI chief RS Sharma's challenge boomeranged as his personal info gets disclosed

Moneylife Digital Team 30 July 2018

Public Interest

Moments after RS Sharma, Chairman of Telecom Regulatory Authority of India (TRAI), shared his Aadhaar number on Twitter with a challenge to 'harm him' on Sunday, several people revealed his personal information, like permanent account number (PAN), his date of birth, mobile numbers, and residential address. Some even claimed to have created a profile on e-shopping sites using these credentials.

The TRAI Chairman neither accepted nor rejected whether the information revealed on Twitter belonged to him or no.

In a series of tweets on Saturday, a French security expert, who goes by the nickname Elliot Alderson and uses twitter handle @fs0c131y, caused ripples on the social media, leaking "personal address, DoB, your alternate phone number" and explaining to Mr Sharma, the TRAI chairman, how risky it was to make the Aadhaar number public.

"People managed to get your personal address, DoB and your alternate phone number. I stop here, I hope you will understand why make your Aadhaar number public is not a good idea," Alderson wrote.

If you disagree with this tweet, you probably don’t know what #privacy is...and this ok. Please, try to learn more about privacy and after that I will happy to debate with you to know if #Aadhaar is a privacy nightmare or not https://t.co/7E4nqZ5yfY
— Elliot Alderson (@fs0c131y) July 28, 2018

Mr Sharma, former Director General (DG) and Mission Director of Unique Identification Authority of India (UIDAI), has been maintaining that Aadhaar does not violate privacy and the government reserved a right to create such a database of residents since it gives subsidies on state-run welfare schemes. He and all other supporters of Aadhaar, however, keep quite on why Aadhaar is enforced upon citizens who does not receive any subsidy from the government.

It is illegal for even Mr Sharma to publish his Aadhaar number, under the Aadhaar Act. Section 29 of the Aadhaar (Targeted delivery of financial and other subsidies, benefits and services) Act, 2016 prohibits public sharing Aadhaar number. Sub-section 4 of Section 29 of the Act says, “No Aadhaar number or core biometric information collected or created under this Act in respect of an Aadhaar number holder shall be published, displayed or posted publicly, except for the purposes as may be specified by regulations.”

In this situation, it would be interesting to see if UIDAI takes any action against Mr Sharma, its former chief for publishing own Aadhaar number on a public platform.

Amid a debate on privacy concerns, which has also reached the Supreme Court, activists and people in general fear that the 12-digit biometric number is harmful to citizen's privacy.

"My Aadhaar number is 7*** **** ***0. Now I give this challenge to you: Show me one concrete example where you can do any harm to me," tweeted Mr Sharma, whose tenure as chief of TRAI ends on 9 August 2018. He is holding the position since August 2015.

Earlier, a Twitter user had asked Mr Sharma to "walk your talk" after the TRAI chief tweeted his interview with an online portal in which he strongly defended Aadhaar and rejected apprehensions that one billion Aadhaar accounts were vulnerable.

He had said there had not been a single instance of data being breached and had there been one, the entire Aadhaar database would have been vulnerable.

Within hours of tweeting his Aadhaar number, Anderson replied to Sharma: "The phone number linked to this #Aadhaar number is 9********7. According to an official @nicmeity circular, this phone number is the number of your secretary," Anderson wrote and posted a link to a circular issued by the Ministry of Electronics and Information Technology (MeitY).

One question here is how Mr Sharma linked his secretary's mobile number with his own Aadhaar number? Also, in that case, which number is used by Mr Sharma's secretary to link to own Aadhaar?

The security researcher also posted a picture of Mr Sharma with a portion of it blackened. "I supposed this is your wife or daughter next to you."

Anderson, who is known to have revealed security loopholes in the Aadhaar data system, also posted screenshots of Mr Sharma's leaked details with key areas blackened and hidden.

One of the screenshots even carried his PAN details. But that was also hidden.

PAN number pic.twitter.com/yKwtT7QuCh
— Elliot Alderson (@fs0c131y) July 28, 2018

While personal information of Mr Sharma was being spread on the social media, his previous employer, UIDAI came out with its ‘standard’ denial. Dismissing claims made by ‘certain elements’ on Twitter and a section of media, UIDAI said, “they have fetched personal details of Ram Sewak Sharma, who is a public servant using his Aadhaar number. Any information published on Twitter about RS Sharma was not fetched from Aadhaar database or UIDAI’s servers. In fact, this so–called ‘hacked’ information was already available in public domain as he being a public servant for decades and was easily available on Google and other sites.”

Alderson, however says, “If your phone numbers, address, date of birth, bank accounts and others personal details are easily found on the Internet you have no #privacy. End of the story.”

If your phone numbers, address, dob, bank accounts and others personal details are easily found on the Internet you have no #privacy. End of the story.
— Elliot Alderson (@fs0c131y) July 28, 2018

/div>

Comments

User

Suresh Deshmukh

8 years ago

I hold this portal - Moneylife - in very high esteem for the forthright views, stories and opinions - but except in matters related with Aadhaar. Almost everyday, stories trying to show Aadhaar in very bad light are being churned out. They stretch things to very ridiculous levels at times. I am at a loss to understand why Moneylife appears to have made anti-Aadhaar stand as their journalistic policy, putting their own credibility at stake.
Very sad and hurting!

Shivram Ramakrishnan

Replied to Suresh Deshmukh comment 8 years ago

Hi Suresh, You perfectly expressed my thoughts. I am still unable to fathom how knowing someoneâ€™s PAN number or email ID is more dangerous than giving an identity to a lot of people and ensuring benefits are targeted to the right group? I am yet to see a convincing argument in this regard. Merely asking people to read up on privacy and then discuss is insufficient argument.

Venkatraman Narayanan

8 years ago

Please donâ€™t give credence to frauds such as Elliot Anderson etc.

Anindya Bhattacharya

8 years ago

Can Moneylife digital team suggest me a way to know if any particular MP / MLA in India have Aadhaar card?

Anindya Bhattacharya

8 years ago

May I request Moneylife team to put in perspective "What privacy is in today's context?" through a well researched article.

Mahesh S Bhatt

8 years ago

Overconfidence gifted stupid Telecom Companies Government Ministers ( Sinisters) Mahesh Bhatt

Narayan

8 years ago

Very bad journalism. The so-called ethical have failed miserably to prove that you can harm anyone if you know their aadhar number. They could crack aadhar database, they simply googled and turned in the info available there. Sharma is public servant, much of the information they claim to have gathered is widely available on government site. Nobody can harm him with such data. Please stop criticizing aadhar.

Roy Aranha

8 years ago

Something terribly wrong with claims and arguments about the safety of ones personal information and security

Saravanan R

8 years ago

This confirms there is bigger conspiracy by anti bjp forces to discourage digital transactions and to support black money generation.

Vivek Silla

8 years ago

https://thewire.in/tech/trai-rs-sharma-daughter-kavita/amp/

atul naik

8 years ago

What boomeranged? Challenge was to harm. No one has been able to do that.

Mihir A. Kulkarni

8 years ago

Disappointed with the article. Should have done more research. There is another thread where all claims are refuted with proof and source of information that Anderson revealed is provided.

Magesh Kuppan

8 years ago

If phone, email id and address is available in public domain, then why cry that "privacy is affected because of Aadhaar "

Saravanan R

Replied to Magesh Kuppan comment 8 years ago

True.