The Smart cards Expo in New Delhi has thrown up many
marketing gauntlets for the GOI to bite as regards introduction of Smart
Cards for Citizen ID.
One of such gauntlets has been the idea that every one
of the one billion Indian will have a smart card with an embedded digital
certificate so that he can even get an online passport in a day or two. (Ref:
Enclosed report in The Hindu).
Costs are Prohibitive:
If the GOI accepts the suggestion, we shall have 100
crore Smart Cards, a few lakh smart card readers and a few thousand smart
card writers purchased from various vendors who are licking their lips in
anticipation. The total cost of such a purchase would be over Rs 17000
crores. made up of the following.
a) Smart Cards capable of holding data and private
key: Rs 150 per card (Rs 15000 crores)
b) 10 lakh Smart Card readers at around Rs 6000/- per
reader (Rs 600 crores with annual replacement of around Rs 60 crores)
c) 50,000 Smart Card writers at around Rs 3 lakhs
each (RS 1500 crores)
(P.S: The above figures are provisional and it can be
argued that at such quantities the actual costs will be much lower. But in
principle the budget for the exercise is likely to be astronomical.).
It is impossible to think that GOI is really thinking
of such an expenditure nor it is capable of bearing such a huge cost which
will ultimately have to be boarne by the Citizens themselves.
Smart Cards for Digital Signature
The proposal is also faulty from yet another angle.
The Digital Signatures became a legal reality once the
IT Bill was presented in the Parliament in December 1999. But it took more
than three years for two vendors to come up with a proposal to issue
digital certificates, Safescrypt and TCS. The number of certificates so
far issued by these two companies to the public are negligible. Neither of
these companies nor the MIT have invested enough time and money in
building an awareness of Digital Signatures amongst the public or the
corporate sector. The PKI applications also became a reality only in the
current year with Odyssey coming up with some products and Safescrypt
following with a few more.
Under the circumstances the market is no where ready
even at the informed corporate levels to start using Digital Signatures.
None of the Government officials including IT Secretaries and those
governing E-Governance projects have been equipped with digital signatures
as of now. Even the officials of the Controller of Certifying Authorities
themselves are yet to start using Digital Signatures in their
correspondence. Many of the celebrated E-Governance projects are legally
erroneous implementations due to PKI non-compliancy. The task of
educating the market on Digital Signatures is huge and will take several
years to be accomplished.
It is also not clear if the law on digital signatures
would undergo modifications which may make bio-informatics signatures
being used instead of the current technology for digital signatures.
Readers are aware that the undersigned is a strong
advocator of the PKI technology and use of digital signatures. There is
also no doubt that it is in this area that Smart Cards have a relevance
and not for holding data on health or Vehicle registration or Driver's
License details etc.
However, it is neither feasible, nor desirable to
introduce Private Key embedded Smart Cards for the Citizen ID project. We
must remember that such cards will invoke the private key by use of a
"Password" and the security will be as strong as the password. (If the
custody of the Card gets compromised). Hence the possibility of Citizens
losing their identity card and along with it their passport etc is more
than a reality.
Cost of Digital Certificates:
It is also to be remembered that the Digital
Certificates themselves would cost at least RS 500/- per year for each
subscriber or a total of Rs 50,000 crores for the 100 crore Indians who
are eligible for the above smart cards.
Under such circumstances, talking of the advantages
of Smart Cards to hold Digital Signatures and pushing the Citizen ID card
project is nothing but building castles in the air.
The present hype about use of Smart Cards for Citizen
ID needs to be tempered as it may create a situation where huge
investments of the Government may go down the drain.
September 24, 2003
Related Article in The Hindu:
Time to get 'smart' on national ID cards?
Related Article in Naavi.org:
Smart Cards and Their Limitations