Do you have a Cloud Computing Strategy for your organization yet?

While discussing Hybrid vs Public Cloud with a client I realized that they still did not have an strategy for using Cloud for the enterprise.Cloud Computing has been here for a decade and yet cloud computing issues are still perplexing many CIOs. Studies indicate that less than 10% of enterprises have a well defined Cloud Strategy. All the new applications development in the next few years would have to follow the enterprise Cloud Computing strategy. Having a well planned Cloud Strategy will enable business to apply its tenets quickly with fewer delays, thus speeding the arrival of the ultimate business outcomes. So if your CIO still does not have a Cloud Strategy for your enterprise it's time he should define one. The 1st step in the journey to the Cloud is to understand the multiple aspects & phases of Cloud Computing.

                                            Soon everything will be served on the Cloud !

Cloud computing : 

The average cloud spending across industries is anything between 5 to 10% and most organizations are migrating on premise data center to cloud. The spending is projected to grow every year as legacy applications are migrated and new applications are built. A key benefit of public cloud infrastructure as a service (IaaS) and platform as a service (PaaS) is to place applications closer to customers to enable a better user experience. Private cloud computing is also being exploited, especially where intellectual property, control, regulatory or compliance concerns, security, performance, and cost of service delivery are differentiated. In such cases, private clouds run on-premises, in co-location facilities or at provider facilities, and they can offer similar benefits to public cloud computing. Organizations are also exploiting Hybrid cloud computing with focus on  integration between the internal and external (or two or more external) environments at the data, process and/or security layers.

Defining a case for Cloud Computing : 

Next step is to define a Cloud Strategy based on the business vision and the digital strategy. Digital business requires speed and agility that cloud computing provides through the use of cloud services – which become available to a broader set of users through a dynamic self-service interface. Users “help themselves” to these cloud services, stimulating creativity and innovation.

CIOs need to educate their organization about the need to invest in cloud as a style of computing that drives greater speed, agility and innovation through this democratization of IT and the benefits they can derive from Cloud Computing. Organization's digital business strategy should justify the investments needed for cloud computing.

Design for Cloud  : 

Just using cloud services is not enough: you must optimize your application design for the cloud. Migrating applications to cloud requires change in application architecture and design. Unless we adapt the design to Cloud Computing we may land into badly designed application with poor scalability and performance with high maintenance overhead. We have to optimize our applications for cloud computing with the explicit purpose of getting the most value at the lowest effective cost. New applications essentially have to be designed for the Cloud and migration of legacy application should also be designed for the cloud.

Finally a picture of a sample Cloud Strategy Road-map for an enterprise.

Securing Mobile Applications

Mobile applications draw the attention of hackers more and more each day because they have something that the attackers want, user personal data. Hard-coded secret keys, personal information stored in plain text on SD cards, usernames and passwords found unencrypted in databases, analytics collected and sent in the clear to remote servers, are just a few cases that make the life of an attacker easier.

So how do we protect data on mobile phones? To protect sensitive data, and ensure confidentiality and/or integrity developers have to use Cryptography. There are many cryptographic libraries that can be integrated into Android applications. Cryptographic libraries can be seen as cryptographic tools that contain tools, such as encryption algorithms, padding schemes, and hash functions.

Few of the common basic cryptography libraries are as follows -
1) AeroGear (Crypto AeroGear) Apache 2.0 license
2) Conceal (Facebook) BSD license,
3) Keyczar (Google) Apache 2.0 license

Once you decide to encrypt appication data you have to decide how to implement it. What encryption algorithm should you use, AES or DES? How long should your key be, 128 or 256 bits? Which encryption mode should you use, ECB or CBC? If you do not have an answer to all these questions, along with a good reason for each answer, then it seems that you have found yourself in a position where, although you probably have all the tools you need, you are not absolutely sure which ones to use and how.

The cryptographic toolkits do not implement any exotic cryptographic functionalities, nor do they intend to replace the cryptographic libraries presented above; they rather built on some of them with the sole purpose of making cryptography easier and safer to use.

These toolkit may supports only a subset of the algorithms, modes, schemes, parameters, and other cryptographic tools that are out there. Instead it provides you with sensible defaults in case you (a) know what you want to do but don’t know how to do it, or (b) don’t really care as long as you end up with a safe solution. Let’s examine some of these toolkits to better understand their role.

There are many good sites to learn more about cryptography & one of the websites I can recommend  is  https://www.garykessler.net/library/crypto.html

How to start innovation? How to build an 'Innovation Culture' in your organization?

In an organizational culture is a system of shared assumptions, values, and beliefs, which governs how people behave in organizations. These shared values have a strong influence on the people in the organization and dictate how they act, and perform their jobs. Organizations today have high focus on innovation & innovative offerings and it is imperative that organization adopts innovation as part of the organization culture.

                                  Innovation culture can be defined as the work environment that organizations cultivate in order to nurture unorthodox thinking and its application. Organizations that foster a culture of innovation subscribe to the belief that innovation is not the province of top leadership but can come from anyone in the organization.

                    Many organizations claim to that they support innovation. Plan are made on how to go about investing in INNOVATION & providing resources towards the innovation work. But when look at the program over months organization's support seems to be lacking in terms of fostering innovation. Their Reward & Recognition systems do not support innovation or they just stifle it. Usually the problem is that companies have review systems designed to ensure only Completed & Successful projects and programs are recognized. True to the service culture organizations only look at today’s results and not towards the future.

                                                          The CTO directive says  “go innovate,” but the organization usually supports taking 'Only Those Risks That Will Ensure Success' and that seems to defeat the Innovation Culture. GE would not be GE if they had no invested a huge amount of talented resources in research & promoting innovation but most organization defer from allocating the most experienced resources to innovation teams.

So what  needs to change? The answer is Possibility Thinking – starting with a clear definition of where you want Solve with your innovation and then spending time trying to figure out what is required to make it happen. Not focusing on the next single improvement, but rather the final picture first. This frees us from the constraints of the current system and processes and allows for a more open field of possible routes to get to a solution.

                                                                                  

                                      A 5 point approach for building Innovation Culture

1. Innovation Strategy:  Company's Innovation Strategy should be a combination of Top-Down & Bottom-Up collaboration of ideas. A lot of organizations want to innovate but the leadership team has no clear strategy around innovation. Instead, employees are given a broad and general remit to come up with great new ideas. This can lead companies to work on a number of unconnected products and services. In addition to this, innovation teams can find that some of the great ideas they come up with have no internal support from managers because they were never on anyone’s agenda to begin with. What companies need is a clear Innovation Vision that outlines the key trends impacting their business and how the company plans to use innovation to get ahead of those trends. This Innovation Vision should provide a simple guide of the types of innovative ideas the company will invest in. Innovation starts with the strategic decision to pursue specific types of ideas. Innovation tools can then be deployed as best practice to deliver on the chosen innovation strategy.

2. Innovation Funding: Corporate leaders can stifle innovation by how they make decisions to invest in ideas. Whether it is investment of money or resources, investment decisions making is perhaps the most powerful lever managers have in transforming a company's culture. If employees are required to write long business plans before they get any money, the company will end up rewarding the kinds of people who are happy to write such plans. Such practices tend to exclude the creatives and leave them out of the process. Furthermore, innovation succeeds through making several small bets and seeing what works. If the Business planning involves five-year projections, detailed delivery plans and an ask for a large amount of investment money then after a large investment is made, innovation teams are then managed by whether their project is on time and on budget. Such large investments based on detailed plans limit the number of bets a company can make. Since most innovative ideas fail, increasing the number of bets is a good method for discovering ideas that work. As such, what companies need is an investment process that allows managers to make Small Investments on a number of strategically aligned ideas, support employees as they test their ideas and then double-down investment on those ideas that demonstrate traction.

3. Collaboration: Innovation is a team sport. It requires excellent collaboration among siloed business and functional units, across geographies. Finding the best resources in your organization and combining them is a hallmark of successful innovation. To find the best solutions, you need to leverage the full range of expertise across your organization. This requires one to pull capabilities from across the company; this doesn’t happen when people are working separately instead of collaboratively. Another important aspect of innovation is involving the customers to create a breakthrough product.

4. Motivators -  Intrapreneurs are the employees who couple an entrepreneurial mind-set with the ability to leverage company assets such as expertise, channels, brand, market and customer base.to innovate.  To enable innovators to succeed, you’ll need to measure and recognize their innovative efforts. Three metrics play special roles. The first are leading indicators such as the percentage of employees and the size & strength of the internal collaborative ecosystem. The second type of metric measures the process. How many meaningful ideas are in your pipeline? Is your portfolio balanced and robust? Are you commercializing your ideas? Thirdly there are lagging indicators, the metrics focus on the revenues from new products, the impact on profit, and the effect of innovation on brand.

5.) Rewards & Recognition : You need to give public recognition to innovators. Bonuses are great, but they’re private — no one in the organization sees the check. However, when you promote someone based on their contribution to and collaboration on successful innovations, it sets a good example and motives coworkers. Public recognition displays management’s commitment to the people who demonstrate truly innovative behavior. All innovation efforts do not succeed  & in order to drive towards innovative thinking, failure has to be an option. Understanding that the lessons that you learn from failure leads to success is the key to any learning organization.Support of these failures is critical to their ultimate success. Leadership should recognize innovators instead of spending time looking for who was at fault and focus on the leanings from the failure and how to overcome it. How can you avoid it in the future and strive for better results? 

Finally, the hardest part of any innovation culture is to simply Pull Back & stop work on an innovation idea. When innovations are not panning out, not delivering the results expected, or driving to the capability you thought, you need to stop the work and simply move on. This is much harder for people and organizations to do as any innovation begins with a passionate individual or group that truly invests in the direction. While very difficult, it is a critical step in managing those critical resources you have directed towards innovation. An organization that has clear vision for innovation, a well thought innovation strategy and  road-map, encourages collaboration will succeed in building an innovation culture that realizes its innovation goals.

"Service Before Self" - From 10 meter MSL to our boys defending the borders at 5000 meter MSL

I have been a fan of Indian armed forces since I was a kid. After 12th standard I did appear for the NDA entrance exam but I did not clear the exam. When I started working I decided I will contribute a small portion of my salary to the armed forces and started contributing to PM fund with  a special note that I want to contribute for the Indian army and I have bunch of letters from Prime Minister that are sent to everyone who contributes to PM Fund.
                        Every time we have a situation where army/navy/airforce are called into action I can't help but feel proud of the selfless service by these young men. I believe as long as a man serves in the armed forces he is young and that's why we sometimes call them 'Our boys' out of our love, admiration & affection for them. Our boys, our brothers & sisters, our sons & daughters who serve with the motto 'Service before Self' are on call 24/7, 365 days and their are no holidays when you serve the motherland. And what can we say about the families of these brave hearts who have encouraged their sons & daughters to join armed forces but to salute them. I get pained when certain politicians and so called human right activist criticize the Indian army without studying the history of Indian army.

History is witness that Indian army has always been called by civilian government to help protect from enemy and there has not been  single instance where army has taken any step without orders from the civilian government. A government elected by the people works on people's agenda and in people's interest so when you criticize the army you are actually criticizing your own vote, the vote of the majority of Indians.
                                 If you do not like army to be called in by the government then you should have voted for a government of your choice that does not take help of army to maintain peace. Assuming people understand this and they should criticize the government decision and not just criticize the government but also educate the government on what alternatives they have. Sadly people who criticize the government do not seem to have any clue to an alternate solution.

Successive governments have deployed army in J&K. Does governments have any option  but to deploy army when they are fighting terrorism sponsored by a neighboring country? Do these critics expect NGOs to fight the heavily armed enemy that is attacking J&K? Or do they expect civilian government to pickup guns themselves and protect the Kashmiri's from terrorists and Pakistani army? Or do these critics want India to give away a piece of our land to enemy country without resistance? Fine if that is what critics want then do these critics have enough numbers to elect a government that supports their mandate to give away J&K? Or are these critics only a handful of jokers who attack the government to get few minutes of TV publicity? Or are these handful of critics funded by agencies who want to break India? I often wonder how the NGOs that talk in support of terrorist get their funds from outside India and why would someone in another country sponsor these NGO is not to cause unrest in India.
                                             
Where were these critics when army gets called to save flood victims & earth quake victims? Is that the job of the army & police or of National Disaster Management Force? When the nation needs them the armed forces (airforce, navy & army) have been asked to help is all possible areas and they have never failed the country - forget about complaining, because complaining is not in the DNA of Indian Armed forces.

These critics are not smart enough to visualize what will happen if we remove forces from J&K or other border state? Before you know the enemy will reach their Airconditioned cabins in Delhi where these critics of India hibernate & protest. Why in the hell should a man do his duty at Siachen Glacier, 5000 meter above Mean sea level if not to protect his country men?

1. These people do not know that Indian army is the biggest voluntary army n the world . We do not force people to serve in army they join of their own will
2.  Unlike other government organizations and institutions in India, there are no provisions for reservations based on caste or religion in Indian armed forces.
3. The Indian Army is not just about guns and bombs . Army has some smartest engineers who have built the highest bridge 'Bailey bridge' in the world. 
4.  The Military Engineering Services (MES) is one of the biggest construction agencies in India. They have built roads and bridges in areas where no other agency would dare to venture.
5. The Operation Rahat (2013) in Uttarakhand was one of the biggest civilian rescue operations ever carried out in the world.
6. The Indo Pakistan War of 1971 came to end with the surrender of about 93,000 combatants and officials of the Pakistani Army. This is the largest surrender of POW after World War2
7. The UN acknowledges that Indian Army is one of the biggest troop contributors to the United Nations peace making operations.
8. Indian army is considered among the very best in high altitude and mountain warfare.
9. Indian army often trains soldiers from USA, UK & Russia as they are considered best in Jungle warfare.

You cannot imagine the life of these men sitting in cozy rooms with AC and room heater so that your body does not face the adverse change in temperature all the year through. So dear critics don't even bother to get out of your rooms you were meant to stagnate & die in your temperature controlled rooms. But when you attack the army or the government you are indirectly attacking the people of India who have voted for the government and who support the governments decision to deploy army to defend India & its citizen. And if you are attacking me for my decision to vote for a government & army that defends India's sovereignty then I am not going to take it lying down. You attack us on social media, TV or on the roads  and we Indians will protest against you and expose your anti-national mindset that makes you criticize your own country men and our army. One cannot help but think who sponsors these critics who dont have jobs but still have money to take care of their family, Who finances the critics who come to TV every day to attack the army & government? Who sponsors their business class air tickets to foreign countries for pleasure and attending conferences to criticize India? What is the motive of a bunch of Indians critics who seem to have single motive of defaming armed forces and governments that are protecting our people and our sovereignty? Why are these people concerned about Human Rights of Terrorist but not concerned about Human Rights of the ordinary citizen killed by terrorist & naxals? And if critics & NGOs are concerned about HUman Rights of ordinary Indian why do we not see them on the road protesting against the terrorist in J&K, against the stone pelters who attack the police? Why don't the critics & NGO's protest against the naxals in Uttarakhand, Maharashra & Andhra or the Pakistani government that is not just ignoring but sponsoring and protecting terrorist?

Some people protested the actions of Major Gogoi. What would you do Mr.Critic if you were the soldier were given duty to protect 15 poll officials and 200 civilians start to throw stones at you? Assuming you would sacrifice your life what about poll officials, would you let them die?  Major Gogoi had presense of mind. He could have opened fire but he chose not to fire as many civilians could have got killed. He chose to use a surprise element by putting the leader of stone pelters on his jeep so that people were taken by surprise and he got opportunity to save lives of polll officials and his men. Why should army not be proud of such officers who show presence of mind? This is a classic case study that should be used to train army on how to deal with a misled mob of your own country men. Mr Critic, while shouting and screaming you have avoided answering the question, what would you do if you were in Major Gogoi's shoes? Answer that and we can have a meaningful debate. If Major Gogoi was your son you would be proud of him, a soldier who chose not to use gun and yet saved lives. Salute to Major Gogoi and the army that imparts training to shape such smart soldiers. Entire world should be proud of Major Gogoi, Indian army and their respect for human life.
                                         I did not see any NGO protesting against Pakistan for the innocents killed in terror attacks by Pakistani terrorist with audio & video proof of handlers in Pakistan. Are these critics just stray dogs who can bark against their own people's interest but are afraid to raise voice against the REAL terror mongers of the world? Or is criticizing government and army become a new business to earn a living and feeding your family? It must be very shameful for their children to tell their friends that my father/mother earn their living by criticizing my motherland and defending terrorist who attack our country! I hope better sense prevails and these critics realize that in the world today, their existence & sleep is possible because of the forces that protect the country. It is in extreme bad taste  to criticize the people who are defending India and if you are so concerned then mobile people, form a government who ratifies your views and then decide the deployment of Indian army or would you rather prefer to live in Pakistan that is controlled by Pakistani army & cannot take a decision without approval of the army?

I salute the army boys ob vigil from 10 meter Mean Sea Level to 5000 meter Mean Sea Level because in them we trust like nobody else. Jai Hind!

What is Technical Architecture ? Understanding Technology Architecture (3) : Layers

We have seen that Technology Architecture (TA) provides the foundation for software applications. We can  There are 3 virtual layers of TA 
1) Application Architecture, 
2) Technical Architecture  &
3)  Infrastructure Architecture.   
A visualization of  a software system with its application & virtual layers is depicted in the following figure

The layering shown is important: because each layer builds upon the layers below it. 

The Applications, fit into the structure provided by the Application architecture & use Application Services'  (a.k.a Common Application Services, such as data access and session management services.   

The application architecture layer, in turn, leverages common technical services provided by the technical architecture (for example, data caching and authentication).  The Technology Architecture also defines how services are packaged into environments, to support development, execution, and operations of the system.  

All of the architecture layers, including the 'Environments' in which they run, reside on the platforms and technologies defined by the Infrastructure Architecture.

What is Technical Architecture? - Understanding Technology Architecture 2

Like a building requires an Architect to understand the requirements and then create the architecture plan before a civil  engineer constructs the building, the role of Technology Architect is critical for software development.

When a company decided to build a new software for its business requirements it appoints a software project manager to manage the software development.. The project manager follows a 5 step process of plan, analyze, design, build, test and deploy. A Technology Architect is a experienced software engineer with experience of executing multiple applications on multitude of technologies and is aware of the latest software technologies and standards.

A technology architect can be part of the project from the plan stage but his role really starts from the analyze phase of the project plan where he understand the Business Requirements and then defines the Technical Requirements for the project. The architect  addresses the architecture concerns and identifies the Development Environment, Execution Environment and Operations Environment for the project.  At this stage the architects interacts with the project managers and the business to further enhance & refine the requirements by asking relevant questions and validate the assumptions. His job at this stage is to ensure that all the stakeholders understand t& agree on the Technology Architecture requirements & assumptions.

Every software application should have defined service level agreements or SLA. The SLA's are crucial because they define

Intelligent Sensors for Predictive Maintenance of Railways

When comparing European Rail with Indian Rail you will notice quite a lot of differences. European rails are limited companies & are definitely more professionally managed as compared to Indian Railway which has catered to fancies of Railway Ministers who had no understanding or education to manage railway. Ministers did not know How & Why railway has to run like a profitable business if it has to safely transport passengers. A loss making company cannot spend on safety of its passengers and accidents will further cripple the railways. Railway does not need to server Fancy Tea in Mud Cups to become popular - Indian's requirements are very basic, we want punctuality, cleanliness & above all safety of passengers.
                                             Being software architect and a fan of Event Driven Architecture ( An event triggers a software process that checks the type of event and accordingly performs predefined relative action, helping us build smarter software that can decide next task based on previous event). To give a simple real life example, if a "Duranto Fast Train" that is supposed to travel with max speed of 120miles per hour in a particular sector, crosses a station at speed of 130 miles per hour then an unmanned 'Speed Sensor" located at every few kilometers, will captures the speed and sends it to a Rail Database in Real Time or Immediately in layman's language. What happens next is that a Smart Software program that is watching Database for any unusual event understand that the current speed captured by sensor is more than Speed Limit for this particular ' Duranto Fast Train' and this is a EVENT that needs to be ACTED upon. The program next checks what are the recommended actions for 'THIS OVER SPEEDING EVENT' and triggers those actions.
Let's say there are 3 recommended actions in the given order of priority
1) Send SMS to driver that he is over speeding along with time, location & speed data
2) Send SMS to NEXT 5 stations to manually monitor the speed of the train
3) Send SMS to Rail Management so that over-speeding is captured in drivers report card & he is given warning and training if required
The software will perform above 3 actions and continue to watch for other events. Since it is smart software it is able to use other data to identify each train running across the country so One Software will be useful for all trains. This is very simple & limited example of how Sensor, Software & Internet can bring automation in monitoring one aspect of operation & improve safety - rail safety has many aspects as we are all aware and Sensor/Software/Events can help make rail journey safer. Railways in Europe are using Ultrasonic and Microwave sensors to detect flaws in engine parts, wheels, tracks. Ultrasonic sensors emits short ultrasonic pulses and detects the echoes that are reflected from the object - in this case the train. he echoes can be analyzed to predict potential breakdown and help prevent accidents before they can happen. Indian Railways only advantge is as a late comer they have options and technologies that have been tested so they can pick and choose and go for a custom solution. Is railway considering it? Spending money on research is great but if the research does not consider the lessons learnt by Euro Rail and US Rail and comes out with totally different type of solution that has not been tested in real life then we are wasting money. Companies likfe TIBCO have worked withh US and European railways to design Sensor based solutions and they can guide Indian Railways. I would be keen to work on such a project that will change the security paradigm of Indian Railway and guarantee safe journey to each Indian traveler

Burning questions about #Aadhar that we want answered

I have moved the key burning questions about #Aadhar to a new post. Indian citizen is not aware of the answers to these questions and UIDAI  needs to answer the questions before forcing Aadhar down our throat. I am surprised that IT industry leaders are not asking these questions to the government.

Few burning questions regarding #Aadhar are as follows

1) Was #Aadhar architecture designed to handle this large volume of transaction? 

2) Is  #Aadhar secure enough to be accessed by any private company that wants to use it? 

3) Who is monitoring the use of Aadhar data by private companies? 

4) If the Aadhar Database is secure then why has Aadhar data been leaked so many times in last 2 years?

5) Has any independent agency conducted an audit of the #Aadhar Software? Why is govt not publishing the report of such audit so that Indians are reassured that their bio-metrics are safe? 

6) Today hardly 1% of Indians have #Adhar card, Will Aadhar will the system be able to handle #Aadhar transaction when entire India has #Aadhar and every private company starts accessing #Aadhar database to authenticate the customer? 

7) If Software Audit of Aadhar Software has not been done so far it is a huge concern, Who are the CEO & CTO of #Aadhar Software (UIDAI) and why have they not advised the government to conduct  'Yearly Software Audit' of such a crucial software that is going to handle and manage world's biggest citizen bio-metrics database?

8) Does the Aadhar team not think it is necessary to audit the security, availability & scalability of its system by an independent expert agency?

9) Why is #Aadhar & Government not publishing a whitepaper on the security and stability of Aadhar system, particularly after a series of data breaches have been reported by the media?

10) How can #Aadhar team get away fro the responsibility by saying the data breaches were not at the source? 

11) Finally if citizen's bio-metrics data is leaked will he be able to sue the government?

I hope someone from the UIDAI & Govt reads this blog and many other blogs by IT industry experts and better sense prevails. Software systems are great enablers but if they are not designed well they can play havoc beyond our imagination and that is why software industry defines processes and guidelines to ensure development and maintenance of quality software. It would be sad if the most crucial software of India takes a hit because of a bunch of overconfident and under qualified engineers that decide not to use external agencies to validate the software they have built. Indian Govt needs to take measure to ensure security of internet transactions and review the laws to ensure consumer protection. The slogan of Digital India should be changed to Digital India, Secure India. Is #Aadhar 100% secure? I will believe when government publishes a whitepaper on the security measures take to ensure Security of my #Aadhar data and justifies why #Aadhar is being allowed to be used by private companies. It seems we have not learned anything from the mistakes committed by USA when they implemented SSN (Social Security Number)

Why you should be concerned about #Aadhar being made mandatory for citizen of India?

#Aadhar card is a part of world’s largest bio-metrics identity program. The initial vision of Congress Govt was to use #Aadhar to stop fraud and pilferage from India’s social welfare programs. Now the BJP government is gradually making it mandatory for every citizen to use #Aadhar cards for buying railway tickets, Filing tax returns, obtaining PAN card, procuring SIM card & for opening bank account.

So the Indian government now wants to change the Aadhar Vision. This has given rise to concerns of millions because Aadhar database has iris and finger print stored in a central database. Given the weak cyber security laws in the country, you often wonder how safe your banking transactions are; given the fact even your telecom operator store has your Aadhar number. People with Half-Knowledge are trying to convince us that even USA uses SSN and #Aadhar is similar to SSN. One needs to understand SSN is much different from Aadhar and how India’s Aadhar cannot be compared to the USA’s Social Security Number.

What is the difference between Aadhar and SSN
The main difference between Aadhar & SSN is that #Aadhar captures biometrics and SSN does not. Those who still do not understand the impact of Indian governments decision to make Aadhar mandatory need to read further.
                                           In 1936, SSN was introduced as a 9-digit number to be used by the government to track ac citizen’s income and ensure the social benefit on the basis of the same. That’s quite much like Aadhar of ours. Gradually more US government agencies and corporates started storing the records of SSN. In 1961, just like the US Internal Revenue Service started using SSN for identifying taxpayers. However in 1977, under Jimmy Carter, the 39th President of the United States, it was decided that SSN cannot be used as an identification document. Rather, it should only be used as a legal permit to work.

On the Social Security website of the USA government, it is clearly mentioned: “The card was never intended to serve as a personal identification document – that is, it does not establish that the person presenting the card is actually the person whose name & SSN appear on the card.” So eventually in 1977 USA  made a rule that SSN cannot be used for identification of an individual either by govt or private companies. The mistake corrected by USA is being repeated by India by its plans to use Aadhar, which is a single digital identity number as an 'Identity Card' to authenticate you as an Indian citizen.

Aadhar Applicability:   

SSN is for citizens and non-citizens authorized to work in USA: The social security number is primarily for citizens of the United States of America. In certain cases, non citizens who have been authorized by the Department of Homeland Security to work in the US may obtain a Social Security number.

Aadhar is for ALL Indian residents and not just citizen: The Aadhar number is available to any resident of India. Anyone who has stayed in India for 182 days can apply for #Aadhar card . However SSN is only given to the US citizens who have permit to work in the country.

Aadhar Data Collection :

The process of registering people for Aadhar was executed through private enterprises known as "Enroller" who operated freely without any government supervision at the field level. The qualifications needed to become an enrollment agency were quite low and nobody was from a recognized name and often unqualified people were used to collect the data which lead to incorrect data collection as media has widely reported.  It is alleged that some untrained enrollers forgot to collect some, for example address or fingerprint and then to cover their mistake the fudged the data by updating missing data with someone elses data. Shocking but if you remember the kind of sub-contractors who were collecting your Aadhar data I can say whats alleged is not impossible.

Why should we be concerned about #Aadhar Data Security:

#Aadhar database stores everything from finger print to iris to personal details. However in SSN, the US government didn’t collect finger prints. To support their logic, the Social Security website reads: “The use of fingerprints was associated in the public mind with criminal activity, making this approach undesirable.” SSN doesn’t even contain any photograph for that matter. In 2007, there were talks to include these details to act against terrorism, but the country who have experienced terrorist attacks in its worst form and often behave cynical on this matter actually went against it.

Observation of USA Homeland Security about bio-metric identification:

“A bio-metric identifier, such as a fingerprint, can be an effective and highly accurate way to establish the identity of an individual, but it can also facilitate a much higher degree of tracking and profiling than would be appropriate for many transactions,” said Marc Rotenberg, Executive Director, Electronic Privacy Information Center a research organization, speaking on the Use and Misuse of the Social Security Number before the Subcommittee on of the U.S. House of Representatives. He observed that the severe problems would arise if bio-metric identifiers are compromised. "What will happen at the point that your bio-metric identifiers no longer identify you?” he added.

SSN is never used as Unique Identifier while govt plans to use Aadhar as an Unique Identifier:

As per Privacy Policy Guidance Memo of  USA Homeland Security,  “Department of Homeland Security shall not collect or use SSN as a unique identifier; rather, programs shall create their own unique identifiers to identify or link information concerning an individual”.  The SSN card does not serve proof of identity, citizenship, and it cannot be used to transact with and does not have the ability to store information. Did Indian government not consider the impact of their decision to and reasoning of of USA Homeland Security?  Govt is allowing private companies to use Aadhar but USA does not allow SSN to be used by private companies except to verify that person has a work permit. What memo says is that the SSN is required by private businesses only on two cases:

(1) you are involved in a transaction in which the Internal Revenue Service requires notification, or (2) you are engaged in a financial transaction subject to federal Customer Identification Program rules.

However for Aadhar as we know, even the mobile store (read Private Entity) that operates from a small kiosk will ask you to show your Aadhar Card to identify yourself to buy a sim card and no one can stop them from saving a copy of your Aadhar card (how can you?). The banks are already refusing a new bank account for those who do not have Aadhar. I just hope that governments understand what a grave risk they are subjecting all Indians by forcing a software system which is already subject of numerous data leaks 

Why are some IT engineers concerned about #Aadhar? 
Each software system is built to requirement and if the requirements change then there is need to redesign & rebuild the software.  If the initial purpose of Aadhar was to be used in similar manner as SSN where Aadhar becomes the unique ID which is used by government agencies to identify a person and now Aadhar is being used not just by the government but banks, telecom companies and any other private company which means  the usage of Aadhar System will increase by 100X then what the system may have been originally intended to handle. 
                                                                      To get an idea of the volume of Aadhar transactions in a single month, in Dec 2016  alone 2 Cr 79 lakh NEW subscribers were added as per TRAI.. People are buying dual and quad SIM phone so one can imagine the number of times #Aadhar data is being accessed by the Telecom companies and there are another 100 industry sectors from Health to Banking to Hotel that will soon start using Aadhar to validate their customers..

Here is the link to view Wireless Subscriber added in Dec 2016  - Click this link
Here is the link to view latest TRAI Telecom Subscription report - Click this link

 
Let me highlight few burning QUESTIONS that the current Govt & UIDAI need to answer -

1) Was #Aadhar architecture designed to handle this large volume of daily transaction? 

2) Is  #Aadhar secure enough to be accessed by any private company that wants to use it? 

3) Who is monitoring the use of Aadhar data by private companies? 

4) If the Aadhar Database is secure then why has Aadhar data been leaked so many times in last 2 years? If the data was not leaked then why is the Tribune reporter who exposed DataLeak not charged with treason and put in jail?

5) Has any independent agency conducted an audit of the #Aadhar Software? Why is govt not publishing the report of such audit so that Indians are reassured that their personal data as well as their bio-metrics are secure & safe? 

6) Today hardly 1% of Indians have #Aadhar card, Will Aadhar system be able to handle #Aadhar transaction when entire India has #Aadhar and every private company starts accessing #Aadhar database to authenticate the customer? 

7) If Software Audit of Aadhar Software (typically done once every year for critical IT systems) has not been done so far it is a huge concern. Who are the CEO & CTO of #Aadhar Software (UIDAI) and why have they not advised the government to conduct  'Yearly Software Audit' of such a crucial software that is going to handle and manage world's biggest citizen bio-metrics database?

8) Does the Aadhar team not think it is necessary to audit the security, availability & scalability of its system by an independent expert agency?

9) Why is #Aadhar & Government not publishing a whitepaper on the security and stability of Aadhar system, particularly after a series of data breaches have been reported by the media?

10) How can #Aadhar team get away from the responsibility by saying the data breaches were not at the source? 

11) Finally if citizen's bio-metrics data is leaked will he be able to sue the government? The answer is no - the BJP government has cleverly avoided any responsibility towards data leak. I am not a supporter of any political party but I must admit the Congress government did not have this Draconian law and they did not try to fool the public.

I hope someone from the government reads this blog and many other blogs by IT industry experts and better sense prevails. Software systems are great enablers but if they are not designed well they can play havoc beyond our imagination and that is why software industry defines processes and guidelines to ensure development and maintenance of quality software. It would be sad if the most crucial software of India takes a hit because of a bunch of overconfident and under qualified engineers that decide not to use external agencies to validate the software they have built. 

P.S- I have tweeted to UIDAI and volunteered to review the Aadhar System and advice UIDAI because a billion Indians my data privacy is at stake but I did not get a response from UIDAI.

Understanding Technology Architecture (1)

Apart from working as software engineer & technology architect for over 18 years, I have also been conducting training & workshops on Technology Architecture for many years now. People often ask me to share articles on Technology Architecture that they can read and learn about technology architecture. There are many papers published on the internet but not all of them are easy to understand and some of them are quite dull and boring. I am going to start posting about Technology Architecture in the way I explain it to my workshop participants and hopefully people will find it useful read.

                                                              A building architecture 

What is Technology Architecture?

When constructing a building an Architect interact with customer to understand the requirements and how the building will be used and then he create the architecture blueprint that gets reviewed & approved by the civic authorities before a civil  engineer starts the construction of the building.Once the blueprint is ready the architect will use the blueprint to explain to the builder, civil engineers and contractors about the type of foundation, material that should be used and how to build the building.
                                                       In software engineering the Technology Architect creates the Technology Architecture which at nothing but set of high level components that will help him create the architecture blueprint.Once the blueprint is ready the architect will use the blueprint to explain to the development team how the software should be constructed.So Technology Architecture is the blueprint of the software solution.
The Technology Architecture defines
1) the building blocks of the software
2) the relationship of blocks with each other & how the blocks will work together
4) how the current & future business requirement are being met by the solution
5) the standards that are to be followed
6) how solution can reuse certain components of the block
7) how to meet the technical and non-technical requirements ( system performance, throughout, response time, security, scalability etc)

                                            Snapshot of Technology Architecture blocks 


Note- The above sample image is of Microsoft Azure Architecture Blueprint