The government again denied that a breach of the Aadhaar database had taken place in response to starred question no 421 by Ravi Prakash Verma in the Rajya Sabha on April 6, 2018.

Verma had asked:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to refer to answers to Starred Question 5, Starred Question 155 and Unstarred Question 1690 given in the Rajya Sabha on 2 February, 2018, 9 March, 2018 and 9 March, 2018 respectively and state:

  1. the basis on which Government is claiming that reports regarding leakage of Aadhaar details of millions of people on WhatsApp for Rs. 500/- only is completely false, without any investigation so far;
  2. whether Government is aware that there is foolproof evidence of such Aadhaar details leak and it has not been investigated till date;
  3. if so, whether Government would withdraw the FIR against journalists and newspapers in view of freedom of press and claim by Government without any proof;
  4. if so, the details thereof; and
  5. if not, the reasons therefor?

To questions a and b, the reply was “There has been no leakage of Aadhaar data from UIDAI database.” and to the remaining the reply was “Do not arise”

MediaNama’s take

There are no surprises here. At this point, it is clear that the government is narrowly defining Aadhaar data as the data contained within the Aadhaar database and consider a breach as strictly the data being accessed on the CIDR. Therefore any breaches involving passwords, or authorized access (even if the authorization was given illegally) are being denied as breaches. Any data that has exited the CIDR is fair game for exploitation by design and not seen as a crime. Given that these databases have no legal basis, there is no law governing them. Breaches of data provided by the UIDAI to various states is also not being considered to be Aadhaar data.

The safety of the CIDR database is the only security in question and the data of citizens being leaked from entities the government gave it to does not appear to be a concern for the government.

This raises an important question – why is the governmnent refusing to withdraw the FIR against the journalists and newspapers, given that there is no breach according to the government? Surely one does not file cases against people for crimes that did not happen? That such an action has been taken against a journalist and news publication as a consequence of reporting they have done definitely implies that the government would punish specific kinds of reporting.