Your Face is Your Boarding Pass
Digi Yatra, India’s new biometric air travel system, adequately addresses privacy concerns. It is designed to keep personal data on the user’s device and purge data from airport systems 24 hours post-flight. Despite my initial skepticism, the system is efficient and privacy-conscious.
This article was first published in The Mint. You can read the original at this link.
I strongly believe that no matter how repugnant a technology might sound at first blush, I need to try it out myself before forming a firm opinion. When I don’t, I find that my implicit biases colour my judgment - to the point where I assume the worst before giving it a chance. What’s more, as a commentator on the impact that technology has on society, I can hardly express an opinion without having experienced what I am writing about first hand.
Digi Yatra
It was in that spirit of experimentation that I signed up to Digi Yatra - the government’s new biometric access system for air travel - despite protestations from every privacy bone in my body over the risk of handing over facial data. I had to make a day trip to Delhi for a conference and, given the horror stories about the interminable queues at Terminal 3, I was hoping that Digi Yatra would improve the odds that I would make the return flight on time.
Onboarding was relatively easy even though it takes a bit of effort to set it up the Digi Yatra app. You need to first allow the application to take a photograph of you using your phone’s selfie camera. This is the image that will identify you at the airport so try and make sure it is clear and well lit. Once you have done this you need to add your identity information to Digi Yatra. If, like me, you already have the Digilocker app installed on your phone with your Aadhaar details updated, all you need to do is connect Digi Yatra to your DigiLocker app and authorised it transfer your Aadhaar information. From start to finish, it took me all of 5 minutes to complete this initial set-up process. And since this is a one-time set-up process I will never have to bother with it again.
Now all you need to do just before you travel, is share the specific details of your flight with the airport so that they can identify you when you show up. To do this you first add information about your flight to a digital wallet on the app. This is easy enough as the Digi Yatra app can scan the QR code of your boarding pass and automatically extract the relevant flight information that needs to be stored into the wallet. You can do this upto 24 hours in advance but, no later than 2 hours before your flight is scheduled to depart, you have to share the information in your Digi Yatra wallet with the airport so that your face biometrics and associated travel information is uploaded onto the airport’s Biometric Boarding Processing System (BBPS).
Privacy Concerns
Much of the opposition to Digi Yatra has been on privacy grounds. Civil society activists are concerned about the use of facial recognition technology and the fact that if we allow our photograph to be uploaded onto the Digi Yatra servers it will inevitably be used to track us wherever we go.
This fear is misplaced for two reasons. In the first place if it is government access to your photograph what you are worried about, I am sorry to break it to you but that ship has already sailed. For the 100 million of us who have passports and the 1.35 billion of us have who have Aadhaar cards, our photograph is already with the government in one database or the other. It is not clear how Digi Yatra is going to make this situation any worse.
But perhaps most importantly, Digi Yatra has been designed to keep your personal data remains on your device as far as possible. This includes, most importantly for the purposes of this discussion, the photograph you took when you first set the app up. That photo is never shared as is, Instead it is first converted into a digital template that extracts a set of unique data points and stores it in a specified format. These data points are what is used to identify whether the person standing before the scanner is you or not. It is impossible to use this data to generate a photograph of you and so the fact that it is being shared has very little privacy significance.
This is all that is transferred to the airport BBPS when you share your travel information and it is against this biometric template that the airport identifies you as you pass through its various checkpoints. 24 hours after your flight departs all this data is purged from the airport systems.
Privacy by Design
This is privacy by design. At every stage the app makes every effort to use only as much information as is necessary to achieve its stated purpose - no more. And once that purpose is served, all the data is purged. The only place where it remains is on your device - under your control so that you can, if you choose, simply delete the app and all the data that it has collected.
As it happened, the conference I was supposed to be speaking at was running late even before I arrived. When our turn came to speak, the audience must have really enjoyed what we had to say because there were more questions than anyone could have anticipated. By the time I left the venue and got into my cab I knew that there was every likelihood that I was going to miss my flight. Not only did I have the dreaded T3 queues to get past but now I had to contend with New Delhi’s utterly unpredictable mid evening traffic snarls.
Despite the best efforts of Baljeet, my taxi driver, by the time I got to the airport I had just 40 minutes to make it to the boarding gate. I took one look at the long queues at the entrance and knew that if, for any reason my Digi Yatra didn’t work there was no way I would make my flight. I took a deep breath and scanned my boarding pass and looked at the camera till it snapped a picture and turned green. I was through.
Ten minutes later I was in my seat on the plane.
