AADHAAR / UIDAI / INDIA STACK

Institutional Archetype

THE TURNSTILE — The archetype is the gate installed to let people in, which thereby acquires the power to keep them out. Aadhaar authenticates: a twelve-digit number keyed to ten fingerprints, two iris scans, and a facial photograph, with a binary output — authenticated or not authenticated. There is no “probably her but the fingerprints are worn.” There is no “override because she’s been coming here for five years and everyone knows her name.” A turnstile does not care which way the policy points; it admits or it denies, roughly 100 million times a day. The structural power is not any single denial. It is that once the body is the key to food, banking, phones, and health care, the failure of the key is the failure of the person.

Mandate & Origin

Enrollment began in 2009 under the Government of India, administered by the Unique Identification Authority of India (UIDAI). By 2024 the system held roughly 1.4 billion people — virtually the entire population. The stated purpose was financial inclusion: India had hundreds of millions of people outside the formal economy, with no bank accounts, no government ID, and no way to receive subsidies. The World Bank counts 850 million people worldwide who lack official identification and cannot access healthcare, education, or financial services; Aadhaar was built to solve that problem at national scale, and in measurable respects it has — India’s fuel subsidy program saves roughly $1 billion per year through Aadhaar-linked direct benefit transfers by eliminating duplicate and ghost beneficiaries. The inclusion case is not a pretext. It is documented, quantified, and endorsed by the development economics literature.

Identity was only the first layer. On top of Aadhaar, India assembled the India Stack: UPI, the government-designed payment rail clearing on the order of 14 billion transactions a month through the state-backed NPCI, with real-time visibility into sender, receiver, amount, and timestamp; DigiLocker (300 million users, 7 billion documents); ABDM (national health ID); ONDC (state commerce protocol); the Account Aggregator framework (1.1 billion accounts linked); and eKYC, instant identity verification for any service. No other democracy has anything comparable in scope or integration.

Funding & Backers

UIDAI is a government authority — the funding line is the Indian state, and the 2025 rule-making runs through the Ministry of Electronics and IT. The backers worth cataloguing are the export wing. In 2018 the International Institute of Information Technology Bangalore launched MOSIP — the Modular Open Source Identity Platform, explicitly modeled on the Aadhaar architecture and offered free to developing nations — with launch funding from the Bill & Melinda Gates Foundation, the Norwegian Agency for Development Cooperation, the Tata Trusts, and the Omidyar Network. The World Bank’s ID4D program has financed national rollouts of the model with billions in concessional loans, with coverage targets that imply substantially universal enrollment by 2030. By 2025 MOSIP was in production in the Philippines, Morocco, Ethiopia, Sri Lanka, Togo, Uganda, Guinea, and the Democratic Republic of Congo. The pattern: the architecture ships with documentation, training, and technical support. The constitutional jurisprudence does not.

Actions & Institutional Choices

The body count. The Right to Food Campaign and researchers including economists Jean Drèze and Reetika Khera documented starvation deaths — between twenty and fifty, depending on the count, and the researchers state the true number is likely higher — where Aadhaar authentication failures blocked access to food rations the dead were legally entitled to receive. The authentication failure rate was 49 percent in Jharkhand and 37 percent in Rajasthan: manual laborers with worn fingerprints, elderly people with changed iris patterns. Santoshi Kumari was an eleven-year-old girl in Jharkhand. Her family’s ration card was cut off after its Aadhaar linkage failed. Her mother said she died asking for rice. In peer-reviewed follow-up work, Drèze, Khera, and Somanchi documented a 29 percent authentication-failure-driven disruption rate in the PMMVY maternity benefit program, and LibTech India found Aadhaar-related issues in a quarter of MGNREGA wage payments in Jharkhand. These are not edge cases. They are the operating rate of the turnstile in the states where it was tested hardest.

The breach, and who got prosecuted. In January 2018 the Tribune India reported that a reporter had purchased access to the Aadhaar database from an anonymous seller on WhatsApp for 500 rupees — eight dollars — with name, address, photo, phone, and email retrievable by Aadhaar number, and card-printing software available for four dollars more. UIDAI denied the database was breached and filed a criminal complaint against the reporter. Not the seller. The reporter. In October 2023 the cybersecurity firm Resecurity reported 815 million Indian citizens’ records — Aadhaar numbers and passport data — for sale on the dark web, attributed by the firm to a breach of the Indian Council of Medical Research database. The attack surface grows with every integration; when a single identifier is the key to everything, every database that stores it becomes a target.

The Court, and the workaround. On September 26, 2018, the Supreme Court of India in Puttaswamy upheld Aadhaar’s constitutionality 4:1 but struck down mandatory bank and SIM linking, struck the Section 33(2) national-security access provision, and cut data retention from five years to six months — acknowledging that the system’s scope had exceeded its justification. By 2024 Aadhaar was de facto mandatory for virtually every government service anyway. In February 2025 the government extended Aadhaar authentication to private businesses; Supreme Court advocate Prasanna S said the amendment “attempts to virtually re-legislate what was struck down,” and Sidharth Deb of The Quantum Hub warned it “carries the risk of exclusion.” The Rethink Aadhaar campaign — more than 50 organizations — continues to document exclusion testimonials. The Court won the legal battle. The infrastructure won the war.

CONDUCT verdict: ENTRENCHED — INCLUSION ENGINE WITH AN EXCLUSION SWITCH. The inclusion results are real and the counter-argument travels at full strength: 850 million people without papers is a genuine crisis, and a billion dollars a year in recovered subsidy fraud is a genuine result. But the institution’s documented reflexes point one direction — deny the breach and prosecute the messenger, absorb the Court’s constraints through regulatory workarounds, expand into the private sector over the objection of the lawyers who won the original case — and its documented failure mode killed people at a rate its own states’ data made visible. The system was built for the poor. The people it failed hardest were the poor it was built for.

Sources: UIDAI; NPCI — UPI product statistics; NPR: India’s Biometric ID System Has Led To Starvation For Some Poor, Advocates Say (1 Oct 2018); Scroll.in: A year after Jharkhand girl died of starvation, Aadhaar tragedies are on the rise; The Wire: Digital Exclusion — Poor, Elderly Face the Brunt of Aadhaar-Based Authentication Errors; EPW Engage: Aadhaar Failures — A Tragedy of Errors; Tribune India: Rs 500, 10 minutes, and you have access to billion Aadhaar details (Jan 2018); Resecurity: Threat actors sell 800M+ records of Indian citizens on the dark web (Oct 2023); Supreme Court Observer: Puttaswamy (Aadhaar) judgment in plain English; Puttaswamy judgment, full text (26 Sep 2018, PDF); K.S. Puttaswamy v. Union of India — Indian Kanoon; TechCrunch: India expands Aadhaar authentication for businesses, raising privacy concerns (2 Feb 2025); TechCrunch: India makes Aadhaar more ubiquitous, but critics say privacy concerns remain (9 Feb 2026); MOSIP; World Bank ID4D; World Bank: Inclusive and Trusted Digital ID Can Unlock Opportunities for the World’s Most Vulnerable; J-PAL: Digital financial services; Access Now #KeepItOn; Access Now: Internet shutdowns in 2024; SFLC.in Internet Shutdown Tracker; Anuradha Bhasin v. Union of India (2020) — Indian Kanoon; Internet Freedom Foundation — Project Panoptic; LibTech India; Rethink Aadhaar; PMC: A failure to “do no harm” — India’s Aadhaar biometric ID program; Drèze, Khera & Somanchi, “Balancing Corruption and Exclusion,” Economic & Political Weekly, 2020; RBI Annual Report 2023-24 (e-Rupee pilot).