Thread by @gautambhatia88

Aadhaar bench reassembles. Day 4, Session 2.

Shyam Divan to continue the case for the petitioners.

Shyam Divan says that he will explain how the architecture of the Aadhaar Act enables surveillance.

SD: Tue CIDR retains the records. The State is empowered to collect records over the course of an individual's lifetime.

SD: On the basis of aggregation, over time, the State acquires a profile of an individual, a community, a segment of society.

SD: The Constitution does not permit a surveillance State.

SD: Every electronic device linked to the internet has a unique number. In addition when the device is linked to CIDR, the devices exchange information.

SD: The device is assigned a number qua Aadhaar. A specific ID at the first interaction. Thereafter, the transmission will be recognised as emanating from that device.

SD: A unique electronic path attaches to each transmission. This identifies the links through which the transmission is done. Each link is identifiable.

SD: It is technically possible to track every transaction. It is possible to track the location of every device in real time.

SD: As well as the broad nature of the transaction.

SD: The extent and scope of the surveillance over time will deepen, and this is enabled by Section 57.

SD: Affidavits and reports of technical personnel demonstrate this.

SD: There are two affidavits by security personnel. Mr Samir Keleker and Mr J D'Souza. They have so offers to come to Court and answer any questions that the Court may have.

SD reads out the first affidavit. "The project facilitates real time and non real time tracking of UID holders."

"It is quite easy to know the place and type of transaction every time authentication takes place. This would allow the UIDAI or any other party to track behaviour."

"UIDAI recommends that each Point of Service Device register itself with UIDAI and get a unique ID. This method of uniquely identifying every device further makes the task of tracking location easier."

"There are other ways as well. No security is perfect. But biometrics are a problem because you can't change them if lost or stolen or hacked."

"If army personnel are using Aadhaar to take salary, and the system is hacked, there could be national security issues."

SD now reads out D'Souza's affidavit. "I have conducted demonstrations to show the unreliability of biometrics. One demonstration was before UIDAI officials themselves. They were shown the ease with which fingerprints can be replicated."

"There may or may not be a GPS on the fingerprint device. GPS can be used to track location."

PS: disclaimer. I am transcribing as SD speaks. There may be some errors, given how technical this is. Please excuse.

"I have examined multiple fingerprint machines. They can be tampered with to capture biometric data before the point of encryption. This called a "skimmer."

"These machines that are not manufactured indigenously. The machine code and source code is not known to UIDAI. There may be backdoor or Trojan Horse feature that can be used for data mining without UIDAI knowing. There are serious national security implications."

"Data collected over an individual's lifetime can become a tool of political blackmail. This can compromise even constitutional functionaries."

"Jan Chrysler recent cracked the IPhone biometric systems and also iris recognition."

Chandrachud J asks to what extent the Court can go into questions of technical evidence. He says that there is also a distinction between the existence of a mechanism and its abuse. He also asks if the distinction between fingerprints on your iPhone and Aadhaar is only if degree

Chandrachud J says, should the Court second-guess the decision of the executive government, especially when no system in the world is secure.

SD: These affidavits confirm that there is a complete mapping of the electronic path, which happens in real time, and that you can track the location.

Chandrachud J says, aren't we
accepting Google Maps tracking us, and other private corporations?

SD says that when you are tracked by the State in real time, it is tantamount to a police State. The Constitution does not allow this. Google is not the Indian State, and the issue is one of consent.

SD: Google, powerful though it is, is not as powerful qua me as the State.

SD takes the example of Stasi.

Chandrachud J says that I should have no objections to the State knowing whether I'm paying my taxes. So there should be a distinction between collecting data and using it.

Chandrachud J says once more that if the use of data is limited to its purpose, then what is the problem with collection.

Chandrachud J says that we live in times of terrorism and money laundering and welfare expenditure, and this has to be balanced.
He says that surveillance is about how data is used, not collected.

Kapil Sibal stands up and says that the problem is of giving the State that kind of information.
He says: "Big brother will have the information. He may use it and you won't know it. By the time you do, he will become a bigger brother."

SD agrees. He says that the point of this whole case is to prevent that situation where Big Brother is watching.

Shyam Divan reads out Justice Subba Rao's dissenting opinion in Kharak Singh, which was endorsed in the privacy judgment as correct.

This was the first articulation of privacy in Indian constitutional history. Read it here: indiankanoon.org/doc/619152/

SD reads the part of Kharak Singh that talks about how surveillance constricts life and liberty.

SD reads out the part of Kharak Singh that says that the "shadow of surveillance" engenders inhibitions upon people.

SD reads out District Collector vs Canara Bank (2005). Read it here: indiankanoon.org/doc/1068532/

This case involved bank raids and inspection of bank documents.

He points to the part of the judgment that said "we are not living in a police raj." He says, this is exactly the point in this case.

SD comes to the US Supreme Court judgment in US v Jones, wish involved a GPS and a warrant. Read it here: law.cornell.edu/supremecourt/t…

This case involved putting a GPS device on a jeep.

SD reads out reads out Justice Sotomayor's opinion that observed that you no longer need physical violations to infringe privacy.

SD reads out the part of the opinion that talks about how GPS data can reveal an entire profile of a person simply by knowing the places she visits. This can be mined years in the future. Because this is surreptitious, it evades scrutiny.

"The very awareness that the government is watching can chill speech and associational freedoms."

"Merely because you voluntarily disclose some information to some people for some time doesn't mean you lose your privacy right over it."

SD comes to the judgment of the ECHR in Sakharov v Russia. Read it here: hudoc.echr.coe.int/eng?i=001-1593…
Wiki summary: en.m.wikipedia.org/wiki/Zakharov_…

This case involved interception of communications.

Bench rises.

To continue next Tuesday.

Cheers.