Next chapter of India's Aadhaar ID: Simple to use but rigorous underneath

Before running the tech for the world's largest national identity and biometric system, India's Aadhaar, Tanusree Deb Barma's public sector career began in the fields— literally. 

Having served as a young district officer for seven years – and the state's first woman administrative service officer, she has worked across communities scattered thinly over hilly, remote tribal terrains.  

Her job was making rights real on the ground, be it land, a job, a food ration, education or healthcare. 

"Done right, technology levels the playing field: a tribal farmer in a remote village gets the same service, at the same speed, as someone in the capital," Deb Barma tells GovInsider. 

She took this lesson from those early years of public service into her policy work as the Director and then Secretary of IT in two state governments. 

She is now the Deputy Director General at the Technology Centre at the Unique Identification Authority of India (UIDAI), which is the country's statutory authority responsible for the Aadhaar national ID. 

Deb Barma is one of the 50 public leaders featured in Apolitical’s DPI 50 list for advancing digital public infrastructure (DPI) in her country. 

"At UIDAI, the same principle of extending the 'ease of living' to the least privileged drives every policy and technology decision," she explains. 

She highlights that the scale makes it urgent, with Aadhaar handling about one million enrolments and updates a day, and close to 100 million authentications. 

Earlier this year, UIDAI replaced the mAadhaar app with a new Aadhaar app to ramp up security and citizen's control around their personal data. 

Some features of the app reflect the UIDAI's principle that Deb Barma speaks of, including QR-based verification that works in offline environments and doesn't require citizens to show their full identity details, ability to manage other family members' IDs on a single device, and more. 

The app has since passed 60 million downloads, and has even enabled 200+ offline verification entities, she says. 

She shares more about how UIDAI makes a high-stakes identity system feel effortless for residents, while keeping it safe from artificial intelligence (AI)-driven fraud.  

Let residents set the priorities 

“We don’t have to guess where the friction is, because the residents tell us,” says Deb Barma, adding that residents’ feedback is pooled through a customer relationship management (CRM) system from across phone calls, emails to regional office walk-ins. 

The volume of grievances shows the scale of each problem, which then sets UIDAI's priorities, she adds.  

UIDAI also leverages AI voice bots to proactively call residents right after receiving a service to ask how it went.  

"Those ratings are linked to the operator who served them, so frontline accountability is built into the system," she adds. 

Three priority areas were identified for Aadhaar’s upgrades, including speeding up enrolment, simplifying corrections, and improving fingerprint matching. 

Aadhaar reduced the enrolment and update requests from 10 days on average to three days by upgrading the tech, improving enrolment processes and automating checks of supporting documents against government records.

Besides making it simpler for residents to correct their identity details, it also improved fingerprint matching for elderly residents and people with worn fingers. 

Deb Barma highlights that improving the fingerprint matching has boosted the authentication success rates by about 10 per cent. 

"A big win for the people most likely to be turned away," as she calls it, highlighting this group of users as elderly pensioners, construction workers, and farmers. 

An in-house AI to improve face authentication 

With smartphones used as a biometric device, this already removes the biggest cost and logistics barrier, especially given the size of India's population. 

UIDAI has built the AI model in-house to improve recognition and "so [UIDAI] could keep retraining it for Indian realities: harsh light, every skin tone, ageing faces, cheap cameras." 

UIDAI also made the authentication system consent-based and matched it against the resident's photo in the Aadhaar system.  

So, there was no need to create a new database.

While UIDAI works on improving its models and tackling AI proofing, it lets the industry ecosystem drive the adoption of face authentication. 

More than 200 public and private entities have built it into their own journeys, including state governments using it for public food distribution, telecom operators needing to onboard customers, and small-loan issuers verifying their borrowers. 

“Each knows its own last mile better than we do, and each takes face authentication there.” 

In September, UIDAI also launched a face authentication software development kit (SDK) for industry partners to directly embed the feature in their own apps. 

Face authentication for Aadhaar now runs at around 190–200 million transactions a month. 

Within six months of implementing these improvements, cumulative transactions for Aadhaar rose from one billion to two billion, with single days topping 15 million transactions. 

Redesigning processes is the hard part 

Deb Barma acknowledges that the cultural shift "took as much effort" as the code for the new app itself. 

"The harder change was internal," she notes, adding that the team at UIDAI had to decide which checks needed human eyes, rewrite procedures built around physical packets, and reset turnaround targets from days to minutes.  

Teams used to working in batches had to adapt to working in a continuous digital flow. 

Another process shift was moving the citizen's trust from the physical counter to the resident's own phone. 

To make this shift as easy and secure as possible, UIDAI combined its own face authentication with security features already built into Android and iOS, so that Aadhaar app can confirm the person holding the phone is indeed the Aadhaar holder. 

Without unnecessarily creating more steps for residents to clear security barriers, UIDAI also differentiates the risks based on the type of request. 

UIDAI’s internal team uses AI to spot anomalies across data points, including biometrics presented, the documents submitted, and transaction histories.  

“Our data science, statistical analysis and information security teams work together to make sense of that data and find the needle in the haystack.  

“Every flag is validated before action is taken, to keep false positives to a minimum,” she explains. 

UIDAI welcomes startups and researchers to "break [its AI] models before fraudsters do," as Deb Barma recognises that generative AI keeps changing the nature of attacks.

Another feature of the Aadhaar app that she calls a “game changer” tackles a common challenge faced by residents. 

Those who have moved in with family, or have no address proof in their own name, can update their address to match a family member’s without further documents, if that family member consents. 

The consent is recorded digitally on the Aadhaar app. 

Making an official process feel simple on a small screen took design help too. 

UIDAI worked with some of the top design schools, design houses, and professionals, many of them contributing on a voluntary basis under the agency’s volunteer policy. 

Lessons for governments  

“Inclusion comes from alternatives, not perfection,” says Deb Barma. 

Instead of achieving 99.9 per cent accuracy on a single modality, a system with some failure for every modality may be more inclusive. 

“Fingerprint, iris, OTP and face each fail someone,” she notes, adding that there is no single biometric working for every citizen.  

She also cautions governments against treating identity as a one-time launch, but as a permanent workload. 

Her advice is to budget for updates from day one, as the residents’ faces, residences and numbers change. 

Also, bet on open standards to ease integration across borders.  

She notes that Aadhaar’s verifiable credentials align with global standards, including SD-JWT, OpenID4VC, ISO mobile license standards as well as the EU Digital Identity Wallet. 

Another lesson is to try to ensure that law keeps at pace with technology.  

“Our early years taught us that a clear legal and data protection framework is what turns adoption into trust,” she says. 

Finally, avoid neglecting the fields. "Enrolment centres are where trust is won or lost. Secure the devices, and train and support the operators," she says. 

Next steps for Aadhaar 

The next leap is moving from “verify with us” to “carry it with you," says Deb Barma. 

Today, most identity checks still call back to UIDAI’s servers.  

But with Aadhaar's verifiable credentials, citizens hold a signed, tamper-proof credential on their phone and share only what a service needs. The verifier can then check it even when offline.  

Currently, more than 100 verifiers have registered, she says. 

She sees three gains from this shift, including privacy since less data moves between systems, resilience as verification no longer needs a live connection, and portability as it allows credentials to travel across borders through interoperable standards.  

"The test I hold us to is simple. Any citizen, on any phone, anywhere, should be able to prove who they are in seconds, share only what they choose, and never be turned away because the system failed them," she concludes.