Indian agency denies security lapse in ID project as ZDNet defends report

NEW DELHI — Tech news site ZDNet said on Sunday it stood by its report that identified a security vulnerability in data-linked to Aadhaar — India’s national identity card project, after a semi-government agency that manages the database sought to discredit the report.

ZDNet reported that a data leak on a system run by a state-owned utility company could allow access to private information of holders of the biometric “Aadhaar” ID cards, exposing their names, their 12-digit identity numbers and their bank details.

The Unique Identification Authority of India (UIDAI), which manages the Aadhaar program, said “there is no truth in this story” in a statement on Saturday.

ZDNet’s global editor-in-chief Larry Dignan said in an e-mail on Sunday that the publication stood by its report. Mr. Dignan said they spent weeks compiling evidence and verifying facts.

“We spent weeks reaching out to the Indian authorities, specifically UIDAI, to responsibly disclose the security issue, and we heard nothing back and no action was taken until after we published our story,” said Mr. Dignan.

UIDAI sought to downplay the report stating that even if the claims in the story were true, it would raise security concerns with the database of the utility company and not with the security of UIDAI’s Aadhaar database.

UIDAI said it is “contemplating legal action against ZDNet.”

Many researchers and journalists, who have identified loopholes in India’s national identity card project, say they have been harassed by some government agencies and slapped with criminal cases because of their work.

Aadhaar is a biometric identification card that is integral to the digitization of India’s economy. With over 1.1 billion users it is the world’s largest such database.

Indians have been asked to furnish their Aadhaar numbers for transactions including accessing bank accounts, paying taxes, receiving subsidies, acquiring a mobile number, settling a property deal and registering a marriage.

The government’s demands for Aadhaar linkage for multiple services is being challenged in India’s Supreme Court.

Researchers and journalists have highlighted vulnerabilities and data leaks tied to the program. UIDAI last week said the biometric data were safe from hacking as the storage facility was not connected to the Internet. — Reuters