AADHAAR / UIDAI / INDIA STACK

OLYMPUS opened an institutional file. An identity system has no Big Five and no Dark Triad, and the unit does not invent them; what it has is a mandate, a funding line, and a voice. Aadhaar is catalogued here as the turnstile — the largest biometric identity system in the history of the species, administered by the Unique Identification Authority of India, and the base layer of a full national stack built on top of it. The finding is the shape of the institution: a state authority whose stated purpose (inclusion) is genuine and documented, whose failure mode (exclusion) is equally documented, and which — alone in this file — has a body count on the public record. The numbers in the front matter are reach, entrenchment, and durability. Not malice.

Institutional Archetype

THE TURNSTILE — The archetype is the gate installed to let people in, which thereby acquires the power to keep them out. Aadhaar authenticates: a twelve-digit number keyed to ten fingerprints, two iris scans, and a facial photograph, with a binary output — authenticated or not authenticated. There is no “probably her but the fingerprints are worn.” There is no “override because she’s been coming here for five years and everyone knows her name.” A turnstile does not care which way the policy points; it admits or it denies, roughly 100 million times a day. The structural power is not any single denial. It is that once the body is the key to food, banking, phones, and health care, the failure of the key is the failure of the person.

Mandate & Origin

Enrollment began in 2009 under the Government of India, administered by the Unique Identification Authority of India (UIDAI). By 2024 the system held roughly 1.4 billion people — virtually the entire population. The stated purpose was financial inclusion: India had hundreds of millions of people outside the formal economy, with no bank accounts, no government ID, and no way to receive subsidies. The World Bank counts 850 million people worldwide who lack official identification and cannot access healthcare, education, or financial services; Aadhaar was built to solve that problem at national scale, and in measurable respects it has — India’s fuel subsidy program saves roughly $1 billion per year through Aadhaar-linked direct benefit transfers by eliminating duplicate and ghost beneficiaries. The inclusion case is not a pretext. It is documented, quantified, and endorsed by the development economics literature.

Identity was only the first layer. On top of Aadhaar, India assembled the India Stack: UPI, the government-designed payment rail clearing on the order of 14 billion transactions a month through the state-backed NPCI, with real-time visibility into sender, receiver, amount, and timestamp; DigiLocker (300 million users, 7 billion documents); ABDM (national health ID); ONDC (state commerce protocol); the Account Aggregator framework (1.1 billion accounts linked); and eKYC, instant identity verification for any service. No other democracy has anything comparable in scope or integration.

The statute, in its own words. The Aadhaar and Other Laws (Amendment) Act, 2019 (No. 14 of 2019, assented to 23 July 2019) rewrote the rules of use after the Court’s judgment. New Section 4(3) reads: “Every Aadhaar number holder to establish his identity, may voluntarily use his Aadhaar number in physical or electronic form by way of authentication or offline verification.” Section 4(4) lets “An entity” authenticate if the Authority is satisfied that it meets privacy and security standards and is either permitted by a law of Parliament or “seeking authentication for such purpose, as the Central Government in consultation with the Authority, and in the interest of State, may prescribe.” Section 4(6) bars refusing service to a holder “for refusing to, or being unable to, undergo authentication,” and Section 4(7) keeps the mandatory route open: “mandatory authentication of an Aadhaar number holder for the provision of any service shall take place if such authentication is required by a law made by Parliament.” The same Act’s twenty-fifth section says: “Section 57 of the principal Act shall be omitted.” It also extended Section 7 benefits to the Consolidated Fund of a State, and it provides that “a child shall not be denied any subsidy, benefit or service under that section in case of failure to establish his identity by undergoing authentication” (Gazette of India, Act 14 of 2019). By UIDAI’s own count, 50 central ministries and departments had issued 229 Section 7 notifications by 31 March 2025 and States and UTs had notified over 1,787 schemes, and UIDAI “has been mandated to facilitate drafting and vetting of section 7 notifications” (UIDAI Annual Report 2024-25). The same report puts the register at “over 141.80 crore Aadhaars” generated by 31 March 2025, and UIDAI’s front page shows 145.32 crore enrolments (UIDAI).

Funding & Backers

UIDAI is a government authority — the funding line is the Indian state, and the 2025 rule-making runs through the Ministry of Electronics and IT. The backers worth cataloguing are the export wing. In 2018 the International Institute of Information Technology Bangalore launched MOSIP — the Modular Open Source Identity Platform, explicitly modeled on the Aadhaar architecture and offered free to developing nations — with launch funding from the Bill & Melinda Gates Foundation, the Norwegian Agency for Development Cooperation, the Tata Trusts, and the Omidyar Network. The World Bank’s ID4D program has financed national rollouts of the model with billions in concessional loans, with coverage targets that imply substantially universal enrollment by 2030. By 2025 MOSIP was in production in the Philippines, Morocco, Ethiopia, Sri Lanka, Togo, Uganda, Guinea, and the Democratic Republic of Congo. The pattern: the architecture ships with documentation, training, and technical support. The constitutional jurisprudence does not.

The budget, in the authority’s own report. UIDAI’s 2024-25 annual report says: “UIDAI receives Grants-in-Aid (GIA) from Ministry of Electronics and Information Technology (MeitY),” and that “a separate UIDAI fund has been constituted for ensuring the financial autonomy of UIDAI,” credited under Section 25 with “all grants, fees and charges received by the Authority under this Act.” The budget and revised estimates for 2024-25 were both 600.00 crore rupees; the report adds that “686.36 crore was made from the UIDAI receipts” to meet committed liabilities, which puts total expenditure at 1,286.36 crore. Across the ten years in its Table 12 the grant estimate ran from 2,000.00 crore in 2015-16 to 600.00 crore in 2024-25, with actual expenditure above the revised estimate in 2019-20, 2020-21, 2022-23, 2023-24 and 2024-25 (UIDAI Annual Report 2024-25). The authority’s money is the Indian state’s grant plus its own receipts. No private or foreign funder is named in the budget section. The report does not break the receipts down by payer.

The export wing’s money is on the record in its own terms. MOSIP’s news page says “The project is funded by The Bill & Melinda Gates Foundation, Tata Trust, Omidyar Network, NORAD, and the Pratiksha Trust” (MOSIP). The Gates Foundation’s grant database lists a $16,000,000 commitment dated October 2021, grantee “International Institute of Information Technology Bangalore (IIITB),” 48 months, “to create, sustain, evolve and integrate a modular open source identity platform (MOSIP)” (Gates Foundation). The grantee is the institute. UIDAI is not named in the grant record, and its name is not among the organizations on MOSIP’s governance page, which lists Norad, the Gates Foundation, Tata Trusts, Omidyar Network, the Reserve Bank of India and the World Bank among others (MOSIP governance).

Institutional Voice & Intent

The voice is the developmental-state register — “good governance,” “direct benefit transfer,” “leakage elimination,” inclusion as a measurable deliverable. The 2025 expansion rules are titled, in full, the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules. The persuasion is in the arithmetic: 850 million people without papers, a billion dollars a year in fraud savings. A welfare argument reads as a finding, not an ambition, even when the infrastructure it justifies can do other things.

Stated intent: Give every resident an identity. Include the excluded. Deliver benefits directly, eliminate ghost beneficiaries, bring hundreds of millions into the formal economy.

Observed intent: Become the mandatory key to everything. The Supreme Court struck down compulsory linking of Aadhaar to bank accounts and SIM cards in 2018; by 2024 Aadhaar was de facto mandatory for virtually every government service anyway, through regulatory workarounds rather than legislative mandate. In February 2025 the government opened Aadhaar authentication to private businesses — e-commerce, travel, hospitality, healthcare — and unlinked PAN cards became inoperative from January 1, 2026.

Gap: The stated and observed intents overlap wherever “include everyone” coincides with “enroll everyone.” The question the record forces is whether the infrastructure built to include 850 million people also gives the state the ability to exclude anyone, instantly, without due process. The answer, documented below, is yes — not as an abuse of the system but as its ordinary operating output when authentication fails. The turnstile includes and excludes with the same motion.

The authority’s own voice. The chairperson’s message opens UIDAI’s 2024-25 annual report: “UIDAI continues to improve ease-of-living through our world-leading digital ID Aadhaar.” The authority’s account on X carries the same register in short form. On 19 September 2026: “With more than 18,528 crore Aadhaar authentication transactions completed. Aadhaar continues to support secure and convenient access to services at population scale” (UIDAI on X). On 17 September 2026: “Aadhaar-enabled authentication helps make the distribution of foodgrains more efficient and ensures benefits reach the intended beneficiaries. 77.33 crore PDS beneficiaries accounts are Aadhaar-seeded” (UIDAI on X). On 29 September 2026, at the Aadhaar Samvaad in Kolkata: “Introducing SWIK Portal 2.0” as “a single-window platform streamlining approvals for non-Government entities” (UIDAI on X), and a “National Launch of Face Authentication in e-PDS” that “marked a step towards making ration services more secure, seamless and accessible” (UIDAI on X). The register is the metrics dashboard: a cumulative count, a coverage figure, an adjective. The two posts that give numbers give a count of authentications and a count of seeded accounts, and neither gives a count of failures.

Interest: What each position would pay the authority and the parties around it, documented, with the best case each side makes. The positions are the state’s own, stated in its statutes, rules and the authority’s reports.

• Open authentication to non-government entities. Position: the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025, notified by MeitY on 31 January 2025: “The amendment enables both government and non-government entities to avail Aadhaar authentication service for providing various services in the public interest,” and “The applications will be examined by UIDAI and MeitY will issue the approval based on the recommendation of UIDAI” (PIB, 31 Jan 2025 (NeGD copy)). What it pays: the release names e-commerce, travel, tourism, hospitality and health providers as the entities that gain a trusted check on customers. UIDAI’s own fund is credited with “all grants, fees and charges received by the Authority under this Act,” and 686.36 crore rupees of its 2024-25 spending came from its receipts; the report prints no fee schedule and no split of receipts by payer, so no per-entity payment is documented (UIDAI Annual Report 2024-25). The statutory route is Section 4(4)(b)(ii) of the Act, quoted above. Best case, the release’s own: “This will help both the service providers as well as the service seekers to have trusted transactions.” Convergence: the 2019 Act had already opened telecom licensees and PMLA reporting entities to Aadhaar authentication on the terms that “no person shall be denied any service for not having an Aadhaar number” and that the Aadhaar number and core biometric information are not stored (Gazette, Act 14 of 2019). Banks, telecoms and now commerce are admitted under the same Act.
• Face authentication as the default modality. Position: UIDAI’s report says its face authentication, “developed in-house,” is “now being used by 105 entities, including state government departments, ministries in the central government, telecoms, banks and NBFC’s,” with 130.31 crore transactions from inception to 31 March 2025. In September 2026 UIDAI’s press-release page lists “UIDAI Launches Aadhaar Face Authentication SDK and Sandbox at Global Fintech Fest 2026” (UIDAI Annual Report 2024-25; UIDAI press releases). What it pays: the developer is the authority, so the in-house build is UIDAI’s own product; the users are the banks, NBFCs and telecoms named, and the report’s account of the 2024 Global Fintech Fest describes it as “eliminating dependency on external devices.” The report prints no price. Best case, the report’s: face authentication “Reduces the risk of fraudulent claims and corruption.” Convergence: state governments, which the authority’s 3 October 2026 post shows taking it into the ration shop.
• Aadhaar-gated benefits, mandatory where Parliament says so. Position: Section 7 benefits and Section 4(7), quoted above, with the 2020 Rules allowing authentication “on voluntary basis, in the interest of good governance, preventing leakage of public funds.” What it pays: the state’s own exchequer, by the authority’s account. The report records its deputy director general on a 2024 Global Fintech Fest panel “highlighting Aadhaar’s impact on inclusion and its role in generating USD 42 billion in savings through DBT,” and the report counts 18,13,328.25 crore rupees paid over the APB platform (UIDAI Annual Report 2024-25). The report does not show how the savings figure was derived. Best case, the Attorney General’s, recorded by the Court: “no deserving person would be denied the benefit of a scheme on the failure of authentication” (Supreme Court of India, 26 Sep 2018). Convergence: State governments, which gained the same gate for schemes paid from a State’s own fund when the 2019 Act inserted “or the Consolidated Fund of State.”
• Exempt notified State bodies from the data protection law. Position: Section 17(2)(a) of the Digital Personal Data Protection Act, 2023 disapplies the Act to processing “by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order,” and Section 17(4) disapplies the erasure duty in Section 8(7) for processing by the State or any instrumentality of it (DPDP Act 2023, Gazette text). What it pays: whichever body the Centre notifies. No notification naming UIDAI is cited here, so no payment to the authority is documented. Best case, the Act’s own list of grounds: sovereignty, security of the State, public order. Convergence: none documented.
• Export the architecture. Position: the annual report records that “An active interest has been shown by some countries like Egypt, Papua New Guinea, Mauritius, Cuba, Jamaika, Nigeria, Denmark Kenya, Madagascar and Indonesia” in learning from Aadhaar, and MOSIP offers countries “modular and open-source technology to build and own their national identity systems” (UIDAI Annual Report 2024-25; MOSIP). What it pays: the funders’ grant goes to the institute that hosts MOSIP, quoted above, and the authority is named on neither the grant record nor the governance page, so no payment to UIDAI is documented. MOSIP’s front page reports 32 country engagements and 14 national rollouts. Best case, MOSIP’s: countries “build and own” the system. Convergence: the same four philanthropic funders and a bilateral aid agency back the platform that carries the architecture abroad, and MOSIP’s governance page lists the World Bank and the Reserve Bank of India among its organizations.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

Aadhaar is the base plate the rest of the stack bolts onto. Payments: UPI cleared 16.73 billion transactions in December 2024 alone, and the RBI’s retail e-Rupee CBDC pilot (~5 million users, 16 banks) requires Aadhaar-linked KYC for bank wallets — the direct biometric-to-CBDC bridge. The kill switch: India leads the world in internet shutdowns — 116 in 2023, roughly 60 percent of the global total; 84 in 2024, second only to Myanmar and the most of any democracy — and during the 2023 Manipur shutdown, residents who had migrated to UPI were locked out of their own money for months. The identity layer and the kill-switch layer collided, and the stack became a single point of failure for the people standing on it. Facial recognition: more than 100 projects documented by the Internet Freedom Foundation’s Project Panoptic, with DigiYatra airport boarding linked to Aadhaar, and a 2023 data protection act that exempts the government on national security grounds. The export circuit: MOSIP carries the architecture outward; the Philippines’ PhilSys followed the trajectory in compressed form — inclusion-first launch in 2018, bank-account and scholarship gating by 2023. And the private-sector recapitulation of the model — a global biometric ID scheme run by a company instead of a state — is filed under its founder: Sam Altman (cross-reference Sam Altman), whose World ID iris-scanning operation pitched proof-of-humanity to the populations weakest positioned to refuse it.

The legal conduits into banking and telecom. After the Court quashed the mandatory bank and SIM links, Parliament rebuilt both as voluntary routes in the same 2019 Act. It inserted into the Indian Telegraph Act a duty on every telegraph licensee to identify subscribers by Aadhaar authentication, Aadhaar offline verification, a passport or another notified document, and provided that “The use of modes of identification under sub-section (3) shall be a voluntary choice of the person who is sought to be identified and no person shall be denied any service for not having an Aadhaar number.” It did the same for PMLA reporting entities, adding that the Centre may by notification, after consulting UIDAI and the regulator, permit a reporting entity other than a bank to authenticate by Aadhaar (Gazette of India, Act 14 of 2019). The Annual Report counts 219 active authentication user agencies, 215 e-KYC user agencies and 20 authentication service agencies as of 31 March 2025, and says 2,356 crore e-KYC authentications had been performed since the facility began in May 2013 (UIDAI Annual Report 2024-25). The conduits are lawful, written down and voluntary on paper, and they are how the identifier stays in the account-opening and SIM-activation path that the Court’s order closed as a mandate.

Actions & Leadership Choices

The body count. The Right to Food Campaign and researchers including economists Jean Drèze and Reetika Khera documented starvation deaths — between twenty and fifty, depending on the count, and the researchers state the true number is likely higher — where Aadhaar authentication failures blocked access to food rations the dead were legally entitled to receive. The authentication failure rate was 49 percent in Jharkhand and 37 percent in Rajasthan: manual laborers with worn fingerprints, elderly people with changed iris patterns. Santoshi Kumari was an eleven-year-old girl in Jharkhand. Her family’s ration card was cut off after its Aadhaar linkage failed. Her mother said she died asking for rice. In peer-reviewed follow-up work, Drèze, Khera, and Somanchi documented a 29 percent authentication-failure-driven disruption rate in the PMMVY maternity benefit program, and LibTech India found Aadhaar-related issues in a quarter of MGNREGA wage payments in Jharkhand. These are not edge cases. They are the operating rate of the turnstile in the states where it was tested hardest.

The breach, and who got prosecuted. In January 2018 the Tribune India reported that a reporter had purchased access to the Aadhaar database from an anonymous seller on WhatsApp for 500 rupees — eight dollars — with name, address, photo, phone, and email retrievable by Aadhaar number, and card-printing software available for four dollars more. UIDAI denied the database was breached and filed a criminal complaint that named the reporter and her newspaper alongside the sellers she had dealt with. The Delhi Police closed the case in 2021. In October 2023 the cybersecurity firm Resecurity reported 815 million Indian citizens’ records — Aadhaar numbers and passport data — for sale on the dark web, attributed by the firm to a breach of the Indian Council of Medical Research database. The attack surface grows with every integration; when a single identifier is the key to everything, every database that stores it becomes a target.

The Court, and the workaround. On September 26, 2018, the Supreme Court of India in Puttaswamy upheld Aadhaar’s constitutionality 4:1 but struck down mandatory bank and SIM linking, struck the Section 33(2) national-security access provision, and cut data retention from five years to six months — acknowledging that the system’s scope had exceeded its justification. By 2024 Aadhaar was de facto mandatory for virtually every government service anyway. In February 2025 the government extended Aadhaar authentication to private businesses; Supreme Court advocate Prasanna S said the amendment attempts to “re-legislate” the Section 57 the Court had struck down, and Sidharth Deb of The Quantum Hub warned that “there is always the risk of exclusion.” The Rethink Aadhaar campaign — more than 50 organizations — continues to document exclusion testimonials. The Court won the legal battle. The infrastructure won the war.

The judgment, in the Court’s own words. The majority’s conclusions are in the Court’s own record. On Section 57: “This part of the section, thus, is declared unconstitutional,” after finding use on the basis of a contract “clearly impermissible as a contractual provision is not backed by a law.” On bank accounts: “We find that this move of mandatory linking of Aadhaar with bank account does not satisfy the test of proportionality.” On mobile numbers: the Department of Telecommunications circular “is held to be illegal and unconstitutional as it is not backed by any law and is hereby quashed.” On retention: “Retention of data beyond the period of six months is impermissible.” On Section 33(2): “disclosure of information in the interest of national security cannot be faulted with,” but the provision “in the present form is struck down with liberty to enact a suitable provision.” The same majority recorded the Attorney General’s undertaking, “that no deserving person would be denied the benefit of a scheme on the failure of authentication,” and held that Section 7 “benefits” and “services” must be those drawn from the Consolidated Fund of India, so that “CBSE, NEET, JEE, UGC etc. cannot make the requirement of Aadhaar mandatory.” Justice Bhushan’s concurring conclusions, signed the same day, say: “Aadhaar Act does not create an architecture for pervasive surveillance” and “Section 7 of the Aadhaar is constitutional. The provision does not deserve to be struck down on account of denial in some cases of right to claim on account of failure of authentication.” The dissent, by Justice Chandrachud, opens its analysis: “An identification project that involves the collection of the biometric and demographic information of 1.3 billion people, creating the largest biometric identity project in the world, must be scrutinized carefully to assess its compliance with human rights” (Supreme Court of India, Puttaswamy (Aadhaar) judgment, 26 Sep 2018). A dissenting judge’s description of the system is the one this file uses: the largest of its kind. On the failures of authentication the majority wrote that “remedy is to plug the loopholes rather than axe a project,” and directed a fallback, not the striking of Section 7.

CONDUCT verdict: ENTRENCHED — INCLUSION ENGINE WITH AN EXCLUSION SWITCH. The inclusion results are real and the counter-argument travels at full strength: 850 million people without papers is a genuine crisis, and a billion dollars a year in recovered subsidy fraud is a genuine result. But the institution’s documented reflexes point one direction — deny the breach and prosecute the messenger, absorb the Court’s constraints through regulatory workarounds, expand into the private sector over the objection of the lawyers who won the original case — and its documented failure mode killed people at a rate its own states’ data made visible. The system was built for the poor. The people it failed hardest were the poor it was built for.

Alliance Map

These run at the same time. UIDAI is a statutory authority paid by a ministry grant and its own receipts, is mandated to facilitate drafting and vetting of the Section 7 notifications (229 central, over 1,787 State schemes), approves private requesting entities on MeitY’s behalf, lost a Section 57 case in the Supreme Court and then watched Parliament write the replacement into Section 4, and has its architecture carried abroad by MOSIP, which a philanthropic consortium funds through a different institution. The overlap is the finding, not a coordination claim.

Reach Assessment

Institutional: No system on earth touches more people. The base layer of identity for 1.4 billion, load-bearing under payments, health, commerce, tax, and credit — and via MOSIP and ID4D, the reference architecture for national identity across three continents. Memetic: Aadhaar is the proof-of-scale the entire digital-ID field reasons from — the demonstration that a democracy can enroll a billion people biometrically, cited by every government building a wallet and every development bank financing one. The export is not just code; it is the premise that enrollment is what inclusion looks like. Civilizational: India is a democracy, with courts, a constitution, a free press, and competitive elections — which is precisely what makes this file the load-bearing one. China proving an authoritarian state can build total digital infrastructure is unsurprising. India proves a democracy builds the same infrastructure through a different process: slower, messier, contested at every step, and arriving at a comparable destination. The democratic checks constrained the ratchet’s speed. They did not change its direction.

Score basis. Atk 9 is reach: UIDAI’s annual report counts 229 Section 7 notifications from 50 central ministries and over 1,787 State and UT schemes, 2,237.94 crore Yes/No authentications in 2024-25 against 219 active authentication agencies, and a chairperson’s figure of “9.6 crore” average daily authentications; the 2025 Rules extend the gate to non-government entities (UIDAI Annual Report 2024-25; PIB via NeGD). Def 8 is funding insulation: UIDAI spent 1,286.36 crore rupees in 2024-25 against a MeitY grant of 600.00 crore, meeting 686.36 crore from its own receipts under a fund the report says was constituted “for ensuring the financial autonomy of UIDAI”; the grant and the rules still come from the same ministry (UIDAI Annual Report 2024-25). Hp 10 is entrenchment: the system is written into a statute that Parliament amended in 2019 and the Supreme Court upheld in 2018 apart from the provisions it struck, with 141.80 crore numbers issued, 12,445.84 crore Yes/No authentications since 2012, and 18,13,328.25 crore rupees paid over the APB platform (Gazette, Act 14 of 2019; Supreme Court of India; UIDAI Annual Report 2024-25). Peers on the same values: OpenAI at 9/8/9, hazard 88, reaches users who chose it, while the authority’s reach includes a statute that makes authentication mandatory where Parliament says so, which is why its hp sits a point higher. CISA at 9/8/7, hazard 86, shares atk and def; the three-point hp gap is the installed base here, 141.80 crore numbers issued. The NSA stack (nsa-fisa-702) at 10/9/10, hazard 88, shares hp 10 and sits a point higher on atk and def; this authority’s authentication is voluntary except where Parliament requires it under Section 4(7), which is why its atk and def stay a point lower.

Sources: UIDAI; NPCI — UPI product statistics; NPR: India’s Biometric ID System Has Led To Starvation For Some Poor, Advocates Say (1 Oct 2018); Scroll.in: A year after Jharkhand girl died of starvation, Aadhaar tragedies are on the rise; The Wire: Digital Exclusion — Poor, Elderly Face the Brunt of Aadhaar-Based Authentication Errors; EPW Engage: Aadhaar Failures — A Tragedy of Errors; Tribune India: Rs 500, 10 minutes, and you have access to billion Aadhaar details (Jan 2018); Resecurity: Threat actors sell 800M+ records of Indian citizens on the dark web (Oct 2023) (Moneylife, citing Resecurity); Supreme Court Observer: Puttaswamy (Aadhaar) judgment in plain English; Puttaswamy judgment, full text (26 Sep 2018, PDF) (Supreme Court of India: Puttaswamy (Aadhaar) judgment) (archived); K.S. Puttaswamy v. Union of India — Indian Kanoon; TechCrunch: India expands Aadhaar authentication for businesses, raising privacy concerns (2 Feb 2025); TechCrunch: India makes Aadhaar more ubiquitous, but critics say privacy concerns remain (9 Feb 2026); MOSIP; World Bank ID4D; World Bank: Inclusive and Trusted Digital ID Can Unlock Opportunities for the World’s Most Vulnerable (World Bank ID4D blog (850M figure)) (archived); J-PAL: Digital financial services; Access Now #KeepItOn; Access Now: Internet shutdowns in 2024; SFLC.in Internet Shutdown Tracker; Anuradha Bhasin v. Union of India (2020) — Indian Kanoon; Internet Freedom Foundation — Project Panoptic; LibTech India; Rethink Aadhaar; PMC: A failure to “do no harm” — India’s Aadhaar biometric ID program; Drèze, Khera & Somanchi, “Balancing Corruption and Exclusion,” Economic & Political Weekly, 2020; RBI Annual Report 2023-24 (e-Rupee pilot); UIDAI Annual Report 2024-25; UIDAI front page; UIDAI press releases; UIDAI on X; Aadhaar and Other Laws (Amendment) Act, 2019 - Gazette of India; PIB: Aadhaar Authentication for Good Governance Amendment Rules, 2025 (31 Jan 2025, NeGD copy); Digital Personal Data Protection Act, 2023 - MeitY; Supreme Court of India: Puttaswamy (Aadhaar) judgment, 26 Sep 2018; MOSIP: Identifying a Billion; MOSIP governance; MOSIP; Gates Foundation grant: IIIT Bangalore, Oct 2021; Research: Diaspora PACs.