Access To Knowledge (A2K)

When the virtual world wakes up the real one

praskrishna — 2013-11-30T09:35:06Z

The unprecedented wave of voices speaking up against sexual harassment in recent times has as much to do with technology as the determination to seek justice. From Twitter to Tumblr, and blogs to pastebin, the internet's anonymity, reach and speed allow small, personal stories of abuse to swell into big stories.

The article by Malini Nair was published in the Times of India on November 24. Nishant Shah is quoted.

The outrage over the Tehelka case started with a post on pastebin, an anonymous document sharing site, on Wednesday evening. It contained the email managing editor Shoma Chaudhury had sent to the Tehelka staff with editor Tarun Tejpal's "atonement" letter appended below. A few hours later, the story had ballooned into a heated debate, and the outpouring forced what was being dismissed as an "internal matter" to be treated as a criminal case.

The two women who recently spoke up against harassment at the hands of a retired Supreme Court judge also used Facebook and the blogosphere to tell their stories, ensuring that the real world was actually moved into taking action. "The social web's biggest comfort is that we are no longer alone," says Nishant Shah, director, Research at the Centre for Internet and Society, Bangalore. "No matter what has happened to us, it has happened to somebody else. The possibility of finding credulous and empathetic audiences who but share our pain, understand it, and respond to it is unprecedented." Retweets and comments have often been described as the digital equivalent of holding hands.

Shah's pick of web campaigns that highlighted the problems include Blank Noise which calls women to talk of small, everyday stories of harassment, the Pink Chaddi drive and Why We Need Feminism, a web venture across American universities.

The other reason why the net encourages victims of abuse who might otherwise have stayed quiet to speak out is its "pseudonymity", as Shah terms it. In societies where there is shame attached to talking about sexual assault, the online space saves women from having to put themselves out in the "physical space" while ensuring that the perpetrator is exposed, he points out.

A plus for social web is that it gets other victims to speak up as well, gathering force and magnitude in the process. This happened in the instance of the legal interns. Another instance that surfaced just a month ago was of two American women science bloggers Danielle Lee and Monica Byrne. When Lee refused to write a piece for free for Biology Online, she was called "urban whore" by an enraged editor. She blogged about it and the ensuing storm over social media got her huge support. After Lee's expose, Byrne blogged about an acutely sexual conversation a powerful science writer inflicted on her. The outrage this provoked abated only after he made amends.

As an article in Gender and Culture blog project puts it: "( The digital world provided) a forum for these victims to document their abuse, and a courtroom where the abusers have been judged and found guilty by public opinion".

Of course there are problems with the internet's version of justice — it tends to play judge, jury and executioner with giddy recklessness. In the Tehelka case, the first questionable moment came when the survivor's email was tweeted and re-tweeted with no concern for her requests for anonymity. "The problem with Twitter and Facebook is the incredible and gross violations of privacy of the survivor. And otherwise responsible adults join lynch mobs calling either the survivor or the accused names, making ridiculous allegations, desperately looking for an easy narrative to hang everything on," says author Nisha Susan, who led the Pink Chaddi campaign.

Commentator Santosh Desai says that it is tough to choose between an unbridled but powerful social web and one that is cautious and governed by norms. "Earlier, there were receivers and broadcasters who were few and governed by licenses and a code of behaviour. Now everyone is a broadcaster, everyone is a circulator and everyone is an aggregator. Having no oversight here could be problematic," he says.

Susan says communities need to go beyond social media in such situations. "It should also be a time for us to reflect. On what we would do in such a situation, how we could perhaps prevent it, on the sense of entitlement powerful men have all over the world, on the awful pressures young women face. We should all be reflecting. Instead we are just re-tweeting."

For more details visit https://cis-india.org/news/the-times-of-india-malini-nair-november-24-2013-when-the-virtual-world-wakes-up-the-real-one

I Just Pinged to Say Hello

nishant — 2013-11-30T08:36:02Z

A host of social networks find us more connected than ever before, but leave us groping for words in the digital space.

Dr. Nishant Shah's article was published in the Indian Express on November 24, 2013.

I am making a list of all the platforms that I use to connect with the large networks that I belong to. Here goes: I use Yahoo! Messenger to talk to my friends in east Asia. Most of my work meetings happen on Skype and Google Hangout. A lot of friendly chatter fills up my Facebook Messenger. Twitter is always available for a little back-chat and bitching. On the phone, I use Viber to make VoIP calls and WhatsApp is the space for unending conversations spread across days. And these are just the spaces for real-time conversation. Across all these platforms, something strange is happening. As I stay connected all the time, I am facing a phenomenon where we have run out of things to say, but not the desire to talk.

I had these three conversations today on three different instant-messaging platforms:

Person 1 (on WhatsApp): Hi.

Me: Hey, good to hear from you. How are you doing?

Person 1: Good.

Me (after considerable silence): So what's up?

Person 1: Nothing.

End of conversation.

Person 2 (On an incoming video call on Skype): Hey, you there?

Me: Yeah. What time is it for you right now?

Person 2: It is 10 at night.

Me: Oh! That is late. How come you are calling me so late?

Person 2: Oh, I saw you online.

Me: Ok….. *eyes raised in question mark*

Person 2: So, that's it. I am going to sleep soon.

Me: Ok…. Er…goodnight.

Person2: Goodnight.

We hang up.

Person 3 (pinging me on Facebook): Hey, you are in the US right now?

Me: Yes. I am attending a conference here.

Person 3: Cool!

Me: Umm… yeah, it is.

Person 3: emoticon of a Facebook 'like'. Have fun. Bye.

Initially I was irritated at the futility of these pings that are bewildering in their lack of content. I dismissed it as one of those things, but I realise that there is a pattern here. Our lives are so particularly open and documented, such minute details of what we do, where we are and who we are with, is now available for the rest of the world to consume, making most of the conversations seeking information, redundant. If you know me on my social media networks, you already know most of the basic things that you would want to know about me. And it goes without saying that no matter how close and connected we are, we are not necessarily in a state where we want to talk all the time. The more distributed our lives are, the more diminished is the need for personal communication.

And yet, the habit or the urge to ping, buzz, DM or chat has not caught up with this interaction deficit. So, we still seem to reach out, using a variety of platforms just to say hello, even when there is nothing to say. I call this the 'Always On' syndrome. We live in a world where being online all the time has become a ubiquitous reality. Even when we are asleep, or busy in a meeting, or just mentally disconnected from the online spaces, our avatars are still awake. They interact with others. And when they feel too lonely, they reach out and send that empty ping — just to confirm that they are not alone. That on the other side of the glowing screen is somebody else who is going to connect back, and to reassure you that we are all together in this state of being alone.

This empty ping has now become a signifier, loaded with meaning. The need for human connection has been distributed, but it does not compensate our need for one-on-one contact. In the early days of the cell phone, when incoming calls were still being charged, the missed call, without any content, was a code between friends and lovers. It had messages about where to meet, when to meet, or sometimes, just that you were missing somebody. The empty ping is the latest avatar of the missed call — in a world where we are always online but not always connected, when we are constantly together, but also spatially and emotionally alone, the ping remains that human touch in the digital space that reassures us that on the other side of that seductive interface and the buzzing gadget, is somebody we can say hello to.

For more details visit https://cis-india.org/internet-governance/blog/indian-express-november-24-2013-nishant-shah-i-just-pinged-to-say-hello

November 2013 Bulletin

praskrishna — 2014-01-04T04:38:08Z

Our newsletter for the month of November 2013 can be accessed below.

The Centre for Internet and Society (CIS) welcomes you to the eleventh issue of its newsletter (November) for the year 2013:

Highlights

CIS is pleased to announce the second "Institute on Internet and Society" to be held in Yashada, Pune from February 11 to 17, 2014. Any members from the civil society (students, research scholars, academicians, scientists, legal professionals, etc.) who engage in issues concerning Internet and Society are encouraged to apply.
The National Resource Kit team is pleased to bring you its research for the states of Tripura, Nagaland and Chattisgarh.
CIS-A2K team signed a memorandum of understanding (MoU) with Christ University in Bangalore to introduce Wikipedia in classrooms.
The Access to Knowledge narrative report capturing the work done by CIS-A2K team in the first ten months of the grant along with its strategy for the next 1 year is published.
Last month we organised the Seventh Privacy Round-table in collaboration with FICCI, DSCI, and Privacy International in Delhi. The developments are captured in a report by Elonnai Hickok.
Along with Wikimedia India and Acharya Narendra Dev College, we organised the Relaunch of Creative Commons in India. Dr. Shashi Tharoor was the chief guest.

Accessibility and Inclusion

As part of our project (under a grant from the Hans Foundation) on creating a national resource kit of state-wise laws, policies and programmes on issues relating to persons with disabilities in India, we bring you draft chapters for the states of Madhya Pradesh and Arunachal Pradesh, and the union territory of Daman and Diu. With this we have completed compilation of draft chapters for 27 states and 5 union territories. Feedback and comments are invited from readers for the following chapters:

► National Resource Kit Chapter

The Tripura Chapter (by CLPR, November 13, 2013): http://bit.ly/1bCFPwq.
The Nagaland Chapter (by CLPR, November 13, 2013): http://bit.ly/1cmKzq0.
The Chattisgarh Chapter (by Anandhi Viswanathan, November 30, 2013): http://bit.ly/1cSczSt.

Note: All of these are early drafts and will be reviewed and updated.

► Other Accessibility Update

# Events Participated In

E-Accessibility Workshop 2013 (organised by Directorate of Information Technology, Government of Maharashtra, Mahaonline Limited and National Internet Exchange of India, November 19-20, 2013): http://bit.ly/1cQ0wd8. CIS was one of the trainer organisations for the event.
National Conference on Harnessing Technology for the Empowerment for Persons with Visual Impairments (organized by NAB Centre for Blind Women & Disability Studies, Indian Islamic Cultural Centre, New Delhi, November 19, 2013). Dr. Nirmita Narasimhan participated as a speaker: http://bit.ly/IzLOty.

Access to Knowledge

The Access to Knowledge programme addresses the harms caused to consumers and human rights, and critically examines Open Government Data, Open Access to Scholarly Literature, and Open Access to Law, Open Content, Open Standards, and Free/Libre/Open Source Software.

The following has been done under grant from the Wikimedia Foundation (http://bit.ly/SPqFOl). As part this project (http://bit.ly/X80ELd), we held 8 workshops, signed a MoU with Christ University for teaching Wikipedia to students, published a detailed narrative report of activities done during the initial period of the Wikimedia grant.

►Wikipedia

# Articles

ಅಂತರ್ಜಾಲದಲ್ಲಿ ನೆಟ್ಟ ಸಸಿಗೆ ಈಗ ಹತ್ತು ವರ್ಷ (by Dr. U.B. Pavanaja, Kannada Prabha, November 1, 2013): http://bit.ly/17LOw4O. The article highlights 10 years of Kannada Wikipedia, the current status of the Kannada Wikipedia vis-a-vis number of articles, number of editors, active editors, and page views per month.
Train The Trainer Programme for Wikipedians (by Subhashish Panigrahi, DNA, November 14, 2013): http://bit.ly/1ehr8kz. The article was edited by Rohini Lakshane of DNA.

# Announcement

CIS Signs MoU with Christ University, Bangalore (November 20, 2013): The Access to Knowledge team signed a MoU as part of which CIS-A2K and Christ University will impart Wikipedia education in Indian classrooms: http://bit.ly/1ehr8kz.

# Report

CIS-A2K Narrative Report (September 2012 – June 2013) (by T. Vishnu Vardhan, Nitika Tandon and Subhashish Panigrahi, November 29, 2013): http://bit.ly/1dFyjpO. The report throws some light on the CIS-A2K program strategy in the next one year.

# Blog Entries

Note: A couple of the below blog entries were carried in the Access to Knowledge newsletter last month.

Konkani Vishwakosh Digitization Project (by Nitika Tandon, November 13, 2013): http://bit.ly/1dodyuK.
Konkani Vishwakosh Under CC-BY-SA (by Nitika Tandon, November 13, 2013): http://bit.ly/1cm9wBH.
Train the Trainer Program (by Subhashish Panigrahi, November 18, 2013): http://bit.ly/18hjw0n.

# Event Co-organised

The Relaunch of Creative Commons India (co-organised by Wikimedia India, Acharya Narendra Dev College and CIS, India Islamic Cultural Centre, November 12, 2013): http://bit.ly/HPxrAO. Dr. Shashi Tharoor, Minister of State for Human Resource Development was the chief guest at the event.

# Events Organised

Wikipedia Orientation Programme for MA Students (Christ University, Bangalore, November 12, 2013): http://bit.ly/ItxAtu. Syed Muzammiluddin was the trainer. Twenty students participated.
Wikipedia Orientation Programme for the Second Language Students (Christ University, Bangalore, November 12, 13, 16 and 19, 2013): http://bit.ly/1bxsOYF. T. Vishnu Vardhan, Syed Muzammiluddin and Dr. U.B.Pavanaja were the trainers. About 1200 second language students participated in the programme.
Documentation and Wikipedia Contribution — A One Day Workshop (Kalinga Institute of Social Studies, Bhubaneswar, November 14, 2013). The workshop was conducted by Subhashish Panigrahi: http://bit.ly/1fSvl1v.
Documentation and Wikipedia Workshop (Kalinga School of Management, Bhubaneswar, November 16, 2013): http://bit.ly/Imf0DV. Subhashish Panigrahi conducted the workshop.
Konknni Wikipedia Workshop (organised by Dalgado Konknni Akademi and CIS-A2K, Goa Central State Library, November 16 and 17, 2013): http://bit.ly/1fSwiH5.
Tenth Anniversary of Wikipedia (H N Multimedia Hall, National College, Basavanagudi, Bangalore, November 17, 2013): http://bit.ly/1eJ6da9. Dr. U R Ananthamurthy, Prof. G. Venkatasubbiah and Ravi Hegde were the guests of honour. Dr. U.B. Pavanaja conducted the workshop.
First Phase of Odia Wikipedia Workshop (Indian Institute of Mass Communication, Bhubaneswar, November 18, 2013): http://bit.ly/18doDer. Subhashish Panigrahi conducted the workshop.
Konkani Wikipedia Workshop (Nirmala Institute of Education, Goa, November 19, 2013): http://bit.ly/1fSAUwT. Nitika Tandon conducted the event.

# Event Participated In

Wikimedia Diversity Conference (organized by German Wikipedia Community, GLS Campus, Berlin): http://bit.ly/Ixr9W8.

# Media Coverage

CIS gave its inputs for the following media coverage:

Kannada Wikipedia and its Tenth Anniversary (RadioCity, November 2, 2013): http://bit.ly/1dHEwBI.
10th anniversary of Kannada wikipedia (The Times of India, November 15, 2013): http://bit.ly/IxqDr7.
Tenth Anniversary of Kannada Wikipedia (Udayavani, November 15, 2013): http://bit.ly/1aFwqF1.
ಕನ್ನಡ ವಿಕಿಪೀಡಿಯಕ್ಕೆ ಈಗ ದಶಮಾನೋತ್ಸವ. ಅದರ ಪ್ರಯುಕ್ತ ಒಂದು ಆಚರಣೆ (Avadhi Website, November 16, 2013): http://bit.ly/ImiBSy.
ಕನ್ನಡ ವಿಕಿಪೀಡಿಯಗೆ 10, ಬೆಳವಣಿಗೆ ಸಾಲದು : ಪ್ರೊ .ಜಿವಿ (OneindiaKannada, November 17, 2013): http://bit.ly/1fSAUwT.
Tenth Anniversary of Kannada Wikipedia (Vijayavani, November 17, 2013): http://bit.ly/1b7exSa.
ಕನ್ನಡ ವಿಕಿಪೀಡಿಯಕ್ಕೆ ದಶಮಾನೋತ್ಸವ ಸಂಭ್ರಮ (Prajavani, November 18, 2013): http://bit.ly/1hWtt9v.
ಕನ್ನಡದ ಆನ್‌ಲೈನ್ ವಿಶ್ವಕೋಶ ದುರ್ಬಲ (Vijaya Karnataka, November 19, 2013): http://bit.ly/1hWtsCy.
Panaji: DKA organizes two day Konkani Wikipedia workshop (Daijiworld, November 18, 2013): http://bit.ly/1inoi03.

Note: The following are not a part of the Wikimedia Grant:

► Other

# Blog Entries

History of Creative Commons in India (by Priyank Dwivedi, November 13, 2013): http://bit.ly/17txcH7.
How Can We Make Open Education Truly Open? (by Dr. Nishant Shah, DML Central, November 22, 2013): http://bit.ly/1ezsAyj.

# Events Participated In

Conference on e-Governance for India: Opportunities, Challenges and Policy Alternatives (organised by OECD Korea Policy Centre in partnership with the Centre for Good Governance, Hyderabad, November 6-7, 2013): http://bit.ly/1cGP13c. Sunil Abraham was a panelist in the session on OECD Principles on eGovernment and their applicability to the developing world and India.
Indo-European Conference on the Role of the Patent System in Fostering Innovation and Technology Transfer (organized by European Patent Office, FICCI and European Business & Technology Centre, November 29, 2013, New Delhi). Nehaa Chaudhari participated in this conference.

Internet Governance

CIS is doing a project (under a grant from Privacy International and International Development Research Centre (IDRC)) on conducting research on surveillance and freedom of expression (SAFEGUARDS). So far we have organised seven privacy round-tables and drafted the Privacy (Protection) Bill. This month we bring you a report from the seventh privacy round-table held in Delhi, and an analysis on why Facebook is more dangerous than government spying. As part of its project (funded by Citizen Lab, Munk School of Global Affairs, University of Toronto and support from the IDRC) on mapping cyber security actors in South Asia and South East Asia we did an interview with Namita A Malhotra, a researcher and lawyer from Alternative Law Forum. With this we have completed a total of 12 video interviews:

►Privacy

# Event Report

Seventh Privacy Round-table (organised by FICCI, DSCI, Privacy International and CIS, October 19, 2013): http://bit.ly/187pFOO. The report was published in the month of November.

# Newspaper Columns

Open Secrets (by Nishant Shah, Indian Express, October 27, 2013): http://bit.ly/1b5uvK0.
I Just Pinged to Say Hello (by Nishant Shah, Indian Express, November 24, 2013): http://bit.ly/183H34t.

# Blog Entries

An Interview with Caspar Bowden (by Maria Xynou, November 6, 2013): http://bit.ly/17LQqFX.
India's Response to WGEC Questionnaire (by Snehashish Ghosh, November 13, 2013): http://bit.ly/HX0r96.
Why 'Facebook' is More Dangerous than the Government Spying on You (by Maria Xynou, November 19, 2013): http://bit.ly/HWLFzi.
CIS Supports the UN Resolution on “The Right to Privacy in the Digital age” (by Elonnai Hickok, November 30, 2013): http://bit.ly/1c2A89q.

# Events Organised

IDEX Impact Assessment Workshop (organised by IDEX, CIS, Bangalore, November 16, 2013): http://bit.ly/1bxRfFm.
The Evolving Cyber Threat and How to Address It (CIS, Bangalore, November 22, 2013): http://bit.ly/1cEkUZY.
Panel on Privacy, Surveillance & the UID in the post-Snowden era (Institution of Agricultural Technologists, Bangalore, November 30, 2013): http://bit.ly/1ctSHW3.

# Events Participated In

Chances and Risks of Social Participation (organised by Alexander von Humboldt Institute for Internet and Society and Friedrich Ebert Foundation, Berlin, November 22, 2013). Dr. Nishant Shah gave the keynote: http://bit.ly/18PcMXN.
Expert Committee Meeting on Human DNA Profiling Bill (organised by the Ministry of Science & Technology, Government of India, New Delhi). Sunil Abraham participated in the meeting: http://bit.ly/19CpDbD.

# Upcoming Event

Big Democracy: Big Surveillance - A Talk by Maria Xynou (CIS, Bangalore, December 3, 2013): http://bit.ly/1j4mzgu.

► Cyber Security

Laird Brown, a strategic planner and writer with core competencies on brand analysis, public relations and resource management and Purba Sarkar who in the past worked as a strategic advisor in the field of SAP Retail are working in this project:

# Video Interview

Part 12: An Interview with Namita A. Malhotra (November 15, 2013): http://bit.ly/1j8MCjN.

# Documentary Film

First Look: Cyber Security Film (by Purba Sarkar, November 18, 2013): http://bit.ly/1alHhVu. The trailer was presented by Laird Brown recently at the IGF.

# Upcoming Event

DesiSec: Episode 1 - Film Release and Screening (December 11, 2013): Screening of the first documentary film on cyber security in India.

News & Media Coverage

CIS gave its inputs to the following media coverage:

EC guidelines on social media: Welcome move, but not enough (by Shruti Dhapola, FirstPost, November 1, 2013): http://bit.ly/1c3fNkt.
NSA leaks helping India become 'Big Brother' state? (British Broadcasting Corporation, November 1, 2013): http://bit.ly/1b7ftDG.
Spy agencies, IB and RAW, put spanner in proposed privacy law (by Nagender Sharma and Aloke Tikku, Hindustan Times, November 2, 2013): http://bit.ly/1aox4HP.
India must support UN's e-snooping move: Human rights activists (by Indu Nandakumar, Economic Times, November 11, 2013): http://bit.ly/18LrI5s.
Social media promotions can backfire, too (by Ratna Bhushan and Varuni Khosla, The Times of India, November 11, 2013): http://bit.ly/1gMj7rg.
YouTube is the answer to what has changed in India (by Moulishree Srivastava, Livemint, November 20, 2013): http://bit.ly/1fg214A.
When the virtual world wakes up the real one (by Malini Nair, November 24, 2013): http://bit.ly/1hovyd3.

Digital Natives

CIS is doing a research project titled “Making Change”. The project will explore new ways of defining, locating, and understanding change in network societies. Having the thought piece 'Whose Change is it Anyway' as an entry point for discussion and reflection, the project will feature profiles, interviews and responses of change-makers to questions around current mechanisms and practices of change in South Asia and South East Asia.:

► Making Change

# Blog Entries

Methods to Conceive and Condense Social Change (by Denisse Albornoz, November 30, 2013): http://bit.ly/1ezrBhw.
Blank Noise and the Active Citizen Dissonance (by Denisse Albornoz, November 30, 2013): http://bit.ly/IwOHu9.

► Other

# Blog Entry

Digitally Enhanced Civil Resistance (by Denisse Albornoz, November 20, 2013): http://bit.ly/18ndc7p.

Telecom

Shyam Ponappa, a Distinguished Fellow at CIS is a regular columnist with the Business Standard. The articles published on his blog Organizing India Blogspot is mirrored on our website:

► Newspaper Column

Predictability in Infrastructure (by Shyam Ponappa, Business Standard, November 6, 2013 and Observer India Blogspot, November 10, 2013): http://bit.ly/1dLZ0Fp.

Knowledge Repository on Internet Access

CIS in partnership with the Ford Foundation is executing a project to create a knowledge repository on Internet and society. This repository will comprise content targeted primarily at civil society with a view to enabling their informed participation in the Indian Internet and ICT policy space. The repository is available at the Internet Institute website: http://bit.ly/1iQT2UB.

►Upcoming Event

Institute on Internet and Society (organised by Ford Foundation and CIS, Yashada, Pune, February 11-17, 2014): http://bit.ly/180mQi9. The application form is available at http://internet-institute.in/form. Registrations close on December 15, 2013.

► Modules

Internet Engineering Task Force (by Anirudh Sridhar, November 30, 2013). The Internet Engineering Task Force (IETF) is an open standards body with no requirements for membership and does not have a formal membership process either: http://bit.ly/1c4aOQr.
World Summit on Information Society (WSIS) (by Anirudh Sridhar, November 30, 2013). The World Summit on Information Society was first proposed by the International Telecommunication Union in 1998. The main focus of the WSIS was to address issues related to the global digital divide. However, the scope of the WSIS was broadened later to include internet related public policy issues: http://bit.ly/186dbnV.

Digital Humanities

CIS is building research clusters in the field of Digital Humanities. The Digital will be used as a way of unpacking the debates in humanities and social sciences and look at the new frameworks, concepts and ideas that emerge in our engagement with the digital. The clusters aim to produce and document new conversations and debates that shape the contours of Digital Humanities in Asia:

► Event Participated In

From Seemingly Transparent to Definitely Opaque (organised by University of St. Gallen, Switzerland, November 4-7, 2013): http://bit.ly/19b6IW1. Nishant Shah taught this course and also presented on a panel on 'Secrets of Digital Culture'.

About CIS

The Centre for Internet and Society is a non-profit research organization that works on policy issues relating to freedom of expression, privacy, accessibility for persons with disabilities, access to knowledge and IPR reform, and openness (including open government, FOSS, open standards, etc.), and engages in academic research on digital natives and digital humanities.

► Follow us elsewhere

Twitter: https://twitter.com/CISA2K
Facebook group: https://www.facebook.com/cisa2k
Visit us at: https://meta.wikimedia.org/wiki/India_Access_To_Knowledge
E-mail: a2k@cis-india.org

► Support Us

Please help us defend consumer / citizen rights on the Internet! Write a cheque in favour of ‘The Centre for Internet and Society’ and mail it to us at No. 194, 2nd ‘C’ Cross, Domlur, 2nd Stage, Bengaluru – 5600 71.

► Request for Collaboration:

We invite researchers, practitioners, and theoreticians, both organisationally and as individuals, to collaboratively engage with Internet and society and improve our understanding of this new field. To discuss the research collaborations, write to Sunil Abraham, Executive Director, at sunil@cis-india.org or Nishant Shah, Director – Research, at nishant@cis-india.org. To discuss collaborations on Indic language wikipedia, write to T. Vishnu Vardhan, Programme Director, A2K, at vishnu@cis-india.org.

CIS is grateful to its donors, Wikimedia Foundation, Ford Foundation, Privacy International, UK, Hans Foundation and the Kusuma Trust which was founded by Anurag Dikshit and Soma Pujari, philanthropists of Indian origin, for its core funding and support for most of its projects.

For more details visit https://cis-india.org/about/newsletters/november-2013-bulletin

CIS Supports the UN Resolution on “The Right to Privacy in the Digital age”.

elonnai — 2013-11-30T07:25:18Z

The United Nations adopted the resolution on the right to privacy recently. It recognised privacy as a human right, integral to the right to free expression, and also declared that mass surveillance could have negative impacts on human rights.

On November 26, 2013, the United Nations adopted a non-binding resolution on The Right to Privacy in the Digital Age. The resolution was drafted by Brazil and Germany and expressed concern over the negative impact of surveillance and interception on the exercise of human rights. The resolution was controversial as countries such as the US, the UK, and Canada opposed language that spoke to the right to privacy extending equally to citizens and non-citizens of a country. The resolution welcomed the report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression that examined the implications of surveillance of communications on the human rights of privacy and freedom of expression.

The resolution made a number of important statements that India, as a member of the United Nations, and as a country in the process of implementing a number of surveillance projects, like the Central Monitoring System, should take cognizance of, including in short:

Privacy is a human right: Privacy is a human right according to which no one should be subjected to arbitrary or unlawful interference with his or her privacy, family, home, or correspondence.
Privacy is integral to the right to free expression: an integral component in recognizing the right to freedom of expression.
Unlawful and arbitrary surveillance violates the right to privacy and freedom of expression: Unlawful and/or arbitrary surveillance, interception, and collection of personal data are intrusive acts that violate the right to privacy and freedom of expression.
Exceptions to privacy and freedom of expression should be in compliance with human rights law: Public security is a potential exception justifying collection and protection of information, but States must ensure that this is done fully in compliance with international human rights law.
Mass surveillance may have negative implications for human rights: Domestic and extraterritorial surveillance, interception, and the collection of personal data on a mass scale may have a negative impact on individual human rights.
Equal protection for online and offline privacy: The right to privacy must be equally protected online and offline.

The resolution further called upon states to:

Respect and protect the right to privacy, particularly in the context of digital communications.
To ensure that relevant legislation is in compliance with international human rights law
To review national procedures and practices around surveillance to ensure full and effective implementation of obligations under international human rights law.
To establish and maintain effective domestic oversight mechanisms around domestic surveillance capable of ensuring transparency and accountability.

The resolution finally calls upon the UN High Commissioner for Human Rights to present a report with views and recommendations on the protection and promotion of the right to privacy in the context of surveillance to the Human Rights Council at its twenty-seventh session and to the General Assembly at its sixty-ninth session and decides to examine “Human rights questions, including alternative approaches for improving the effective enjoyment of human rights and fundamental freedoms”.

The UN Resolution on the Right to Privacy in the Digital Age is a welcome step towards an international recognition of privacy as a human right in the context of communications and extra territorial surveillance. The Centre for Internet and Society encourages the Government of India to, as called upon in the Resolution, to review national procedures and practices around surveillance to ensure full and effective implementation of obligations under international human rights law.

Prior to the UN Resolution on “The Right to Privacy in the Digital Age”, a group of international NGO’s developed the Necessary and Proportionate principles that seek to form a backbone for a response to mass surveillance and provide a framework for governments to assess if domestic surveillance regimes are in compliance with international Human Rights Law. CIS has contributed to the process of developing these principles. The principles include legality, legitimate aim, necessity, adequacy, proportionality, competent judicial authority, due process, user notification, transparency, public oversight, integrity of communications and systems, safeguards for international cooperation, and safeguards against illegitimate access. A petition to sign onto the principles and demand an end to mass surveillance is currently underway.

Both the Government of India and public of India should take into consideration the UN Resolution and the necessary and proportionate principles to reflect on how India’s surveillance regime and practices can be brought in line with international human rights law and understand where the balance is drawn for necessary and proportionate surveillance, specific to the Indian context.

For more details visit https://cis-india.org/internet-governance/blog/cis-supports-the-un-resolution-on-201cthe-right-to-privacy-in-the-digital-age201d

DesiSec: Episode 1 - Film Release and Screening

purba — 2013-12-17T08:13:32Z

The Centre for Internet and Society is pleased to to announce the release of the first documentary film on cybersecurity in India - DesiSec. We hope you can join us for a special screening of the first episode of DesiSec, on 11th December, at CIS!

Early 2013, the Centre for Internet and Society began shooting its first documentary film project. After months of researching and interviewing activists and experts, CIS is thrilled to announce the release of the first documentary film on cybersecurity in India - DesiSec: Cybersecurity and Civi Society in India.

Trailer link: http://cis-india.org/internet-governance/blog/cis-cybersecurity-series-film-trailer

CIS is hosting a special screening of DesiSec: Episode 1 on 11th December, 2013, 6 pm and invites you to this event. The first episode is centered around the issue of privacy and surveillance in cyber space and how it affects Indian society.

We look forward to seeing you there!

RSVP: purba@cis-india.org

Venue: http://osm.org/go/yy4fIjrQL?m=

This work was carried out as part of the Cyber Stewards Network with aid of a grant from the International Development Research Centre, Ottawa, Canada.

For more details visit https://cis-india.org/internet-governance/desisec-episode-1-film-release-and-screening

Big Democracy: Big Surveillance - A talk by Maria Xynou

maria — 2013-12-12T10:23:21Z

Next Tuesday, Maria Xynou will be presenting her latest research on surveillance in India. Come and engage in a discussion on India's controversial surveillance schemes, surveillance industry and much much more!

And so we've heard a lot about the Edward Snowden leaks and about the NSA's controversial mass surveillance projects. But what's happening in India?

It turns out that the world's largest democracy has some of the most controversial surveillance schemes in the world! Some of India's laws, schemes, projects and technologies are unbeatable when it comes to mass surveillance, censorship and control. While India may be a developing country with issues ranging from poverty to corruption, it nonetheless appears to be at the forefront of surveillance on an international level.

Join us at the Centre for Internet and Society (CIS) on 3rd December 2013 to hear about India's surveillance laws, schemes and technologies and to engage in a discussion on the potential implications. All that is required is an open mind, critical thought and a will to challenge that which has not been challenged!

We look forward to seeing you all and to hearing your thoughts, ideas and opinions!

VIDEO

For more details visit https://cis-india.org/internet-governance/events/big-democracy-big-surveillance-a-talk-by-maria-xynou

Election Commission to monitor conduct of political parties on Facebook, Twitter and Google

praskrishna — 2013-12-30T07:02:06Z

With Congress and BJP hammering away at each other in the ongoing assembly contests that will set the stage for national polls next year, the Election Commission wants to make sure social media and online platforms run by Google, Facebook and Twitter are not used to breach the code of conduct that governs candidates and parties. The commission's key concerns relate to malicious content and exceeding the campaign expense limit.

The article by Ajmer Singh was published in the Economic Times on November 25, 2013. Sunil Abraham is quoted.

The Election Commission, which summoned the social media companies to a meeting last Monday, directed them to cooperate in monitoring content. They were asked to set up a mechanism that would help prevent posting of material that could vitiate the election atmosphere, according to Election Commission officials who are aware of the development and didn't want to be named. If such content is posted, the mechanism should also allow for its speedy removal, they said.

"It is difficult to monitor and track content on social media or Internet sites, since the servers are based out of the US," said one of the officials cited above. "EC has asked social media giants to cooperate for compliance with the code of conduct, pre-certification of advertisement on the web and monitoring malicious content."

The companies declined to comment and referred ET to the Internet and Mobile Association of India (IAMAI) for a response. "It was a sensitising meeting on the code of conduct with some legal and corporate affairs representatives of Internet firms which are members of IAMAI," said Subho Roy, president of the grouping.

"The Election Commission representatives explained to us the model code of conduct, its importance during the last 48 hours of the election, the pre-certified advertisements and why they were important in accounting of the candidate's expenses. They also wanted to understand from us what are the current methods of removing illegal content from websites under existing laws. The Election Commission also assured us that at no point there would be any attempt to censor social media," said Subho Roy, IAMAI president and one of those present at the November 18 meeting.

The commission has classified social media into five types - collaborative projects such as Wikipedia; blogs and micro blogs such as Twitter; content communities such as Google-owned YouTube; social networking sites such as Facebook; and games and apps.

"We have received many complaints about misuse of social media platforms, and it is becoming unmanageable. So all these sites shall now be strictly monitored and asked to comply with EC's instructions," an official said.

According to Election Commission guidelines, "Legal provisions relating to election campaigning apply to social media in the same manner in which they apply to any other form of election campaigning using any other media."

The social media companies will also need to make sure that any advertising they carry conforms to the rules.

An official said social media companies have been asked to "keep an eye on any breach of model code of conduct, in respect of any party or candidate who posts hate messages or creates hatred or tension between different castes, communities, religions, etc. The social media giants have been directed to ensure pre-certification of advertisement on web/social media (clearance of political advertisement by a committee before being displayed in social media/web by any registered party or by any group or association)".

An executive at one of the companies said it would be difficult to keep a check on what was being posted as this may count as a breach of privacy, besides being impinging on other rules.
"It is a highly contentious issue and (it's) impossible to monitor malicious content," said this person who didn't want to be named. "The diktat issued by EC can't be implemented since it overrides the Information Technology Act. We all comply with the IT Act, and the model code of conduct is not for us but for political parties and candidates."

A privacy advocate pointed out the difficulties that the social media companies may face when it comes to implementing the Election Commission guidelines.

"This is what we call proactive censorship or proactive monitoring and may interfere with the intermediary's immunity from liability, when they have no actual knowledge of content. It may be in conflict with provisions of the IT Act (Section 79) and could have serious privacy implications," said Sunil Abraham of the Centre for Internet Society, and an expert on privacy laws. "Pre-censorship is required by Indian law and courts only for cinema that is exhibited in theatres. In the case of books, this type of censorship has been held to be unconstitutional. This case is worse because it is private pre-censorship of user-generated content that is not subject to judicial review."

The Election Commission had, on October 25, asked candidates to provide information about social media accounts and expenditure on online campaigns. It had clarified that the provisions of the code of conduct would apply to the Internet, including social media websites.

A Congress member said social media accounts would be difficult to police as these may be in the name of individuals and have no direct links to parties or candidates.

"The biggest problem is that candidates or political parties may not be operating their Twitter handles or posting advertisements on Facebook or the web, but (through) an unknown Internet army, which builds up a social media campaign and posts hate messages," the person said. A senior Congress MP, who didn't want to be named, suggested that such efforts were extensive on behalf of BJP prime ministerial candidate Narendra Modi, the chief minister of Gujarat.

"More than 90% of Twitter traffic is emanating from Rajkot, Ahmedabad and Baroda, all in Gujarat," this person said. "Who are these people, campaigning and managing an obnoxious campaign?"

BJP denied that its Internet campaigns were in violation of any Election Commission guidelines.
"There is no truth in these allegations and Congress has little understanding of this," said Arvind Gupta, who heads BJP's IT cell. "Narendra Modi has a pan-India presence and is a popular leader, they are just jealous of him. We have a social media cell, which acts responsibly and complies with guidelines."

Election Commission officials said social media companies have been asked to resolve issues related to malicious content and provide details of serious infringements. The ministry of communications and information technology has also been asked to suggest ways of tackling the matter.

For more details visit https://cis-india.org/news/economic-times-november-25-2013-ajmer-singh-election-commission-to-monitor-conduct-of-political-parties-on-facebook-twitter-google

Panel on Privacy, Surveillance & the UID in the post-Snowden era

praskrishna — 2013-11-26T19:05:54Z

The Centre for Internet and Society (CIS) and the Say No to UID campaign invite you to a discussion on the UID and on the implications of the world's largest biometric data collection scheme in a post-Snowden era. The panel will take place on November 30th at the Institution of Agricultural Technologists in Bangalore.

Probably one of the most important things that we learnt following the Edward Snowden revelations is that our data has value. In fact, what we learnt is that our data has immense value...since it is clearly worth billions of dollars — to say the least.

However, not only does India lack privacy legislation which could safeguard our data from potential abuse, but it is also currently implementing some of the most controversial surveillance schemes in the world, in addition to the world's largest biometric data collection scheme. What's probably more alarming is that such schemes, such as the UID, lack legal backing, as well as public and parliamentary debate!

We aim to change that. As such, the Centre for Internet and Society (CIS) and the Say No to UID campaign jointly invite you to attend a panel which will discuss all of these crucial topics.

Schedule of panel:

3.30pm - 4pm: Tea/Coffee/Refreshments & Registration

4pm - 5.30pm: Panel on Privacy, Surveillance & the UID in the post-Snowden era

5.30pm - 6pm: Q&A and Open Discussion

Panelists:

- Dr. Usha Ramanathan: Academic, Jurist and Activist

- K V Narendra: Director of Rezorce Research Foundation

- Vinay Baindur: Researcher on Urban Local Government & Decentralisation

- Maria Xynou: Policy Associate on the Privacy Project at the Centre for Internet & Society

For more details visit https://cis-india.org/events/panel-on-privacy-surveillance-uid-in-the-post-snowden-era

Chances and Risks of Social Participation

praskrishna — 2013-11-30T09:19:34Z

Participation is a key issue within Internet research and hence also for the Alexander von Humboldt Institute for Internet and Society. For this reason the institute is going to host a thematically focused meeting on Chances and Risks of Social Participation in Berlin on 22 November 2013 in co-operation with the Friedrich Ebert Foundation.

Nishant Shah gave the keynote for this event.

Morning Session
by invitation only
International senior researchers from a broad field of disciplines are invited to join the discussion and contribute with their expertise to various sessions as well as a public panel discussion. Thereby, the institute aims to push ahead research and exchange of ideas around the field of participation ranging from encouragement in context of democracy to the impact on innovation management.

Public Afternoon: Online into Politics?
open to the public, registration required
In the afternoon, the meeting will be opened to the public. We are pleased to announce that Helen Margetts, director of the Oxford Internet Institute (OII) has agreed to hold a keynote. We are also excited to be able to share first findings from a study on the e-petition platform of the German parliament, the Bundestag, with the attendants. Representatives of politics and society will reveal national perspectives on political participation within the concluding panel discussion.

Side Events

This meeting adds to the activities of the newly founded Network of Internet & Society Research Centers (NoC). Alongside the meeting on participation the annual Early Stage Researchers Colloquium and a meeting of participants of the Network of Centers will take place – guaranteeing fruitful and inspiring discourses across disciplines and research institutions.

Hosts and Co-Hosts

The event is hosted in co-operation with the Friedrich Ebert Foundation and serves as a Network of Centers (NoC) regional event. The event is furthermore supported by the British Embassy Berlin.

Click to download the brochure of the event.

For more details visit https://cis-india.org/news/alexander-von-humbodt-institute-for-internet-november-22-chances-and-risks-of-social-participation

Seventh Privacy Round-table

elonnai — 2013-11-20T09:58:39Z

On October 19, 2013, the Centre for Internet and Society (CIS) in collaboration with the Federation for Indian Chambers of Commerce and Industry, the Data Security Council of India, and Privacy International held a “Privacy Round-table” in New Delhi at the FICCI Federation House.

The Round-table was the last in a series of seven, beginning in April 2013, which were held across India.

Previous Privacy Round-tables were held in:

New Delhi: (April 13, 2013) with 45 participants;
Bangalore: (April 20, 2013) with 45 participants;
Chennai: (May 18, 2013) with 25 participants;
Mumbai, (June 15, 2013) with 20 participants;
Kolkata: (July 13, 2013) with 25 participants; and
New Delhi: (August 24, 2013) with 40 participants.

Chantal Bernier, Assistant Privacy Commissioner Canada, Jacob Kohnstamm, Dutch Data Protection Authority and Chairman of the Article 29 Working Party, and Christopher Graham, Information Commissioner UK were the featured speakers for this event.

The Privacy Round-tables were organised to ignite spark in public dialogues and gain feedback for a privacy framework for India. To achieve this, the Privacy Protection Bill, 2013, drafted by the Centre for Internet and Society, Strengthening Privacy through Co-regulation by the Data Security Council of India, and the Report of the Group of Experts on Privacy by the Justice A.P. Shah committee were used as background documents for the Round-tables. As a note, after each Round-table, CIS revised the text of the Privacy Protection Bill, 2013 based on feedback gathered from the general public.

The Seventh Privacy Round-table meeting began with an overview of the past round-tables and a description of the evolution of a privacy legislation in India till date, and an overview of the Indian interception regime. In 2011, the Department of Personnel and Training drafted a Privacy Bill that incorporated provisions regulating data protection, surveillance, interception of communications, and unsolicited messages. Since 2010, India has been seeking data secure status from the European Union, and in 2012 a report was issued noting that the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules found under section 43A of the Information Technology Act, were not sufficient to meet EU data secure adequacy. In 2012, the Report of the Group of Experts on Privacy was published recommending a privacy framework for India and was accepted by the government, and the Department of Personnel and Training is presently responsible for drafting of a privacy legislation for India.

Presentation: Jacob Kohnstamm, Dutch Data Protection Authority and Chairman of the Article 29 Working Group

Jacob Kohnstamm, made a presentation on the privacy framework in the European Union. In his presentation, Khonstamm shared how history, such as the Second World War, shaped the present understanding and legal framework for privacy in the European Union, where privacy is seen as a fundamental human right. Kohnstamm also explained how over the years technological developments have made data gold, and subsequently, companies who process this data and create services that allow for the generation of more data are becoming monopolies. This has created an unbalanced situation for the individual consumer, where his or her data is being routinely collected by companies, and once collected — the individual loses control over the data. Because of this asymmetric relationship, data protection regulations are critical to ensure that individual rights are safeguarded.

Kohnstamm recognized the tension between stringent data protection regulations and security for the government, and the provision of services for businesses was recognized. However, he argued that the use of technology without regulation — for commercial reason or security reasons, can lead to harm. Thus, it is key that any regulation incorporate proportionality as a cornerstone to the use of these technologies to ensure trust between the individual and the State, and the individual and the corporation. This will also ensure that individuals are given the right of equality, and the right to live free of discrimination. Kohnstamm went on to explain that any regulation needs to ensure that individuals are provided the necessary tools to control their data and that a robust supervisory authority is established with enough powers to enforce the provisions, and that checks and balances are put in place to safeguard against abuse.

In response to a question asked about how the EU addresses the tension of data protection and national security, Kohnstamm clarified that in the EU, national security is left as a matter for member states to address but the main principles found in the EU Data Protection Directive also apply to the handling of information for national security purposes. He emphasized the importance of the creation of checks and balances. As security agencies are given additional and broader powers, they must also be subjected to stronger safeguards.

Kohnstamm also discussed the history of the fair trade agreement with India, and India’s request for data secure status. It was noted that currently the fair trade agreement between India and the EU is stalled, as India has asked for data secure status. For the EU to grant this status, it must be satisfied that when European data is transferred and processed in India and that it is subject to the same level of protections as it would be if it were processed in the EU. Without a privacy legislation in place, India’s present regime does not reflect the same level of protections as the EU regime. To find a way out of this ‘dead lock’, the EU and India have agreed to set up an expert group — with experts from both the EU and India to find a way in which India’s regime can be modified to meet EU date secure adequacy. As of date, no experts from the Indian side have been nominated and communicated to the EU.

Key Points:

Europe’s history has influenced the understanding and formulation of the right to privacy as a fundamental right.
Any privacy regulation must have strong checks and balances in place and ensure that individuals are given the tools to control their data.
India’s current regime does not meet EU data secure adequacy. Currently, the EU is waiting for India to nominate experts to work with the EU to find a way of the ‘dead lock’.

Discussion: National Security, Surveillance and Privacy

Opening the discussion up to the floor, it was discussed how in India, there is a tension between data protection and national security, as national security is always a blanket exception to the right to privacy. This tension has been discussed and debated by both democratic institutions in India and commercial entities. It was pointed out that though data protection is a new debate, national security is a debate that has existed in India for many years. It was also pointed out that currently there are not sufficient checks and balances for the powers given to Indian security agencies. One missing safeguard that the Indian regime has been heavily criticized for is the power of the Secretary of the Home Ministry to authorize interception requests, as having the authorization power vested in the executive leaves little space between interested parties seeking approval of interception orders, and could result in abuse or conflict of interest. With regards to the Indian interception regime, it was explained that currently there are five ways in which messages can be intercepted in India. Previously, the Law Commission of India had asked that amendments be made to both the Indian Post Office Act and the Indian Telegraph Act.

Moving the discussion to the Privacy Protection Bill, 2013 by CIS, in Chapter V “Surveillance and Interception of Communications” clause 34, the authorization of interception and surveillance orders is left to a magistrate. Previously, the authorization of interception orders rested with the Privacy Commissioner, but this model was heavily critiqued in previous round-tables, and the authorizing authority has been subsequently changed to a magistrate. Participants pointed out that the Bill should specify the level of the magistrate that will be responsible for the authorization of surveillance orders, and also raised the concern that the lower judiciary in India is not adequately functioning as the courts are overwhelmed, thus creating the possibility for abuse. Participants also suggested that perhaps data protection and surveillance should be de-linked from each other and placed in separate bills. This echoes public feedback from previous roundtables.

While discussing needed safeguards in an interception and surveillance regime for India, it was called out that transparency of surveillance, by both the government and the service providers as key safeguards to ensuring the protection of privacy, as it would enable individuals to make educated decisions about the services they choose to use and the extent of governmental surveillance. The need to bring in a provision that incorporated the idea of "nexus of surveillance" was also highlighted. It was also pointed out that in Canada, entities wanting to deploy surveillance in the name of public safety, must take steps to prove nexus. For example, the organization must empirically prove that there is a need for a security requirement, demonstrate that only data that is absolutely necessary will be collected, show how the technology will be effective, prove that there is not a less invasive way to collect the information, demonstrate security measures in place to ensure against loss and misuse, and the organizations must have in place both internal and external oversight mechanisms. It was also shared that in Canada, security agencies are regulated by the Office of the Canadian Privacy Commissioner, as privacy and security are not seen as separate matters. In the Canadian regime, because security agencies have more powers, they are also subjected to greater oversight.

Key Points:

The Indian surveillance regime currently does not have strong enough safeguards.
The concept of ‘nexus’ should be incorporated into the Privacy Protection Bill, 2013.
A magistrate, through judicial oversight for interception and surveillance requests, might not be the most effective authority for this role in India.

Presentation: Chantal Bernier, Deputy Privacy Commissioner, Canada

In her presentation, Bernier made the note that in the Canadian model there are multiple legislative initiatives that are separate but connected, and all provide a legislative basis for the right to privacy. Furthermore, it was pointed out that there are two privacy legislations in Canada, one regulating the private sector and the other regulating the public sector. It has been structured this way as it is understood that the relationship between individuals and business is based on consent, while the relationship between individuals and the state is based on human rights. Furthermore, aspects of privacy, such as consent are different in the public sector and the private sector. In her presentation, Bernier pointed out that privacy is a global issue and because of this, it is critical that countries have privacy regimes that can speak to each other. This does not mean that the regimes must be identical, but they must at the least be inter-operable.

Bernier described three main characteristics of the Canadian privacy regime including:

It is comprehensive and applies to both the public and the private sectors.
The right to privacy in Canada is constitutionally based and is a fundamental right as it is attached to personal integrity. This means that privacy is above contractual fairness. That said, the right to privacy must be balanced collectively with other imperatives.
The Canadian privacy regime is principle based and not rule based. This flexible model allows for quick adaption to changing technologies and societal norms. Furthermore, Bernier explained how Canada places responsibility and accountability on companies to respect, protect, and secure privacy in the way in which the company believes it can meet. Bernier also noted that all companies are responsible and accountable for any data that they outsource for processing.

Furthermore, any company that substantially deals with Canadians must ensure that the forum for which complaints etc., are heard is Canada. Furthermore, under the Canadian privacy regime, accountability for data protection rests with the original data holder who must ensure — through contractual clauses — that any information processed through a third party meets the Canadian level of protection. This means any company that deals with a Canadian company will be required to meet the Canadian standards for data protection.

Speaking to the governance structure of the Office of the Privacy Commissioner in Canada, Bernier explained that the OPC is a completely independent office and reports directly to the Parliament. The OPC hears complaints from both individuals and organizations. The OPC does not have any enforcement powers, such as finding a company, but does have the ability to "name" companies who are not in compliance with Canadian regulations, if it is in the public interest to do so. The OPC can perform audits upon discretion with respect to the public sector, and can perform audits on the private sector if they have reasonable grounds to investigate.

Bernier concluded her presentation with lessons that have been learned from the Canadian experience including:

The importance of having strong regulators.
Privacy regulators must work and cooperate together.
Privacy has become a condition of trade.
In today’s age, issues around surveillance cannot be underestimated.
Companies that have strong privacy practices now have a competitive advantage in place in today’s global market.
Privacy frameworks must be clear and flexible.
Oversight must be powerful to ensure proper protection of citizens in a world of asymmetry between individuals, corporations, and governments.

Key Points:

The Right to Privacy is a fundamental right in Canada.
The Canadian privacy regime regulates the public sector and the private sector, but through two separate legislations.
The OPC does not have the power to levy fines, but does have the power to conduct audits and investigations and ‘name’ companies who are not in compliance with Canadian regulations if it is in the public interest.

Discussion: The Data Protection Authority

Participants also discussed the composition of the Data Protection Authority as described in chapter IV of the Privacy Protection Bill. It was called out that the in the Bill, the Data Protection Authority might need to be made more independent. It was suggested that to avoid having the office of the Data Protection Authority be filled with bureaucrats, the Bill should specify that the office must be staffed by individuals with IT experience, lawyers, judges, etc. On the other hand it was cautioned, that though this might be useful to some extent, it might not be helpful to be overly prescriptive, as there is no set profile of what composition of employees makes for a strong and effective Data Protection Authority. Instead the Bill should ensure that the office of the Data Protection Authority is independent, accountable, and chosen by an independent selection board.

When discussing possible models for the framework of the Data Protection Authority, it was pointed out that there are many models that could be adopted. Currently in India the commission model is not flexible, and many commissions that are set up, are not effective due to funding and internal bureaucracy. Taking that into account, in the Privacy Protection Bill, 2013, the Data Protection Authority, could be established as a small regulator with an appellate body to hear complaints.

Key Points:

The Data Protection Authority established in the Privacy Protection Bill must be adequately independent.
The composition of the Data Protection Authority be diverse and it should have the competence to address the dynamic nature of privacy.
The Data Protection Authority could be established as a small regulator with an appellate body attached.

Presentation: Christopher Graham, Information Commissioner, United Kingdom

Christopher Graham, the UK Information Commissioner, spoke about the privacy regime in the United Kingdom and his role as the UK Information Commissioner. As the UK Information Commissioner, his office is responsible for both the UK Data Protection Act and the Freedom of Information Act. In this way, the right to know is not in opposition to the right to privacy, but instead an integral part.

Graham said that his office also provides advice to data controllers on how to comply with the privacy principles found in the Data Protection Act, and his office has the power to fine up to half a million pounds on non-compliant data controllers. Despite having this power, it is rarely used, as a smaller fine is usually sufficient enough for the desired effect. Yet, at the end of the day, whatever penalty is levied, it must be proportionate and risk based i.e., selective to be effective. In this way the regulatory regime should not be heavy handed but instead should be subtle and effective. In fact, one of the strongest regulators is the reality of the market place where the price of not having strong standards is innovation and economic growth. To this extent, Graham also pointed out that self regulation and co-regulation are both workable models, if there is strong enforcement mechanisms. Graham emphasized the fact that any data protection must go beyond, and cannot be limited to, just security.

Graham also explained that he has found that currently there is a lack of confidence in Indian partners. This is problematic as the Indian industry tries to grow with European partners. For example, he has been told that customers are moving banks because their previous bank’s back offices were located in India. Citing other examples of cases of data breaches from Indian data controllers, such as a call center merging the accounts of two customers and another call centre selling customer information, he explained that the lack of confidence in the Indian regime has real economic implications. Graham further explained that one difficulty that the office of the UK ICO is faced with, is that India does not have the equivalent of the ICO. Thus, when a breach does happen, it is unclear who can be approached in India about the breach.

Touching upon the issue of data adequacy with the EU, Graham noted that if data adequacy is a goal of India, the privacy principles as defined in the Directive and reflected in the UK Data Protection Act, must be addressed in addition to security. In his presentation, Graham emphasized the importance of India amending their current regime, if they want data secure status and spoke about the economic benefits for both Europe and India, if India does in fact obtain data secure status. In response to a question about why it is so important that India amend its laws, if in effect the UK has the ability to enforce the provisions of UK Data Protection Act, Graham clarified that most important is the rule of law, and according to UK law and more broadly the EU Directive, companies cannot transfer information to jurisdictions that do not have recognized adequate levels of protection. Thus, if companies still wish to transfer information to India, this must be done through binding corporate rules.

Another question which was put forth was about how the right to privacy differs from other human rights, and why countries are requiring that other countries to uphold the right to privacy to the same level, when, for example this is not practiced for other human rights such as children’s rights. In response Graham explained that data belongs to the individual, and when it is transferred to another country — it still belongs to the individual. Although the UK would like all countries to uphold the rights of children to the standard that they do, the UK is not exporting UK citizen’s children to India. Thus, as the Information Commissioner he has a responsibility to protect his citizen’s data, even when it leaves the UK jurisdiction. Graham explained further that in the history of Europe, the misuse of data to do harm has been a common trend, which is why privacy is seen as a fundamental right, and why it is paramount that European data is subject to the same level of protection no matter what jurisdiction it is in. India needs to understand that privacy is a fundamental right and goes beyond security, and that when a company processes data it does not own the data, the individual owns the data and thus has rights attached to it to understand why Europe requires countries to be ‘data secure’ before transferring data to them.

Key Points:

The UK Information Commissioners Office regulates both the right to information and privacy, and thus the two rights are seen as integral to each other.
Penalties must be proportionate and scalable to the offense.
Co-regulation and self-regulation can both be viable models to for privacy, but enforcement is key to them being effective.

Discussion: Collection of Data with Consent and Collection of Data without Consent

Participants also discussed the collection of data with consent and the collection of data without consent found in Chapter III of the Bill. When asked opinions about the circumstances when informed consent should not be required, it was pointed out that in the Canadian model, the option to collect information without consent only applies to the public sector if it is necessary for the delivery of a service by the government. In the private sector all collection of information requires informed and meaningful consent. Yet, collection of data without consent in the commercial context is an area that Canada is wrestling with, as there are instances, such as online advertising, where it is unreasonable to expect consent all the time. It was also pointed out that in the European Directive, consent is only one of the seven grounds under which data can be collected. As part of the conversation on consent, it was pointed out that the Bill currently does not take explicitly take into account the consent for transfer of information, and it does not address changing terms of service and if companies must re-take consent, or if providing notice to the individual was sufficient. The question about consent and additional collection of data that is generated through use of that service was also raised. For example, if an individual signs up for a mobile connection and initially provides information that the service provider stores in accordance to the privacy principles, does the service provider have an obligation to treat all data generated by the user while using the service of the same? The exception of disclosure without consent was also raised and it was pointed out that companies are required to disclose information to law enforcement when required. For example, telecom service providers must now store location data of all subscribers for up to 6 months and share the same when requested by law enforcement.

Key Points:

There are instances where expecting companies to have informed consent for every collection of information is not reasonable. Alternative models, based on — for example transparency — must be explored to address these situations.
The Privacy Protection Bill should explicitly address transfer of information to other countries.
The Privacy Protection Bill should address consent in the context of changing terms of service.

Discussion: Penalties and Offences

The penalties and offenses prescribed in chapter VI of the Privacy Protection Bill were discussed by participants. While discussing the chapter, many different opinions were voiced. For example, some participants held the opinion that offences and penalties should not exist in the Privacy Protection Bill, because in reality they are more likely than not to be effective. For example, when litigating civil penalties, it takes a long time for the money to be realized. Others argued that in India, where enforcement of any law is often weak, strong, clear, and well defined criminal penalties are needed. Another comment raised the point that a distinction should be made between breaches of the law by data controllers and breaches by rogue individuals — as the type of violation. For example, a breach by a data controller is often a matter identifying the breach and putting in place strictures to ensure that it does not happen again by holding the company accountable through oversight. Where as a breach by a rogue agent entails identifying the breach and the rogue agent and creating a strong enough penalty to ensure that they will not repeat the violation. Adding to this discussion, it was pointed out that in the end, scalability is key in ensuring that penalties are proportional and effective. It was also noted that in the UK, any fine that is levied is appealable. This builds in a system of checks and balances, and ensures that companies and individuals are not subject to unfair or burdensome penalties.

The possibility of incentivizing compliance, through rewards and distinctions, was discussed by participants. Some felt that incentivizing compliance would be more effective as it would give companies distinct advantages to incorporating privacy protections, while others felt that incentives can be included but penalties cannot be excluded, otherwise the provisions of the Privacy Protection Bill 2013 will not be enforceable. It was also pointed out that in the context of India, ideally there should be a mechanism to address the ‘leakages’ that happen in the system i.e., corruption. Though this is difficult to achieve, regulations could take steps like specifically prohibiting the voluntary disclosure of information by companies to law enforcement. Taking a sectoral approach to penalties was also suggested as companies in different sectors face specific challenges and types of breaches. Another approach that could be implemented is the statement of a time limit for data controllers and commissioners to respond to complaints. This has worked for the implementation of the Right to Information Act in India, and it would be interesting to see how it plays out for the right to privacy. Throughout the discussion a number of different possible ways to structure offenses and penalties were suggested, but for all of them it was clear that it is important to be creative about the type of penalties and not rely only on financial penalty, as for many companies, a fine has less of an impact than perhaps having to publicly disclose what happened around a data breach.

Key Points:

Penalties and offenses by companies vs. rogue agents should be separately addressed in the Bill.
Instead of levying penalties, the Bill should include incentives to ensure compliance.
Penalties for companies should go beyond fines and include mechanisms such as requiring the company to disclose to the public information about the breach.

Discussion: Cultural Aspects of Privacy

The cultural realities of India, and the subsequent impact on the perception of privacy in India were discussed. It was pointed out that India has a history of colonization, multiple religions and languages, ethnic tensions, a communal based society, and a large population. All of these factors impact understandings, perceptions, practices, and the effectiveness of different frameworks around privacy in India. For example, the point was raised that given India’s cultural and political diversity, having a principle based model might be too difficult to enforce as every judge, authority, and regulator will have a different perspective and agenda. Other participants pointed out that there is a lack of awareness around privacy in India, and this will impact the effectiveness of the regulation. It was also highlighted that anecdotal claims that cultural privacy in India is different, such as the fact that in India on a train everyone will ask you personal questions, and thus Indian’s do not have a concept of privacy, cannot influence how a privacy law is framed for India.

Key Points:

India’s diverse culture will impact perceptions of privacy and the implementation of any privacy regulation.
Given India’s diversity, a principle based model might not be adequate.
Though culture is important to understand and incorporate into the framing of any privacy regulation in India, anecdotal stories and broad assumptions about India’s culture and societal norms around privacy cannot influence how a privacy law is framed for India.

Conclusion

The seventh privacy round-table concluded with a conversation on the NSA spying and the Snowden Revelations. It was asked if domestic servers could be an answer to protect Indian data. Participants agreed that domestic servers are just a band aid to the problem. With regards to the Privacy Protection Bill it was clarified that CIS is now in the process of collecting public statements to the Bill and will be submitting a revised version to the Department of Personnel and Training. Speaking to the privacy debate at large, it was emphasized that every stakeholder has an important voice and can impact the framing of a privacy law in India.

For more details visit https://cis-india.org/internet-governance/blog/report-of-sevent-privacy-round-table

YouTube is the answer to what has changed in India

praskrishna — 2013-11-20T07:00:48Z

Alternative Law Forum’s Lawrence Liang on relaunching Creative Commons, and how it changes the legal landscape of copyright issues.

The article by Moulishree Srivastava was published in Livemint on November 20, 2013. Lawrence Liang was quoted.

Creative Commons (CC), a non-profit organization headquartered in Mountain View, California, US, which enables Internet users to share and use the creativity and knowledge of others, on Tuesday relaunched its India chapter after six years. CC provides free copyright licences that give creators a way to share their creative work, on conditions of their choice.

In India, for instance, Pratham Books, a not-for-profit publisher, licenses its content under a CC licence that allows others to use the content (on certain conditions). And the National Council of Educational Research and Training has created a portal where digital versions of its course material have been uploaded under a CC licence.

In an interview, Lawrence Liang , co-founder of Alternative Law Forum and chairman of the board at the Bangalore-based Centre for Internet and Society, which is one of the CC affiliates in India, spoke about the re-launch, what went wrong the last time, what it means for the country and how it changes the legal landscape of copyright issues. Edited excerpts:

People all over the world are already using CC licences. What does this relaunch mean for India?

There are two things. One is the legal component. The licences have been tailor-made for Indian law. Tomorrow, if someone were to use CC licence and there were violations and it came up in court, this (the CC licence) would be in compliance with the Indian Copyright Act. The other is, we have a very large number of young people who are entering the space of making creative works. The CC means for them to be aware that there are options they have apart from traditional copyright licensing.

How does it impact the legal landscape of copyright issues?

In the US, you have something called derivative rights, which is conversion of one medium into another medium. In India, you don’t have that idea; you have the right of adaptation, which is a much more narrowly defined idea. It has the specific definition of what the adaptation is. There is the right to adaptation of a work from, say, literary into dramatic, but it doesn’t mean conversion of a work into any form.

The second is in terms of presumption of how you gain ownership over copyright, which is slightly different in India than it is in the US.

In India—section 17 (of the Constitution) lays out different classes of work—there are different presumptions of who the owner of copyright is, which becomes very important. For example, if a film-maker wants to license his work, now it has to be clear that he is the owner of the copyright in the first place, because the presumption in India would be that the producer is the owner of the work, whereas in Europe the producer is the first owner of the work. These are some of the small differences that CC attempts to clarify.

What went wrong the last time?

When it was first launched (in India) in 2007, perhaps there wasn’t the momentum. Last time CC was launched as a licence in India, but not as a community, which was the key issue. Second, it was institutionally housed in IIT (Indian Institute of Technology) Bombay and it needed being pluralized. You can’t depend on CC being housed in one single institution. It should be in as many institutions as possible, which is what has happened this time. The crucial thing here is that we will be developing a community. A lot more people know about CC now than they did back in 2007.

Why do you think it will succeed?

One is the overall awareness about open source and alternatives. The other one, which is more crucial, is, when CC was launched in the US, it was in response to a very clear crisis. The crisis was that a large number of users were being prevented from using existing works. Lawrence Lessig (one of the co-founders of CC) felt that there was a need to create a legal alternative. There was already, in a way, a certain kind of environment which allowed CC to automatically speak to a number of people’s concerns. In India, we didn’t have that. Copyright was anyway not being enforced. That’s happening now. So once people could use YouTube, could create remixes, then they suddenly realized that they have used a film song and other copyrighted content. Then they suddenly realize a need of legal content as alternative. YouTube is the answer to what has changed.

What does it mean for the media?

It depends on whether you are looking at it from the perspective of a media producer or a user. From the perspective of a media producer, one of the big things that people assume is that everything is copyrighted until stated otherwise and that you can’t use it. There are a number of people who will be very happy to use it, but they may not want to use it commercially. With a CC licence, the boundaries are clear. What you are allowed to do and what you are not allowed to do is extremely clear. One of the biggest problems in the digital landscape at the moment is opacity. You are not sure. There is an image on a website, which seems to be used in many places. Am I allowed to reproduce it? What is the extent to which I can use the content? A lot of these will be rendered clear for media practitioners.

For more details visit https://cis-india.org/news/livemint-november-12-2013-moulishree-srivastava-you-tube-is-answer-to-what-changed-in-india

Why 'Facebook' is More Dangerous than the Government Spying on You

maria — 2013-11-23T08:38:30Z

In this article, Maria Xynou looks at state and corporate surveillance in India and analyzes why our "choice" to hand over our personal data can potentially be more harmful than traditional, top-down, state surveillance. Read this article and perhaps reconsider your "choice" to use social networking sites, such as Facebook.

Do you have a profile on Facebook? Almost every time I ask this question, the answer is ‘yes’. In fact, I think the amount of people who have replied ‘no’ to this question can literally be counted on my right hand. But this is not an article about Facebook per se. It’s more about the ‘Facebooks’ of the world, and of people’s increasing “choice” to hand over their most personal data. More accurate questions are probably:

“Would you like the Government to go through your personal diary? If not, then why do you have a profile on Facebook?”

The Indian Surveillance State

Following Snowden ’s revelations, there’s finally been more talk about surveillance. But what is surveillance?

David Lyon - who directs the Surveillance Studies Centre - defines surveillance as “any collection and processing of personal data, whether identifiable or not, for the purposes of influencing or managing those whose data have been garnered”. Surveillance can also be defined as the monitoring of the behaviour, activities or other changing information of individuals or groups of people. However, this definition implies that individuals and/or groups of people are being monitored in a top-down manner, without this being their “choice”. But is that actually the case? To answer this question, let’s have a look at how the Indian government and corporations operating in India spy on us.

State Surveillance

The first things that probably come to mind when thinking about India from a foreigner’s perspective are poverty and corruption. Surveillance appears to be a “Western, elitist issue”, which mainly concerns those who have already solved their main survival problems. In other words, the most mainstream argument I hear in India is that surveillance is not a real issue, especially since the majority of the population in the country lives below the line of poverty and does not even have any Internet access. Interestingly enough though, the other day when I was walking around a slum in Koramangala, I noticed that most people have Airtel satellites...even though they barely have any clean water!

The point though is that surveillance in India is a fact, and the state plays a rather large role in it. In particular, Indian law enforcement agencies follow three steps in ensuring that targeted and mass surveillance is carried out in the country:

1. They create surveillance schemes, such as the Central Monitoring System (CMS ), which carry out targeted and/or mass surveillance

2. They create laws, guidelines and license agreements, such as the Information Technology (Amendment ) Act 2008, which mandate targeted and mass surveillance and which require ISP and telecom operators to comply

3. They buy surveillance technologies from companies, such as CCTV cameras and spyware, and use them to carry out targeted and/or mass surveillance

While Indian law enforcement agencies don’t necessarily follow these steps in this precise order, they usually try to create surveillance schemes, legalise them and then buy the gear to carry them out.

In particular, surveillance in India is regulated under five laws: the Indian Telegraph Act 1885, the Indian Post Office Act 1898, the Indian Wireless Telegraphy Act 1933, section 91 of the 1973 Code of Criminal Procedure (CrPc ) and the Information Technology (Amendment ) Act 2008. These laws mandate targeted surveillance, but remain silent on the issue of mass surveillance which means that technically it is neither allowed nor prohibited, but remains a grey legal area.

While surveillance laws in India may not mandate mass surveillance, some of their sections are particularly concerning. Section 69 of the Information Technology (Amendment ) Act 2008 allows for the interception of all information transmitted through a computer resource, while requiring that all users disclose their private encryption keys or face a jail sentence of up to seven years. This appears to be quite bizarre, as individuals can only keep their data private and protect themselves from surveillance through encryption.

Section 44 of the Information Technology (Amendment) Act 2008 imposes stiff penalties on anyone who fails to provide requested information to authorities - which kind of reminds us of Orwell’s totalitarian regime in “1984”. Furthermore, section 66A of the same law states that individuals will be punished for sending “offensive messages through communication services”. However, the vagueness of this section raises huge concerns, as it remains unclear what defines an “offensive message” and whether this will have grave implications on the freedom of expression. The arrest of two Indian women last November over a Facebook post reminds us of this.

Laws in India may not mandate mass surveillance, but guidelines and license agreements issued by the Department of Telecommunications do. In particular, the UAS License Agreement regarding the Central Monitoring System (CMS ) not only mandates mass surveillance, but also attempts to legalise a mass surveillance scheme which aims to intercept all telecommunications and Internet communications in India. Furthermore, the Department of Telecommunications has issued numerous guidelines and license agreements for ISPs and telecom operators, which require them to not only be “surveillance-friendly”, but to also enable law enforcement agencies to tap into their servers on the grounds of national security. And then, of course, there’s the new National Cyber Security Policy, which mandates surveillance to tackle cyber-crime, cyber-terrorism, cyber-war and cyber-vandalism.

As both a result and prerequisite of these laws, the Indian government has created various surveillance schemes and teams to aid them. In particular, India ’s Computer Emergency Response Team (CERT ) is currently monitoring “any suspicious move on the Internet” in order to checkmate any potential cyber attacks from hackers. While this may be useful for the purpose of preventing and detecting cyber-criminals, it remains unclear how “any suspicious move” is defined and whether that inevitably enables mass surveillance, without individuals’ knowledge or consent.

The Crime and Criminal Tracking and Network & Systems (CCTNS ) is the creation of a nationwide networking infrastructure for enhancing the efficiency and effectiveness of policing and sharing data among 14,000 police stations across the country. It has been estimated that Rs. 2000 crore has been allocated for the CCTNS project and while it may potentially increase the effectiveness of tackling crime and terrorism, it raises questions around the legality of data sharing and its potential implications on the right to privacy and other human rights - especially if such data sharing results in data being disclosed or shared with unauthorised third parties.

Similarly, the National Intelligence Grid (NATGRID ) is an integrated intelligence grid that will link the databases of several departments and ministries of the Government of India so as to collect comprehensive patterns of intelligence that can be readily accessed by intelligence agencies. This was first proposed in the aftermath of the Mumbai 2008 terrorist attacks and while it may potentially aid intelligence agencies in countering crime and terrorism, enforced privacy legislation should be a prerequisite, which would safeguard our data from potential abuse.

However, the most controversial surveillance scheme being implemented in India is probably the Central Monitoring System (CMS). While several states, such as Assam, already have Internet Monitoring Systems in place, the Central Monitoring System appears to raise even graver concerns. In particular, the CMS is a system through which all telecommunications and Internet communications in India will be monitored by Indian authorities. In other words, the CMS will be capable of intercepting our calls and of analyzing our data on social networking sites, while all such data would be retained in a centralised database. Given that India currently lacks privacy legislation, such a system would mostly be unregulated and would pose major threats to our right to privacy and other human rights. Given that data would be centrally stored, the system would create a type of “honeypot” for centralised cyber attacks. Given that the centralised database would have massive volumes of data for literally a billion people, the probability of error in pattern and profile matching would be high - which could potentially result in innocent people being convicted for crimes they did not commit. Nonetheless, mass surveillance through the CMS is currently a reality in India.

And the even bigger question: How can law enforcement agencies mine the data of 1.2 billion people? How do they even carry out surveillance in practice? Well, that’s where surveillance technology companies come in. In fact, the surveillance industry in India is massively expanding - especially in light of its new surveillance schemes which require advanced and sophisticated technology. According to CIS ’ India Privacy Monitor Map - which is part of ongoing research - Indian law enforcement agencies use CCTV cameras in pretty much every single state in India. The map also shows that Unmanned Aerial Vehicles (UAVs), otherwise known as drones, are being used in most states in India and the DRDO ’s “Netra ” - which is a lightweight drone, not much bigger than a bird - is particularly noteworthy.

But Indian law enforcement agencies also buy surveillance software and hardware which is aimed at intercepting telecommunications and Internet communications. In particular, ClearTrail Technologies is an Indian company - based in Indore - which equips law enforcement agencies in India and around the world with surveillance software which can probably be compared with the “notorious” FinFisher. So in short, there appears to be a tight collaboration between Indian law enforcement agencies and the surveillance industry, which can be clearly depicted in the ISS surveillance trade shows, otherwise known as “the wiretappers’ ball”.

Corporate Surveillance

When I ask people about corporate surveillance, the answer I usually get is: “Corporations only care about their profit - they don’t do surveillance per se”. And while that may be true, David Lyon ’s definition of surveillance - as “any collection and processing of personal data, whether identifiable or not, for the purposes of influencing or managing those whose data have been garnered” - may indicate otherwise.

Corporations, like Google, Amazon and Facebook, may not have an agenda for spying per se, but they do collect massive volumes of personal data and, in cases such as PRISM, allow law enforcement to tap into their servers. Once law enforcement agencies get hold of data collected by companies, such as Facebook, they then use data mining software - equipped by various surveillance technology companies - to process and mine the data. And how do companies, like Google and Facebook, make money off our personal data? By selling it to big buyers, such as law enforcement agencies.

So while Facebook and all the ‘Facebooks’ of the world may not profit from surveillance per se, they do profit from collecting our personal data and selling it to third parties, which include law enforcement agencies. And David Lyon argues that surveillance involves the collection of personal data - which corporations, like Facebook, do - for the purpose of influencing and managing individuals. While this last point can probably be widely debated on, it is clear that corporations share their collected data with third parties, which ultimately leads to the influence or managing of individuals - directly or indirectly. In other words, the collection of personal data, in combination with its disclosure to third parties, is surveillance. So when we think about companies, like Google or Facebook, we should not just think of businesses interested in their profit - but also of spying agencies. After all, “if the product is free , you are the product ”.

Now if we look at online corporations more closely, we can probably identify three categories:

1. Websites through which we buy products and hand over our personal details - e.g. Amazon

2. Websites through which we use services and hand over our personal details - e.g. flight ticket

3. Websites through which we communicate and hand over our personal details - e.g. Facebook

And why could the above be considered “spying” at all? Because such corporations collect massive volumes of personal data and subsequently:

- Disclose such data to law enforcement agencies

- Allow law enforcement agencies to tap into their servers

- Sell such data to “third parties”

What’s notable about so-called corporate surveillance is that, in all cases, there is a mutual, key element: we consent to the handing over of our personal information. We are not forced to hand over our personal data when buying a book online, booking a flight ticket or using Facebook. Instead, we “choose” to hand over our personal data in exchange for a product or service. Now what significantly differentiates state surveillance to corporate surveillance is the factor of “choice”. While we may choose to hand over our most personal details to large online corporations, such as Google and Facebook, we do not have a choice when the government monitors our communications, collects and stores our personal data.

State Surveillance vs. Corporate Surveillance

Both Indian law enforcement agencies and corporations collect massive volumes of personal data. In fact, it is probably noteworthy to mention that Facebook, in particular, collects 20 times more data per day than the NSA in total. In addition, Facebook has claimed that it has received more demands from the US government for information about its users than from all other countries combined. In this sense, the corporate collection of personal data can potentially be more harmful than government surveillance, especially when law enforcement agencies are tapping into the servers of companies like Facebook. After all, the Indian government and all other governments would have very little data to analyse if it weren’t for such corporations.

Surveillance is not just about “spying” or about “watching people” - it’s about much much more. Observing people’s behaviour only really becomes harmful when the data observed is collected, retained, analysed, shared and disclosed to unauthorised third parties. In other words, surveillance is meaningful to examine because it involves the analysis of data, which in turn involves pattern matching and profiling, which can potentially have actual, real-world implications - good or bad. But such analysis cannot be possible without having access to large volumes of data - most of which belong to large corporations, like Facebook. The question, though, is: How do corporations collect such large volumes of personal data, which they subsequently share with law enforcement agencies? Simple: Because we “choose” to hand over our data!

Three years ago, when I was doing research on young people’s perspective of Facebook, all of the interviewees replied that they feel that they are in control of their personal data, because they “choose” what they share online. While this may appear to be a valid point, the “choice” factor can widely be debated on. There are many reasons why people “choose” to hand over their personal data, whether to buy a product, use a service, to communicate with peers or because they feel socially pressured into using social networking sites. Nonetheless, it all really comes down to one main reason: convenience. Today, in most cases, the reason why we hand over our personal data online in exchange for products or services is because it is simply more convenient to do so. And while that is understandable, at the same time we are exposing our data (and ultimately our lives) in the name of convenience.

The irony in all of this is that, while many people reacted to Snowden ’s revelations on NSA dragnet surveillance, most of these people probably have profiles on Facebook. Secret, warrantless government surveillance is undeniably intrusive, but in the end of the day, our profiles on Facebook - and on all the ‘Facebooks’ of the world - is what enabled it to begin with. In other words, if we didn’t choose to give up our personal data - especially without really knowing how it would be handled - large databases would not exist and the NSA - and all the ‘NSAs’ of the world - would have had a harder time gathering and analysing data.

In short, the main difference between state and corporate surveillance is that the first is imposed in a top-down manner by authorities, while the second is a result of our “choice” to give up our data. While many may argue that it’s worse to have control imposed on you, I strongly disagree. When control and surveillance are imposed on us in a top-down manner, it’s likely that we will perceive this - sooner or later - as a direct threat to our human rights, which means that it’s likely that we will resist to it at some point. People usually react to what they perceive as a direct threat, whereas they rarely react to what does not directly affect them. For example, one may perceive murder or suicide as a direct threat due the immediateness of its effect, whereas smoking may not be seen as an equally direct threat, because its consequences are indirect and can usually be seen in the long term. It’s somehow like that with surveillance.

University students have protested on the streets against the installation of CCTV cameras, but how many of them have profiles on social networking sites, such as Facebook? People may react to the installation of CCTV cameras, because it may appear as a direct threat to their right to privacy. However, the irony is that the real danger does not necessarily lie within some CCTV cameras, but rather within the profile of each person on a major commercial social networking site. At very best, a CCTV camera will capture some images of us and through that, track our location and possibly our acquaintances. What type of data is captured through a simple, “harmless” Facebook profile? The following probably only includes a tiny percentage of what is actually captured:

- Personal photos

- Biometrics (possibly through photos)

- Family members

- Friends and acquaintances

- Habits, hobbies and interests

- Location (through IP address)

- Places visited

- Economic standing (based on pictures, comments, etc.)

- Educational background

- Ideas and opinions (which may be political, religious, etc.)

- Activities

- Affiliations

The above list could potentially go on and on, probably depending on how much - or what type - of data is disclosed by the individual. The interesting element to this is that we can never really know how much data we are disclosing, even if we think we control it. While an individual may argue that he/she chooses to disclose an x amount of data, while retaining the rest, that individual may actually be disclosing a 10x amount of data. This may be the case because usually every bit of data hides lots of other bits of data, that we may not be aware of. It all really comes down to who is looking at our data, when and why.

For example, (fictional) Priya may choose to share on her Facebook profile (through photos, comments, or any other type of data) that she is female, Indian, a Harvard graduate and that her favourite book is “Anarchism and other Essays ” by Emma Goldman. At first glance, nothing appears to be “wrong” with what Priya is revealing and in fact, she appears to care about her privacy by not revealing “the most intimate details” of her life. Moreover, one could argue that there is absolutely nothing “incriminating” about her data and that, on the contrary, it just reflects that she is a “shiny star” from Harvard. However, I am not sure if a data analyst would be restricted to this data and if data analysis would show the same “sparkly” image.

In theory, the fact that Priya is an Indian who attended Harvard reveals another bit of information, that Priya did not choose to share: her economic standing. Given that the majority of Indians live below the line of poverty, there is a big probability that Priya belongs to India’s middle class - if not elite. Priya may not have intentionally shared this information, but it was indirectly revealed through the bits of data that she did reveal: female Indian and Harvard graduate. And while there may not be anything “incriminating” about the fact that she has a good economic standing, in India this usually means that there’s also some strong political affiliation. That brings us to her other bit of information, that her favourite author is a feminist, anarchist. While that may be viewed as indifferent information, it may be crucial depending on the specific political actors in the country she’s in and on the general political situation. If a data analyst were to map the data that Priya chose to share, along with all her friends and acquaintances that she inevitably has through Facebook, that data analyst could probably tell a story about her. And the concerning part is that that story may or may not be true. But that doesn’t really matter.

Today, governments don’t judge us and take decisions based on our version of our data, but based on what our data says about us. And perhaps, under certain political, social and economic circumstances, our “harmless” data could be more incriminating than what we think. While an individual may express strong political views within a democratic regime, if that political system were to change in the future and to become authoritarian, that individual would possibly be suspicious in the eyes of the government - to say the least. This is where data retention plays a significant role.

Most companies retain data indefinitely or for a long period of time, which means that future, potentially less-democratic governments may have access to it. And the worst part is that we can never really know what data is being held about us, because within data analysis, every bit of data may potentially entails various other bits of data that we are not even aware of. So, when we “choose” to hand over our data, we don’t necessarily know what or how much we are choosing to disclose. Thus, this is why I agree with Bruce Schneier’s argument that people have an illusionary sense of control over their personal data.

Social network analysis software is specifically designed to mine huge volumes of data that is collected through social networking sites, such as Facebook. Such software is specifically designed to profile individuals, to create “trees of communication” around them and to match patterns. In other words, this software tells a story about each and every one of us, based on our activities, interests, acquaintances, and all other data. And as mentioned before, such a story may or may not be true.

In data mining, behavioural statistics are being used to analyse our data and to predict how we are likely to behave. When applied to national databases, this may potentially amount to predicting how masses or groups within the public are likely to behave and to subsequently control them. If a data analyst can predict an individual’s future behaviour - with some probability - based on that individuals’ data, the same could potentially occur on a mass, public level. As such, the danger within surveillance - especially corporate surveillance through which we voluntarily disclose massive amounts of data about ourselves - is that it appears to come down to public control.

According to security expert Bruce Schneier, data today is a byproduct of the Information Society. Unlike an Orwellian totalitarian state where surveillance is imposed in a top-down manner, surveillance today appears to widely exist because we indirectly choose and enable it (by handing over our data to online companies), rather than it being imposed on us in a solely top-down manner. However, contemporary surveillance may potentially be far worse than that described in Orwell’s “1984”, because surveillance is publicly perceived to be an indirect threat - if considered to be a threat at all. It is more likely that people will resist a direct threat, than an indirect threat, which means that the possibility of mass violations of human rights as a result of surveillance is real.

Hannah Arendt argued that a main prerequisite and component of totalitarian power is support by the masses. Today, surveillance appears to be socially integrated within societies which indicates that contemporary power fueled by surveillance has mass support. While the argument that surveillance is being socially integrated can potentially be widely debated on and requires an entire in depth research of its own, few simple facts might be adequate to prove it at this stage. Firstly, CCTV cameras are installed in most countries, yet there has been very little resistance - on the contrary, there appears to be a type of universal acceptance on the grounds of security. Secondly, different types of spy products exist in the market - such as Spy Coca Cola cans - which can be purchased by anyone online. Thirdly, countries all over the world carry out controversial surveillance schemes - such as the Central Monitoring System in India - yet public resistance to such projects is limited. And while one may argue that the above cases don’t necessarily prove that surveillance is being socially integrated, it would be interesting to look at a fourth fact: most people who have Internet access choose to share their personal data through the use of social networking sites.

Reality shows, such as Big Brother, which broadcast the surveillance of people’s lives and present it as a form of entertainment - when actually, I think it should be worrisome - appear to enable the social integration of surveillance. The very fact that we all probably - or, hopefully - know that Facebook can share our personal data with unauthorised third parties and - now, after the Snowden revelations - that governments can tap into Facebook’s servers, should be enough to convince us to delete our profiles. Yet, why do we still all have Facebook profiles? Perhaps because surveillance is socially integrated and perhaps because it is just convenient to be on Facebook. But that doesn’t change the fact that surveillance can potentially be a threat to our human rights. It just means that we perceive surveillance as an indirect threat and that we are unlikely to react to it.

In the long term, what does this mean? Well, it seems like we will probably be more acceptive towards more authoritarian power, that we will be used to the idea of censoring our own thoughts and actions (in the fear of getting caught by the CCTV camera on the street or the spyware which may or may not be implanted in our laptop) and that ultimately, we will be less politically active and more reluctant to challenge the authority.

What’s particularly interesting though about surveillance today is that it is fueled and enabled through our freedom of speech and general Internet freedom. If we didn’t have any Internet freedom - or as much as we do - we would have disclosed less personal data and thus surveillance would probably have been more restricted. The more Internet freedom we have, the more personal data we will disclose on Facebook - and on all the ‘Facebooks’ of the world - and the more data will potentially be available to mine, analyse, share and generally incorporate in the surveillance regime. So in this sense, Internet freedom appears to be a type of prerequisite of surveillance, as contradictory and ironic as it may seem. No wonder why the Chinese government has gone the extra mile in creating the Chinese versions of Facebook and Twitter - it’s probably no coincidence.

While we may blame governments for establishing surveillance schemes, ISP and TSP operators for complying with governments’ license agreements which often mandate that they create backdoors for spying on us and security companies for creating the surveillance gear in the first place, in the end of the day, we are all equally a part of this mess. If we didn’t choose to hand over our personal data to begin with, none of the above would have been possible.

The real danger in the Digital Age is not necessarily surveillance per se, but our choice to voluntarily disclose our personal data.

For more details visit https://cis-india.org/internet-governance/blog/why-facebook-is-more-dangerous-than-the-government-spying-on-you

Expert Committee meeting on 25th November, 2013

praskrishna — 2013-11-19T10:41:27Z

A meeting of the Expert Committee has been scheduled for 25th November, 2013 at 11.00 a.m. in R.No. 714 (7th Floor), Group Meeting Room, DBT, New Delhi to discuss the draft 'Human DNA Profiling Bill 2012' under the Chairmanship of Dr. T. S. Rao, Sr. Adviser, DBT.

This was communicated by Dr. Alka Sharma, Director/Scientist, Ministry of Science & Technology, Government of India to the following individuals:

Raghbir
RK Gupta
Murali Krishna Kumar
Sunil Abraham
Amar Jesani
Usha Ramanathan
Kamal Kumar
Dr. N. Madhusudan Reddy

For more details visit https://cis-india.org/news/expert-committee-meeting-november-25-2013

Spy agencies, IB and RAW, put spanner in proposed privacy law

praskrishna — 2013-11-19T09:50:05Z

The country’s intelligence agencies are out to scuttle a law that’s being drafted to protect your privacy.

The article by Nagender Sharma and Aloke Tikku was published in the Hindustan Times on November 2, 2013. Sunil Abraham is quoted.

The Intelligence Bureau and the Research and Analysis Wing (RAW) have told the government to water down the proposed law that makes it a crime to leak sensitive personal information collected by government departments and the private sector.

The agencies conveyed their views to national security adviser Shivshankar Menon at a recent meeting at the prime minister’s office. With home secretary Anil Goswami backing the spooks, even arguing that “the very need for such a bill” should be reviewed, Menon has called for revisiting the provisions the agencies have objected to.

The Right to Privacy Bill 2013 lays down privacy principles and standards, and stipulates jail terms and fines for leak of sensitive personal data.

“If such a bill was to be considered, intelligence agencies should be exempted from its purview,” Goswami argued at the meeting.

The intelligence agencies also spoke about how the bill would “adversely affect or compromise” the functioning of many agencies and projects, such as the Central Monitoring System that is used to intercept phone calls and internet communication, and the National Intelligence Grid that would give law enforcement agencies access to information combat terror threats.

The proposed privacy law was initially conceptualised to address data privacy, particularly in the context of data handled by the Indian IT industry for foreign clients.

But the Department of Personnel and Training – that drew up the bill – expanded its scope to cover information collected by the government and interception by intelligence agencies.

Sunil Abraham of the Centre for Internet and Society, a Bangalore-headquartered advocacy group, said the security establishment’s attempts to scuttle the privacy law were a step back.

“Civil society isn’t against surveillance by security agencies. All that we ask for is due process and oversight,” Abraham said.

For more details visit https://cis-india.org/news/hindustan-times-november-2-2013-nagender-sharma-alok-tikku-spy-agencies-ib-and-raw-put-spanner-in-proposed-privacy-law

India must support UN's e-snooping move: Human rights activists

praskrishna — 2013-11-19T09:10:02Z

India is facing pressure from internet and human rights activists to support a United Nations resolution that calls for an end to electronic spying after revelations of mass illegal surveillance by the United States.

The article by Indu Nandakumar was published in the Economic Times on November 11, 2013. Sunil Abraham is quoted.

The resolution, jointly submitted by Brazil and Germany - vocal opponents of US cyber spying - urged UN member states to act against excessive surveillance. Records leaked by whistleblower Edward Snowden had exposed US eavesdropping on Brazil's President Dilma Rousseff and German Chancellor Angela Merkel.

Internet activists and experts said the world's largest democracy must join the resolution as a reaction to unfair surveillance by the US. Confidential documents from Snowden, a former US National Security Agency contractor showed India was one of the victims of US snooping.

"Decision-makers in India haven't made a principled stand on the issue. They are still debating and deliberating," said Oleg Demidov, program director for international information security and global internet governance at the Russian Center for Policy Studies.

Demidov said India was unlikely to join the resolution as it has strong language and measures that need to be implemented immediately. "Joining this would mean a big political step." The resolution, while not legally binding, can still be a formal vote against US spying. A senior government official in New Delhi said Brazil and Germany on Friday held consultations with all UN member states including India on the draft resolution.

India will take 'detailed' look

He said India will take a "detailed look" at the resolution over the coming days before deciding whether it wants to be part of it. Revelations about US government snooping on communication between governments and individuals has caused global outrage over the past few months.

Popular email and internet service providers locating their servers in the US makes tapping into communication lines easier for that country. Brazil is considering legislation that would require internet companies to store data locally.

Latest documents revealed by Snowden showed that NSA had been monitoring data that travels between servers of Yahoo and Google, thus accessing personal data of millions of internet users across the world, including Indian users. It had prompted strong reaction from Google, whose executive chairman Eric Schimdt called such snooping "outrageous."

A representative for the German federal foreign office said the resolution was submitted to "protect human rights in the digital age more effectively" and that all member states are invited to co-sponsor the resolution.

"Indians should press their own government to forcefully object to the United States' surveillance policies and demand that those policies be brought into conformity with international law," said Jameel Jaffer, deputy legal director of the American Civil Liberties Union, an influential civil rights union based in New York. Jaffer said while no one questions the US government's right to engage judicially supervised surveillance, "dragnet surveillance of entire populations is a severe and unnecessary infringement on the privacy of millions."

He said that reforming the policies of NSA would require pressure from outside the US, especially foreign governments.

The pushback against mass surveillance is taking place in the backdrop of India and US looking to strengthen their economic relationship. Issues such as the US immigration reform bill which is seen as detrimental by India's $75 billion softw are export industry, and India's nuclear liability law, which US companies find unreasonable, have been irritants in bilateral relations.

Another senior government official said India's stance on US surveillance has been soft as any discussion on the subject would bring India's Central Monitoring System into the spotlight. The system, similar to the US government's PRISM project, gives the government access to phone calls, text messages and even social media conversations of individuals.

Sunil Abraham, executive director of Bangalore based think-tank Centre for Internet and Society, said India must be a part of the efforts by Brazil and Germany.

"Surveillance needs to be addressed both at technological as well as policy levels." Former diplomat and foreign affairs expert G Parthasarathy acknowledged the need for international consensus to protect individual privacy but doubted whether snooping by governments will ever end.

"Yes, the Americans are over-doing it, but India cannot condemn it because we have been doing the same thing. India monitored conversations between (Pakistan army chief) Pervez Musharraf and his chief of general staff (Mohammed Aziz) during the Kargil conflict. The point is everyone does it, but Americans got caught."

For more details visit https://cis-india.org/news/economic-times-november-11-2013-indu-nandakumar-india-must-support-un-e-snooping-move