Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 provided by Authentication Regulation 19. They are to use certified devices, equipment, or software are duly registered with or approved or certified by the Authority/agency. The systems and operations are audited by information system auditor. The REs pass the encrypted data to the CIDR through the ASA and the response (Yes/No authentication or e-KYC information) also takes the same route back. The server of the ASA has to perform basic compliance and completeness checks on the authentication data packet before forwarding it to the CIDR. (e) Hacking 212) As far as hacking is concerned, the respondents submit that the authority has involved adequate firewalling and other safety features. The biometric data stored in the CIDR is stored offline. Only templates are online. So far there has been no incidence of hacking. However, the authority is conscious of the hackers and it constantly updates itself to safe guard the data. It may, however, be mentioned that of late certain reports have appeared in newspapers to the effect that some people could hack the website of CIDR, though it is emphatically denied by the UIDAI. Since there are only newspapers reports to this effect which appeared after the conclusion of hearing in these cases and, therefore, parties could not be heard on this aspect, we leave this aspect of the matter at that with a hope that CIDR would find out the ways and means to curb any such tendency. (f) Biometric Solution Providers 213) With respect to foreign companies owning software, Respondents submit that UIDAI has entered into licensing agreements with foreign biometric solution providers (BSP) for software. Even thought the source code of the software are retained by the BSP as it constitutes their Intellectual property, the data in the server rooms is secure as the software operates automatically and the biometric data is stored offline. There is no opportunity available to BSP to extract data as they have no access to it. Substantive, Procedural or Judicial Safeguards: 214) Another grievance of the petitioners is that the Act lacks any substantive, procedural or judicial safeguards against misuse of individual data. Section 23(2)(k) which allows sharing information of Aadhaar holders, in such manner as may be specified by regulations. This means individuals identity information can be shared with the government. This may include demographic and core biometric information, include aspects such as DNA profiles, handwriting, voice-print etc., (in the future). Subsequent linkage with various state and non-state actors that interact with such individual may enable UIDAI to share greater information. The police can easily gain access to all biometric information, bank accounts of the individual, all mobile phones, and meta data associated with any associated linkages, information relating to all mutual funds, policies etc., information relating to travel by air or by rail by such person and so on. 215) In other cases of collection of information of this kind under other laws, there are exhaustive legal procedures. For example, Section 73 of the Indian Evidence Act, 1872 which allows the taking Indian Kanoon - http://indiankanoon.org/doc/127517806/ 144