Rebooting India: Realizing a Billion Aspirations (7 page)

Thanks to this ecosystem, residents could now choose to enrol at a bank, a post office, a government school housing a state-run enrolment camp, or even a ration card shop. Freedom of choice
meant that monopolies had no chance to arise; no one could force you to enrol at a particular centre, or pay a bribe to get your number. If residents were unhappy with the quality of service at a particular centre, they could simply go to another one of their choice, or wait for another enrolment agency to set up shop in the same area, as was usually the case.

Recognizing the power of incentives, the UIDAI initially paid the registrars Rs 50 for every successful enrolment. As enrolments scaled up, this figure dropped to Rs 40. Financial incentives also operated in the lower tiers of the ecosystem, where the registrars paid the enrolment agencies anywhere from Rs 25 to Rs 35 per enrolment. The estimated cost of the back-end processes (which did not directly involve the resident)—software development, building a data centre, operations costs, biometric de-duplication, mailing Aadhaar letters—was around Rs 50. Adding up these numbers, the entire enrolment process cost roughly Rs 100 per resident. For a population of 1.2 billion people, the cost is estimated to be Rs 120 billion over a period of ten years. Compare this to the Rs 3 trillion spent by the government on entitlements and subsidies, where a minimum of 10 per cent—Rs 30 billion every year—is lost to leakages, fakes, duplicates and ghosts. The numbers speak for themselves. Even so, a detailed cost-benefit analysis of Aadhaar published by the National Institute of Public Finance and Policy found that the project would yield an internal rate of return of nearly 53 per cent to the government.

As with any project of this magnitude and complexity, it was not always smooth sailing. The multiple registrar model faced some operational issues and has been continuously tweaked while leaving the principles of choice and competition intact. Rajesh Bansal recalls, ‘When we wrote to all the banks saying that we would like them to be registrars, they were hesitant since they felt this wasn’t their business. We had to convince them of the merits of becoming registrars, pointing out that as people enrolled for Aadhaar, the banks could simultaneously open new accounts for them and expand their customer base. Later, banks turned out to be the largest drivers for enrolment in states like Uttar Pradesh, Bihar and Orissa.’

Some state governments wanted to be the only registrars in their state so that they could build a complete database of all their residents. These states wanted the UIDAI to bar all other registrars in their region. Other states, however, did not share this opinion and actively encouraged multiple registrars to achieve full coverage. Ashok Pal Singh recalls, ‘Uttar Pradesh was the first state to accept non-state registrars, whereas West Bengal was the first to officially oppose this concept. However, West Bengal’s opposition didn’t last long, since within a month they issued another notification saying that they were willing to allow non-state registrars to enrol residents of the state.’ As a compromise between these two points of view, non-state registrars were eventually allowed to enrol residents only within or around their premises. Initially, public sector banks were not keen on letting private sector banks become registrars. These turf wars were not unexpected, and subsided as registrars came to realize that the power of Aadhaar was in the open platform it provided, rather than in the enrolment process itself. As a result, internecine conflicts came to a halt as enrolments sped up.

Here’s a deceptively simple question: how many digits should a number have to make it secure, and to ensure you can give out 1.2 billion numbers without any repetition? The answer we came up with was twelve. These twelve digits also need to be completely random so that there’s no easy guessing possible. Consider that in the US, you can guess a person’s social security number if you know their birthdate and the location from which their number was issued.
⁵
With identity theft becoming increasingly common, issuing completely random numbers was the only way to combat such issues, so much so that even if a family enrols for Aadhaar together, each member will get a number that is totally different from the others.

We said twelve, but Aadhaar is actually eleven random digits, followed by a twelfth digit whose purpose is to detect data-entry errors. This numbering system is similar to the one used for credit
cards, where a formula called the Verhoeff Scheme is used to calculate the last digit. The twelve-digit format allows for enough permutations and combinations to generate 80 billion Aadhaar numbers so that we are never in danger of running out of numbers to assign to people. To further strengthen the numbering scheme, a number once assigned to a person will never be reassigned, even after their death. There was some pressure for ‘VIP numbers’—numbers that are seen as numerologically favourable, for example, or special numbers for ministers. The UIDAI disregarded all such requests so that everyone got one democratically assigned random number irrespective of who they were.

A key design decision that the UIDAI’s technology team took very early on was that biometric data would be used to ensure an Aadhaar number’s uniqueness. We knew that every time a new enrolment took place, an individual’s biometric data would have to be compared against every other data set already in the system to verify that this person had never enrolled before—a process called de-duplication. But could this be done 1.2 billion times? To find out, Raj Mashruwala flew to San Francisco to meet leading experts in the field of biometric identification.

Nandan recalls the aftermath of that discussion. ‘I got a call from Srikanth Nadhamuni who was on his way to Dehradun to give a talk. He was in a bit of a panic as he said, the experts more or less think the way we’re planning to do biometric de-duplication is going to be fantastically expensive, with no guarantee that it will even work.’ In their opinion, the kind of heavy computational processing that de-duplication would require, to say nothing of the biometric scanners themselves, would drive costs to an unsustainable high. Nandan recalls, ‘I told Srikanth that the UIDAI had already promised to deliver 600 million Aadhaars in five years and we could not go back on that commitment. The team had to find a way to make it work.’

Srikanth recalls experts opining that the team would end up with several cricket fields’ worth of data centres to handle the enormous
volumes of data the project would generate. Pramod Varma, UIDAI’s chief architect, tells us, ‘I remember being told that we would need a million computers worth a million dollars each for the de-duplication process, which is an expenditure of a billion dollars just to buy computing power.’ What could the technology team do to bring costs down to a manageable level?

One option was to look at what some of the leading technology companies in the world were doing. As early as a decade ago, working at these scales would have seemed improbable enough to belong to the realms of science fiction. Yet, today we exchange over 100 billion emails a day;
⁶
Google handles 3.5 billion search queries daily;
⁷
there are currently over 1.28 billion people in the world using Facebook,
⁸
and over half a billion using WhatsApp
⁹
. Companies that have used the power of the internet to build new technologies and tools have become trailblazers in the art of working with a huge user base. The innovations they used to make this possible gave the UIDAI both the tools, and more importantly, the courage to forge ahead by taking calculated risks.

Another decision was to use commodity hardware—the same sort of computers that are freely available in the open market, and which aren’t terribly powerful by themselves. But hooking up lots of them in parallel increased their computing power significantly, enough to tackle the de-duplication exercise. This system was cheap and flexible, avoiding any issues of vendor lock-in while being easily scalable and compact—the final data centre taking up only 10,000 sq. ft. rather than entire cricket fields.

A major technology challenge was to figure out in what language the actual enrolment would be carried out. Sanjay Jain, UIDAI’s chief product manager and formerly at Google (where he co-authored the popular MapMaker tool) explains that ‘urban residents tend to be more comfortable with English than their rural counterparts, who largely communicate in the local language of the state. Hence, data was captured both in English and the local language of the enrolment area. As the operator keyed in the data in English, the software automatically translated it into the local language, which
could then be corrected for phonetic and spelling errors by both the operator and the enrolee.’ The entire enrolment process is explained in the diagram on the facing page.

The technology team at Aadhaar was faced with the challenge of using biometric data at scales beyond anything the world had seen so far. In order to enrol 1.2 billion people, every person’s biometrics would have to be compared with every other biometric in the system to ensure uniqueness. That’s 700,000,000,000,000,000 (700 million billion) biometric comparisons. Storing all this information would generate 15 petabytes of data.

Hoping to learn from others’ experiences, they studied other biometrics-based efforts, such as the US VISIT border security programme. Our team found that this programme was ‘locked-in’ with one vendor, forced to use only that vendor’s software and biometric devices. At the time the team met with them, they were handling numbers on the order of 100 million identities. India is ten times bigger; what if we selected one vendor for Aadhaar and found that they were unable to work at this scale? Around the world, we’d seen that multiple government projects failed because they were helplessly yoked to a single vendor, who was unable to deliver for a variety of reasons. We could not afford to take that risk, and so we decided to use multiple vendors, both to provide the biometric scanning devices as well as to carry out the de-duplication process before handing out a new Aadhaar number. This approach had never been tried before, but by virtue of being the largest customer in this field, the government was able to dictate its terms. Now the UIDAI could never be held hostage by one supplier, and the power of the markets ended up driving volumes up and prices down.

Jagadish Babu, on a two-year sabbatical from Intel, managed the biometric device ecosystem in the early days of Aadhaar. He tells us that ‘Aadhaar has single-handedly created a large market in biometric sensors and has spurred innovation in sensor technology worldwide. The
demand generated by the UIDAI has led to a ten-fold drop in sensor costs, from over $5000 to $500 per device.’ Biometrics used to be a restricted-use technology for security applications; now, it has been thrown open to the Indian public for the targeted delivery of social services—consider that Apple launched its fingerprint-based Touch ID on the iPhone in 2013, four years after Aadhaar was up and running. As a result of competition and scale, it was estimated that UIDAI’s cost per de-duplication was the lowest in the world by a factor of three. Srikanth Nadhamuni explains the numbers to us. ‘The worldwide benchmark for a single de-duplication was on the order of Rs 20. We managed to carry out de-duplications at a cost of Rs 2.75 per query.’

As enrolments scaled up, the team started finding aberrations in the biometric data due to mistakes in scanning. Vivek Raghavan, an expert in integrated circuit design, was one of the lead volunteers heading the UIDAI’s early biometric efforts and the proud holder of what he calls ‘the most interesting title at UIDAI’—his official title didn’t even use the word ‘volunteer’, it just said Biometrics. He tells us, ‘There were a number of data packets where the iris data for the left and right eye had been switched—it turns out the camera used for the iris capture had been inadvertently flipped. We found out about this error in early January 2011 and fixed it within a month, in which time we had to invent a bunch of algorithms to detect flipped iris images and correct them—you actually need to check the position of the tear gland in every image.’ They caught these and similar errors only because they had a strong set of quality checks in place, allowing them to fix these mistakes quickly without forcing individuals to re-enrol and ensuring that all the captured data met quality standards.

Once enrolment and de-duplication are complete and an Aadhaar number is issued, every resident receives a printed letter with their number and demographic information. Today, that thick, laminated sheet of A5 paper is a familiar sight at airports, in trains and at bank branches. When it came to getting these letters out to people, there
was considerable discussion on whether to use a courier service. But at the end of the day, the only agency in the country with the reach and the staff to decipher such cryptic names and addresses as ‘X, Y’s son, who lives behind the old school’, was India Post. The postman is a government employee, and his delivery of the letter is considered as an official verification of one’s address that can be used for other government procedures. He is also the person most likely to know every nook and cranny of the locality in which he operates as well as the families who live there, granting him the facility of decoding complex or incomplete addresses.