Thread by @prasanna_s

#Aadhaar hearing resumes. CEO of UIDAI continues his ppt.

He starts by giving a break up of enrolment operators having been blacklisted..classified by reason. Will shortly give a link to that document.

DYC J asks if there has any operator been blacklisted for data breach....such as sharing of data etc.

CEO says only possible when the operator is so qualified to tamper the enrolment client software to capture or share biometric data.

Even if someone does it, it is punishable.

CEO says now they are phasing out private enrollment agencies and are going to be housed only inside banks and post offices.

CEO says they have "directed" the banks. (Me thinks: RBI, UIDAI, Potayto Potahto)...

Continues explaining now Slide 13 on Aadhaar Authentication Services.
Explains how CIDR is fully secure and not even connected to internet.

He wants to demo E-KYC. Demo being set up.

Ashok Bhushan J asks about UIDAI having to satisfy that no aggregation is possible. CEO cites 32 (3) that we are prohibited from knowing the purpose anyway.

DYC J asks about whether AUAs can be pvt sector. Asks whether AUAs can record auth data and share or monetise.

CEO says such sharing is prohibited under the Act. DYC J correctly says but they don't have control.

DYC J says there is difficulty and cites the TOI Op-ed today. Probably @ambaonadventure piece.

A pizza chain sharing that information with an health insurance provider for instance is a problem! Lifestyle is an important info for the latter.

Khanwilkar J is slightly livid. Asks CEO to not bother them with operational aspects but satisfy them that breaches etc not possible.

CEO says all breaches are other databases not UIDAI's...refers to Tribune, the latest Indane breach etc.

DYC J says there is no enforceable...

....protection against others even if CIDR is fully secure.

The live demo of biometrically withdrawing 100 rupees from an IDBI bank account works. (Against all odds).

Slide on auth security. He says we continue to make it more and more secure..Details etc.

Now wants to explain all fields captured during authentication.

Says Geo Code and IP address of Authentication txns are not received by UIDAI.

Say UIDAI used to track locations such as GPS coordinates and PIN code earlier...but as per latest api released a few months back, it is no longer captured.

Aadhaar is privacy by design, says CEO and does more marketing of how core biometric is not shared except for national security. And that no request under that for the last 1.5 year from Govt.

Refers to their started strudded Technology and Architecture review and security review committee and refers to Godel Prize winner Prof. Maninder Aggarwal being in SRC.

Now the 4-minute video on the design of the CIDR data centre shown.

Narration by a false baritone male voice.

Twitter trouble.

Bench rises for lunch. He is on VID. To continue post lunch.

Held up elsewhere briefly. Will try and be back by 3 PM or so. Please follow @SFLCin in the meanwhile.