What happened
According to an investigation by Al Jazeera with the Pulitzer Center’s AI Accountability Network, Haryana’s Parivar Pehchan Patra, a mandatory family ID that links several government databases, from birth and death registries to land records and income tax, to decide who in the Indian state receives pensions, subsidised food and other welfare, wrongly recorded living people as dead and assigned families incomes they did not have. The investigation quoted government documents as saying that where verification failed, family income was derived by “logic-based artificial intelligence”, and quoted the department running the system describing the database as a “single source of truth”. The reported errors were the kind a single source of truth makes irreversible. A 102-year-old man, Dhuli Chand, was recorded as dead and spent six months failing to convince the state otherwise; his pension was restored only after he led a mock wedding procession through Rohtak with a placard reading, roughly, “your uncle is alive”, and the case made headlines. A married couple, both 60, were marked dead and lost their pensions for about six months. A widow lost hers after the system attributed an annual income of 600,000 rupees to her nine-year-old granddaughter.
The scale surfaced in the state assembly. According to the reporting, government data presented there showed that over three years, pensions of about 330,000 elderly people and widows were stopped after the system classified the recipients as dead, and several thousand of those people were alive. In August 2023 chief minister Manohar Lal Khattar told the assembly that of 63,353 old-age pensions halted on the basis of the system’s data, 44,050, about 70 percent, were later found to belong to people who were in fact eligible. The state had opened grievance camps to process corrections after the earlier cases made headlines. What the disclosures left unsettled, the journalists reported, was how much of the error came from bad data entry and how much from the system’s own inferences: the state did not clarify in response to their queries, and right-to-information requests about the system, including one from Dhuli Chand asking why he had been recorded as dead, went unanswered, according to the investigation. The Tribune reported a further case of a living pensioner recorded as dead in the system as late as 2025.
What an auditable version would have shown
When the state marked Dhuli Chand dead, nothing in the system could say why. Which database contributed the death signal, which matching rule fired, whether a human confirmed it, and what evidence would overturn it were all unanswerable, which is why the burden fell on a 102-year-old to prove he existed. An auditable version writes a signed record at the moment of each eligibility decision: the source records consulted, the rule or inference that produced the conclusion, and the confidence behind it. With that record, his appeal is a lookup, the state’s 70 percent figure is computable continuously rather than admitted annually, and the split between data-entry error and algorithmic error, the thing the state never disclosed, is a query over the logs.
Where the gap was
A life-or-death fact about a citizen was inferred and acted on without ever being checked against a source that could actually know it. A VerificationGate routes a conclusion as consequential as a record of death to a trusted registry, or to a human confirmation, before any benefit stops; a record that cannot be verified suspends the action, not the pension. A ConductRecord preserves each decision with its sources and reasoning, so that when a living person is cut off, the correction takes a day and an explanation exists to give them.
What governance should have looked like
A system empowered to stop a pension is a system empowered to take food away from someone with no other income, and it should meet the standard that power implies: consequential conclusions verified before they act, every decision explainable from its own records, and error rates the government measures itself rather than discovers in its legislature. The reported response, camps where the wrongly-cut queue to prove they are alive, is what a remedy looks like when the record layer is missing. The state, not the citizen, should carry the burden of proof, because the state is the one that made the decision.
The reference implementation of VerificationGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- In India, an algorithm declares them dead; they have to prove they’re alive (Al Jazeera)
- In India, an Algorithm Declares Them Dead; They Have To Prove They’re Alive (Pulitzer Center)
- Pension predicament: Digital system fails elderly citizens (The Tribune)