India Stack: The Democratic Ratchet

A woman in Jharkhand walks to the Public Distribution System office to collect her family’s food rations. She places her thumb on the biometric reader. It fails. She tries again. It fails. Her fingerprints are worn from years of manual labor. The machine has a binary output: authenticated or not authenticated. There is no “probably her.” There is no human override. She leaves without food.

She is one of thirty to fifty people documented by researchers including economist Reetika Khera and the Right to Food Campaign who died after Aadhaar authentication failures blocked access to food rations they were entitled to receive. The authentication failure rate in Jharkhand was 49 percent. The actual death toll is almost certainly higher. People dying of hunger in remote villages rarely make the news.

India’s Supreme Court ruled the system constitutional. The system that killed Santoshi Kumari, an eleven-year-old whose family could not authenticate, remains in operation.

This is the world’s largest democracy doing what no other democracy has attempted at scale.

The Architecture

The India Stack is the most comprehensive digital infrastructure any democracy has built. Aadhaar covers 1.39 billion people with a twelve-digit biometric ID, fingerprints and iris scans, processing roughly 100 million authentications per day. UPI, the Unified Payments Interface, runs 14 billion transactions per month on government-designed rails that any bank and any merchant can connect to without paying card-network fees. DigiLocker holds verified government documents for 300 million users. The Ayushman Bharat Digital Mission builds the health-record layer. The Open Network for Digital Commerce builds the merchant layer. The Account Aggregator framework gives 1.1 billion accounts a single consent layer for financial data sharing.

No other democracy has anything comparable. The European Union has fragmented national systems. The United States has private-sector payment rails and no federal ID. China has Alipay and WeChat Pay running on a private duopoly, and a national ID system with no equivalent unified application stack. India built the whole thing as a public good, open-source, with documented APIs, and the rest of the developing world is downloading it.

Internet Shutdowns

India led the world in internet shutdowns for the sixth consecutive year in 2023, with 116 documented shutdowns logged by Access Now’s #KeepItOn coalition. The SFLC tracker counts more than 780 cumulative shutdowns since 2012.

The duration matters more than the count. Kashmir lost 4G service for 552 days following the August 2019 abrogation of Article 370. Manipur was offline for more than five months during the 2023 ethnic conflict. The Supreme Court’s Anuradha Bhasin ruling in January 2020 held that indefinite shutdowns are unconstitutional and require periodic proportionality review. The shutdowns continued. The proportionality review became a procedural box that gets ticked, not a substantive constraint.

Facial Recognition

The Internet Freedom Foundation’s Project Panoptic tracks more than 100 facial recognition systems in deployment or procurement across Indian governments. There is no national legal framework governing their use. Most projects were authorized by executive order or ministry circular rather than by statute.

Delhi Police used facial recognition against anti-CAA protesters in early 2020 (before the February 2020 Delhi riots, on demonstrators identified by the technology) and continued using it against alleged rioters afterward. The DigiYatra program rolled out facial recognition at major Indian airports beginning in 2022, framed as a voluntary convenience for domestic travelers. The Hyderabad city camera network was reported to be one of the most surveilled in the world by mid-2024. None of it operates under a privacy statute, because the Personal Data Protection Bill was repeatedly amended, delayed, weakened, and finally enacted in 2023 in a form privacy advocates described as a retreat from the earlier drafts.

The IT Rules

The Information Technology Rules notified in 2021 and amended in subsequent years impose traceability obligations on messaging platforms. A requirement that breaks end-to-end encryption for any platform serving more than five million Indian users. Platforms must take down content within 36 hours of a government order. The 2023 Fact Check Unit amendment gave a government body the authority to designate online content about “the government” as false, with binding takedown effect.

The Bombay High Court struck down the Fact Check Unit provision in September 2024. A partial check. The traceability obligation remains in force. WhatsApp’s challenge has been pending in the Delhi High Court since 2021.

Aadhaar Failures

The Tribune India demonstrated in January 2018 that the entire Aadhaar database could be queried by anyone with a WhatsApp account and 500 rupees. Eight dollars. For 300 additional rupees, the buyer received software that could print Aadhaar cards. The UIDAI’s response was to file a criminal complaint against the reporter rather than the seller.

In October 2023, Resecurity reported that 815 million Indian citizens’ records, including Aadhaar numbers and passport data, were being sold on the dark web, sourced from the Indian Council of Medical Research database. The attack surface grows with every integration. When a single identifier is the key to banking, healthcare, food rations, and SIM cards, every database that stores that number becomes a target.

The thirty to fifty documented starvation deaths from authentication failures are the human cost. The 815 million leaked records are the security cost. The infrastructure was built for inclusion. The infrastructure scaled past its capacity to be governed.

Where the Checks Worked

The 2018 Puttaswamy judgment by a nine-judge Constitutional Bench established privacy as a fundamental right and struck down mandatory Aadhaar linkage to bank accounts, SIM cards, and school enrollment. It upheld Aadhaar for welfare-program targeting. The Court won the legal battle on scope.

The 2020-2021 farm laws were repealed in November 2021 after more than a year of protest by farmers blockading approaches to Delhi. The Fact Check Unit was partially blocked in 2024. These are real constraints. The Indian judiciary, the Indian press, and the Indian protest tradition produced real reversals of executive overreach.

Where the Checks Did Not

Aadhaar became de facto mandatory by 2024 through regulatory workarounds. Banks, telecom providers, and welfare programs all required it as the path of least resistance, and any alternative path was sufficiently bureaucratic that the user gave up. The infrastructure won the war the court won the battle of.

The farm-protest surveillance infrastructure (facial-recognition matching against protester databases, internet shutdowns at protest perimeters, financial scrutiny of organizing accounts) was not dismantled when the farm laws were repealed. It was retained for the next protest.

Internet shutdowns continued at over 100 per year after the Anuradha Bhasin proportionality ruling. The Court said do less of it. The government did not do less of it.

MOSIP — The Export Pattern

India did not keep Aadhaar to itself.

In 2018, the International Institute of Information Technology Bangalore launched MOSIP, the Modular Open Source Identity Platform, explicitly modeled on the Aadhaar architecture and offered free to developing nations. The launch funders were the Bill & Melinda Gates Foundation, the Norwegian Agency for Development Cooperation, the Tata Trusts, and the Omidyar Network. The pitch was digital identity infrastructure as foreign aid. The product was the blueprint of the world’s largest biometric ID system, packaged for export.

By 2025, MOSIP had been adopted in production in the Philippines (PhilSys), Morocco, Ethiopia, Sri Lanka, Togo, Uganda, Guinea, and the Democratic Republic of Congo, with pilots in another dozen countries. The World Bank’s ID4D program is financing the rollouts with concessional loans. The stated coverage targets imply substantially universal enrollment by 2030.

The Philippines is the canonical case. PhilSys launched in 2018 with the same inclusion-first framing. By 2023, the Bangko Sentral required PhilSys ID for bank account opening. The Department of Education required it for tertiary scholarship applications. The technical architecture replicates the Indian model: biometric capture, central database, mandatory linkage to financial and educational services. The exception is scale. 110 million Filipinos rather than 1.4 billion Indians.

The constitutional jurisprudence is what doesn’t get exported. The Aadhaar system has been audited, litigated, breached, and partially constrained by India’s Supreme Court. Few of the importing jurisdictions have a comparable judicial review capacity. The infrastructure ships with documentation, training, and ongoing technical support from the original architects. The case law does not.

The Diaspora Apparatus

The Indian-American diaspora supports the export with three layers operating in parallel.

The foreign-agent layer is OFBJP-USA, the Overseas Friends of the BJP, which registered under FARA on 27 August 2020. It is the first US affiliate of any Indian political party to register as a foreign agent. The registration was the response to a Justice Department inquiry that had been building for several years.

The domestic PAC layer operates inside US frameworks. USINPAC, the US India Political Action Committee, was founded in 2002 by Sanjay Puri and Vikram Chauhan and registered with the FEC as C00381699; its founders explicitly modeled it on AIPAC. Indian American Impact and its associated Impact Fund (Deepak Raj, Raj Goyle, Neil Makhija) raised roughly $10 million in a single cycle. The Republican Hindu Coalition, founded by Shalabh Kumar in 2015, runs in the Trump-aligned political ecosystem.

The advocacy and religious-discrimination layer is the Hindu American Foundation, a 501(c)(3) founded in 2003.

The book separates these explicitly. Only OFBJP-USA is the documented foreign-state-coordination instance. The rest are domestic political organizing inside US frameworks, comparable to other diaspora PAC networks. The pattern matters because the same infrastructure that exports the technical stack also organizes the political environment that receives the stack.

The UK-India FTA Mobility Chapter

The UK-India Free Trade Agreement signed on 24 July 2025 contains a mobility chapter that bakes in 20,000 annual service-supplier visas plus a three-year UK social-security exemption. It is a direct H-1B-analog regime, embedded in a bilateral treaty rather than a regulatory framework that can be revised between elections.

The immediate beneficiaries on the UK side are Indian IT services firms. TCS, Infosys, HCL, Wipro, Tech Mahindra. The immediate concerns are UK domestic workforce displacement and the enforcement record under the UK Modern Slavery Act, which produced more than 470 sponsor-licence revocations in the 2023-24 Health and Care Worker visa scandal. The treaty mechanism makes the labor-arbitrage stream legally durable in a way the H-1B regulatory regime is not. Future UK governments can change H-1B-equivalent regulations. They cannot easily change a treaty.

The Verdict

Democracy constrains the ratchet’s speed but not its direction.

The Indian Supreme Court is the most active constitutional court in any major democracy on digital-infrastructure questions. Puttaswamy is the most important privacy ruling outside the European Court of Human Rights. The 2018 Aadhaar judgment did meaningful work. The farm laws were repealed. The Fact Check Unit was partially blocked. Indian democracy is doing the constitutional work that no other large jurisdiction is doing on this scale.

The infrastructure expanded anyway. Aadhaar became de facto mandatory. The surveillance technology built for one protest was retained for the next. The shutdowns continued at world-leading volume. MOSIP exports the architecture to countries with weaker judicial review. The diaspora apparatus organizes the political environment for the export. The bilateral treaty locks in the labor pipeline.

The Court won the legal battle. The infrastructure won the war. And India also exports the infrastructure and the diaspora apparatus that supports the export.

The Jharkhand authentication reader said no. There was no human in the loop. The infrastructure does not distinguish between worn fingerprints and fraud. The output was binary. The output was final.

Click.

The receipts (free, on this site): the digital-ID stack · CBDCs

This research appears in The Ratchet, Chapter 5.