When the Biometric Says No: Aadhaar and Death at the Margins

Every large welfare system has a nightmare it is built to prevent, and for India’s ration shops that nightmare was always the same: a name on a list that belongs to no one, a card drawing grain for a person who died years ago or never existed at all. Aadhaar — the twelve-digit biometric identity that now sits behind most public benefits — was sold as the cure. Link the card to a fingerprint, the argument went, and the ghost beneficiaries vanish, because a fingerprint cannot be faked and a dead man cannot press his thumb to a scanner. That promise of inclusion is real, and it is worth taking seriously. But Aadhaar exclusion is the other face of the same machine, and it is the face the poorest see. A system that can verify you can also refuse you, and when it refuses the wrong person, the cost is not an inconvenience. Sometimes it is a life.

The machine that says no

Here is how the refusal works, stripped of jargon. To collect your subsidised grain, you go to the ration dealer, and the dealer runs a small point-of-sale device. You press your finger to a scanner; the device sends your fingerprint and your Aadhaar number over a mobile network to a government server; the server compares the print against the one recorded when you enrolled; and only if the two match does the dealer hand over your rice or wheat. Four things have to work at once — your fingerprint, the scanner, the network, and the record. If any single link fails, the answer is no, and the person standing at the counter has no way to appeal to anyone in the room, because no one in the room decided anything. The device did.

And the links fail constantly, in ways that fall hardest on exactly the people the ration shop exists to feed. Manual labourers, farmers, the elderly — the people whose hands have done the most work — are the people whose fingerprints have worn smooth or cracked, so the scanner reads them least reliably. In winter, dry and fissured skin fails to match. In villages at the end of a bad mobile signal, the authentication request never reaches the server. Studies of Aadhaar-enabled distribution have reported biometric authentication failure rates in the range of several to over ten percent — a number that sounds tolerable until you remember that a ten percent failure rate, applied every month to hundreds of millions of dependent people, means an enormous population of the genuinely eligible being turned away from food they are legally entitled to.

A fingerprint scanner does not know the difference between a fraud and a farmer whose hands have worn smooth. It only knows match or no match — and it delivers both verdicts with the same indifferent certainty.

What happened in Jharkhand

The state where this went furthest, earliest, was Jharkhand. In March 2017 the state administration ordered that ration cards not linked to Aadhaar would be treated as null and void. Over the following months, by the state’s own accounting, roughly eleven lakh — over a million — ration cards were cancelled. Officials described this as a purge of fake and duplicate cards, proof the cleanup was working. But a cancelled card and a fake card are not the same thing, and there was no careful sorting of one from the other. A card could be voided simply because a poor, semi-literate family in a remote village had not managed to complete a linking process they may not have understood was mandatory, or could not physically reach an enrolment centre to complete.

In September 2017, in Simdega district, an eleven-year-old girl named Santoshi Kumari died. Her family’s ration card had been cancelled, reportedly for not being linked to Aadhaar; they had received no grain for months and had been surviving on food shared by neighbours and the midday meal she got at school. Her mother later told reporters that as she was dying the girl kept asking for rice, and there was none in the house. The case became national news, and it is important to be precise about what is and is not established. That Santoshi Kumari died, that her family’s card had been cancelled, and that they had been cut off from rations — these are documented. The direct causal chain from Aadhaar to her death was, and remains, officially disputed; authorities in such cases routinely attribute the death to illness rather than hunger, and a single death always has more than one cause. What is not seriously in dispute is that a girl in a household legally entitled to subsidised grain was not getting it, and that the reason her family gives is that the machine had erased them from the list.

Santoshi Kumari was not the only such case, and that is the part that should trouble us most. In the months and years that followed, activists with the Right to Food Campaign documented a series of deaths across Jharkhand and other states in which people who had been denied rations or pensions — because a card was cancelled, or a fingerprint would not authenticate, or a name had fallen out of a database — later died, often elderly or already frail. Journalists and researchers have compiled these into lists that run to dozens of names. In every one of them the government contests the causal link, and in every one of them the honest thing to say is the same careful sentence: these are reported starvation deaths linked to Aadhaar-gated welfare, not deaths a court has ruled Aadhaar caused. But you do not need to prove the strongest version of the claim for the weaker version to be damning. Even if Aadhaar was only ever the last straw, a welfare system should not be in the business of supplying last straws to people already at the edge of survival.

The design trade-off nobody wanted to name

It would be comforting to file all this under bad implementation — glitchy scanners, patchy networks, over-zealous local officials — the sort of thing better engineering fixes. Some of it is that. But underneath the bugs there is a design choice, and the choice is the point.

Every filter that decides who deserves something makes two kinds of mistakes. It can let through someone who should have been stopped — a fake card, a ghost beneficiary — which we call an inclusion error. And it can stop someone who should have been let through — a real, hungry, eligible person — which we call an exclusion error. You cannot drive both to zero at once; tighten the filter to catch more frauds and you inevitably catch more of the genuine poor in the same net. Aadhaar-based authentication was tuned, deliberately, to attack inclusion errors — the ghosts, the duplicates, the leakage that makes for good headlines about savings. The tragedy is that the same tuning that makes a system ruthless about excluding the undeserving makes it ruthless about excluding the deserving, because at the moment of the fingerprint scan the machine cannot tell the two apart. It sees a match or a non-match. It does not see a hungry child.

A tool built to catch the undeserving will exclude the deserving with exactly the same efficiency, because at the counter it cannot tell them apart — it sees only a fingerprint that matched, or one that did not.

This is why the framing of “fixing leakage” is so seductive and so misleading. The independent research on this — including work by economists such as Jean Drèze and Reetika Khera — has repeatedly found that Aadhaar-based biometric authentication did far less to reduce genuine corruption in the ration system than promised, while measurably raising the burden of exclusion on legitimate beneficiaries, and falling hardest on the most vulnerable: widows, the elderly, migrant labourers. Rights groups reported that in a single state, over a single stretch, on the order of millions of families saw ration supplies denied or disrupted over Aadhaar linking problems. The savings that got counted were often not fraud eliminated but eligible people quietly dropped — an exclusion rebranded as an efficiency.

Who the system is built to see

I keep coming back to a simple asymmetry. When a fake card is stopped, no one suffers — that is the whole idea. When a real family is stopped, the family suffers, silently, in a village far from any newspaper, and the system records their non-collection of grain as a success. The very metric that makes biometric authentication look like a triumph — grain not disbursed — is the metric that would look identical whether you had defeated a fraud or starved a citizen. A system that cannot distinguish between those two outcomes in its own numbers is a system that has been designed to not see its own worst failures.

This is the deeper pattern, and it is not unique to ration shops. A technology introduced in the name of the powerless has a way of hardening, over time, into an instrument that serves the convenience of the state and the story it wants to tell about itself — and I have argued at more length in how technology gets captured that this drift is the rule rather than the exception. We saw the same logic of a verifying gaze in facial recognition in India, where a tool sold as public safety quietly becomes a tool of identification and control. We see the privacy dimension of the same architecture in Aadhaar, UPI and privacy, where the trail of authentications is itself a kind of surveillance. And the ration-shop failures are a warning label for the whole ambition of digital public infrastructure: rails this central and this mandatory will, at scale, reproduce their smallest flaws across the largest and poorest populations, and the people least able to route around a failure are the ones standing at the counter.

What inclusion would actually require

None of this is an argument that fraud does not matter, or that ghost cards were a fiction, or that we should have no way to check who is who. It is an argument about which error you decide to fear. A welfare system that is genuinely built for the poor treats an excluded eligible person as the catastrophe — the failure it will pay almost any price to avoid — and treats a leaked ration as a cost to be managed. Aadhaar authentication, as it was deployed, inverted that priority: it made exclusion cheap and invisible, and made the appearance of stopping leakage the thing worth celebrating.

The fix is not mysterious, and where it has been demanded it is simple: no one is ever denied their legal entitlement because a machine could not read them. Authentication can fail open, not closed — offline registers, a witnessed manual override, a dealer empowered to give grain and reconcile the record later. The technology is capable of being built to say when in doubt, feed the person. That it was so often built to say the opposite tells you it was never really the fingerprint that decided who ate. It was a choice about whose mistake we were willing to tolerate — and we chose to tolerate the mistake that falls on people too poor and too far away to make us hear about it until a child has already died asking for rice.