Digital ID in the time of COVID-19 in India

• by Mitul Thapliyal, Venkat Goli, Saborni Poddar and Sneha Sampath
• Feb 7, 2021
• 6 min

This blog reflects on the challenges of having a single biometric technology for authentication and suggests alternate contactless technologies that the government can deploy during a pandemic.

India’s social welfare delivery system relies on Aadhaar, a biometric digital ID system, to identify and authenticate beneficiaries. About 800 million people use biometric authentication to receive highly subsidized rations every month through the Public Distribution System (PDS). Similarly, millions of beneficiaries use biometric authentication to withdraw money that they receive from social welfare programs and other sources through bank agents, known as business correspondents (BCs). Almost all these transactions rely on a single technology, that is, fingerprint-based authentication. 

On 25th March, 2020, the Government of India (GoI) announced an unprecedented nationwide lockdown to curtail the spread of COVID-19. To mitigate the lockdown’s social and economic impact, the GoI rolled out several measures related to welfare and relief. The Pradhan Mantri Garib Kalyan Yojana (PMGKY) was the first such measure and included free food grains and cash aid for the poor and vulnerable segments.

During the lockdown period, and even now, fingerprint-based technology was the primary mode for beneficiaries to authenticate themselves to access benefits under the PMGKY and other social benefit transfer programs. The high-contact nature of fingerprint technology created apprehension among service delivery agents and beneficiaries due to the risk of COVID-19 transmission. In the absence of any reliable alternate technology, they had no other option but to use their fingerprint. 

Alternative modes of authentication have been required for a long time, primarily to reduce failure and manage exceptions. For example, studies show that out of the ~7 million Aadhaar-enabled payment system (AePS) transactions between December 2014-2018 facilitated by Business Correspondents (BCs), 34% failed –  of which 17% were due to biometric mismatch. During April, 2020, while  the lockdown was in effect and vulnerable populations tried to access their cash benefits, cash withdrawal transactions through the Aadhaar-enabled payment system (AePS) were as high as 403 million, which was almost double the transactions in the previous months. 

In line with this increase, the rate at which transactions failed in AePS was 39%. The main reason for such failures was a mismatch in biometric data. With limited to no exception handling procedures in place, this high rate of failure translated to millions of distressed and disadvantaged citizens who failed to withdraw cash. Instances of fingerprint authentication failure in the PDS, the most extensive government program to use Aadhaar, have also been reported for a long time. 

In this context, this blog examines the constraints that arise from the deployment of just one contact-based biometric authentication technology to avail government benefits. It also identifies contactless technologies to mitigate some of the challenges associated with fingerprint authentication.

The adoption of contactless biometric technology

Iris and facial recognition are two viable alternatives to fingerprint authentication that offer the highest level of security, that is, validation of who you are, which characterizes India’s biometric authentication process. The table below benchmarks, these authentication technologies across various observable parameters:

Fingerprint matching technology is accurate and has proven to be highly scalable. However, it struggles to read damaged prints and requires users to physically place their fingers on a surface, a risky proposition during a global pandemic.

Iris recognition has the advantage of high-speed authentication, is highly accurate and mature, and relies on scanning the iris, which is less prone to degradation over time than one’s fingerprints, as with the case of the elderly or those engaged in heavy manual labor. However, successful usage depends on user training as the devices require specific positioning of the iris. Success also depends on robust internet connectivity, as the data packet transmitted to the Aadhaar central repository for authentication is much larger than that of the fingerprint-based system. 

Another feasible contactless technology is facial recognition technology (FRT), which relies on consistent facial features despite aging or surgery or both. This biometric technology is affordable and widely available as part of multifunctional devices and across form factors, making it cost-effective and potentially scalable. Globally, law enforcement agencies dominate the use-cases for FRT. Yet more recently, India has utilized FRT for digital ID authentication. 

In the past, the country was conservative in its adoption of FRT for ID authentication owing to concerns around privacy and existing investments in fingerprint and iris scanners. However, the tide seems to be turning, in part due to studies that have shown the effectiveness of facial identification. In August 2018, the Unique Identification Authority of India (UIDAI) formally included FRT as an option for Aadhaar authentication. Sector experts have been deliberating about the potential to identify and track COVID-19-positive Indian citizens using Aadhaar-integrated cameras equipped with thermal scanners. UIDAI currently holds images and contact details for approximately 1.23 billion people which can be leveraged after assessing the quality of images captured. 

FRT case study: Bangladesh

In October 2019, Bangladesh conducted its first Electronic Know Your Customer (eKYC) pilot. Rather than relying solely on the current practice of four-finger biometric authentication, the government opted to try its home-grown FRT created by Giga Tech Ltd. Of the total 19 banks participating in the pilot, approximately half were assigned fingerprint authentication technology, while the remainder received FRT. Bank employees and agents confirmed the relative ease of using camera phones or tablets to capture beneficiaries’ photos and complete the e-KYC process. Although fingerprint authentication was more readily adopted due to familiarity with the technology, FRT was found to be an efficient contactless technology on par with fingerprint technology. Despite the pilot’s short-term nature, MSC’s analysis suggests that standardizing the biometric devices in terms of hardware and software specifications, issuing detailed FRT instructions, and delivering training sessions would make FRT a leading contender in e-KYC systems. 

Let us consider equipping the PDS with alternate technologies—iris or FRT—in addition to the existing fingerprint-based ePoS. Equipping all the fair price shops (FPS) in India with an iris scanner that can be integrated with the existing ePoS will cost USD 60-163 million. For FRT, this cost will be around USD 54 million if a phone or device is also provided to all FPSs. However, the cost would be negligible if the dealers already possess a smartphone and only an agnostic software application needs to be developed. 

Adopting other exception management protocols 

Besides adopting a nascent technology such as FRT, it is also possible to work within the confines of existing authentication infrastructure to ensure the safety of India’s citizens while limiting exclusions. Such approaches entail the active use of exception management protocols, such as one-time passwords (OTP). This is already part of the protocol for PDS. During the lockdown, PDS dealers in Rajasthan and Karnataka conducted exception handling through OTPs. 

As per the Indian Telecom Services Performance Indicator Report as of June 2020, India’s average teledensity was 85.85%, with urban and rural teledensity at 137.35% and 58.96%, respectively. Such widespread mobile penetration makes OTP-based ID authentication feasible, safe, and cost-effective. Moreover, citizens with an Aadhaar card are encouraged to register their mobile numbers to avail different services. Therefore, mobile numbers are already linked to Aadhaar cards, and no additional effort or data collection is required to use this exception management mechanism. 

Requesting and using an OTP ensures a satisfactory level of contactless identity authentication and reduces exclusions due to worn fingerprints or interrupted service, resulting in a smooth flow of benefits. However, the challenge in this method is that the most vulnerable populations still might not have access to a phone or may change their numbers frequently. 

Conclusion

The COVID-19 pandemic has seen the beneficiaries of the government’s welfare programs either being increasingly excluded or inconvenienced due to the reliance on a single mode of authentication. Biometric-based ID solutions were rolled out, in part, to address such exclusions. However, the contact-based nature of fingerprint technology potentially creates additional health risks for millions of vulnerable people. 

The solution may not lie in phasing out or eliminating fingerprint authentication but in providing      safer, contactless, and alternative verification options using different technologies. This would ultimately avoid exclusions and ideally eliminate them. Currently, exception handling technologies are sparse, and their usage sporadic. For example, in PDS delivery, only eight states have reported Aadhaar authentication using iris scanners. In the case of banking services, alternate technologies are limited to small-scale pilots. 

The newer technologies we covered in this blog have the potential to coexist as robust alternative methods of identity verification to not only assure beneficiary safety but ensure the delivery of benefits. Deploying alternative technologies should be done after considering factors like areas with higher rates of failure, network and server issues, and last-mile service providers’ ability to afford and operate the devices. The government can adopt a phased approach to test the technology after running pilots to ensure that the transition is smooth and sustainable. It has become critical to strike a balance between identifying the recipient accurately, preventing pilferage and delivering government benefits without interruptions. Innovation in the area of authentication technology will be a meaningful step toward achieving this symbiosis.