een able to sell as a panacea so nobody understands what is happening in the communication problem but like he is talking no this is well acknowledged if you have an idea no I do not know it is a well acknowledged I will give you another case where judges are totally cruel as if you remember IPL2 was moved to South Africa and of course the DCCI and this is ridiculous right IPL it was big and I think one of the judges somebody said I wish you all the best I wish India wins the IPL that was actually said and nobody really challenged that that means you do not know what the IPL is in your past judgment so I think there is a communication gap where here that you need to it is not a problem of and sure all of you guys know your technical stuff but it is a problem of there is an organization in design problem on your side as well which you probably need to solve before you go after that yeah I do not think we are an organization necessarily we are kind of like a loose collection of loose collection of stupid forms loose collection work perfectly well look at the Lina Shriza groups they work perfectly well no but another challenge in this specifically is that the judiciary has been extremely difficult to get through too even the matters that are before them have been heard very very after long gaps that is okay that problem India will get resolved when the January 17 thing comes the question is what do you do for the final one see so here is the problem if you look at it most of the people the technology and it is always easy to defend the technology when the users have not been rolled out so that is the reason why it is a good thing it is rolled out and we know all the problems and we have now collected truckloads of documents so the only question that you have to again ask is are you going to go and explain all this to a lawyer what is simply for a lawyer versus you go and argue purely on the technology versus you go argue purely on the law and me I can certainly believe that this is going to be a lost if you are going to argue purely on the law and that I am very sure that I am 100% sure but here is the problem the catastrophic is going to come after the court is going to say yes there will be a lot of collateral damage we should talk more about single point of failure I guess see so here is the problem the catastrophic is going to happen there is no predicting it and the way in which I typically tell in terms of security to my team is look there is a 100 floor building and you guys have just jumped off from the 100 floor right even at the 99 floor these fellows are going to come and argue to me I am still alive what the fuck are you talking about okay this is what I call the immortality problem which is as long as you are alive you are going to argue you are immortal and I can't disprove you but after you are dead what is the point of arguing with you right so basically the main which I look at is the problem in software companies right it is easier because there is not a judiciary thing and there are people whose businesses are on the line and there is money in the world if you get it wrong incentives are aligned in terms of running a business here incentives are not aligned also people who have been specifically educated along those lines and here what you are basically saying is Sikri comes and says well it is encrypted and there has never been a rebuttal in the court asking what kind of encryption and the lawyer himself doesn't know okay exactly the point and there have been several such so forget about just the lawyer part I mean in terms of technology we will keep that aside but just look at the outrageous number lies the way since he told about 59,000 crore rupees saved saving numbers we have saved so many duplicates right but here is the point with that numbers right and lies are pretty easy and all you really read it was mathematics okay not the complicated mathematics but just plus and minus on 2015 you go and say that I found 0.4% duplicates in LPG on 2014 on the supreme court the government basically gave an effort about saying that they found 0.4% duplicates in the LPG scheme okay 2015 exactly 6 months later they went and told the government that we found 15% duplicates in the LPG database okay the net addition between the 2014 LPG database and 2015 LPG database is 1 lakh you understood the difference on 2014 the government went to the supreme court and made an effort of it which said we found 0.4% duplicates in the database of LPG guys okay 2015 to the same court 6 months later they went and told we found 3.34 crore duplicates in the LPG database the size addition between 2014 and 2015 is 1 lakh so for a net addition of 1 lakh in the LPG database how the fuck did you find 3.34 crore duplicates new of course right that seeded environment so it's not random people in the database so if you look at every single mathematical I mean then it gets even interesting in the media right financial express basically said Rajasthan found 2.33 crore duplicate entries in the ration database okay the net size of the Rajasthan PDS database is 96 lakhs but don't trust me because the net size the duplicate size is greater than the total number of duplicates before the duplicates all of it was 96 lakhs the total size of the database was 96 lakhs and the duplicates found in it were 2.33 crore okay no no here's one thing the communication between what is said and what is reported is very huge in my experience this one is based on financial express no no there is the same information in the court I mean you look at it it's a transparent lie and I can tell you the latest RTA that I got from meha so basically they said in LPG 2015 and 16 financial 2015 and 16 the total number of duplicates found was 3.36 crore okay which is anyway a lie but let's not get into that in a beneficiary size of 18 crores database size was 18 crores on 2015 and 16 they said 3.36 crores on 2016 and 17 they said we found another additional 3.31 crore duplicates when the total number of beneficiary size added was 1 crore okay so any which way you look at it I call this ffx is equal to random of x okay you're basically just pure numbers from 1 crore as and hope the other guy doesn't notice it but where is the engagement on that I mean none nobody is questioning them about these numbers right the only guys who are questioning them is me on twitter and a bunch of other guys in rithika and so on but where in the court did you yeah I think it is on the kalyani men on funnish on funnish in us who wrote that on funnish in us where was that question right and again first time it's question and they chose not to defend it and it gets even better the world bank lie where they basically said that we world bank so basically when we put the counter for shanty sanha and they chose not to defend it they found the counter affidavit which is very very rare and they said well world bank essentially said I work and save 10 billion dollars are you saying that world bank is also a compromised organization or something that they put on the court affidavit I mean I have it all right and then I went and looked at the world bank world bank report it said the total number of the value of subsidy subsidy transfers every year in India is 10 billion dollars remember the wording the value of subsidy transfers every year in India is equal to 10 billion dollars these bloody buggers essentially went and changed that into 10 billion dollars of savings okay for other okay and it was yeah yeah it gets even more interesting because I did it like a proper journalist I basically sent the questioner to world bank itself saying what the fuck are you talking about your bumps alright and they replied back by saying that oh these are the two studies and the extrapolated interpolated and we came up with this number I said show me the excel sheet we have shared everything what we could share last one security right right right I was like done and dusted done and dusted right and then even after exactly two weeks later right it was a big article on wire initially it was with old news no it came on wire yeah it came on wire September 15th it came right it had 35,000 views and everyone read it even Observer Research Foundation there was even prior to that called with world bank there was a call with world bank it was documented and the entire transcript was published in the article every single media organization read it knew it exactly three weeks later Nandan attends a conference on IGF two weeks after that there was a conference he went and attended about digital IGM product and then he said others saved 9 billion dollars and they are looking at it saying hang on does this have any correlation I mean 9 billion 10 billion 200 billion 2 billion 3 billion so I call it as the billionaire problem in the sense that because Nandan is a billionaire and he says everything it has to be billion and because people believe that Nandan is a billionaire and everything he says has to have a billion number show me one statistic that the other guys put which doesn't have a billion in it open challenge and by the way it was the fastest fastest 1 billion the fastest product or user fair enough that's how the typical stuff works this government has been applying with numbers consistently you file any idea about demonetization asking about different periods they will lie on record you ask them about the number of enrolments you ask them about savings this is all covered in the article this is all related to other they will lie on record but demonetization there was news statements the actual spending of incrementing demonetization it is no different here so here is the other thing that we are doing we are basically trying to come up with some kind of a cost benefit analysis and I can tell you off front on my head we have several billion dollars negative they have already accepted it not this this other this several billion dollars negative it has to be minus the savings from all that it is several billion dollars negative it has to be that doesn't account for the cost of privacy lost and things like that no there is one of the most costliest cities okay by a poor country which could have used the money to do 100 other things even with corruption I guess the runway would have been better so here is the point so far in my thing they have probably saved 6000 find up crores was the set up cost for LPG okay and set up cost and then other environment is anyway 20,000 crores so let's not bring that up let's think about LPG itself the average money they are saving because of all this is about 100 crores every year they are saving close to about 1000 crores okay so on a run rate basis they are already negative okay so in order to recoup the 6000 finding crores they are never going to set up it's a non converging function plus they are burning every year plus they are burning every year so the way in which I look at other is fundamentally a start up which is funded by government which is always making losing a lot of money that's what I said this year when you can stop funding your gamble this is a government funded gambling addiction and if you have to be just look at this year alone this year start they had 50,000 plus other enrollment centers then they blacklisted 49,000 then they had 35,000 enrollers remaining then the registered device strategy came then they closed down they moved all their enrollment centers into government premises then the device changed for registered device and all the new kind of things then they closed down every enrollment center and decided to open enrollment centers in the banks and as of now only 2,500 enrollment centers exist all over India you can imagine just imagine this also because some people like are trying to get the government with numbers like trying to get each state their enrollment is there and there are other people also working with them what they have done is they have deliberately stopped enrolling people in Aathav and this is legit one of my friends who is doing it in Bangalore he had to go and stand in the queue on Monday for 3 weeks because they give you 200 tokens on Monday even if you are the 201th person you won't get a token and in the rest of the 5 days or 4 days of the week they will process only those 200 tokens this is because the states have reached 100% or more than 100% that is not the reason there is a story how many guys have you heard about the fact about the ghost kid the ghost kid ghost kid how many guys have you heard about the ghost kid story here is the most interesting problem can a biometric be faked yes can I take your left hand and my right hand Kiran's left eye and my right eye and give this guy's address will it pass the re-duplication engine yes you got the ghost kid people have used it and people have used it and for close to 1 year you couldn't recognize it so it turns out that it was one of their own staffers doing this yeah this is the Kanpur case so it turns out that there was this thriving business of selling ghost kids where they were selling fingerprint masks of legitimate environment agents but on the black market so you could download others after yourself enroll anybody you want with all these mixmatch or biometrics use the fake fingerprint authenticate and they had no we just get another number you get another number remember every ghost number is gold why you can use it you can use it to link to everything so your bank account won't shut down but in case they don't track you they will never be able to find you but it's a fake number yeah and so this was something done by an insider in UDI and this was selling like hotcakes hotcakes all over the country okay believe me and I'll give this so think this is not movie guys so is this guy a volunteer this is even better okay so we looked at how the environment software works he has a domain called biometrics shop downloaded as it turns out the environment software you can download it from UDI's website you want okay do you want the environment software on your laptop I can do it today it's even downloadable and installable today and you can buy the fingerprint machine and it's a java app it's a java app right it's a java app it's very easy to decompile it is not even up first catered it is not up first catered it is not signed when you do an enrollment and this guy is encrypted so here's the problem when you do an enrollment I think that explains why everybody wants to be a volunteer because nobody wants to keep against something amateur like this when you do an enrollment with the software the enrolling agent is supposed to put their finger and scan their irises every time they do an enrollment so you do it for the customer who is working and you read yourself to prove it now as it turns out the server doesn't check your authentication only the software checks it so all you have to do and this is what the ghost kit was doing they disabled the iris scan part of the enrollment system true equal to false so they re-compiled the java file removing the iris scan part of the enrollment software removing the iris scan part of the enrollment software no no it is not that so basically how it works is let's say you download the software and you want to enroll yourself as some other guy the only thing that prevents you from doing that is I am the operator and I have to authenticate you as so using my iris and fingerprint these guys knew how to make fingerprint masks so they made fingerprint prints of thumb prints of all the operators fingerprint unique fingerprints of all the operators were found in the place where they arrested these guys but however these guys didn't know how to disable the iris so what they did is they said java software can be re-compiled re-compiled and patched so what they said is get iris match with local if match is equal to true if match is equal to false just went and changed that line and just put it in fixed, compiled so what this guy does is he will come and say put a fingerprint with the rubber thing and it will start he will put his finger, I mean this is documented, we have an F.A.R. copy for it okay and this has been going on for close to an year right okay yeah yeah this is a gift that can never stop giving right now here is the hard part right how the fuck do I tell this to the courts who is the document verifier in this who is the document verifier you make whatever you want and there is no authority because somebody else's fingerprint you are using and you know what they are sending the software for the software is 12000 for 5000 bucks the fingerprint is extra and so what happens is you got that software and you got a fingerprint also some extra fingerprint for 5000 bucks and everything now here is your opportunity how will you re-coup your cost you call annivar and say duplicate goeski chahiye kya 5000 so you see the wonderful integrated business model being built around all this fantastic stuff I mean it's mind-blowing so this incidentally is why enrollment has been shut down after a second in case you guys didn't know this is precisely the reason why after I reported this case enrollment has been shut down throughout the country so now only the government so it's limited to 200 people yeah because now it's now only the government all private enrollment is all private because of this case so in case you guys wonder what is the culprit and why you guys can never get an Aadhaar without standing in the queue for like 5 hours you know precisely whom to blame but in this case also you are assuming press that the bank operator is not complicit absolutely that also happens yeah we are not done yet okay so in case you guys understand what was the original Aadhaar case it is access bank yes so the bank is already complicit so one of the things came out last week so your document verification is supposed to be done by retired government officer or government officer who is the guest editor guest editor officer so as it turns out one particular doctor who is the guest editor officer has been verifying documents even though he had retired he was therefore technically not authorized to do it anymore and he had just been going on verifying documents certifying data saying this document is genuine you and I discovered suddenly that they were all coming from someone who is retired and therefore not authorized so they had to cancel all those Aadhaars saying documents are not verified now the point is what is the problem here is it fraud or is it not authorized they do different things now this could be just a retired official continue to do it as if he is not retired but doing it honestly or it could be fraud what's the difference everything and these people have no mechanism they just say everything must be fraud there is an interesting there is a mastercard paper which says existing Aadhaar enrollment process is fraud and only banks can solve it and that is their proposition and this is what the result is now UADA following that path by closing the other enrollment agency so they closed every single private enrollment agency every single private enrollment agency and here is the interesting part before closing they tried to move it to government government so 50,000 at any given point of time there were 60,000 private enrollment agencies they shut down every one of them after last month or May now how many people got enrolled using those 60,000 agencies which is 1.2 billion what happened how many ghosts are there so we don't know the ghost kid has been alive for close to a year we know that for sure another question which comes up nice sci-fi stuff now you can buy the enrollment kit in the tuker and you know what is the best part about the registered devices because all these enrollment guys bought all these enrollment biometric devices and tried to register now they are all being shut down right now what they are doing is they checking all those biometric devices that they bought and putting in quicker so you can basically buy them and here is the best part are they also selling the registered keys I bet yes because the standard device would not be registered registered so I am pretty sure if I go and say yeah this key is enabled or disabled now we don't know the thing is that you discover this you report it and you get harassed another question if anyone knows the answer to this what are your e-courses when the UIDI decides to disable your app Zilx at this point 85 lakh disabled 85 lakh disabled other numbers I know one known way which is fighting to promote Irma yeah yeah yeah that's a documented case that's a documented case 85 lakh disabled other numbers how many pan numbers they found were duplicates 11.2 lakhs for which the court essentially cleared pan other case saying yeah it is valid how many other numbers disabled 85 lakhs what exactly are we talking about in this country so the titanic is coming but the only question is are you and me are going to face the collateral damages of the titanic or the court will stop it or the court will stop it after the titanic is collapsed we don't know I think the only reports is that to reduce your attack surface dude they work very hard if you have a chance they have worked very hard to ensure that there is no attack surface but even linking other with love will work and in case you didn't know the latest thing even in Goa and paid sex if you want you have to get other the most interesting is the UP Act right I mean for all practical purpose the attack surface is in entire life I don't think you can escape it our cyber security attack model threat model is long gone question received on whatsapp if the legal challenge supreme court fails then how will the failures in the system happen so basically whats the iceberg I think it's a I think it's like a massive failure that gets covered that's plastered all over the TV screens yeah so personally I'm hoping disaster happens instead of a slow burn because slow burn will normalize the failure so actually I'm happy with the acceleration that means that the failure will happen yeah the failure will happen it is just going to get more people aware of the fact that this is a broken system website talk about it send people to speak for me make sure you have the argument because lots of people keep saying what is the harm in Aadha I think everything is the wrong harm in Aadha because it's so broken and the only way to do this is to just talk about it as much as possible discussion and debate discussion and debate never stop see the one good thing about India is we never stop talking right the unfortunate reality is that we keep talking about stuff that is not really relevant interesting there was a UP based Aadha based marriage registration so it is like you don't need to go to government office it's an act, it's a special act in UP, you can enter Aadha number of two people and then authenticate them and you basically get married and pay 10 rupees pay 10 bucks and you don't need anyone so and this is from UP and this is only for Hindus only for Hindus we are both Hindus can you just give me a mobile phone can you just give me a mobile number can you give me a mobile number I can give you 5 minutes but now this facility got suspended this facility of Aadha based marriage registration is temporarily available due to change in Aadha policy and new marriage registration rules the process is incorporated above changes in progress and online marriage registration will be avail soon how they shut down the service shit shit there are many you have to worry, divorce should be as simple as this it is not it is not but anyway, there are interesting state Aadha rags similar to this we know them all so here in case you guys don't understand the impact of it this is the reality just talk as much as you can it may be too late or it may be not who knows already I have a very hard time explaining this to my parents my parents are pretty pretty understanding, they say I am mad ok so parents are very very understanding why are they even trying to waste your time on this I mean do something useful with your life a lot of questions maybe you have somebody has encountered this scenario so the first time I was against Aadha for a long time but finally I went and applied and the application was not taken by the system that means I got the enrollment ID they said you come back after 3 weeks Aadha rags so I kept going back every time the system will throw an error that means the center has not received your Aadha packet there is the same error I used to get so even after 3-4 months the same error was there so finally they said we will cancel that and you re-enroll again so now I am asking whether this could be a case of duplicate enrollment so if it never hit the CIDR see packet upload problems are very common so what happens is your enrollment basically gets generated as a packet and stays in the local hard disk and if they are never able to upload it it never hits the CIDR and hence you will probably never get a duplicate other that is the best I can answer if it only hits there you said one more basically you get duplicates if you happen to stay outside those thresholds but if it never hits that is how it is so what happens to my first enrollment it got lost it is not that it is still in the system it may go to CIDR at a later point very unlikely happens a lot there were close to 1.2 crore other enrollments that Maharashtra lost because in those days we used to send it on a physical hard disk and the hard disk got lost half way and we used to send the physical hard disk on india post some of you might have of course some of you might have CIDR was saying the CDs are available in pirate market with the biometrics sorry you are asking some of you might have got a telecom connection using your Aadha let's say a Jio connection so when they authenticate they get the details from UADI and does that detail continue mobile number as well of course it did for a while but not now till Aadhares APA 2.0 it returned email and mobile but not now 2.1 onwards it is not it is dead mobile number was not returned for a long time it did but not now because people made a lot of noise saying why the hell are you guys giving this information to other people and secondly is there a requirement that when an authentication is done you should get a notification of course you should if your mobile and email is registered you should but I did not happens a lot OTP gets lost not OTP but the acknowledgement was used notification also gets lost if you go to the website and log in there and see it you will be able to see it except you can just guess that at this rate at this time I was at the Jio center there is no name that this was authenticated by Jio it is just random numbers I am talking about somebody using it there is a website which goes into all the authentication except you are made you can go check that it keeps it for last 6 months or 50 attempts but notification you should get it you should get it if you have registered your mobile or email ID is proper there you should get it you get a lot is it no I instantly had to use it so there is a problem I wanted to put it down like you means all of us are saying that we should avoid using other but in the practically no I think what this is if you have other you should use it no no if you have it ignore it and try to be careful that is what use it as little as possible because there is so many leaks in this system so the problem I want to put down say here it is that practically it is it is a mandate now in everyday life so recently I had a very urgent job at my home town where I needed to open so that line was on only accepted biometrics it didn't even accept anything else so I had no choice there so I had to scan it yeah this happened with Jio also where they said that they are only opening they are only giving out museums using yeah so what it was but now they have gone back so everywhere you were there they were already giving it operators it is the most convenient easy quick way and the chance of providing customers double authentication for example customers such as you who does not get sms you won't know if both were successful or just one and that's how in mp there was a huge scam where the operators were issuing double since to everyone and they were selling one on black market one to the rest this was throughout I think no but the three of them arrested for this case got busted there must have been others so recently I locked I locked my biometrics some eight nine months back and I tried to use it some three months back to get a gosm and I couldn't it wouldn't recognize my theory and then did you try to unlock it no I did unlock it it did not work it was still the same to you so that's what somebody said no unlocking may not work yeah unlocking does not work sometimes and here is the other interesting part right so here is the assumption part on biometrics which you have never covered do you really think there is a single body part in your body that survives time no right so a permanent ID with a permanent marker doesn't really exist and so yeah it's not modeled on truth it is not modeled on truth and so what will happen is they will keep forcing you to keep re-enrolling again and again on upgrading your biometrics okay what is the story that we heard on Karnataka's thing five years no ten years five years so the fact of the matter is this right your fingerprint does change over five years enough that the machine quality of the machine that these guys use is not able to recognize it and say it is you so we call it as a probabilistic you sometimes it is you sometimes it is not you so biometrics in phones work like if I give a wrong fingerprint and then I give the passcode then it learns that it is actually me so it saves the new copy and then builds on it so here enrollment and authentication are two very distinct operations okay and enrollment is fundamentally a very costly scanner it is at least what we call a slap scanner it has high resolution images and hence it is much more easier to capture your templates okay the one that you see on the lines and on the stuff is basically mantra systems which is 3000 to 2000 rupees 2000 rupees they don't even scan the full fingerprint they basically scan part of it part of it okay and it is low resolution right and every single guy puts it puts it puts it so there is anyway mechanical wear and tear right so the matching is worse because matching works best see the numbers they claim as two percent or three percent failures is when the same system is being used for enrollment and authentication quality matches a lot matters a lot but then for these guys everything has to be cheap got it so what they ended up doing was they gave this mantra scanner by very low quality and in image comparison quality matters a lot so what happens is even there is a small change the quality amplifies it so there are known cases where even people who are not able to get it back often so that is why we call it as playing dice with probability got play if it works so the question is does it does the chance of acceptance of your fingerprint entries as you use it more no because they are not learning because they don't do learning it's not a learning system there is no re-enrollment happening every time there is a failure okay because think about it if it is really the case then I can become you by repeatedly trying no all I need to know is the other number which anyway you will be very happy to give everyone gives it believe me when I tell you this should we call it an anecdote I would like to share one anecdote through my work we were working for an AAPS based system which is Aadhar Anubha Payment system and we were working with an I guess ASA who is authorized to have the Aadhar AAPS which can talk to banks and we were to build a system on top of it where a common man can use it for online payments for testing the system they sent us a physical fingerprint machine but then we told them that we can't test it because our accounts are not linked and our employees would not do it they sent us their own employees fingerprint files over Gmail in a XML format imagine the possibilities and it was sent to not one person but to team email ID why wouldn't people who work with Aadhar and with such sensitive systems where they themselves are dealing with the bank do not know the consequences of what can happen if you share your own fingerprint data why am I not surprised so finally we should go to speak for me.in and then take action ask her MP to say do something about it because there are only two avenues for it okay one is fishery and the other is legislature. Executor will forget about it and media is already compromised whatever media that is happening is all sitting here alright thank you guys and people on the live stream bye