UIDAI UID Authority of India U nique Identification Authority of India Planning Commission, Govt. of India (GoI), 3rd Floor, Tower II, Jeevan Bharati Building, Connaught Circus, New Delhi 110001 Role of Biometric Technology in Aadhaar Enrollment Role of Biometric Technology in Aadhaar Enrollment Page 1 of 23 UID Authority of India Executive Summary This report focuses on the biometric technology of the UID project for the purposes of UID enrollment. It goes into the proof of concept studies conducted in India, analysis of the study results, design decisions on biometric modes necessary in the Indian context, implementation of client and server side systems for enrollment and finally concludes with the accuracy and performance achieved by the UID biometric system using 8.4crore real enrolments. Goal: The goal of the UID project is to assign a unique Identification number to each resident of India. The uniqueness constraint implies that during enrolment stage (creation of Aadhaar) each person will get one and only one Aadhaar number. To ensure that each person gets one and only one Aadhaar number it is necessary that the resident’s identity information is captured and matched against every other resident (1:N check) who have previously enrolled - This process is called de-duplication. Uniqueness & Biometrics: It is not possible to de-duplicate 1.2 billion residents by using demographic fields only (like name, address, age, gender etc) and moreover identity documents that rely only on demographic fields and personal reference checks are surrogates of identity and are vulnerable to forgery, falsification, theft, loss and other corruptions. In Indian context, biometrics were determined to be the most suitable factors for carrying out de-duplication. Hence it is necessary to enrol all residents along with their biometrics and build a clean database for the purposes of a National Identity system. Biometric Standards Committee: The UIDAI’s Biometric Standards Committee headed by Director General NIC (National Informatics Centre), published a report in December 2009 and advised that a biometric system based only on fingerprint might present challenges in India due to a large number of people engaged in manual labour and urged the UIDAI to consider the use of Iris in addition to fingerprints in order to improve inclusiveness and accuracy of the system. Proof-of-Concept Study (PoC): The UIDAI conducted a Proof-of-Concept study during Mar-June 2010 in predominantly rural areas of Andhra Pradesh, Karnataka and Bihar published a report in December 2010 whose key findings included: • Iris enrollment took less than a minute to capture and could be captured effectively from people, even from those who were blind. • Children between 4-15 years could be biometrically enrolled correctly, and could be de-duplicated as accurately as adults. • The accuracy levels achieved with a combination of fingerprint and iris were more than an order of magnitude (10x) better than using one or the other. The PoC report concluded that “The biometric matching analysis of 40,000 people showed that the accuracy levels achieved using both iris and ten fingerprints were more than an order of magnitude better compared to using either of the two individually. The Role of Biometric Technology in Aadhaar Enrollment Page 2 of 23 UID Authority of India multi-modal enrolment was adequate to carry out de-duplication on a much larger scale, with reasonable expectations of extending it to all residents of India”1. System Design: Based on the biometrics standards committee report, the PoC report, global learning’s and expert opinions the UIDAI made the following design choices: • Selected three biometric modalities of –10 fingerprints, 2 irises and face. • Created standard client enrollment software - with quality checks for biometric and demographic data, consistency of capture process and encryption of enrolment data for security/data-protection. • Built an enrollment server to perform demographic de-duplication, biometric de- duplication and manual adjudication of matches found by the system. • Used commodity hardware, devices standards, open source software wherever possible, and defined standards and APIs (application programming interface) for interoperability and to avoid vendor-lock-in. The Enrollment status of the UIDAI project as of Dec 31st 2011 • 36,000 Active enrolment stations • 59 Registrars, 83 Enrolment agencies in 32 states and union territories • 87,000 Certified enrolment operators • 11 - Models of certified biometric devices that are deployed in the field • 15 crore – Number of residents enrolled in the field • 10.25 crore – Number of Aadhaars generated by UIDAI • 10 lakhs/day – Peak enrolment processing rate • 100 trillion - Biometric person matches conducted every day to issue 10 lakh Aadhaars Biometric Accuracy and Effectiveness: In the last few months there have been media reports with misconceptions about the accuracy and efficacy of the UIDAI’s biometric system. The Parliamentary Standing Committee on Finance (2011-12) that reviewed the National Identification Authority of India bill has referred to an “expert” who has stated “it has been proven again and again that in the Indian environment, the failure to enrol with fingerprints is as high as 15% due to the prevalence of a huge population dependent on manual labour”. These misconceptions have been addressed in the box below: 1 http://uidai.gov.in/images/FrontPageUpdates/uid_enrolment_poc_report.pdf Role of Biometric Technology in Aadhaar Enrollment Page 3 of 23 UID Authority of India Biometric Accuracy As of December 31st 2011, the UIDAI has true and tested statistics computed from real operational large-scale UIDAI system with the resident enrollment database size of 8.4 crore (84 million). It is unnecessary and inaccurate to attempt to infer UIDAI system performance from other systems which are ten to thousand times smaller. Specifically, • Failure to Enroll(FTE) Rate: Zero. As a policy, every unique resident, regardless of their biometrics can be enrolled and issued Aadhaar number. • Biometric Failure to Enrol Rate: 0.14%. This implies that 99.86% of the population can be uniquely identified by the biometric system. The exceptions (0.14%) however are de- duplicated using demographic data and checked manually for fraud. The legitimate cases among these are issued Aadhaar number. • False Positive Identification Rate (FPIR): 0.057%. In practical terms, it means that at a run rate of 10 lakh enrolments a day, only about 570 cases need to be manually reviewed daily to ensure that no resident is erroneously denied an Aadhaar number. The UIDAI currently has a manual adjudication team that reviews and resolves these cases. After manual adjudication, there is a negligible number of legitimate residents who are wrongly denied an Aadhaar number • False Negative Identification Rate (FNIR): 0.035%. This implies that 99.965% of all duplicates submitted to the biometric de-duplication system are correctly caught by the system as duplicates. Given that currently approximately 0.5% of enrolments are duplicate submissions, only a few thousand duplicate Aadhaars would possibly be issued when the entire country of 120 crores is enrolled. The analysis resulting from such a large data set (8.4 crore records) is empirically repeatable and statistically accurate. There is no longer a need to rely on small sample size tests or hearsay from other projects. The UIDAI is now capable of measuring the accuracy, performance and scalability of the actual production system, which is already among the largest in the world. The results lay to rest unfounded claims that the underlying technology is untested, unreliable and based on unproven assumptions. Based on the analysis, it can be stated with confidence that UIDAI enrollment system has proven to be reliable, accurate and scalable to meet the nation’s need of providing unique Aadhaar numbers to the entire population. It is now safe to conclude that the system will be able to scale to handle the entire population. Role of Biometric Technology in Aadhaar Enrollment Page 4 of 23 UID Authority of India Abbreviations ABIS Automatic Biometric Identification System API Application Programming Interface CIDR Central Information Data Repository FPIR False Positive Identification Rate FNIR False Negative Identification Rate FTE Failure to Enroll NFIQ NIST Fingerprint Image Quality POC Proof of Concept SDK Software Development Kit STQC Standardisation Testing and Quality Certification Directorate UIDAI Unique Identification Authority of India Role of Biometric Technology in Aadhaar Enrollment Page 5 of 23 UID Authority of India Contents Abbreviations ......................................................................................................................................... 5 1 Introduction ...................................................................................................................................... 7 2 Biometric Design Methodology ...................................................................................................... 8 3 Biometric System Design .............................................................................................................. 11 3.1 Enrollment software: Client side ........................................................................................... 12 3.2 Enrollment software: Server side .......................................................................................... 14 4 Project Status & System Performance ......................................................................................... 17 4.1 Measured System Performance ............................................................................................ 18 4.2 Scaling to 120 Crore ................................................................................................................ 19 5 Analysis ........................................................................................................................................... 20 5.1 Duplicates found correctly ..................................................................................................... 20 5.2 Impact of biometric sample quality ....................................................................................... 20 6 Conclusion ...................................................................................................................................... 22 Role of Biometric Technology in Aadhaar Enrollment Page 6 of 23 UID Authority of India 1 Introduction UIDAI has adopted use of biometrics technology as part of its core strategy2 in meeting its goal of preventing issuance of duplicate identity number to a resident. There is no method or technology, other than biometrics, that can catch a person who is disclaiming his real identity. Biometrics consists of methods for uniquely recognizing human beings based on one or more of their intrinsic physical or behavioural traits. By matching a person’s biometric characteristics with everyone else’s (known as de-duplication), the technology helps prevent issuance of duplicate identity (Aadhaar number) to a single person. Identity documents that rely only on demographic fields and personal reference checks are surrogates of identity and are vulnerable to forgery, falsification, theft, loss, and other corruptions. In western countries such as the United States and the United Kingdom, documents such as driver’s license, and passports are used as identity proofs but only because of the reliability of the birth certificates. A birth certificate acts as a breeder document (in conjunction with identity documents of the child’s parents) in obtaining identity document for the child. Even in countries with reliable birth certificates, the issuance of identity documents in a way that assures a ‘one person/one identity’ policy has been problematic. This model does not work in India, so UIDAI’s strategy has been to minimize dependence on unreliable breeder and identity documentation and to not depend upon the trustworthiness of the operator, but rather to leverage automation and technology in a way that reduces the total dependence on error-prone documents and people based processes. 2 http://uidai.gov.in/UID_PDF/Front_Page_Articles/Documents/Strategy_Overveiw-001.pdf Role of Biometric Technology in Aadhaar Enrollment Page 7 of 23 UID Authority of India 2 Biometric Design Methodology The UIDAI biometric system design has followed global best practices. In designing UIDAI’s biometric system, UIDAI reviewed existing state-of-the-art biometric systems, consulted with the world’s top biometric experts, conducted a proof of concept study and built a biometric system that is currently considered to be world’s best and widely acknowledged to be so in numerous international biometric forums and conferences. UIDAI technical experts visited two of the world’s largest biometric implementations: US- VISIT program and US Visa/Consular system. They had meetings with a large number of experts from several countries including Mexico, Bangladesh, UK, the US, Singapore and Australia. Two of the world’s most renowned biometrics experts – Prof. Anil Jain3 and Prof. James Wayman worked with the UIDAI team and helped with the design. Prof. Anil Jain is pre-eminent biometric expert and advisor to many national and international governments. Prof. Wayman has served as an expert to numerous national ID system programs including UK, Philippines and the US. Several other biometric experts including Prof. Arun Ross4, Prof. John Daugman5 and Prof. Venu Govindaraju6 also contributed to UIDAI’s design. UIDAI technical staff visited, reviewed and analyzed existing biometric programs in India including E-shakti NREGA scheme in Bihar, Coastal ID card of RGI, Orissa’s UNWFR program, AP’s Iris based ration card enrollment, Employees State Insurance Scheme of India (ESIC) and RSBY. These learnings were incorporated into a report published in December of 2009 by the UIDAI’s Biometrics Standards Committee7. Analysis of some of the programs is referenced in the committee’s report. Based on other programs’ results, the report acknowledged that fingerprint-only system might present challenge in India due to majority of population being engaged in manual labour and advised that UIDAI to consider using iris to complement fingerprints in order to improve inclusiveness and accuracy of the system. In December of 2010, The UIDAI published a Proof-of-Concept (PoC) study8 of biometric enrolments that were conducted between March 2010 and June 2010 in the predominantly rural areas of Andhra Pradesh, Karnataka, and Bihar. The UIDAI also carried out biometric enrolment of school children in the vicinity of Bangalore. About seventy five thousand people in all were enrolled during the first phase of the PoC study 3 http://www.cse.msu.edu/~jain/ 4 http://www.csee.wvu.edu/~ross/ 5 http://www.cl.cam.ac.uk/~jgd1000/ 6 http://www.cubs.buffalo.edu/govind/ 7 http://uidai.gov.in/UID_PDF/Committees/Biometrics_Standards_Committee_report.pdf 8 http://uidai.gov.in/images/FrontPageUpdates/uid_enrolment_poc_report.pdf Role of Biometric Technology in Aadhaar Enrollment Page 8 of 23 UID Authority of India including people over 90 years of age,, and sixty thousand of the same people were re- enrolled during the second phase after a gap of three weeks, in order to test the biometric matching efficiency using known duplicates. While the biometrics committee report based its recommendations upon learnings from other programs and experts, the proof-of-concept study aided the UIDAI team in getting first hand field experience and in measuring the various process and accuracy parameters. It also confirmed empirically, the earlier recommendation of the ‘Biometrics Standards Committee’ that using iris in conjunction with fingerprints was a prudent decision. The PoC was conducted to evaluate technical, operational, and behavioral hypotheses related to both the use of biometric devices and the overall enrolment process itself. It was also conducted to establish a baseline for the quality of biometric data that could be collected in rural India. Figure: Fingerprint and Iris biometric The key findings of the POC report, which have been presented internationally at scientific conferences and received extensive peer review, are listed here: 1. The PoC was successfully conducted over 1,35,000 biometric enrolments9. The relative ease of conducting the operation confirmed that biometric enrolment conforming to UID standards of quality and process was indeed possible on a large scale in rural India. The total biometric enrolment time for each individual, on average, was a little over three minutes. Of this, iris enrolment took a little under a minute, and was not perceived to be excessively difficult either by the resident or the enrolling operator. Specifically, many blind people also had their iris images captured successfully. 2. Multiple fingerprint scanners as well as iris capture devices were used in the PoC, and they performed according to expectations. The PoC was dispersed geographically and included many rural, often remote locations across three states. The enrolment was typically conducted with minimal infrastructure and sometimes in extreme 9 Sample size of the PoC is considered large and statistically adequate for biometric technology assessment. Role of Biometric Technology in Aadhaar Enrollment Page 9 of 23 UID Authority of India weather conditions. Residents varied in age all the way from four years to about ninety years. 3. In general older people took longer to enroll than younger people, and residents whose employment involved manual work took longer to enroll than the rest of the PoC population. Older people needed more assistance from operators to capture their biometrics. However, the range of enrolment times observed was well within expectations implying that the enrolment exercise for the population was indeed practical. 4. The enrolment variations tested in the process led to the conclusion that the best process was one where the resident remained stationary during enrolment and the operator did the positioning of the devices. 5. The enrolment of children at the school showed that children in the age range of four to fifteen could be biometrically enrolled using the same process as that used for adults and with no additional difficulty. The match analysis also showed that their iris images and fingerprints could be de-duplicated as accurately as those of adults. 6. The quality of the biometric capture was sensitive to the setup of the enrolment station and the process itself. Most importantly, the enrolment operator’s instructions made a significant difference in the efficiency of the biometric capture. 7. The quality check process built into the enrolment software was very important and provided helpful feedback to the operator in capturing high quality images. The biometric matching analysis of 40,000 people showed that the accuracy levels achieved using both iris and ten fingerprints were more than an order of magnitude better compared to using either of the two individually. The multi-modal enrolment was adequate to carry out de-duplication on a much larger scale, with reasonable expectations of extending it to all residents of India. The complete report is available on UIDAI’s website. The final UIDAI design incorporated learnings from this PoC. As of December of 2011, UIDAI has documented measurements taken from the real large- scale operational UIDAI system that has already issued over 10.25 crore (102.5 million) Aadhaar numbers. These measurements will be discussed later in this report under the heading of project status and system performance after we review the high level design of the UIDAI biometric system. Role of Biometric Technology in Aadhaar Enrollment Page 10 of 23