Facial recognition-based authentication could soon be coming to Aadhaar. The Unique Identification Authority of India (UIDAI) is running a pilot project to test out its functionality for financial services, Vivek Raghavan, chief product manager and biometric architect at UIDAI, revealed details about the pilot, run with the National Payments Corporation of India (NPCI), during the Indian government’s RAISE 2020 Summit (Responsible AI for Social Empowerment, 2020).

“We don’t need to have this [face authentication] for every [Aadhaar] service, but it should be able to do it [sic] at any place and on any device,” Raghavan said. He said that the UIDAI has built “advanced liveness models” to further strengthen the facial recognition algorithm. Liveness detection allows a facial recognition system to ascertain that the face being shown to the camera is a real face and not another image on a separate screen.

NPCI was testing the feature with four banks, ICICI Bank, Yes Bank, RBL Bank, and Fino Payments Bank, the Economic Times had reported in August. The report said that the tests were done for non-financial transactions in the first phase, and a full-scale rollout will happen only if results from the pilot are “satisfactory”. The NPCI operates Aadhaar enabled payment system (AePS), which works using a Point of Sale (POS) machine, and instead of using a debit/credit card, uses a person’s Aadhaar number, which is linked to their banked account. This transaction is then authenticated using a person’s biometrics, and it is possible that the NPCI could use face authentication for these transactions.

What we don’t know: Raghavan didn’t comment on how UIDAI developed the training dataset to test its facial recognition algorithm, and if images from the Aadhaar database — often taken with low resolution webcams — were used to train the algorithm. It is also not clear whether the UIDAI has any plans to roll facial recognition based authentication for other Aadhaar related services after the completion of the pilot project with NPCI. MediaNama raised these queries in the question and answer window of the discussion, but they remained unanswered.

UIDAI has been keen on using face authentication for Aadhaar since 2018

To be sure, UIDAI has been wanting to include facial authentication into Aadhaar since January 2018. The organisation, on January 15, 2018, had issued a circular, noting that the photo of a person captured during the Aadhaar enrolment process can be used to verify their identity later on. The circular had stated that face authentication will provide an “additional choice” to create “inclusive authentication” for residents who face a problem in authenticating their identity using fingerprint or iris scan. The feature, per the circular, was supposed to be used only in fusion mode, that is, along with one more authentication factor, including either fingerprint/iris or OTP. Reasons why the UIDAI was considering face authentication:

  • There is no need to capture fresh pictures since such images are already available in the UIDAI database
  • Cameras are now available on laptops and mobiles which makes taking pictures easy for  AUAs (Authentication User Agency) without any additional hardware.
  • Face authentication along with liveness detection can add to security

The January 2018 circular also said:

“UIDAI will work with biometric device providers to integrate face modality into the certified registered devices and also may provide standalone Registered Device (RD) service as required by the ecosystem. UIDAI will provide Software Development Kits (SDKs) / Registered Device (RD) services in various operating systems which will have the ability to capture face image, check liveness, and create digitally signed and encrypted authentication input (PIO block) as required.”

However, on December 14, 2018, the then state IT Minister, S.S. Ahluwalia informed Parliament that the feature’s rollout was delayed as its “implementation depends on technical readiness of various stakeholders such as Requesting Entities, Device Providers etc.”

Facial recognition everywhere

The Indian government, several law enforcement agencies, and a number of state governments have deployed, or are planning to deploy facial recognition surveillance tools. The National Crime Records Bureau is currently working towards building a national level facial recognition system, and only very recently revealed that it wants to tests the system on mask-wearing faces, and for it to generate “comprehensive biometric reports”.

In Telangana, police have been known to demand people to undergo a facial recognition verification exercise, randomly, claiming that they do so to nab criminals. The state is also planning to introduce facial recognition for obtain ration, and is already using it for issuing renewed driving licenses and pensions. Telangana is also the first state in the country to pilot facial verification of voters during its civic polls earlier this year.

The Vadodara City Police, in Gujarat had earlier told MediaNama that it was planning to use Clearview AI’s controversial facial recognition software. The Indian Railways said that it was in the process of installing Video Surveillance Systems, equipped with a facial recognition system. A number of airports in the country have introduced facial recognition based boarding solutions.

It is worth noting that Indian agencies are installing facial recognition surveillance tools when India doesn’t have a data protection law. Moreover, the Personal Data Protection Bill, 2019, which is currently being deliberated upon by a Joint Parliamentary Committee, has carved out exemptions for government agencies to adhere to provisions of the Bill. This suggests that government institutions like the NCRB, or the Railways could potentially be able to collect, store and process biometric data of Indians without necessarily adhering to provisions of the Bill.

Also read: