TECH
12/06/2018 12:21 PM IST | Updated 12/06/2018 12:21 PM IST

After Beta-Testing On A Billion Indians, The Tech Behind Aadhaar Is Going Global

Modi bats for India Stack at Singapore Summit.

Saumya Khandelwal / Reuters

Bengaluru — India Stack, a privately-owned bouquet of proprietary software applications powering most Aadhaar applications and Prime Minister Narendra Modi's Digital India initiative, has long stayed below the radar and out of the raging public debate around data and privacy.

Until now.

In a joint press conference with Modi last week, Singapore Prime Minister Lee Hsien Loong said Singapore was ready "internationalise" India Stack and help other countries build and exploit technologies similar to Aadhaar.

Loong and Modi's explicit endorsement means that companies like Flipkart and Paytm, which own products like PhonePe and Paytm's Payments Bank, that leverage the India Stack, could potentially make a lot of money.

These companies that built the Aadhaar ecosystem of identity and payments, an India Stack insider explained, are "experienced and can give useful inputs to any country that is putting together this kind of system."

India Stack's global push has thrilled its backers, and has prompted dismay amongst privacy advocates, who note that India Stack has been developed by iSPIRT, an opaque clique of "volunteers", who have developed an unaccountable set of software tools that affect the lives of over a billion Indians.

"This important initiative—potentially as important as anything coming from government ministries—is not subject to that degree of oversight.

The India Stack doesn't officially belong to anyone - it's described as a public good, but its creation lies within the small and close-knit iSPIRT.

Many of these volunteers – like Srikanth Nadhamuni, formerly Aadhaar's head of technology, and Sanjay Jain, formerly Aadhaar's chief product manager – have launched for-profit companies,(Nadhamuni is now CEO at Khosla Labs, a leading eKYC company, while Jain now works as Chief Innovation Officer incubating startups at IIM Ahmedabad), that leverage the very same India Stack tools and standards that they built for 'free'.

"Having India Stack as a product produced by a group of 'volunteers'—rather than, say, within the UIDAI—has certain advantages from their point of view: they do not have to operate transparently, there is no requirement for them to be subject to rights to information legislation or procurement rules," notes global watchdog, Privacy International. "Thus, this important initiative—potentially as important as anything coming from government ministries—is not subject to that degree of oversight."

Independent law researcher Usha Ramanathan, who is one of the leading critics of Aadhaar, is more direct.

"India Stack is about a business interest in government. They created business structures within the government, and the kinds of things they created were based on business interests. And that is why authentication became eKYC - Know Your Customer, not citizen."

Edgar Su / Reuters

What is India Stack?

A tech stack is a clutch of complementary software, built layer by layer, on a common foundation or platform. This gives disproportionate power to the entity owning the platform.

For example, let's take Google Maps as a platform that is the de facto standard for location-based services. Now companies like Uber, Ola, Zomato, Swiggy — for whom location services are a crucial part of their business — can all build apps that use Maps by paying Google a license fee.

India Stack aims for something similar, but for an entire country.

The base layer of India Stack is the people — you and me — wrapped in an identity layer, called (you guessed it) Aadhaar, which turns us all into uniquely identifiable data-points.

Then there's a layer for paperless transactions, on top of which sits a layer for instant bank to bank transfers which is the UPI platform, and then you have the various UPI apps through which you can transfer money.

Nikhil Kumar, Fellow and Head of Developer Ecosystem - India Stack at the iSPIRT Foundation, said India Stack has three main platforms:

Aadhaar, which means anyone can be authenticated, quickly and easily via the Internet.

Once someone is authenticated, the UPI platform allows for seamless payments.

The third, and most controversial layer, has privacy advocates up in arms.

"Why is the World Bank, or Bill and Melinda Gates Foundation in favour of India Stack? Because it makes every transaction very visible, and generates a lot more data."

"Third is the digital consent layer, which is about a user consenting to how their data is used," Kumar said. "This is a little different to the European model, where they are blocking all use of data, instead we want to empower people, to answer, how does a person gain value from their data."

The European Model, Kumar disparages, is a new privacy regulation to protect digital identities, by preventing tracking and targeted advertising without explicit user consent.

The new regulations, called the General Data Protection Regulation, mean Europeans can ask for all the data that a company has collected about them, and have that data deleted.

India, by contrast, does not have a data protection law at all, which means companies can do pretty much what they want with our data – which is what they are doing.

"We can offer what we've learned to the other countries, both good and bad," said Kumar, speaking of India's Aadhaar roll-out. "The empanelment of agencies should have been better, and the data protection law is not in place yet, but we've also learned a lot and can really help people."

Lawyer and researcher Ramanathan disagrees, "It is a business, not the government. There is no answering to RTI or the CAG, and the goal for India Stack has been to collect people's data.

"Why is the World Bank, or Bill and Melinda Gates Foundation in favour of India Stack? Because it makes every transaction very visible, and generates a lot more data."

This is actually something that Nandan Nilekani also writes about, in a Credit Suisse report from 2016. "As India goes from being data poor to data rich in the next 2-3 years, the Electronic Consent layer of the India Stack will enable consumers and business to harness the power of their own data to get fast, convenient and affordable credit."

"And as data becomes the new currency, financial institutions will be willing to forego transaction fees to get rich digital information on their customers. The elimination of these fees will further accelerate the move to a cashless economy as merchant payments will also become digital."

indiastack.org

So Who Benefits?

India Stack critics point out that the Aadhaar-ecosystem is riven with conflicts of interest.

Many of the individuals involved in building the stack, and making it a de facto standard for digital transactions in India, have set up for-profit companies to exploit it.

As pointed out in a Caravan article on the private-public conflicts behind Aadhaar, lobbying by private companies is a cause for concern as these companies benefit from having more information about customers - and with Aadhaar, they can have access to some of the users' most intimate details. This is particularly problematic in India, as awareness of privacy issues, whether from apps, or from services, is low.

It turns out that there are linkages between the different companies that are making use of Aadhaar, and the people who are involved in the creation of the Aadhaar, the UIDAI, and its subsequent implementation. For example, this article notes that Khosla Labs, which plays a big role in eKYC, gave a Rs. 21 lakh loan in 2016 (since repaid) to an NGO called the eGovernments Foundation - which was established in 2003, by Srikanth Nadhamuni, the CEO of Khosla Labs, and Nandan Nilekani, the first head of the UIDAI and the man most closely associated with Aadhaar.

Another worrying example comes from the company OnGrid - which said it would offer facial recognition to link to a person's Aadhaar, and show other details as well, for authentication, security, and so on.

It sounds a little dystopian, doesn't it? Well, look at OnGrid's founders, and you'll come across Piyush Peshwani, who was apparently one of the core team members in the Aadhaar project.

Ironically, the other beneficiaries are the usual suspects: Google, Facebook, Alibaba due to share in Paytm, and now Walmart – through its purchase of the Flipkart-owned UPI interface PhonePe.

So, for example, if the Philippines were to adopt India Stack, then all UPI-backed applications like Flipkart-owned PhonePe, FaceBook's Whatapp payments, Google's Tez, and of course Paytm, would be able to roll out, with minimal changes, to enable payments in that country.

Digital authentication companies, which power things like eKYC, would similarly find whole new markets open up instantly.

India Stack backers say such criticism misses the point.

Sanjay Swamy, VC at Prime Venture Partners in Bengaluru, and an India Stack Evangelist, says the world has recognised India Stack's quality.

"It's a very modern architecture, but it's also open," Swamy said. "While in the US, everything is very vendor specific. You have private tie ups, but nothing that happens at a standards level.

"In China on the other hand, you've got a duopoly, with Alibaba and Tencent, it's a closed system. India has state of the art technology, and an open framework."

More On This Topic