Access To Knowledge (A2K)

Asian Forum on Global Governance

praskrishna — 2013-11-20T04:35:38Z

The Asian Forum on Global Governance is an annual workshop jointly organized by the ZEIT-Stiftung Ebelin und Gerd Bucerius, and the Observer Research Foundation.

See the details on the Asian Forum on Global Governance website here. Sunil Abraham will participate in a panel discussion. Click below for:

This year's Asian Forum is scheduled to take place from November 10 - 19, 2013 in New Delhi, India. The nomination and application process commences from March 15 and the last date for submission of applications is June 1, 2013.

The Asian Forum on Global Governance will take a close look at the Asian region and at the challenges facing the global community. The primary objective of this forum is to provide an instructional and networking platform for young professional leaders to discuss, debate and challenge conventional interpretations of the existing complex realities confronting communities and leaders. The program provides a unique opportunity for them to confer with high-ranking figures from the political, business and academic communities from around the globe, and especially from Asia.

Though the emphasis is on Asia, there will be a fair mix of young leaders from Europe, Americas, Africa, Asia and Australia. The participants will be drawn from diverse sectors and streams of study. Each of these participants will, at the outset, be nominated by senior figures – Heads of Governments, Ministries and Government Departments, the CEO’s of major National and Multinational Companies, Heads of Universities and of Non-Profit Organizations – and thereafter carefully selected by an eminent jury of experts.

The participants will be between 28 and 35 years of age. They would have acquired significant professional experience and would already exhibit promise at work.

Agenda

Sunday, November 10, 2013

Arrival in New Delhi at Hotel Oberoi, Dr. Zakir Hussain Marg, New Delhi, 110003 (Ph. +91.11.24363030)

14.00

Arrival and Check-in at Hotel Oberoi/ Lunch

16.00
19.00

Optional Heritage Walk

Spend an Afternoon Exploring the Woods and the Fort of Rai Pithora

Long before the Mughals came to Delhi, the only territory which was inhabited was Qila Rai Pithora in what is now South Delhi. Excavations have found evidence of settlements at the site. The city had 13 gates, of which only some signs of three—Hauz Rani, Barka and Badaun-- have been found so far. The Badaun gate has been mentioned by the famous traveller Ibn Batuta and could have been the main entrance to the city. We will explore the ruins of the old fort built by Prithviraj Chauhan, climbing the crumbling ramparts and fort walls to get a panoramic view of the forest surroundings.

20.00

Dinner at Restaurant “The Rooftop”, Hotel Oberoi

Welcome Remarks
Sascha Suhrke, Program Director, Governance, ZEIT – Stiftung Ebelin und Gerd Bucerius, Germany

Monday, November 11, 2013

Reimagining Sovereignty

09.00 09.10	Welcome Remarks Sunjoy Joshi, Director, Observer Research Foundation, India Manfred Lahnstein, Chairman of the Board of Trustees, ZEIT – Stiftung Ebelin und Gerd Bucerius, Germany
09.20 09.30	Co-Chair Address C. Raja Mohan, Head, Strategic Studies, Observer Research Foundation Theo Sommer, Editor-at-Large, DIE ZEIT
09.30 09.50	Honorary Patron’s Address Shashi Tharoor, Minister of State for Human Resource Development, Government of India and Honorary Patron, Asian Forum on Global Governance
09.50 10.30	Breaking the Ice: Self Introduction by Participants
10.30 11.00	Tea/Coffee
11.00 11.30	Keynote Address: Gridlock: Why Global Cooperation is Failing When we need it Most David Held, Master, University College, Durham, UK
11.30 12.30	Plenary Discussion
12.30 13.00	Group Photograph
13.00 14.30	Lunch
14.30 16.30	Panel Discussion: A New Definition of Sovereignty Ashley Tellis, Senior Associate at the Carnegie Endowment for International Peace, USA Siddharth Varadarajan, Editor, The Hindu, India Shen Dingli, Vice Dean of the Institute of International Affairs, Fudan University, China Michael Schaefer, Chairman, BMW Stiftung, Germany
16.30 17.00	Tea/Coffee
18.30 19.00	Bus Transfer to Lodhi Estate
19.00 22.00	Cocktails and Dinner Hosted by Sunanda and Shashi Tharoor
22.00 22.30	Bus Transfer to Hotel Oberoi

Tuesday, November 12, 2013

Technology, Security and Society

09.00 09.30	Plenary Address: Technology vs. Sovereignty Reka Szemerkenyi, Chief Foreign and Security Policy Adviser to the Prime Minister of Hungary (TBC)
09.30 10.30	Plenary Discussion
10.30 11.00	Tea/Coffee
11.00 13.00	Panel Discussion: Internet and the State: A New Area of Conflict Tripurari Sharan, Director General, Doordarshan, India Sunil Abraham, Executive Director, Centre for Internet and Society (CIS), India Katharine Sarikakis, Professor, Department of Communication, University of Vienna, Austria
13.00 14.30	Lunch
Working Groups
14.30 17.00	Technology, Security and Society a) Drones and Sovereignty b) Cyber Security and Privacy c) Democracy and New Media
17.00 17.30	Tea/Coffee
17.30 18.00	Rapporteur’s Report
19.30 20.00	Bus Transfer to Restaurant “China Kitchen”, Hyatt Regency
20.00 22.30	Dinner
22.30 23.00	Bus Transfer to Hotel Oberoi

Wednesday, November 13, 2013

Economic Gridlock: From one Crisis to the Next

09.30 11.30	Panel Discussion: Elusive Global Financial Governance Steffen Kern, Chief Economist, European Security and Markets Authority, France John Hulsman, President, Hulsman Enterprises, Germany Manfred Lahnstein, Former Federal Minister of Finance, Germany Jwalant Nanavati, Co-Head, Corporate Finance, BNP Paribas, India
11.30 12.00	Tea/Coffee
Working Groups (shorter format)
12.30 13.00	Gridlocks in Rulemaking a) Is the UNSC still Relevant for Peace and Security? b) FTAs, Regional Blocs and Equity: Who will Represent the Voiceless in Trade? c) Oceans: Governing the New Arenas of Contest or Cooperation?
13.30 14.30	Lunch

Thursday, November 14, 2013

Demography and Governance

09.00 09.30	Plenary Address: Dreaming with a Billion Shashi Tharoor, Minister of State for Human Resource Development, Government of India and Honorary Patron, Asian Forum on Global Governance
09.30 10.30	Plenary Discussion
10.30 11.00	Tea/Coffee
11.00 11.30	Panel Discussion: Delivery of Public Goods Rakesh Basant, Professor, Indian Institute of Management Yogesh Jain, Founder and Secretary, Jan Swasthya Sahyog (People’s Health Support Group), India Glauco Arbix, President, Brazilian Agency for Innovation, Brazil Chhavi Rajawat, Sarpanch, Soda Village, India (TBC
13.00 13.15	Preparation for Site Visits (Collection of Packed lunch)
13.15 18.15	Site Visits
19.30 20.00	Bus Transfer to Restaurant “Indian Accent”
20.00 20.30	Dinner
22.30 23.00	Bus Transfer to Hotel Oberoi

Friday, November 15, 2013

10.00 10.45	Review of Site Visits by Participants
10.45 11.00	Wrap-Up Remarks by Chair
11.00 11.30	Tea/Coffee
Climate Change, Sustainable Development and the Crisis in Multilateralism
11.30 13.30	Panel Discussion: Climate Change and Sustainable Development: The Roadblocks to Consensus Aled Jones, Director, Global Sustainability Institute, Anglia Ruskin University, UK Lydia Powell, Senior Fellow, Observer Research Foundation, India Catherine MacKenzie, Lecturer in Law, University of Cambridge, UK
13.30 14.30	Lunch
14.30 17.30	Simulation Exercise
17.30 18.00	Debriefing Session
19.30 20.00	Transfer to “The Lodhi”
20.00 22.30	Dinner
22.30 23.00	Bus Transfer to Hotel Oberoi

Saturday, November 16, 2013

Agra Retreat (ITC Mughal, Taj Ganj, Agra, 282001; Ph: +91 562 4021700)

08.00 11.00	Bus Transfer to Agra (Breakfast Served on Bus)
11.00 12.00	Arrival and Check In at ITC Mughal
12.00 13.30	Lunch
Post Lunch Session
13.30 15.30	Panel Discussion: Religion and Democracy Tarek Fatah, Writer and Political Activist, Canada Charles Kupchan, Whitney Shepardson Senior Fellow, Council on Foreign Relations, USA Ananya Vajpeyi, Ananya Vajpeyi, Associate Fellow, Centre for the Study of Developing Societies, India (TBC)
15.30 16.00	Tea/Coffee
16.00 19.00	Preparation for Debating Day
20.00	An Indian Evening

Sunday, November 17, 2013

Agra retreat

08.30 10.30	Visit to Taj Mahal
10.30 12.30	Visit to Agra Fort
12.30 13.30	Lunch
13.30 16.30	Bus Transfer to Delhi
20.00 22.30	Dinner at “The Rooftop”, Oberoi Hotel

Monday, November 18, 2013

Debating Day

09.00 09.30	Directions for Debating Day
09.30 12.30	Working Groups (Preparation for Debating Clubs) Will Sovereignty Trump Globalism? Is Green Capitalism an Oxymoron? Is Asia Facing a Demographic Nightmare? Does Social Media Strengthen Democracy?
13.00 14.00	Lunch
14.00 16.00	Debating Sessions
16.00 16.30	Tea/Coffee
16.30 17.00	Results
19.30 20.00	Bus Transfer to “Olive Beach”, Mehrauli
20.00 22.30	Dinner
22.30 23.00	Bus Transfer to Hotel Oberoi

Tuesday, November 19, 2013

Valedictory Session

09.00 09.10	Opening Remarks by Organizers
09.10 09.30	Keynote Address: Riva Ganguly Das, Joint Secretary & Head, Public Diplomacy Division, Ministry of External Affairs, Government of India
09.30 10.20	Valedictory Address
10.20 11.30	Plenary Discussion
11.30 12.30	Dean’s Address and Distribution of Certificates
12.30 13.30	Lunch
13.30 14.00	Closing Session
Departures Commence
20.00 22.30	Dinner at Chez Saran

Wednesday, November 20, 2013

Departures conclude

For more details visit https://cis-india.org/news/asian-governance-forum-2013

Taking Stock: Emerging Issues - Internet Surveillance

praskrishna — 2013-11-09T06:31:57Z

This session was held at the IGF in Bali on October 25. Pranesh Prakash made intervention in this session.

Read the original transcript published on the IGF website here.

The following is the output of the real-time captioning taken during the Eigth Meeting of the IGF, in Bali, Indonesia. Although it is largely accurate, in some cases it may be incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid to understanding the proceedings at the session, but should not be treated as an authoritative record.

>> MARKUS KUMMER: Good morning, ladies and gentlemen. Please take your seat. We are about to start our session on surveillance. We are organising ourselves a bit on the fly. The room is already set for the Closing Ceremony this afternoon, but this makes a little bit of a distant feeling. We're up here and you're far away and there are not that many people in the room so what we intend to do is to move down from the podium for the discussion. We've already set up the Chairs on the first row where the panelists will sit and interact with the audience to make it a little bit more often interactive and positive atmosphere for discussion.

We have originally we have reserved 90 minutes for this session but then we thought maybe more time will be needed so we can move on. We have 3 hours at our disposal but we don't need to fill the three hours. If we run out of steam we can conclude earlier, as some people have indicated already that they have to be leaving, so we take it improvise a little bit. But please leave free the very first, as we intend to move down there.

Before asking our Session Chair to introduce the meeting, I'll make a few preliminary remarks, and I would also like to ask the Secretariat to put up the policy questions.

We have had a process when the mandate of the IGF was renewed to look at IGF improvements. There was a special Working Group set up and the Working Group made recommendations and one of the recommendations was that each situation should address some policy questions that would help shape the discussion, and we would also ask to reach out to the community and we did so. We asked for public input and we got the input and these policy questions we received are available on the IGF website, and they will be made available on the screen.

But for better comprehension, I will read them out and our moderators will bear them in mind.

Okay. On Internet surveillance, the first question was the need to prevent mass surveillance carried out in the guise of targeted surveillance. The second question was balancing cybersecurity and privacy. The third question, principles of open Internet/net neutrality.

Fourth question: One of the emerging issues is on Internet regulation. Regulation versus self‑regulation where the Internet is concerned. How can countries that have questions on Internet regulation versus self‑regulation be aided to work on a level playing field that assist the best industry practices being adopted, best practices that make the Internet and thus countries and institutions safer from harm.

Fifth question: Better channels of cooperation between stakeholders especially in areas such as cybersecurity. 6, agreement on fundamental minimum principles for Internet Governance and multistakeholder cooperation.

7, priorities for the IGF, the Internet community, and multistakeholder governance post‑2015.

And with that I hand over to our session Chair, Dr. Setyanto Santosa, you have the Chair.

>> SETYANTO SANTOSA: Thank you. Good morning, everybody. I hope you enjoy the dinner last night. You can also look at the Balinese dancers, the modern dancer and also the original Balinese dancers.

10 years ago I was the permanent Secretary of the Ministry of Tourism and culture. At that time we had Indonesian tourism. The result was at the time surprise me when a question to the foreign tourists deliver most of them said that what actually the question is what actually was is the strength of Indonesian tourism?

They said, the people. And then following the second question, which part of the people that make you attractive? They say the smile. So at the time, I just realized that Indonesia is a country with the highest smile per capita in the world. And you prove already the last 6 days and you can find the Indonesian people with a smile.

So with this introduction, I don't take much time and the issue also very attractive is as Markus just mentioned, regarding the emerging issues.

So I look to deliver the floor to our moderator. So please, Madam.

>> MARKUS KUMMER: Please introduce yourself.

>> ANNE-RACHEL INNE: Thank you, Markus. Thank you, Mr. Chairman. Good morning, ladies and gentlemen. My name is Anne‑Rachel Inne, the Chief Operations Officer the AfriNIC, the Internet registry for the African region, so we're happy to be here. I will let Jovan introduce himself later on when he takes the floor.

We're happy to be here with you today to moderate this session on emerging issues. As panelists we will have this morning Scott Busby, the Director of Office of Multilateral and Global Affairs in the Bureau of Democracy, Rights and Labor at the United States State Department. Then we will have Ross LaJeunesse. He's the global head, free expression and international policy. The then we're having Jari Arkko, who is an expert on Internet architecture with Ericsson Research, and also the Chair of the Internet Engineering Task Force, which is IETF.

And then we have Johann Hallenborg from the Swedish Government. And our last and not least panelist will be Joana Varon. I'll pass to Jovan now. We actually will have commentators. When we finish presentations here, we'll come down to the floor so that everybody will be seated and we'll hopefully have a more convivial atmosphere than talking down to you there.

We'll have commenters from the floor, Bertrand de La Chapelle, the head of Internet and jurisdiction process in France. We will have Megi Margioyono from Civil Society. Nick Ashton‑Hart from CCIA from Switzerland, and Ambassador Fonseca from Brazil. So thank you very much for joining us all, and I'll pass on to Jovan now.

>> JOVAN KURBALIJA: Thank you, Anne‑Rachel. I'm the Director of DiploFoundation, a Swiss Foundation working on inclusive and effective diplomacy and global governance. First of all, I would like to thank Raul Echeberria and the group that he led which propose this topic to be discussed at the emerging session. And as we know, this topic has already emerged on the various diplomatic agendas worldwide. Therefore it is quite important issues to be addressed during the Internet Governance Forum.

It also is the proof of the relevance of the Internet Governance Forum in talking about issues which are of high importance for international community in general and Internet community in particular. Markus already outlined the main questions that were discussed in the preparation for the session and they will be some sort of architecture of our session.

We will tackle these questions in five main baskets and we'll organise five main baskets in 20 minutes time slot. The first basket will be on the question of infrastructure and basic functionality of the Internet, and we'll have expertise in each basket, both on the floor and in the room.

The second basket will deal with the Human Rights issues, question of privacy protection and the other Human Rights issues related to the Internet surveillance.

The third basket will focus on security, and the situations when surveillance is justified and under what conditions.

Fourth basket will deal with Data Protection and the economic model.

And fifth, the last basket, will wrap up the discussion within the general framework of Internet Governance Forum which is ethics. We will address the question of trust on the Internet and impact of Internet surveillance on trust.

The underlying issues which will be appearing in our discussion are issues of the law enforcement procedures and international law. Therefore, this is a general infrastructure and we plan to proceed with 20 minutes dedicated to each basket after we hear from our panelists introductory remarks, which they will also relate to these five main issues.

I think this is the general entry I would like to invite Scott Busby to provide his introductory remarks on the question of Internet surveillance. Scott, please.

>> SCOTT BUSBY: Thank you, Jovan. Well, I'm very happy to be here as all of us from the United States Government are. We had some drama in our country with our Government shutdown, which put in doubt whether or not we would be able to come here. And I'm pleased to say that even had the shutdown continued through this week, we had approval from the White House and other senior officials in our Government for us to attend the IGF because we recognize how important this Forum is to our own policy, as well as the overall policies relating to the Internet.

The United States comes to the Internet Governance Forum every year to stand by our commitment to an open, interoperable and secure Internet. We recognize the importance of the issue of surveillance to the international community, and are grateful for this opportunity to engage with all of you here today on it.

As President Obama has said, the United States welcomes a discussion about privacy and security, and we are right now intensively having that discussion in the United States, as well with all of you in the international community.

We know that many of you, as well as many people in the world, have questions and concerns stemming from the recent reports about alleged U.S. intelligence practices, and we look forward to engaging with you today on them.

When it comes to those practices, I can say that the United States gathers intelligence of the type gathered by all nations. All Governments are involved in efforts to protect their countries from real threats and harm, and all Governments collect information concerning such threats. As we undertake those practices, we remain committed to protecting the American people, as well as our friends in the international community, and those friends include not only Governments, but the private sector and Civil Society.

This commitment relies on robust intelligence capabilities to identify threats to our National interests, and to advance our foreign policy, which includes our commitment to Human Rights. At the same time, we also acknowledge that such intelligence efforts must be fully informed by our international commitments, our Democratic principles, our respect for Human Rights, and the privacy concerns of people around the world.

Consistent with the terms of open debate and the democratic process, President Obama has initiated an effort to review and reform our intelligence practices, and ensure that they are appropriate in light of our commitments and our principles. In terms of reform, the President has already ordered the Director of National intelligence to declassify and make public as much information as possible about certain sensitive intelligence collection programmes undertaken under the authority of the Foreign Intelligence Surveillance Act, otherwise known as FISA. Numerous documents including decisions if the Foreign Intelligence Surveillance Court have been released as part of this effort.

Furthermore, the President has appointed a group of outside experts to advise him on how, in light of advancements in technology, the United States can employ its technical collection capabilities in a way that optimally protects our National Security, and advances our foreign policy, while taking into account other policy considerations, such as our commitment to privacy and to Civil Liberties.

This group has begun its work and is expected to produce its recommendations by the end of this year. We look forward to those recommendations.

Consistent with our normal practice of not commenting on specific allegations of intelligence activities, I cannot say more than this about such allegations. But I can say a few things generally about our commitment to Human Rights and to an open Internet.

First, I would like to emphasize that the United States does not use intelligence collection for the purpose of repressing the citizens of any country for any reason, including their political, religious, or other beliefs. Thus, for instance, we do not use our intelligence capabilities to persecute anyone for ideas that they express online.

Let me also assure you that the United States takes privacy seriously, both that of Americans and of individuals around the world. That commitment to privacy is reaffirmed in the President's international strategy for cyberspace, which states that, quote, individuals should be protected from arbitrary or unlawful State interference with their privacy when they use the Internet, close quote.

As President Obama has recently said, America's not interested in spying on ordinary people. Our intelligence is focused, above all, on finding the information that's necessary to protect our people, and in many cases protect our allies, close quote.

Furthermore, the United States will continue to uphold its longstanding commitments to defend and advance Human Rights in our diplomacy. This includes preserving the consensus reflected in Human Rights Council Resolution 20/8, that the same rights people have online also apply offline. Sorry, rights that apply offline also apply online.

United States will also stay actively engaged in the Freedom Online Coalition, a group of 21 Governments that works with Civil Society and the private sector in a multistakeholder approach to support the ability of individuals to exercise their Human Rights and fundamental freedoms online. As several people have suggested over the course of this week, this Coalition may be a very good Forum in which to continue the discussion on balancing the need for security with Human Rights, and to identify an appropriate way ahead on these tough issues.

I will be hosting the next Ministerial meeting of the Coalition on April 28th and 29th in Tallinn. We will also continue to advance Internet freedom through our programmes. Since 2008, the United States has committed over $100 million to Internet freedom programmes around the world. We intend to maintain that robust level of support for such programmes. On Internet Governance, the United States remains steadfast in our support for a multistakeholder model that supports international trade and commerce, strengthens International security and fosters free expression and innovation. We strongly believe that proposals to centralize control over the Internet through a top‑down intergovernmental approach which is slow the pace of innovation and economic development and could lead to unprecedented control over what people say and do online. Such proposals play into the hands of repressive regimes that wish to legitimize inappropriate state control of content.

We also believe the current multistakeholder system should be strengthened and sustained, particularly through broader multistakeholder participation from the developing world. Through our programmes, we have sought to make such participation possible.

We are aware that some Governments seek to take advantage of the debate initiated by the recent disclosures to draw attention away from their repression of their citizens, or the need for democratic reforms in their countries. The acts of these Governments include for example arresting opponents for what they say or intimidating them into silence and stealing intellectual property for the benefit of their economies. We therefore want to emphasize how important it is not to let Governments that do not share a commitment to Human Rights and fairness to exploit the current debate to their benefit. We should not allow them to gloss over the very important differences between their Internet monitoring activities and those of countries like the United States that conduct intelligence activities to enable responsible state craft. We hope that the discussion today will reflect the fact that the issue of surveillance is a global one and will take into account the views and practices of everyone around the world. We intend to listen closely so that we can take account the many comments and recommendations from you and ensure that they are incorporated into our own Governmental deliberations. Thank you.

>> JOVAN KURBALIJA: Thank you, Scott. Our discussions will result in useful insights for the process that you indicated started in the United States and I will say reflections are going on all over the world as we will hear from the other interventions. Our next speaker is Ross LaJeunesse from Google, and we'll hear something more about the business perspective.

>> ROSS LaJEUNESSE: Thank you very much. It's a pleasure to be here. Am I all set to go? Oh, sorry.

Hi, I'm Ross LaJeunesse from Google, and it is a sincere pleasure to be here. There's been obviously a lot of discussion and debate about this issue, and that is of course a very good thing, and it's very necessary. But in order to have a discussion about this, a discussion based on reality and based on facts, I just want to start by providing a few clarifications so that we're all operating from the same understanding.

The first is that Google does not provide direct access for any Government to our data, our servers, our infrastructure and it never has. And you can use any term you like to try and describe that accusation, a back door, a side door, a trap door, anything like it, but the fact of the matter is that we simply don't do it.

We also don't accept large, blanket‑like Government requests for user data. We are subject to the law, so when we receive a Government request for user data, we look at each and every one of them very carefully. We have a team of lawyers at Google whose sole purpose is to do exactly that. They ensure that the request is valid, is legal, follows due process, and is as limited in scope as possible. And very often, we push back, and we sometimes refuse to comply. And you can see this if you go to our transparency report online, which lists the number of Government requests we receive, how many of them we comply with, and we do that around the world wherever we have services.

Now, on the issue of transparency, we believe this is a critical element to the debate. And we're not newcomers to this issue. We've published our first transparency report. We're the first country, first company, in the world to do so about three years ago, because we recognized long before the Snowden revelations that this is a critical part of our responsibility to our users.

Every 6 months we release an updated transparency report that is better and more granular and I'm glad to see that now many companies are doing the same. We're continuing this work by working with NGOs around the world to publish National transparency reports and we've released one in Estonia this year and we've highlighted another in Hong Kong and that work will continue.

So transparency of course isn't a cure‑all but we really believe you can't have a meaningful debate on the path forward, you can't have a debate on this issue, if you don't have the facts, which is why we're suing the U.S. Government right now to get them to reveal more information about the number of National Security requests and demands that they make on companies, and we're also on a separate track supporting key legislation in the United States Congress sponsored by Senator Franken and another Bill by Representative Lofgren to do the same thing.

Now, I want to emphasize that it would be much easier for us and much easier for any company to simply comply with Government requests for user data. But we don't. And we don't do that because we're a company built on the idea that if you put your user first, everything else will follow. We don't do that because we take our responsibility to our users very seriously, and that's both a matter of principle and a matter of good business.

We're very aware that if our users don't trust us, they won't use our products, and they'll go somewhere else. So again, this debate is good and absolutely necessary, but I also want to echo a point made by Scott and made by Mike Harris at the Index on Censorship, which is this: I'm all for holding the United States Government and Western countries to the highest of standards. We need to do that. But I don't want us to do that at the expense of not focusing on other countries, countries where their surveillance programmes are just as bad or worse. Countries where journalists are beaten, bloggers are imprisoned and activists are killed.

The Expression Online Initiative just released a very important report on Azerbaijan where we held last year's IGF and how horrible things have gotten there over the past year. So I'm all for this discussion about the alleged hypocrisy of the United States and Western Governments but let's not do so in a way that discounts or damages the ability of those Governments to continue their otherwise excellent work which they've long done in supporting Internet and journalist freedom, in supporting Human Rights around the world, and let's not attack them to the point where it undercuts their very important support for the multistakeholder model of Internet Governance. Thanks very much.

>> JOVAN KURBALIJA: Thank you, Ross. Our next speaker is Jari Arkko from IETF from Finland but currently Chairing IETF. Jari, please.

>> JARI ARKKO: Thank you. And thank you for the opportunity to talk, and also this is my first IGF and I really enjoyed all the discussions this week so thank you all for that, on this topic and many other topics.

And then onto this topic so obviously, the Internet community, all of us here, care deeply about how much we trust the commonly used Internet services and products that all these services are based on so the reports about large scale monitoring obviously disturb us.

Interception of targeted individuals and intelligence activities have of course been well known but I think many people are concerned about the scale. And if Internet technology itself is vulnerable to wholesale monitoring, that is also a big concern, and we take that very seriously at the IETF, as the people at least partially in charge of technical aspects of the Internet.

But I wanted to put these events in perspective. Maybe you can consider this talk as the "do not panic" message. These are hard times but we can also work on the problem, and we should.

The first observation that I would make is that surveillance is probably a wider problem in the world than what you would believe just by reading the most recent newspaper headlines. If you live in a glass house, be careful of throwing stones, and if it weren't true before, I'm sure there are many intelligence agencies in the world who have a bad case of NSA envy today.

Secondly, surveillance is not a new issue. Even we at the IETF have had to deal with some issues around that historically. In 1994, we articulated the view that encryption is an important tool to protect the privacy of communications, but at the time, big parts of the world considered encryption a dangerous tool and wanted to limit its availability.

In 2002 we decided that the IETF standard protocols must include appropriate strong security mechanisms. At the time various nations wanted to employ weaker security mechanisms. Now we are facing a new situation and once again Internet technology needs to evolve to match today's challenges.

We need to deprecate the encryptions that are considered weak and that is by the way something we do all the time with new information from research community and others. We also need to consider a bigger update to the security of the Internet. On Tuesday I talked about the by default security model. Maybe that's something we can pursue but technology alone is obviously not a solution. Even if we had a perfect communications security system, you would still need to trust the entity you're communicating with.

If the peer leaks your conversation it was not helpful. So let me talk a little bit about some of the other areas of work where some things might be useful.

First, network operations and buildout. We've seen some proposals to build more Internet exchange points and add more connectivity. Those are excellent things for many reasons. They will keep traffic more local. They will increase speed, lower costs and enable local Internet businesses to grow but an Internet that is more densely connected is a good thing.

Second, the open source community. Open source solutions are useful to assure ourselves about the reliability of our tools, whatever they might be. On some areas it may be that we should actually consider doing more than we have than so far so let us all support additional efforts in this area.

And there's more. Research community and analysis of security vulnerabilities, the attention on the matter will surely make it possible to have political and legal discussions. Maybe the transparency we just talked about, that's a good thing.

Finally, I wanted to say that I really do wish that we keep the ideals of the Internet clear in all of our minds, and not compromise them. We still need a global and open Internet, one where we can all work together across borders, with us not fragmenting the Internet and we still need an Internet that is open to innovation and new applications without asking for anybody's permission to create those conversations. And we still need an Internet that is managed and expanded. Thank you.

>> JOVAN KURBALIJA: Thank you, Jari, for this brief introduction. You give us more time for discussion later on. And our next speaker is Johann Hallenborg from the Swedish Government. Johann, please.

>> JOHANN HALLENBORG: Thank you very much. My name is Johann. I work with the Department of International law and Human Rights at the Foreign Ministry in Stockholm. Thank you very much for inviting us and me to this panel. We're happy to accept. We've been engaging with the IGF for many years, and we continue to really support this important institution.

And the reason why we're engaging is partly because we believe that the integration of a Human Rights perspective in the discussions on Internet and Internet's future is crucial. So that is part of the reasons why we're engaging so much in the IGF.

So the ultimate goal is actually to make sure that the promise on securing Human Rights online as well as offline is realized. We cannot forget that last year, we had an affirmation by consensus in the UN in the Resolution 28 that Human Rights, they do apply in the offline environment ‑‑ online environment, as well as offline.

This was also something that the entire community agreed to. The Resolution was put forward by Sweden, the U.S., Brazil, Tunisia, Turkey, and Nigeria, and it received support by 87 co‑sponsors, and then adoption by consensus. We need to remember that this is a great success, and we need to make this reality.

Governments have a duty to respect and protect Human Rights. This is a central part of our obligations. And security is needed to secure individuals' rights and freedoms and also ultimately it is to protect the open and democratic societies in which we live.

But it's important to remember that there is no tradeoff between Human Rights and security. It is not about balancing. It is about securing the respect for Human Rights, but doing it in a way that is secure.

In providing security, the Government will address several aspects. One important aspect is certainly to protect rights and freedoms of individuals from abuse of others. But equally important is to ensure the State itself does not violate rights and freedoms, in other words setting the limits for State power.

This is why the rule of law is so critically important. The Constitutional framework includes rules on legality, transparency and accountability and provides the fundamentals for what the State can do, to what extent it can utilize its powers in order to secure the well being of people.

In providing security, access to electronic communication has become an important tool for law enforcement agencies to combat crime, and for security agencies to improve security to the public. Swedish legislation makes a distinct separation between surveillance of electronic communication by law enforcement agencies on the one hand, and intelligence collection by security agencies on the other.

This separation is critical since the operational mandates and objectives for law enforcement and security agencies are indeed very different. We are now at the point in time where trust in the Internet is challenged. Therefore, to Governments all over the world, it's crucial to strengthen the relationship with Civil Society and the trust with people. Governments simply cannot afford to lose legitimacy.

But to strengthen trust, we must reinforce the principles of rule of law, transparency, and also respect for Human Rights. This is done through a deeper dialogue with all stakeholders. Therefore, initiatives that come out of the Civil Society are important, and should be taken seriously.

The necessary and proportionate principles, they represent such an important initiative, and it deserves attention from us. Therefore, in recent months, we have arranged two consultations in Geneva and in New York with the International Civil Society Steering Committee and other Governments on these issues and principles. And as a result, foreign Minister Carl Bildt at the recent Seoul Conference on Cyberspace last week presented several fundamental principles that should apply to maintain respect for Human Rights when carrying out surveillance of electronic communications and these 7 principles, they are about legality, legitimate aim, necessity and adequacy, proportionality, judicial authority, transparency, and public oversight.

This is now the foundation where we would like to continue the discussions with all. We welcome a continued deeper dialogue with all stakeholders, and we're willing to engage with you. One such example is the work in the Freedom Online Coalition in which we will continue to engage deeply.

I conclude here, Mr. Chairman. Thank you very much for giving me the word.

>> JOVAN KURBALIJA: Thank you, Johann. I just realized we breached the diplomatic protocol by putting Joana at the end of the table. Joana Varon from Brazil, please go on.

>> JOANA VARON: Thank you for the invitation. Thank you all of you for being here, hearing us and discussing. What I want to highlight here is that the emerging details of the U.S. National Security Agency, mass surveillance programmes have painted a picture of pervasive mass cross‑border surveillance of unprecedented reach and scope, and a scope that's far wider than any reason that could be related to the enforcement of National Security, nothing to do with real threats or harms.

The scope of approved surveillance was broad as it involved tapping communications of the President of countries like Brazil, which could be considered a friendly nation, and as wide as it assessed sensitive strategic business communications, such as communications from our Royal company. This scenario is not only unacceptable for leaders of states but for all Human Rights defenders. It doesn't matter if this data was used or not. The simple collection of our data and our metadata already represents a complete disrespect to the privacy rights from citizens from all over the world and a disrespect of the provisions internationally agreed on international conventions and Treaties addressing fundamental Human Rights.

And it's also a bit hypocritical as all this surveillance was performed by countries that used to pose themselves as defenders for an open and free Internet, and I'm not saying that in order to promote any polarization between different countries that could be posed as good or evil, but I'm saying that to highlight the need that every country shall assume that we still need to work a lot in order to ensure that Human Rights are protected online and offline.

Significant changes are indeed needed. The scenario that we live now is the scenario in which trust among Governments and in the major ICT and Telecom companies is completely broken but it's time to move forward and I agree with the table here, and we need to think about solutions and engage on how to implement them.

As a response to this scenario, I'm happy to see that Brazil has been proactive and has been taking actions in many different levels, as a Brazilian, I'm happy with that. International scenario we have declared urgency to approve Marco Civil, our Civil Rights based framework for the Internet. Inspired by principles suggested through a multistakeholder mechanism incorporated by or promoted by our Internet Steering Committee, Marco Civil, as it's written today, became a model in terms of both content and process, as it was developed through a wide inclusive process of online and offline consultations and resulted in a draft that protects privacy, freedom of expression, and other digital rights. I think we could all learn about this process to think in international scenario, as well.

Also in the National scenario thinking about long‑term solutions, Brazil is now promoting incentives for research, development, and innovation of our ICT Sector. And particularly for building a mail service with encryption by design. But of course, the Internet is global and is meant to remain global, and we would not address this issue only with National policies.

So what I want to highlight here is that the actions taken at the international scenario. So besides delivering a very strong statement at the UN General Assembly, which highlighted all the principles from CGI.br and all the principles that are now drafted in Marco Civil and which are committed to Human Rights, our President now has proposed for us to engage in a multistakeholder fashion, and to develop a Summit, a Summit that in my view shall be bounded by the principles addressed by the President in her statement at the UN General Assembly.

And this could be an opportunity to address all those issues, and I believe that these issues on surveillance should be addressed in both ways, changing the way the companies are operating in order to ensure transparency, but also protection of these users, for instance, by promoting encryption by design, but on the other hand, states should review their practices.

It's good that the U.S. is willing to reform its intelligence practices, so I take this opportunity to ask the U.S. Government to refer and analyze the International Principles on the Application of Human Rights to Communications Surveillance which have been endorsed to date by over 280 international organisations, and represent an attempt to highlight and address some of these concerns.

These principles provide a framework in which to assess whether surveillance laws and practices are consistent with Human Rights standards in the current digital environment. As Johann has related, they focus on legality, legitimate aim, necessity, adequacy, proportionality, competent judicial authority, and due process. They also consider user notification, transparency, and public oversight.

I welcome the initiative from the Swedish Government to consider these principles, and invite other Governments from all over the world to do the same. As I've mentioned, it's time to reassess our practices in order to be sure they're drawing respect for Human Rights with a deep dialogue with all the States that care for the Internet. Thank you.

>> JOVAN KURBALIJA: Thank you, Joana. Thank you panelists for the initial intervention and I think the underlying point is that we can recognize and all panelists recognize the severity of the problem and the need for some action and solution as soon as possible, because it is affecting activities of Governments, business Sector and all Internet users, and there were a few underlying and interesting points that could trigger some discussion in your reflections.

As Scott mentioned, there is a need to observe international law and the existing rules. There is a need to achieve certain balancing acts between the security and Human Rights but we had later on slightly different view from Johann had it's possible to have win‑win solution and not necessarily to create the balancing act and that could be an interesting point of discussion between about balancing act between security and Human Rights.

Ross rightly indicated the need for evidence based policy making, moving from the general reflections to evidence based on the concrete issues, and transparency. Jari highlighted the importance of not only technological but also policy solutions. Technology is not enough.

Johann also indicated the importance of rule of law, institutional separation between electronic communication agency, if I'm correct, and intelligence agencies. Therefore, this is one aspect that we should tackle today, procedural checks and balances as a structural design that could help us to avoid this situation in the future.

And Joana listed an excellent summary on Human Rights, question of necessity ‑‑ necessary and proportional reaction, and the question of using existing international legal tools. And this is important. We have existing international tool that could be applied to this field, including International Covenant on the Civil and Political Rights, and it was clearly indicated throughout the discussion and it is position of all major players, including the United States, that existing international rules should be observed.

With this quick wrapup and ideas for discussion I pass the floor to Anne‑Rachel.

>> ANNE-RACHEL INNE: Thank you very much, Jovan. I think we're going to go directly to our commenters from the floor, so I am going to give the floor to Ambassador Benedicto Fonseca Filho from Brazil to respond to some of the ‑‑ do we have microphones somewhere?

>> JOVAN KURBALIJA: A microphone is coming, yes.

>> ANNE-RACHEL INNE: Thank you.

>> BENEDICTO FONSECA FILHO: Thank you very much. I'd like to start by doing something that usually we do in intergovernmental setting at the UN. For example, I served at the UN a few years ago, and we used to initiate our talk by saying we align our statement with the statement that was delivered before by some Regional Group or some larger setting so I'd like maybe to innovate in the context of IGF, and say that I'd like to align my statement with the one that was delivered by Joana Varon on behalf of Civil Society because I think she expressed in a very clear way most of the things I was prepared to say, and so she made my life much easier, so I'd like to align my statement to what she has expressed and also to a large extent as well to what has been stated by the representative of Sweden, we share also the view that it is not inconsistent to pursue Human Rights dimension and examine the surveillance context and the disclosures in the context of enhancing the Human Rights dimension. It's not inconsistent with the fact that we all and some of us we are very firmly committed to Human Rights.

We are not diverting the discussion. We are not ignoring that this discussion could serve the purposes which are not our own, but at the same time, we do not think it is ‑‑ it would be a good thing to, because of this, to ignore the situation, try to improve on the situation we have.

So the 7 principles that were spelled out by Minister Carl Bildt at the Seoul Conference also I'd say very much express the kind of approach we'd like to take in that regard.

Having said that, and referring to the speech that was delivered by our President at the United Nations, at the opening of the general debate of this year's United Nations General Assembly, I'd like to highlight that the protection of Human Rights, privacy, freedom of expression ‑‑ women's rights, and it's those two specific manifestations, are at the core of the concern of President Dilma. She has clearly indicated that from the Brazilian perspective, there is a clear need that at the international level we should devise and launch a process that would lead us as international community to achieve principles and norms that would guide use and operation of Internet. And these should be guided by a vision inspired by the multistakeholderism approach, and also be firmly grounded on Human Rights and other principles she spelled out.

So we see no inconsistency in pursuing these, and not taking into account the larger picture that we want to be very careful about.

And in that sense, it is very important as has been highlighted by Joana, that we view the Summit, we intend to hold in Brazil, as a follow‑up of the speech that was presented by President Dilma and of course we came to this setting, our Minister of Communication came here, and he was mandated by the President to further discussion and collect views, and I would say that without deviating from our main subject, that the Summit in Brazil today will also incorporate other dimensions of discussion, not only focusing on principles and norms, but this is indeed one of the very clear parameters for us for the meeting that will enable to engage in other aspects of the discussion as a result of the consultations we have held here.

But the clear focus on the necessity as international community working in a multistakeholder environment to develop principles and norms is clearly one of the main objectives we have in mind.

And if I can just clarify one point that has been the object of some misunderstanding in the course of this meeting, when President Dilma delivered her speech at the UN, she referred to a multilateral framework, civil framework, with the support, full support and full involvement of Civil Society, private sector and other stakeholders, and later on when we came to this meeting, our Minister was in contact with her, and as a result of the information he provided, she made clear that she meant what she really meant was referring to multistakeholder, not only multilateral.

And I was just reviewing the news from Brazil, and I saw that yesterday, President Dilma referred again to this, and again she used the word "multilateral," so I know this in the heads of Many people will maybe lead to a confusing reflection on the situation, and say: Well, Brazil is a swing state. Doesn't know if it wants to be multilateral, multistakeholder, or what is the situation.

What I would say, that even, first of all, President Dilma, she has interpreted what she has said, and we maintain there's no contradiction what she said in those circumstances. From the point of your Government, and this is a very important thing that has been discussed here in some panels, that we should be very careful about the concept, the language we use.

Sometimes from the point of view of Government, when the word "multilateral" is used, what is meant primarily is that this is, we use in opposition to unilateral, more than meaning it's something to be done on a purely intergovernmental setting. I think this was the meaning she wanted to convey when she delivered the speech at the UN, that we want a framework that would be indeed done by many parties, not only reflecting the view of one single party or a restricted group of parties.

And she explained that this certainly does not convey the idea of excluding any stakeholder, so I would just maybe, and I apologize for taking so much time, but to clarify that we need maybe not to pay too much attention to particular statement on a particular setting, responding to a journalist that made some question, but having into account the larger picture, and the larger picture, the President interpreted as meaning "multistakeholder."

And when she mentioned the civil framework as a reference for her speech at the United Nations, she used the word, as Joana has spelled out, this was developed in a multistakeholder setting. The principles developed by the Commission are a multistakeholder way are clearly inspired President Dilma's speech, so when she was referring that we need international level such an instrument, clearly there is a linkage to the multistakeholder dimension, even if there is not the word there.

So I just want to caution that sometimes from the part of Government, at that level of leaders maybe we should not be too much vigilant about any particular word, but see the larger picture and what is the real intent.

So I just wanted to take this opportunity to thank all stakeholders we have been meeting in the course of this IGF on the part of Government, Civil Society, private sector. We have seen an overwhelming support for the idea to develop, to go in the direction that was indicated by ‑‑ proposed by President Dilma, but also building on contributions that will add to the process, and it was very stimulating for us to see that there is a willingness to mobilize different stakeholders, to come forward with proposals, to be involved in the preparation for this meeting that we intend to be truly multistakeholder from its outset from the agenda setting, from the kind of outcomes. And we see it as a contribution to the processes that are existing processes.

We wanted to be respectful of the existing process and not compete or overlap or supersede any of the existing processes that exist. And maybe a final word, that is Brazil is a very firm defendant of Human Rights. We have been as was spelled out at the core group that drafted these landmark Human Rights Council Resolution, that gave this very clear message that Human Rights offline should be also respected online.

We are ready to uphold Human Rights in many settings, and in settings that would be global, that would be constructive, that would lead to stimulate countries and provide for positive incentives for Human Rights to be upheld on a worldwide basis. Thank you. Thank you very much.

>> ANNE-RACHEL INNE: Thank you very much, Ambassador Fonseca. I'll go directly now to Bertrand.

We have remote interventions.

>> Yes, there are ‑‑

>> ANNE-RACHEL INNE: Hold on a second Bertrand. We're going to start with remote questions. Go ahead.

>> SUBI CHATURVEDI: Thank you, Anne. There are two questions from Peter Hellman, and we have interaction as well, so that's a wonderful thing. Peter has a question for the U.S. representative, and he wants to know: Does defending U.S. foreign policy interests include surveillance of the phones of heads of Governments, of countries that are friends of the USA?

And there is a question for the representative from Google: There have been reports that U.S. cloud business can expect loss of business from non‑U.S. customers in the coming 3 years to the tune of about 30 billion U.S. dollars and that the overall negative impact for the IT industry over the next three years could be up to 180 billion U.S. dollars because of a loss of trust. What do you intend to do to restore that trust so that people feel that they can trust cloud providers to keep their data private and secure?

The Tweet also relates to the same theme of proportionate and necessary steps that governments can take on the theme of surveillance vis‑a‑vis security.

>> ANNE-RACHEL INNE: Thanks so much, Subi. So now we'll go to Bertrand while our panelists can reflect on what they want to say later. Thank you.

>> BERTRAND DE LA CHAPELLE: Thank you, Anne‑Rachel. Again I'm Bertrand de la Chapelle, the Director of the Internet and Jurisdiction Project. And following the discussion before, I wanted to highlight that this debate on surveillance actually can be placed in a larger framework of issues and I'd like to tackle quickly three. The first word is "sovereignty."

What we're talking about here among others things is the exercise of sovereignty in the digital age. The traditional exercise of sovereignty is on the National territory. And the advent of the Internet is introducing an incredible new capacity for National decisions for better or worse to have a transboundary impact on other ‑‑ on citizens of other countries. The fact that operators are based in one country allows by definition in any country the authorities of that country to exercise sovereignty on those operators and impact decisions that have consequences for actors on another territory.

This is a potential extraterritorial extension of sovereignty, and it reduces and balances among the different countries depending on the number of actors located on their soil.

But the reverse is true, as well. Following what has been named the recent events and the revelation of the Snowden affair, a large number of actors and countries in particular have taken positions in reaction in order to defend their sovereignty and have pushed forward for instance the notion of data sovereignty, requiring or intending to require the location of the data regarding their citizens on the territory.

This is a reintroduction potentially of physical frontiers in a certain way, in a technical infrastructure that was intended from the onset as a cross‑border architecture, not necessarily a completely borderless but a cross‑border architecture.

This is a challenge because the traditional notion of the international system is based on the separation of sovereignties and most international organisations are based on the principle of non‑interference in the affairs of some other country. The current situation is challenging this, and is putting in front of Governments an incredible challenge, which is: How do you cooperate to manage shared online spaces? That's the first point. This is a new type of challenge.

The second word that I would like to highlight, and this goes to what Joana was mentioning, is the notion of due process, of fair process, or any kind of element that ensures that the procedures for issues related to surveillance but also to law enforcement related to freedom of expression, privacy and so on, any kind of process that deals with Human Rights and the rights of citizens and Internet users have to be done according to a set of rules that are fair and en sure due process.

This is particularly difficult when you deal with transborder relations. When something is done in one country across the Internet and you have to obtain data, take down content, have to ask for the removal of a website. There is currently a lack of procedures to handle this and fair process mechanisms to handle the relationship between states, platforms, end users in a fair process manner across borders. And this question is reflection also of what happens here in this debate on surveillance because what we've been talking about is the implementation fair process, oversight, and that's the main issue. Because principles in themselves are not sufficient to ensure the protection of Human Rights. They are necessary but not sufficient.

If the procedures are not appropriate, if the National frameworks are not sufficiently protective, it is not enough. And even when the framework is present, the actual implementation of the framework may be faulty sometimes. And oversight is an important element.

Finally, the third word that I would like to use is the law of unintended consequences. The trend that we're seeing today, in reaction to the recent events and the debate on surveillance, is a very troublesome one for everybody. The notion that in reaction and by legitimate concern regarding the protection of their citizens, Governments are thinking about establishing rules regarding so‑called data sovereignty is something that we should explore with extreme caution. There are extreme technical challenges to do this, and there is a great likelihood that if you want to sort in the databases of large global corporations which users are from one given country or located in one given country, you might end up having to do a larger breach of privacy than the protection you want to establish, or the things you want to correct.

And the second element, and this was very present in a meeting that we organised in Delhi in the Internet jurisdiction project where the industry in India, not the foreign companies, the industry in India, was explicitly saying to the government, be careful what you wish for., because if the principle of data sovereignty is pushed too far you're harming the potential of the local industry to be an actor, a major actor, in the global cloud business.

So without elaborating, the challenge is we are in a situation where because there is no sufficient international frameworks for discussion, among the different stakeholders on those issues of sovereignty in the digital age, and due process, we run the risk of having a large number of uncoordinated actions by different Governments and different private actors that will look perfectly natural as a first step, but what was a communative effect will be harmful to everyone, which leads me to this my conclusion which is this meeting of the IGF has proved beyond doubt the benefit of addressing those issues in a multistakeholder format.

The fact that the whole environment has triggered an event that is likely to take place in Brazil is providing an opportunity to address some of those issues, and to probably hold a little on some of the National decisions that are under discussions until there is a certainty that the communative effect is not harmful. The Brazil meeting will be important. There are other processes. The meeting of the Freedom Online Coalition has been mentioned. There's been a great effort and I'm sure somebody in the audience will refer to on a set of principles called necessary and proportionate. There are not enough but that will certainly be part of the discussion.

And I want to highlight a final element regarding the Council of Europe recommendation two years ago that established the principle of no transboundary harm, i.e., the responsibility of States from the decisions at the National level that may have an impact across borders.

So those elements are aspects that require a lot of caution in the individual actions that the different Governments are contemplating to make sure that they're collectively for the benefit of an open and unified Internet.

>> JOVAN KURBALIJA: Thank you, Bertrand. Before we continue with the other commentators and remote participants I'd like to invite Jari who has to leave in about 10 minutes to reflect on the discussion so far especially from the point of view of the infrastructure and basic functionality of the Internet. Please, Jari.

>> JARI ARKKO: Thank you. Apologies for being forced to leave. I had another commitment in another room in a moment. And of course, much of the discussion has been at the different level not so much about the infrastructure perhaps or the technical things. I wanted to highlight a couple of things I've heard in the discussion so far. I really wholeheartedly agree with Ross about a fact based approach to this. This is really crucial.

The other thing that is important that was highlighted by many people, or almost everyone, is transparency, and the rule of law. Those are very good things, and worthwhile to work towards.

And then I kind of wanted to return also to the important principle question, and many of you had these points, as well, to look after Human Rights, multistakeholder model, decentralized nature of the Internet, in particular the multistakeholder model is really key for us to have an open, well‑functioning Internet that balances the different concerns, and I with pleasure noted the comments from Ambassador Fonseca Filho and others on how important the multistakeholder model is and there's consensus at least here on multistakeholder being the way forward. And I think it was Johann who commented also that the Internet needs to stay global. That really is true.

Sort of the only thing that I gathered from all of the discussions so far that kind of relates to infrastructure or technical things was this possible demand for keeping data local and I just wanted to raise an issue from the technical community perspective that sometimes we may have conflicting desires or requirements, and we need to be careful what we wish for.

I think a blanket requirement for data to be local within a country would probably harm innovation in the Internet. Because if I'm a small enterprise that comes up with a great idea, and I will invite users from all over the world, I don't necessarily immediately have an ability to build out facilities all over the place. I need to be able to innovate without too much burden.

And this is just one example of the kinds of things that we may run into, but we need to be careful about setting too many demands on how the network actually runs. The management and buildout needs to be possible still, and cheap. That's a key, and the innovation needs to continue.

So those were the short remarks that I have at the moment.

>> JOVAN KURBALIJA: Thank you, Jari. You gave us quite comprehensive overview of the infrastructure and technical aspects of the Internet, and a few warnings that we don't go too far with some prescriptions but more guiding principles, and nudging towards useful solution and leave everything as to develop more spontaneously.

>> ANNE-RACHEL INNE: Thanks, Jovan, and thanks very much Jari for joining us so far. I know that Joana had another commitment. You're still okay? Great. Fantastic.

So I'm first going to go to the remote participation people, and then I will come back to Nick Ashton‑Hart.

>> SUBI CHATURVEDI: Thank you, Anne. There's a question from Monika Arnett, who is a freelance reporter and a journalist from Germany. And her question is to U.S. and Sweden representatives. She wishes to know: do the more mighty technical tools oblige us to fundamentally reconsider intelligence legislation? Because we otherwise face a state within the State which blinds public trust, oversight, erodes democratic control, and starts to possibly blackmail those elected to govern. Thank you.

>> ANNE-RACHEL INNE: Thanks, Subi. So up to Nick now. Thank you.

>> NICK ASHTON-HART: Thank you very much. The Computer and Communications Industry Association is made up of many of the Internet's more successful business to consumer companies, so of course we have a strong interest in this, though I would say that our comments stand on their own and our members including Google, who are here, have made their own statements, and you shouldn't conflate the two.

I think fundamentally we're facing a problem that is not technical or an Internet problem even though the Internet has made ‑‑ the tools of the Internet has made it possible and many aspects cannot be solved by legislating, especially at the National level, about the Internet, such as Johann put on hosting. We have a paradigm where we're common digital citizens but also common digital foreigners, by which I mean that in the analog past, our nationally protected rights of privacy were protected because each country could only post, frankly, so many cultural attaches in their foreign embassies before countries would say: No, that's too many spies. You have to get out.

So you could only spy in the analog world frankly on a fairly limited number of non‑nationals. Unfortunately now that situation is inverted and it is now ‑‑ the lack of any legal prohibition on countries spying on other countries' nationals means that we're all in some way fair game for an almost unlimited amount of surveillance by countries, except the one we live in.

And so in previous debates about ACTA in Europe, SOPA, PIPA in the United States, we saw a strong reaction against using the Internet in a way that was harmful to the Internet itself, to solve a specific issue for the benefit for stakeholder or stakeholders, and in a way we can argue we have the same dynamic here where technology is being employed by security services to facilitate information gathering with few limits, especially on non‑nationals, thanks to technology, yet at the same time, the Internet relays on trust. Without trust, people simply will use services less. They will say less. They will fear more.

And right now, we have a debate that is largely focused I think on negative incentives, characterized by a lack of trust, an increase of suspicion, and a fairly continuous stream of revelations which I think we all realize will continue for quite some time. It's understandable that this would generate a lot of unhappiness.

But I think it also obscures a few fundamental things that we share in common, which is that we all would want to trust the online world more rather than less for social and for commercial purposes, that the further development and spread of the Internet, for those who have yet to go online, which is more than half the human family, is a shared goal, so efforts which make that more expensive or more difficult are not welcome.

That legitimate law enforcement efforts as relates to crime of whatever nature, that societies decide need to be interdicted, is a reasonable activity. That fundamental transparency in Government operations is important even if there is a tension about the relative level of transparency in some respects of Government activity.

We want our National Constitutional protections of rights to privacy and the like to have real meaning, online and offline. We want to enjoy the internationally protected Human Rights that are pretty universally accepted, even if they're not always universally observed as we would like.

These are profound common shared needs, and perhaps we can find a way to use them as a basis for a constructive conversation about the role of security services and law enforcement online as it relates in particular to the everyday lives of individuals especially those who are not employed by the Government or in Government service.

The debate we have right now, I don't think leads to a positive end for the Internet community, and especially for the Internet. But as a community, we have the knowledge and the incentive to work to change that debate. I hope that can be another shared interest that we can build on, recognizing of course that criticism of Government behavior is a fundamental right of all, and there must be room for such criticism.

But to return to my original point governments have a responsibility not to allow surveillance of their nationals to get out of control and ironically in a digital age, for those National protections to mean anything, that responsibility really cannot end at your National border because if it does, the result counter‑intuitively is that if everyone but you is spying on your nationals, how can you say that your National Constitutional protections have meaning name? They have even less meaning because you have no idea who knows what and is doing what in relation to you. In that vein I think the explanations we've heard from Ambassador Fonseca of the Brazilian initiative are welcome.

A conversation about what we share, the beliefs we share, is not something we should fear. It's I think essential if we're to meet this conundrum of an analog past meeting a digital future in terms of surveillance.

>> JOVAN KURBALIJA: Thank you very much for your excellent intervention. We'll try to tap this enormous expertise in the room, experience, expertise and knowledge and we will like to ask you for your comments and questions. I think there is one person in the room who comes from the organisation that can help us to address these balancing acts in the surveillance issues. We already heard about Human Rights aspect, security aspect, and Data Protection. And Council of Europe is organisation which has under its one roof three conventions and three institutional mechanisms for covering cybersecurity, Data Protection, Human Rights. I don't know if somebody from Council of Europe, Jan Malinowski, is here. Could you give us a quick remark, a few points, how to address this balancing act between different aspects? It has been underlying theme throughout the discussion, please.

>> JAN MALINOWSKI: The Council of Europe approach I think mirrors in many respects the different dimensions that have been mentioned here already, and I wouldn't go into that. I think that in substantive terms, what Johann Hallenborg has said is valid and it does exemplify the different responses of the Council of Europe.

But the Council of Europe approach I think can be described as multistakeholder. One has to listen in order to deliver good governance, one has to listen to the different voices and leave whoever is responsible for something to take the decisions, but taking into account everything that others have to say.

The Council of Europe response is multidisciplinary. There are different issues that need to be expressed in one topic and we see there are issues relating to National Security, to privacy, to freedom of expression, to crime, to rule of law. All of them need to be taken into account, and that requires a broad vision.

There are in the Council of Europe multiple responses. There are in addition to dialogue, there are responses that go through the intergovernmental negotiation line, with soft law, with recommendations, Bertrand de la Chapelle mentioned some of them. There are a host of others that would apply to this and there is hard law. There is international Treaty law as well. We have the cybercrime Convention that's been mentioned. We have the Data Protection Convention and above all we have the European Convention on Human Rights that encompasses all of it. It goes all the range from freedom of expression to others.

And we have multiple accountability responses, as well. We have political accountability. We have legal accountability in the court. We have discussions in the specialized Committees, in the Data Protection Committee, in the cybercrime Committee and so on.

In connection with the Snowden case in particular, the Council of Europe does not have a response or has not given or attempted to give a response at this stage but there are two things that I would like to draw your attention to in that respect.

Already from the '70s, the European Court of Human Rights has made it clear that a system of mass surveillance can undermine or destroy democracy under the cloak of protecting it. I think that's a very important statement. As I said, it relates to cases well before Snowden, well before the Internet.

And the other aspect which is very relevant to the Snowden affair is that the Council of Europe cares about whistleblowers. Whistleblowers who disclose information in the public interest should be protected, and I think that the discussions that we are having demonstrate that Snowden has made revelations and disclosures that are in the public interest. Thank you very much.

>> JOVAN KURBALIJA: Thank you for addressing this main dilemma if you have in the same room people from cyber security, data collection community and Human Rights community, what is the way to address the question of intersurveillance? And we will be facing it more and more, that interprofessional dialogue.

I saw some hands over there. Khaled, please. And over there, yes.

>> KHALED FATTAL: Thank you, Jovan. Can everybody hear me? Yes? Okay, thank you. My name is Khaled Fattal, Chairman of the Multilingual Internet Group. The issue that I see in front of us here is not about alleged or not alleged. It's really goes to the core and to the values of what multistakeholderism stands for.

Many who attend ICANN would remember that I took the lead on making this a topic that needs to be addressed by ICANN, by the international community during the ICANN Durban. Raising the issue that unless we deal squarely with the issue of surveillance, we are not giving the true value of how damaging it is to multistakeholderism.

This is like a cancer scare to the trust of the multistakeholderism we all believe in. We believe many of us believe in multistakeholderism from an altruistic point of view, and we believe in privacy, freedom online. I'm a Syrian American, and nobody needs to lecture me on the importance of democracy and privacy and freedom of expression. But when the values are being challenged of what this stands for, I think it's time to come to terms with greater acknowledgment of what damage has been done, and how to fix it is required.

In emerging markets, we're embarking on major events in emerging markets. This is the subject matter that people want to talk about at many levels of society. And unless we deal with it very, very squarely, very ‑‑ at a high priority level, we will not be able to diffuse the situation, because so far all I see is an attempt to diffuse, that people get it off their chest. The values of what we stand for is really what's at stake.

I'll just close with this one remark: The war against terror was angled at our values versus theirs. The war against terrorism is our values versus theirs.

What does it say that in pushing towards a free and open Internet, we discover we are spying on the rest of the world? It's again going back to the values. Please take note, a cancer scare does not get treated with an aspirin. It needs an acknowledgment of what had happened, and a desire and a genuine desire and process put in place to show this is being addressed and fixed, rather than just being an attempt to diffuse.

This is my recommendation, because all of us who believe in this do not want to see this multistakeholderism damaged. I will close with that remark. Thank you.

>> JOVAN KURBALIJA: Thank you, Khaled, contributing to the fifth basket on ethics and trust, importance of trust and values in addressing internet surveillance and we will try to organise our discussion along these main five lines. Please could you introduce yourself, Sir?

>> REN YISHENG: Thank you, Mr. Chairman. I believe we have ‑‑

>> JOVAN KURBALIJA: Could you introduce yourself?

>> REN YISHENG: Yes, okay. My name is Ren Yisheng. I'm from the Foreign Ministry of China. I was going to introduce myself in my mother tongue Chinese because I believe we have interpretation in the room so please put on your earphones.

Let me start by making my intervention in English while you are getting your earphones. I have a couple of points to make. Number one, we all have consensus on the common values of the universality or universal value of Human Rights. On the other hand, that we would also like to stress that Human Rights concept is an integral concept, it's a whole concept that we should not neglect the other parts or elements of Human Rights, which is to say that we have two sets of rights, civil political rights, economic, social and cultural rights, and in fact the right to development.

On the other hand, also there is a check and balance of rights. We have rights. On the other hand, we have our obligations, responsibilities. Our obligation, our responsibilities to the society, to respect the rights of others. This is the first point I want to make.

The second point is on Internet. I think that we have so many elements, so many factors that we need to look at. There is at least in my view that we have many elements that we need to look at. For example, the right to access. I think this is a very important issue for many countries, the developing countries in particular.

I'm glad that you're getting your earphones so that I can switch back to my mother tongue language, Chinese.

Since all of you have earphones right now, I'm going to switch back to my mother tongue. Over the past two days, few days, IGF discussed many important issues in relation to Internet development including the stability of Internet, the resource allocation issues of the Internet, and the Internet crime issues, spam e‑mails, as well as how to enhance the trust of the public to Internet.

Meanwhile today, the issues we're discussing and issues we discuss over the past few days is that some individual country carrying out largescale surveillance over other countries, like other Delegations of other countries, we are very surprised, very much concerned over this issue. We believe massive surveillance no matter over the individual citizens or other politicians of other countries is a infringement of sovereignty, National interest, and privacies of other countries, and also it poses as a threat to the safe operation, secure operation, of Internet operation.

Meanwhile, this conduct seriously damaged the public trust of Internet. Last but not least, I'd like to say to discuss the principle of Internet Governance, several points are extremely important, such as transparency, inclusiveness, participatory principles, and cooperation. And so on and so forth. Therefore, we're very much in favor of the points made by the Brazilian Ambassador, the governance of Internet is something that we have to work very hard on the basis of multistakeholder, no matter be it the Government or Internet companies, academic circle, Civil Society, no part should be excluded from this process.

We believe all people should participate. If you exclude any stakeholder in the course of Internet Governance, it's not good. Thank you very much, Mr. Chairman.

>> JOVAN KURBALIJA: Thank you for your patience with our technical facilities and readiness to address us in English, and I think you reiterated quite a few important principles for our discussion, and elements of trust, Human Rights, in comprehensive way, question of sovereignty and I think we have quite a few interesting points. We have intervention here.

>> SUBI CHATURVEDI: Thank you. Am I on? Hi. Is the mic working? Okay. My name is Subi Chaturvedi, and I teach communication and new media technology at a University in India. It's a women's college, and we run a Foundation called media for change. The issues that we primarily look at is how the Internet and new media technologies can empower developing countries. I thank Raul once again for organising this session because we're looking at some of the most important questions that go to the heart of the matter. At the core of the Internet is trust.

The fact that we can trust this wonderful empowering technology which data which is immensely and increasingly private, personal and confidential. I do want to raise a couple of points here. When we start talking about situations such as these, I'm reminded of a story and we all grew up reading Sherlock Holmes and one of the stories was about why the dog didn't bark.

And this was about how we've decided to keep quiet at moments such as these, and when we are faced with uncomfortable situations, we decide to take positions. This is an important moment, and I can't agree more with what Khaled had to say. This is about trust but this is also about working in a space which is collaborative and I do not believe that cybersecurity and concerns around sovereignty can exist in isolation without the consideration for individual rights of States and citizens.

And I do want to reiterate that this journey from being the slave to the citizen has been a long one, and when we come to this point, of data collection by Governments for what purpose, by whom, and for how long, and where is it going to be kept? When we create honey pots such as these, these are questions that we worry about, not just from the Human Rights perspective. And I come from India. We have laws to protect children and women, and vulnerable communities in particular and we have just had two 18‑year‑old girls go to jail for updating a status, because they decided to voice their dissent.

And this is all for our own good, which is what I hear increasingly more often from Governments across the world, but I do want to say that two wrongs don't make a right, but what we have with us is a wonderful process which is bottoms‑up, inclusive and multistakeholder. Yes, there might be problems in the current system but that does not mean that we privilege one stakeholder which is largely the Government and most of us do not know then when these conversations take place, whether our voices would be heard.

Democracy is a wonderful thing and a participatory democracy is an even better one but it's not the same as multistakeholderism. I think we've got a solution. We have a platform. Let's acknowledge this, let's take it from here, and let's keep working with this platform. But let us work to reinforce the system that we have in multistakeholderism.

I think that is the only way forward. Thank you, Chair. Thank you for giving me this opportunity.

>> JOVAN KURBALIJA: Thank you for bringing Sherlock Holmes into our discussion, as well.

>> May I? My very brief question is for Mr. Scott Busby. I was really pleased to hear a changed statement or a changed tone from the U.S. Government, and I would hope and I believe that it is a reflection of the changed mindset within the U.S. Government towards surveillance, and Human Rights and privacy.

And if that's indeed the case, I would like to ask you that at the center of this whole ‑‑ at the center of these developments is a man called Snowden, whom Mr. Obama has referred to as a traitor. Is that still the position? Or has that position changed? Is this changed tone from the U.S. reflective also of the position on Snowden?

Because it's an important Human Rights issue. Snowden as a cause and Snowden as an individual, I'm talking about Snowden as an individual, what does the U.S. Government want to do with him? That's my very brief question and I would like that answer. Thank you.

>> JIMMY SCHULZ: May I? Okay. My name is Jimmy Schulz and I was a member of the German Parliament until Tuesday and the Committee for Internal Affairs and Home. And I've been taking care of the issue since it occurred.

It was said the whole thing of surveillance is not new. It was said that others do that, too. That's true. That doesn't make it better, and that's no excuse.

A question to Google: You said you don't give direct access, which sounds a little bit like Keith Alexander said in last year's Defcon, we don't spy on every American. That doesn't mean we don't give direct access. Is there any indirect access?

Because you've talked about legal interception, are you forced by any law not to tell us everything? That's a question to Google.

To the U.S. Representative: Keith Alexander said earlier this year those who encrypt are treated as potential terrorists, wherefore I am a potential terrorist. Do you think I am a potential terrorist?

And you also said some countries are taking advantage of the situation. Does this apply to Germany? Because I think the whole thing is an earthquake in our relationship. Friends don't do that.

And you said you're taking recommendations. I give you something that is not a recommendation: Stop surveillance now. But to be more coming to the point, I think we have to take three steps. First of all, I expect and I think we need complete transparency, complete transparency which means you have to tell us everything, and everyone has to be open on that issue.

Second, what we need are international contracts that friends don't spy on friends. And, third ‑‑ and this is a thing we really should do ‑‑ is encrypt all our communication so surveillance won't work. Thank you.

[ Applause ]

>> Thank you very much. Yes?

>> EVERTON LUCERO: Hello. So I'm with the Brazilian Government. I think we are dealing with a situation now that requires clarity in terms of what we need to address in the future, so as we avoid that it will ever happen again.

I mean, the unprecedented mass surveillance and un authorized monitoring of communications of millions of citizens worldwide by one intelligence Agency of one single country has naturally revealed something. First, I agree that it reveals we do not have a technological gap to fill in. This is an ethical and a political question. We have an institutional gap clearly. Because the only way that we will avoid there to happen again is if we agree in a set of principles and norms, and an institutional framework that would on the one hand recognize legitimate multistakeholder processes, and on the other hand, create an ethical ground for every actor to behave in the future in a way that will not damage Human Rights and privacy of any citizen in the world based on any grounds.

In particular, when it comes to National Security, I believe this argument does not stand for it any longer since you may hardly conceive a situation in which normal Brazilian citizens or companies or authorities are violated in their privacy. Is that done in the name of National Security? And how come? Does that mean that there is a suspicion that millions of Brazilian citizens and Brazilian companies and authorities are somehow involved with terrorism or any other activity that may be harmful to National Security of other countries?

As a Brazilian citizen and as a Brazilian public servant, to me, these are questions that are still to be answered. And the only thing we can proceed with this in order to create a new vision is to get together all the stakeholders and think deeply about how to make sure that we will agree on a minimum core set of rules and principles that will become the norm, and that will be observed from now on, so that this situation will not repeat itself. Thank you.

>> ANNE-RACHEL INNE: Thank you very much, Mr. Lucero. I'm going to ask for you forgiveness for a few minutes. Given what Everton said I would like to call on our commenter, Megi. Megi is a special consultant with the right of Internet users so we'd like to hear from him now. Thank you.

>> MEGI MARGIYONO: Thank you, moderators and Chairman. As I am an Information Technology lawyer, so my comments will be on the legal aspects. I think our discussions should move forward, not just track a debate whether the surveillance are accepted or not accepted, but on how to make Internet still free and open despite surveillance activities. One of the issues is striking the balance of rights, the rights of security and the rights of privacy and freedom of expressions.

However, to make globally accepted set of standards, principles, and rule to striking the balance of those rights seems difficult, because despite Human Rights is accepted as universal rights, but the applications of Human Rights differs from places to places.

Also on the threat of security issues also different from countries to countries. Freedom of expression in the U.S. is regarded as quote, unquote, the most important right, because protected under First Amendment, but privacy in the U.S. is not clearly whether it's protected under U.S. Constitution. At least it's not written on the U.S. Constitution, despite there are some interpretations that privacy is Constitutional right in the U.S.

On the contrary, in European countries, privacy is most important and there are some sets of limitations of the applications of freedom of expression. We know there are margins of appreciations that apply and applications of the freedom of expressions in European countries.

In Asia, privacy and freedom of expression seems not a strong right, and not strongly protected. Government of Asia like Indonesia pay more attention on security than freedom of expression, also privacy. Some say that privacy don't have cultural rules in Asia like Indonesia.

So regarding to the matter of facts, it seems difficult to set up a globally accepted rule to striking the balance of these rights.

Sorry. However, democratic on the surveillance activity is very important. Maybe the surveillance activity have to be commissioned by Parliament to make sure the surveillance technology is not abused by Government. It's important because technology of surveillance has been proved to be abused by some Governments of Emirates Arab Union and Bahrain. According to a report, surveillance technology provided by United Kingdom company named Gamma Group International is misused to monitor journalists, bloggers and activists in those countries. That is also a report that militia use surveillance technology to monitor the activities of opposition parties prior to the general election last year.

And Indonesia just signed a contract with Gamma Group International on September this year and we should make sure that Indonesian Government don't use this surveillance technology to monitor the opposition activities on the election next year.

>> JOVAN KURBALIJA: Thank you. For our next speakers while they're queuing, a few ideas I can think of. One is this question of balancing act ‑‑ and we just heard that balancing act is not the same in Europe, Asia, United States and other places ‑‑ between security and privacy. Second point, we have the rules on privacy protection and international Government on civil and political rules, and as I've already indicated, there is a question how to apply it, what are the mechanisms.

>> One more point, please.

>> JOVAN KURBALIJA: How we can make the next ‑‑ while you're waiting in the queues think about these two issues: Balancing act in different regions and how we can move from applying the general rules to the problem that exists. Thank you.

>> RAUL ECHEBERRIA: My name is Raul Echeberria. I'm the CEO of LACNIC. I think that some consensus seems to be emerging from the discussion. One thing is that it seems that all of us agree that massive surveillance is something bad. It is something that should not be done, no matter who does it and no matter what are the motivations for doing it. There is also a kind of consensus that some kind of investigations should be permitted using technology but that this kind of use of technology should be done based on the respect of Human Rights given the due process warranted to everybody.

And I have heard many people speaking, using almost the same words about principles, and that any use of technologies for this kind of purpose should be done in the framework of certain principles so here is my question for all of the panelists, because it seems that the speech of the representative of the Swedish Government was very interesting, and it seems to me that they are applying this concept. So my question for all the panelists is: Could be what the Swedish Government is doing a basis for continuing to develop this concept and trying to get a solution in the future? I'm not expecting to have a full agreement today about the principles.

But probably we can get a kind of common view in this session about that this is the path forward. Thank you.

>> MATTHEW SHEARS: Thank you. My name is Matthew Shears with the Center for Technology and Democracy. A couple of comments on what we've heard so far. Let's not trivialize this discussion. I've heard others are worse, NSA envy, alleged hypocrisy. When we use the sentence "others are worse," that's no justification for our own mass surveillance. When we say NSA envy, that's pretty serious stuff, because there are countries out there who are exactly saying that, this is not a joke.

And it is hypocrisy. It's not alleged so let's be clear on this.

Second, thank you to the representative from the Government of Sweden for saying there is no balancing act. We've waited a long time for someone to say, there is no balancing act. Respecting Human Rights increases security, diminishing Human Rights diminishes security.

Three, Frank La Rue, to paraphrase him ‑‑ I'm sure very poorly ‑‑ says that mass surveillance not only makes a mockery of Human Rights, but threatens the very foundations of our societies and the rule of law. Let's remember that. It's very important.

And finally, I don't know about everybody else here, but I have not lost my trust in the Internet. Let's stop saying that. I've lost my trust in the institutions that use the Internet for the purposes of undermining my fundamental rights. Thank you.

[ Applause ]

>> PINDAR WONG: Good morning. I am Pindar Wong from Hong Kong. Hong Kong has been where Snowden chose to make his revelations. My question really was a question is about forgiveness. Partly because as a long time Internet participant, I think what's been demonstrated is spying on an open network or surveillance on a network are low hanging fruit. We really shouldn't be surprised. What we are surprised on about is the scale. So I'll echo what Jimmy Schulz's intervention in terms of full disclosure.

Those of us who have kids know that kids make mistakes, and although the Internet is in its adolescence, looking forward clearly there's been a mistake that has been made. So a starting point really is that full disclosure. It may be naive to ask it. I'm not saying who discloses to whom, but it is a basis of recognizing that you've made a mistake, coming clean, and then going forward.

But what is that going forward? What is that vision? I don't agree with the previous intervention by the CTD guy. There is no balancing act. At least I have a very clear vision of the future that we wish to build, and I think I would suggest that whilst there's a temptation to fall within our National boundaries, to go back to what I would call a pre‑internet era, let's not forget the opportunity before us, the opportunity to really build trade.

And let us view things in positive terms. The next 1.5 billion people perhaps will be coming on the Internet through their mobile phones, making payment over that mobile network. So let's not also look at the issue of routing money over the Internet.

So trade, money, these are all very important issues and those issues if we have a vision of our future, I would hope we can find forgiveness because I'm not surprised of the surveillance, I'm surprised about the scale but let's find mechanisms to reestablish trust and let's look at how we can do so through the old '70s concept: Peace through trade. Thank you.

>> MARKUS KUMMER: Just a quick correction to the scribes. Please correct in the final version the name of the gentleman who just spoke as Pindar Wong. Thank you.

>> MIKE GURSTEIN: Mike Gurstein from the Community Informatics Network from Canada. It's a global network. About a month ago I wrote a blog post arguing or pointing out that the Internet was in fact a two‑way system, and that the National Security Agency while drawing information from the Internet, was also fully capable of putting information into the Internet, and having significant impacts in many of the places, if not most of the places, where it was drawing information from.

In the meantime, we've had confirmation of that, direct confirmation, one being the fact that Mr. Cheney's heart pacer was made hacker‑proof because of fears that using the Internet, it was possible to interfere with his pacemaker and assassinate him in that way. That came out recently.

The second was the use of the Internet and Internet surveillance as a direct input into the drone wars that's being conducted in various parts of the world as guidance systems and as direction systems for these drone wars.

I guess my observation, it's not really a question, is that I think we're dealing with something far more serious than simply surveillance. I think we're dealing with the potential for the active intervention in spurious and potentially dangerous ways into whatever elements of the Internet that we use for whatever purposes that we choose to in our daily lives, including our banking, our health records, our internal organisational communications, our financial communications, and so on and so forth, so that whatever response that's developed into the issues of surveillance also have to take into account the issues of aggressive and offensive actions by those who are in a position to undertake this kind of surveillance. Thank you.

>> And the speaker's name was Michael Gurstein. Thank you.

>> WOUT DE NATRIS: Good morning. I'm here on behalf of NLIGF and reporting back on discussions we had which were relevant. I think one of the main things that came up in the two panels that we did is that Internet is becoming more and more a part of our lives and isn't it time to start acting towards the Internet as if it is normal and not something which is far away from us and unseeable. So in other words if that is true, then what goes on in regular life also goes for Internet life so that would mean there's a triangle of economic development on the one side and the other side is security and the last part is freedom. So in other words, if you treat it like that, then economic development becomes possible, and the Internet becomes safer because there are so many best practices we heard of that it's about time that we stop talking and start to act upon those best practices.

And I won't recall which ones they are but they're in the transcripts. You heard some excellent ones.

And some things that really came forward is that would if Governments want the Internet to be safer, then start showing leadership through showing the best practice. So we did a head count saying who actually orders software off the shelf, or who says, I wanted to have this, this or these qualities before you can sell it to me? And only the commercial parties showed their hands saying, we're doing these sort of demands on software and all the Governments were looking, what are we talking about?

So in other words if you want leadership on security for the Internet, then start showing it yourself by demanding security before you buy something from the Internet.

And the last comment I would like to make is that we tried to envision how large this table should be if you want to have all parties discussing Internet Governance, and we probably have a table as long as this hall up and down and still not enough. And about 50% of the people know each other and still they're responsible for making the same products. So how do you get these sort of people at the table? Maybe never. But let's start with software developers, because they're hardly here in the IGF discussion, they're hardly ever there so Governments can show leadership in security by bringing the right people to the room in your country or regionally or internationally, and start discussing security with the right people, because that's the only way to make the Internet more secure.

And that was one of the comments made by the IETF, which I think made some excellent comments during this IGF, and I was happy to hear them.

>> JOVAN KURBALIJA: The last two presentations brought the broader context for this issue and importance of this issue of surveillance also for individuals, and the way they use the Internet. Now we have the next speaker.

>> JOHN LAPRISE: Good morning. My name is John Laprise. I'm a Professor at Northwestern University. As a scholar and historian, I'm surprised so many States are so surprised by the scope of the NSA surveillance, and I'd just like to offer to those States that perhaps you better take a better look at your intelligence‑gathering entities in your own countries, because they're either demonstrating incompetence in terms of not seeing the history of intelligence gathering or they know about it and are not saying anything, in which case they're guilty of collusion. Either way you have a few problems to remedy in your own countries for your own intelligence organisations. Thank you.

>> JOVAN KURBALIJA: Thank you. Nothing new under the sun.

>> NORBERT BOLLOW: Thank you. My name is Norbert Bollow, speaking in personal capacity right now as a human being who cares about my Human Rights. I start by echoing some remarks that have been made. We should not try to balance Human Rights and security. We need security that protects our Human Rights, our ability to fully experience our Human Rights.

We already have a good set of international Human Rights standards. What we need is the ability to effectively enforce them. This requires, as it has been said, full transparency. And I think it requires an international Treaty of sorts to deal with these widespread transborder Human Rights violations that we have experienced.

And perhaps most importantly, we need to get serious about looking at the technical side of metadata encryption. This is much more difficult technically than encrypting communications content. I am absolutely convinced it can be done, but it requires a fundamental rethinking of the architecture that we use for communicating via the Internet, so I propose the creation of a Dynamic Coalition of metadata privacy protection. Thank you.

>> JOVAN KURBALIJA: Thank you. We have the last two comments and then we'll pass the floor to the panelists, last three comments, I'm sorry.

>> MALCOLM HUTTY: My name is Malcolm Hutty. I work for the London Internet Exchange, and my comments are informed by this, but I'm speaking entirely on my own behalf. I think we've heard a great deal of "can't" about the surveillance issue. It is plainly and always has been the proper purpose of intelligence agencies to gather information about foreign countries, and their activities, insofar as they affect the essential National business and the proper business of security services to identify and do something about those that would cause us harm.

What has changed however is that it is now being said that these proper purposes can only be purr sized if the intelligence and security agencies essentially know everything about everyone. This has never been previous approach of anything except totalitarian societies. And if the Heads of Intelligence and security services cannot be persuaded their mission can be pursued in other fashion I hope that the political leaders will understand that the reaction that's being built around the world here shows that it's worth more than the beliefs of the appropriate way to pursue their mission on the part of those authorities. It is undermining our friends and allies.

Secondly and finally, the activity that work to undermine the protective security mechanisms, in particular undermining fundamental encryption standards, do not merely help the intelligence and security agencies identify those that would do us harm, but generally advance the interests of those who would penetrate information systems and undermine those who would protect them. Fundamentally this is a poor tradeoff for the National Security interests. I would urge you to consider the consequences to business, as well as to citizens, of making flaws generally available as they are becoming generally available to those that would penetrate information systems whether they be states or not state actors. This is an owned goal. Thank you for your attention.

>> PRANESH PRAKASH: My name is Pranesh Prakash. I work with the Center for The Internet Society in India and with the Yale Information Society project. While issues of Human Rights privacy and surveillance will be dealt with at the National level, and there are some indications that in some cases they are being dealt and reforms are ‑‑ will be attempted at least, we need to agree that privacy is a right that belongs not just to the citizens of one country or another, but no one country should be able to deny me the right of being human that privacy is indeed a human right and a country can't escape its international Human Rights obligations by saying that we are safeguarding the privacy of our own citizens and only our own citizens.

Second point I wanted to make is that mass surveillance at the level of Internet infrastructure and architecture as is being done by countries like our friends in the West and India, are contrary to the UDHR and ICCPR and its non‑targeted, non‑proportionate, non‑reasonable nature makes it an arbitrary or unlawful interference in the enjoyment of privacy, that this is contained in itself in International Human Rights Doctrine that mass surveillance of the sort that we are seeing today, especially at the level of the Internet infrastructure, just is not legal. Thank you very much.

>> FURIYANI AMALIA: Thank you very much. My name is Furiani Amalia. I'm from Indonesia. During the last few days we have heard and listened to many challenges that portrayed by multistakeholders in the Internet field. However, we also come up with the common views that trust and cooperation are important issues that we should address. We have a problem of trust there but we cannot stop just right there.

So we need to think what IGF as one of maybe the most Forum that involve many various multistakeholder worldwide. That we need to think what IGF could offer in the future, what IGF can do in the future in leading the role of setting out the principles or norms that are agreeable by all stakeholders, because in this multistakeholder Forum, it's not only to speak up what your interests are. It's not only a Forum to tell everybody else what your concerns are but we need to understand what other interests are so therefore IGF should be a bridge for all stakeholders to be a Forum where everybody can understand each others. Thank you.

>> ANDRES AZPURUA: My name is Andres. I come from Venezuela as part of ISOC Ambassadors Programme. My country is a relatively small country with Human Rights problems makes completely no sense in making the decision if you have Human Rights problems or challenges as they like to be said here.

It doesn't make any sense distinguishing if they're online or offline so I would like to put my perspective on many of the subjects we've been talking in this IGF from the perspective of small countries that are not frequently represented in this Forum or that their issues are not usually commented too much. It's a little sad when Governments defend their actions by saying that they only target foreigners as if they were not subject to Human Rights, and the international Declaration of Human Rights.

I'm also really sad to see that the U.S. who had a very strong agenda in pushing it throughout the world now lacks the moral authority to keep doing that. I think it's time for other countries to step up if they decide not to change their policies.

Mass surveillance and other advanced persistent threats that are more targeted are being used not only by big Governments, also by small ones. In the case of these Governments, usually the controls and oversights are even more weak than in the famous case we've all been discussing. So it would be of much help for countries like mine to actually know what's getting into our countries, because most of this technology doesn't come from our own industries or our own tech industries. It comes from developed nations or nations with stronger IT industries.

So more controls and transparency in those important experts would definitely help activists like myself.

So as I said I'm not a lawyer. I'm just an activist with a tech background. And for me, it's obviously clear that mass surveillance should be treated as a huge Human Rights transgression. So I hope that in the meantime, we learn to use encryption correctly to protect ourselves, our colleagues, and our work. I hope that for next IGF or next meetings of this kind we'll see a lot more PGP fingerprint keys on business cards so that we could start to share the knowledge on how to communicate effectively and securely. Thank you.

>> ANNE-RACHEL INNE: Thanks very much. We're going to go to the online remote participation. Subi?

>> SUBI CHATURVEDI: Yes, we have a question, there's one from Twitter that talks about what Government can do another from the same team about ethics and trust, and this is a question to European Governments. Sweden, as a representative of Europe regarding the individual Snowden issue who has done a great service to the global public in making this information accessible, do European countries consider him to be a whistleblower who needs to be protected? Or is he to be considered a traitor who should not receive protection?

Would any European country, any member of the Council of Europe, now be willing to grant Snowden asylum?

>> ANNE-RACHEL INNE: That's very much. So I think we're going to wrap up a little bit Jovan and then we're going to give the floor to our panelists to respond to some of the questions that we've had. Jovan?

>> JOVAN KURBALIJA: There were ‑‑ I think there was quite high level of consensus of both problems and main issues and controversies, and here are a few points.

There is agreement about the severity of the problems. I think it was equaled in all intervention comments. And also highlighted that there is a question of trust, fundamental trust, as underlying element for the success in the future development of the Internet.

Second point, I think we agreed that there are existing rules in international law that cover this issue, and there is Article 17 of the International Covenant on Political and Civil Rights saying clearly that no one should be suggested to arbitrarily or unlawful interference with his privacy and so on. The international law exists. As we know, international law is sometimes not easily applicable and then we come to the next point which was raised in many comments from Bertrand, how to apply international law. What are the procedures? And here the key words were: Checks and balances, introduce checks and balances, careful transparency, use due process, observe the rule of the law, and have institutional division as Johann from Sweden mentioned between different players in this field.

That will be the main challenge, and one can argue that maybe some new reporting mechanism of existing conventions should be introduced, or it should be introduced in universal periodical review in the work of the UN Council of Human Rights. We're speaking about the way how to implement existing rules.

There was a bit of ‑‑ there are quite a few different views about possibility of having win‑win solution or balancing act. We should act and we should aim for win‑win solution by achieving Human Rights protection through more security. But we should be equally ready to have some balancing acts, because it is reality of political life.

What are the next steps? First, we are waiting for the results of the review process in the United States. In the meantime, there are quite a few international initiatives in the UN Human Rights Council, and it will be moving on especially on the issues on protection of privacy and Data Protection.

And we should start exploring some National models like Swedish model for tackling these issues and these delicate balances between security, Human Rights and Data Protection and it was clear from all interventions the topic is extremely important and the IGF should find ways and means to continue discussion including proposal to create Dynamic Coalition dealing with these issues.

I hope it reflected in a few Tweets what was ‑‑ were underlying messages. Please.

>> I think there is one important issue that I should address, it's the liability and responsibility of technology providers. Technology providers should ensure that technology, they provide not be misused by Government so there should be any legal remedy if the technology used to suppress or to monitor the activity of activists or journalists. So there is the contract between the technology providers and Government should be cover an Article saying that the Government only use this technology for legitimate purposes, not misuse et cetera.

>> JOVAN KURBALIJA: We'll start now with our panelists answering the questions and commenting on overall discussion and also this underlying elements for possible summary of our discussion.

I think we had the most questions addressed to Scott. Scott, could you start, please?

>> SCOTT BUSBY: Thank you, Jovan.

>> JOVAN KURBALIJA: It's not surprising.

>> SCOTT BUSBY: I'm not sure I'll be able to answer them all, but I'll do my best. First of all I want to thank my Fellow panelists, commentators as well as the audience for all of your many thoughtful comments and questions. The United States Government is here in force. There are over 10 of us here. On the heels of a Government shutdown, mind you, which there was travel restrictions on virtually every U.S. Government Agency, and I hope that demonstrates to all of you not only the seriousness with which we take the IGF, but the seriousness with which we take this issue.

We intend to take back your comments, your questions, to report back to our senior leadership on what we've heard here, with the goal of ensuring that those views are taken account of in the deliberations that are now taking place in the United States.

Second of all, to Khaled who first made this point but the woman from India, as well, about the seriousness or potential lack of seriousness with which we take this issue, I don't think that President Obama and the rest of the U.S. Government is not taking this issue seriously, is trying to deflect. The President has taken extraordinary action in setting up this review Board of independent experts to give him their best advice on how the U.S. should move ahead on this issue.

As I just mentioned, the U.S. Government has come here in force knowing this issue was going to be at the heart of the discussions at this IGF and willing to engage with you, to hear you out, on this issue. So we take very seriously this issue.

With regards to transparency, which several commentators mentioned, the President has already ordered that as much transparency about what the NSA has been doing, the judicial orders relating to the NSA activities, that those be released, and indeed, you can find those online. If anyone wants to know the site where they can be found, I'd be happy to send that to them.

On Edward Snowden, I don't have anything to say on that beyond what President Obama has already said, so I would refer the questioner to what President Obama has said.

On China, on our intervention from a colleague from China, I would simply ask anyone who has questions about the Human Rights situation in China and the Human Rights situation in the United States to look at any independent Human Rights report on these issues, and draw their own conclusions. One of the best reports I think is the Freedom on the Net report issued by Freedom House. We have Freedom House here. There are copies of that report here. That report is critical of the United States, I would mind you. It's not often that a Government official refers people to a report that's critical of the United States.

I would urge people to look at that report, and draw their own conclusions.

To the Indonesian representative, the lawyer here, who asked about privacy in the United States, so interesting story here in the United States, for good or worse, we have a very old Constitution in the United States, older than most countries, and the concept of privacy actually post‑dates the creation of our Constitution.

So, yes, the concept of privacy is covered by our Constitution, but it's covered through legal interpretations of that Constitution by our Supreme Court. And there are a slew of decisions in the last century that essentially create this concept of privacy and indeed it is now considered a Constitutional right.

And lastly, there were several questions about the NSA and sort of the NSA out of control, being a state within a state. I would just urge folks to look at what the President has said. The NSA and these activities are subject to judicial review. They are subject to legislative review, and the NSA finally is subject to the command and control of our Commander in Chief, namely, the President of the United States.

So the President has said what he intends to do in this area. He has empowered a review panel to look at these issues, and we will be considering the recommendations of that review panel going forward. Thank you.

>> ANNE-RACHEL INNE: Thank you very much, Scott. Now we go on to Ross.

>> ROSS LaJEUNESSE: Thanks very much. I want to echo Scott's sentiments that I've enjoyed today's panel, and particularly enjoy hearing questions from all of you. And so I've taken a couple notes. I don't think I was as thorough as you were, Scott.

But to Jimmy's question, I appreciated that very much, about direct access versus access. It's a very good point. When I meant we don't provide direct access, what I meant is that we really don't provide access to the infrastructure. I was trying to draw distinction between that and the process I outlined that when we get a legal request from the Government, we look at it thoroughly, and so it is possible for the U.S. Government to get user data, but only through that process that I outlined in my remarks. So thank you for that clarification.

There was a comment or question from a remote participant about user trust. And that is something that we are very focused on. It really is what drives everything we do at Google, so we're incredibly concerned about the impact of users' trust on us from the Snowden revelations. It drives everything we do. It's why we spend the resources that we do on our security infrastructure, on our encryption, with search encrypted by design and Gmail being encrypted and I would make the point that I feel the cloud is certainly more secure than alternative models as Bertrand characterized it, data sovereignty, data localization. The cloud is much more secure than that model.

But this issue of user trust drives much more than our security infrastructure and our technology. It drives the work we do on Internet Governance, our membership, our founding membership in GNI, which is a third party which audits the practices of companies. It drives our development of things like Project Shield, which allows independent news sites and similar sites to take advantage of Google's own security infrastructure for those sites that have been subject to DDoS attacks and the like, and it drives our sponsorship of Civil Society and our work which we do really in each and every country in which we have an office on free expression from issues like intermediary liability in Thailand and India, to even more challenging situations in parts of Southeast Asia.

Finally, to Matthew's intervention from CDT, as Matthew well knows, we are a strong partner of CDT for pushing for greater transparency in the United States, and we see I think very clearly eye to eye on that and so I wanted to clarify Matthew's point. When I said that others are doing it too I thought I made it fairly clear about five or six times in my comments but I'm happy to say it again, I'm not trying to excuse or trivialize in any way the revelations that have come about, about U.S. surveillance but I am making the point that this is not just a U.S. issue. That this is happening everywhere around the world and I think it would be unwise of us to focus solely on the U.S. surveillance programme, and not focus on the very real challenges that are occurring everywhere else around the world.

So that was may point and I thank Matthew for giving me the opportunity to clarify that. And I think as I'm checking my notes, that was it. But someone correct me if I'm wrong.

>> ANNE-RACHEL INNE: Thanks very much, Ross. Next on our panel is Johann.

>> JOHANN HALLENBORG: Okay. Thank you very much. A couple of points from me, as well. There was a question about the powerful tools and resources if that has prompted any change in our society and any legislation. And the answer in my country is: Yes, it certainly has because that has created an all‑new way of looking at this, of course.

And around 10 years ago, discussions intensified in my country on how to find the right legislative framework for this, an area which largely were unregulated before, and so after long negotiations, a draft law was presented. It was thrown out of Parliament, wasn't approved, back to Government. Again the second draft wasn't approved, because of the Parliament felt that the protections for privacy were not good enough.

And the third draft eventually was approved in 2009. This law applies equally to everyone, every citizen. There was a question about not making a difference between different nationalities. It applies equally to Swedes and non‑Swedes. And it includes a fair amount of special mechanisms to protect individuals' privacy. Amongst other things, it includes a special court which takes a decision in every case of signals surveillance.

This law is now being put to the test in the European court of Human Rights. It's being challenged, and we welcome this of course. We welcome to hear if the court in Strasbourg finds it lives up to the standards of the European Convention on Human Rights.

There was a comment on Article 17 of the ICCPR. It is true, it establishes the fundamental right to respect for private life, which is I believe the accurate wording. We believe there may very well be reasons to look at Article 17 and see how we can increase our understanding of how Article 17 should be interpreted.

There are a number of different ways to do that, and we're currently engaging in Geneva and in New York to find ways of promoting the best way forward.

Finally, a few comments were made on the Swedish model. I'm not sure I really know what that would be, but if it refers to the fundamental principles that my Minister outlined last week, we are more than happy to discuss on the basis of those the way to go forward. And indeed, those principles are integrated in our law and in our framework, so in a way, it will ‑‑ I suppose it does represent the Swedish model.

Finally, I am not representing any other country than may own country here on this panel, so I am not in a position to speak on behalf of Council of Europe Member States or European Union Member States when it comes to Edward Snowden. I can just conclude that his Human Rights should be respected, period, regardless of the label that you give him. Thank you very much.

>> ANNE-RACHEL INNE: Thank you, Johann. Joana, you've heard most of the comments. Would you like to say something more?

>> JOANA VARON: I just would like to make some remarks for us to include the comments on Mr. Bollow in this panel report because I believe it's an important Human Rights issue and we're only here debating surveillance because of them. And I'd like to ask Scott and the U.S. Government to give further thoughts about this. That it seems penalties for whistleblowers are getting worse and worse, and I'm not referring only to Snowden.

A person who leaked the information about the war in Iraq is in jail with a 35‑year sentence after remaining for three years without a sentence and according to notes from The Guardian that I quote here, "Manning’s three‑and‑a‑half‑decades jail term is unprecedentedly long for someone convicted of leaking U.S. government documents. Compare, for example, the ten years received by Charles Graner, the most severely punished of those held responsible for the Abu Ghraib torture in Iraq." So the jail is not only talking in Russia.

These people had normal importance for the countries we believe today are being severely punished and in a dilemma between being traitor to a nation and providing openness and important information to the world, I think that most of people here with good faith and will would go for traitor. So that's it.

>> ANNE-RACHEL INNE: Thanks, Joana. So we've heard quite a few things, and I think we're going to give a few seconds to ‑‑ minutes to our commenters to respond. And we're going to start with Ambassador Fonseca. Is the mic around?

>> BENEDICTO FONSECA FILHO: Thank you. And very briefly much has been said and I don't have much to add, just also in reaction to what was proposed and the question that was formulated by Raul Echeberria from LACNIC, I would like to comment that the Swedish model, not the Swedish model, but the points that were raised by your Minister of External Relations at the civil conference really provide a very good basis for our work in regard to the issue of privacy in relation to security, which is of course one of the focus areas and core areas of the speech our President delivered at the United Nations. So we'd be comfortable in working within this framework.

But just to recall that we have proposed and the President has proposed we should aim at having a larger set of principles, and taking into account a huge amount of work that has already been done in that regard within different contexts, it has been mentioned the Council of Europe, we could refer to our OECD so we have a different set of principles but of limited in scope of participation so we are aiming at something of global nature that would encapsulate the core norms and agreed principles that should guide us through.

And just reiterate the invitation and the call for participation in the Brazilian meeting to be held next year. And if you allow me just a very brief comment in regard to this, I was referring before to the kind of misunderstandings that sometimes occur, and the President has termed this meeting as a "Summit," and it must be understood that from the point of view of Government, what we are aiming at is at a very high‑level event that would wishfully be able to make kind of decision that could impact on the work we are doing.

So this is the meaning of saying a "Summit." It should not be interpreted as meaning it's something exclusively for Governments. I think this is the kind of conceptual difference that sometimes must be spelled out. When we say "Summit," we mean a meeting that will be ‑‑ will have authority enough to make decisions. And at the same time, the President clearly also spelled out that she would expect Civil Society, private society, all stakeholders to be represented, and I would dare to say on an equal level as regard any decision‑making process that might be ‑‑ might take place at that point, which we aim of course at some kind of consensus.

So this is just very briefly to reiterate something I said before, and to specify that as we go back, our President is due in the next few days to make an announcement on the basis of everything we heard and the very important inputs we have received and ideas that were presented here. I would not at this point like to anticipate anything the President will say. I think sometimes we like to interpret what she has meant. I think it's as a disciplined civil servant I would prefer the President herself to spell out.

Of course, this will not be a decision or anything made in isolation but fully taking into account the multistakeholder aspect we want. But as the host of the meeting, I think it would be the President's prerogative to decide for example on the Summit aspect or not and this is something we will invite all to be there, and again the announcement to be made in next few days. Thank you very much.

>> JOVAN KURBALIJA: We'll have a few treats if it is possible Nick and Bertrand and we have one comment. We're closing the Plenary Session and the comments, we're wrapping up and if it is of relevance for the wrapping up comments that we will hear.

Please.

>> BERTRAND DE LA CHAPELLE: Thank you, Jovan. I wanted to reaffirm one element that after this panel, it is clear that the answer to excessive surveillance cannot be the proliferation of National frameworks establishing data sovereignty but rather increased oversight and increased due process respect and assessment of the impact of transboundary action or impact assessment for any National measures that has a transboundary action. Thank you.

>> JOVAN KURBALIJA: Nick, please.

>> NICK ASHTON-HART: Thank you also for inviting me to speak in general. One thing that struck me here is that I think we have many different National approaches to surveillance and the protection of individuals in relation to it, but very little have I found published that actually spells out and contrasts the different choices countries have made, and the reasons why they have made them.

I know in Latin America, recent very serious Human Rights violations by security services in living memory have made this issue particularly sensitive in that region, for example, and in Switzerland I know we had a similar scandal in the '90s that has greatly changed the way surveillance is conducted by Switzerland and we've heard a bit about the Swedish protections.

Perhaps it would be useful to have more clarity and be able to compare different systems and understand the choices that they made, and I would say also, the interparliamentary Union in Geneva, the home of the world's Parliaments, perhaps should discuss this issue to see if the world's Parliaments can share information, understand each other better, and perhaps that would help.

>> JOVAN KURBALIJA: Thank you, Nick. We'll have a Chinese colleague, and after that we'll be closing discussion. Otherwise I will be declared persona non grata by the IGF Organising Committee. I just received a letter from Markus. Please.

>> REN YISHENG: Thank you very much, Mr. Chairman, for giving me the floor for the second time. I'll be very brief. First of all, I'd like to clarify. This morning we discussed issues on surveillance, so the Chinese Delegation while making the point quoted a well‑known case, but I don't know why the U.S. speaker is so sensitive to our intervention. He's not here. If he's here, he has to explain to us why he's so sensitive to that.

Secondly, the Human Rights condition situation in China is well known by the Chinese. The Chinese has every right to explain that. Other country has no right to comment on China's Human Rights. The universality of Internet in China, we have almost 600 million netizens in China, much more than the population of the U.S. We have more than 300 millions of users of social media. It's almost the same population of U.S.

Every day, people are posting things on microblogs, blogs. More than 200 million people doing that. Therefore, Chinese also enjoy a full freedom of speech, but any information shall not infringe the society. You have to abide the basic code of conduct, moral conduct, and also you are not allowed to spread any information that will harm National Security. Also, you are not allowed to spread groundless rumors online.

Last but not least, let me say one thing: Every year, U.S. Government publish Human Rights situation or status of more than 200 countries in the world. He recommend us to read that. However, he neglected one thing: The U.S. Government never published Human Rights status report of its own country, but the Chinese Government has done that for the U.S. Government, and for free.

China's state Council's information office publish annual report of U.S. Human Rights status. You're welcome to access. All the information are collected publicly from the U.S. media.

>> JOVAN KURBALIJA: ‑‑ periodical review which is useful mechanism to comparing various situations worldwide when it comes to the Human Rights as what we heard.

We are ‑‑ well, just a half Tweet.

>> ALEX COMNINOS: My name is Alex. I'm from the Internet. It seems people in this room are concerned about eaves dropping so I would just like to point out if you registered online to attend the IGF, you have leaked your personal information including date of birth, ID number or passport number, and residential address, e‑mail address, full name. So defenses against these type of things really do start at home. You can see it on the APC website, APC.org. Thank you kindly. Bye.

>> ANNE-RACHEL INNE: Thank you very much.

>> My name is Juan Carlos. I'm from Brazil. Everyone is still under the perplexity of the size and the rich of American intelligence and many are making decisions in the heart of emotion and it's this that worries me. Decisions that are taken so passionately, decisions under the scenario generally does not so passionate and generally are hurting our hearts. I'm definitely not wanting to give away any right in exchange for security. That's all.

>> JOVAN KURBALIJA: Closing the session with a poem, an artistic expression of overall discussion.

>> ANNE-RACHEL INNE: So what we're going to do right now, I think we're going to have Jovan remained us a little bit some of the points that were raised here in answering if you remember some of the questions that we had that Markus read that the session was also supposed to address.

And I would like to simply say that I think this session is one that is again Building Bridges. This is the start of discussions and I know that I've seen a few Tweets where people are saying we're not satisfied because there aren't really answers. And I don't think anybody expected really that we would have answers here this morning.

But at least conversations have started. You know, the start of a bridge is being built as Ambassador Fonseca said, one of our next meetings will be in Brazil, and that could be a place where at least some general principles could be agreed upon, and then it will be up to all of us to actually just like the other general and global principles that we have, to make sure that we adhere to those. Jovan?

>> JOVAN KURBALIJA: With the risk of confronting Twitter community which is not a wise thing to do, I have to admit that there were quite a few answers and quite a few useful insights. We heard about experiences within Brazil, quite a few suggestions.

There is agreement that there are international rules that cover these issues, and quite a few concrete suggestions how we can implement these rules, through due process checks and balances.

Therefore, I would say that I personally feel quite comfortable with advancement of our discussion, much more than expected before the session. And as you know, these problems are complex and they're so called big problems. You don't have a quick fix. There are many aspects, security, Human Rights, ethical, business that should be addressed. Markus gave us 7 questions at the beginning of the session which were questions posed through the public consultation.

And we answered all of those questions, and even added quite a few more questions. Therefore, we will be having an interesting discussion. And if I can conclude with one point with a famous quote, don't waste a crisis. It seems we're not going to waste this crisis and that at least based on your inputs and panelist inputs, there is a serious determination and responsibility to do something useful for Internet as a whole, and for humanity, first of all to avoid the situation like this one with NSA case, but also to prevent similar situations happening worldwide.

Therefore, there is an opportunity that we shouldn't miss, and I think quite a few players around the world are moving in that direction, to create space, ideas, and proposals that could make Internet even more powerful tool for enabling of the social and economic development worldwide.

Thank you.

>> MARKUS KUMMER: Let me just add a quick word: I think the discussion, A, was certainly very interesting. This is a sensitive issue on top of the agenda. And I think again, the IGF proved its value and its worth, and this kind of discussion clearly is best held in a multistakeholder setting.

And I think it will not be over and we will revisit it at the next IGF. With that, Mr. Chairman, over to you to close the meeting.

>> SETYANTO SANTOSA: Thank you, Markus. Thank you also, Madam Anne‑Rachel and Jovan, for moderating this opening discussion on emerging issues with focusing mainly on approaching the role of security, surveillance, transparency and privacy issues. If I may value this session, it's really the top of the top session of the IGF 2013. If you look at the response from the floor and also they say all the ideas.

As a piece of information that Indonesia also aware of positive impact of Internet as a means of economic development. However, it has become increasingly concerned over the impact of access of information and has demonstrated an interest in increasing its control of offensive online content, particularly pornographic and anti‑Islam online content. The government regulates such content through legal and regulatory framework and through partnership with the ISP, Internet service provider and also the Internet cafe. Meanwhile the telecommunication 99 also prohibit the wire tapping of communication necessary for obtaining evidence for criminal investigation. So ladies and gentlemen, this is my first IGF engagement, with more especially in Bali 2013 from 109 countries so let us wait for our next IGF 2014, wherever it will be held. I think we should come and really I enjoyed this familihood circumstances and it's really a kind of the spirit of multistakeholder cooperation of world community. With a statement I would like to conclude this meeting and again thank you for excellent moderating, and thank you also to our panelists and all participants for this valuable discussion. I hope you enjoy your stay in Bali, Indonesia. For those of you who will leave before the Closing Ceremony, I wish you have a pleasant and safe trip back home.

Please join me to give a big hand to all the panelists and moderators.

[ Applause ]

I return the floor to Mr. Markus Kummer.

>> MARKUS KUMMER: Nothing to add. We resume at 2:30 for the open microphone "Taking Stock" session.

[ End of session ]

For more details visit https://cis-india.org/news/igf-2013-october-25-taking-stock-emerging-issues

Spy Files 3: WikiLeaks Sheds More Light On The Global Surveillance Industry

maria — 2013-11-14T16:21:00Z

In this article, Maria Xynou looks at WikiLeaks' latest Spy Files and examines the legality of India's surveillance technologies, as well as their potential connection with India's Central Monitoring System (CMS) and implications on human rights.

Last month, WikiLeaks released “Spy Files 3”, a mass exposure of the global surveillance trade and industry. WikiLeaks first released the Spy Files in December 2011, which entail brochures, presentations, marketing videos and technical specifications on the global trade of surveillance technologies. Spy Files 3 supplements this with 294 additional documents from 92 global intelligence contractors.

So what do the latest Spy Files reveal about India?

When we think about India, the first issues that probably come to mind are poverty and corruption, while surveillance appears to be a more “Western” and elitist issue. However, while many other developing countries are excluded from WikiLeaks’ list of surveillance technology companies, India is once again on the list with some of the most controversial spyware.

ISS World Surveillance Trade Shows

The latest Spy Files include a brochure of the ISS World 2013 -the so-called “wiretapper’s ball”- which is the world’s largest surveillance trade show. This years ’ ISS World Asia will take place in Malaysia during the first week of December and law enforcement agencies from around the world will have another opportunity to view and purchase the latest surveillance tech. The leaked ISS World 2013 brochure entails a list of last years’ global attendees. According to the brochure, 53% of the attendees included law enforcement agencies and individuals from the defense, public safety and interior security sectors, 41% of the attendees were ISS vendors and technology integrators, while only 6% of the attendees were telecom operators and from the private enterprise. The brochure boasts that 4,635 individuals from 110 countries attended the ISS World trade shows last year and that the percentage of attendance is increasing.

The following table lists the Indian attendees at last years ’ ISS World:

Law Enforcement, Defense and Interior Security Attendees	Telecom Operators and Private Enterprises Attendees	ISS Vendors and Technology Integrators Attendees
Andhra Pradesh India Police	BT	AGC Networks
CBI Academy	Cogence Investment Bank	Aqsacom India
Government of India, Telecom Department	India Reliance Communications	ClearTrail Technologies
India Cabinet Secretariat	Span Telecom Pvt. Ldt.	Foundation Technologies
India Centre for Development of Telematics (C-DOT)		Kommlabs
India Chandigarh Police		Paladion Networks
India Defence Agency		Polaris Wireless
India General Police		Polixel Security Systems
India Intelligence Department		Pyramid Cyber Security
India National Institute of Criminology		Schleicher Group
India office LOKAYUKTA NCT DELHI		Span Technologies
India Police Department, A.P.		TATA India
India Tamil Nadu Police Department		Tata Consultancy Services
Indian Police Service, Vigilance		Telecommunications India
Indian Telecommunications Authority		Vehere Interactive
NTRO India
SAIC Indian Tamil Nadu Police

17 4 15

According to the above table - which is based on data from the WikiLeaks ’ ISS World 2013 brochure- the majority of Indian attendees at last years’ ISS World were from the law enforcement, defense and interior security sectors. 15 Indian companies exhibited and sold their surveillance technologies to law enforcement agencies from around the world and it is notable that India’s popular ISP provider, Reliance Communications, attended the trade show too.

In addition to the ISS World 2013 brochure, the Spy Files 3 entail a detailed brochure of a major Indian surveillance technology company: ClearTrail Technologies.

ClearTrail Technologies

ClearTrail Technologies is an Indian company based in Indore. The document titled “Internet Monitoring Suite ” from ClearTrail Technologies boasts about the company’s mass monitoring, deep packet inspection, COMINT, SIGINT, tactical Internet monitoring, network recording and lawful interception technologies. ClearTrail’s Internet Monitoring Suite includes the following products:

1. ComTrail: Mass Monitoring of IP and Voice Networks

ComTrail is an integrated product suite for centralized interception and monitoring of voice and data networks. It is equipped with an advanced analysis engine for pro-active analysis of thousands of connections and is integrated with various tools, such as Link Analysis, Voice Recognition and Target Location.

ComTrail is deployed within a service provider network and its monitoring function correlates voice and data intercepts across diverse networks to provide a comprehensive intelligence picture. ComTrail supports the capture, record and replay of a variety of Voice and IP communications in pretty much any type of communication, including - but not limited to- Gmail, Yahoo, Hotmail, BlackBerry, ICQ and GSM voice calls.

Additionally, ComTrail intercepts data from any type of network -whether Wireless, packet data, Wire line or VoIP networks- and can decode hundreds of protocols and P2P applications, including HTTP, Instant Messengers, Web-mails, VoIP Calls and MMS.

In short, ComTrail’s key features include the following:

- Equipped to handle millions of communications per day intercepted over high speed STM & Ethernet Links

- Doubles up as Targeted Monitoring System

- On demand data retention, capacity exceeding several years

- Instant Analysis across thousands of Terabytes

- Correlates Identities across multiple networks

- Speaker Recognition and Target Location

2. xTrail: Targeted IP Monitoring

xTrail is a solution for interception, decoding and analysis of high speed data traffic over IP networks and independently monitors ISPs/GPRS and 3G networks. xTrail has been designed in such a way that it can be deployed within minutes and enables law enforcement agencies to intercept and monitor targeted communications without degrading the service quality of the IP network. This product is capable of intercepting all types of networks -including wireline, wireless, cable, VoIP and VSAT networks- and acts as a black box for “record and replay” targeted Internet communications.

Interestingly enough, xTrail can filter based on a “pure keyword”, a URL/Domain with a keyword, an IP address, a mobile number or even with just a user identity, such as an email ID, chat ID or VoIP ID. Furthermore, xTrail can be integrated with link analysis tools and can export data in a digital format which can allegedly be presented in court as evidence.

In short, xTrail’s key features include the following:

- Pure passive probe

- Designed for rapid field operations at ISP/GPRS/Wi-Max/VSAT Network Gateways

- Stand-alone solution for interception, decoding and analysis of multi Gigabit IP traffic

- Portable trolley based for simplified logistics, can easily be deployed and removed from any network location

- Huge data retention, rich analysis interface and tamper proof court evidence

- Easily integrates with any existing centralized monitoring system for extended coverage

3. QuickTrail: Tactical Wi-Fi Monitoring

Some of the biggest IP monitoring challenges that law enforcement agencies face include cases when targets operate from public Internet networks and/or use encryption.

QuickTrail is a device which is designed to gather intelligence from public Internet networks, when a target is operating from a cyber cafe, a hotel, a university campus or a free Wi-Fi zone. In particular, QuickTrail is equipped with multiple monitoring tools and techniques that can help intercept almost any wired, Wi-Fi or hybrid Internet network so that a target communication can be monitored. QuickTrail can be deployed within fractions of seconds to intercept, reconstruct, replay and analyze email, chat, VoIP and other Internet activities of a target. This device supports real time monitoring and wiretapping of Ethernet LANs.

According to ClearTrail’s brochure, QuickTrail is a “all-in-one” device which can intercept secured communications, know passwords with c-Jack attack, alert on activities of a target, support active and passive interception of Wi-Fi and wired LAN and capture, reconstruct and replay. It is noteworthy that QuickTrail can identify a target machine on the basis of an IP address, MAC ID, machine name, activity status and several other parameters. In addition, QuickTrail supports protocol decoding, including HTTP, SMTP, POP3 and HTTPS. This device also enables the remote and central management of field operations at geographically different locations.

In short, QuickTrail’s key features include the following:

- Conveniently housed in a laptop computer

- Intercepts Wi-Fi and wired LANs in five different ways

- Breaks WEP, WPA/WPA2 to rip-off secured Wi-Fi networks

- Deploys spyware into a target’s machine

- Monitor’s Gmail, Yahoo and all other HTTPS-based communications

- Reconstructs webmails, chats, VoIP calls, news groups and social networks

4. mTrail: Off-The-Air Interception

mTrail offers active and passive ‘off-the-air’ interception of GSM 900/1800/1900 Mhz phone calls and data to meet law enforcement surveillance and investigation requirements. The mTrail passive interception system works in the stealth mode so that there is no dependence on the network operator and so that the target is unaware of the interception of its communications.

The mTrail system has the capability to scale from interception of 2 channels (carrier frequencies) to 32 channels. mTrail can be deployed either in a mobile or fixed mode: in the mobile mode the system is able to fit into a briefcase, while in the fixed mode the system fits in a rack-mount industrial grade chassis.

Target location identification is supported by using signal strength, target numbers, such as IMSI, TIMSI, IMEI or MSI SDN, which makes it possible to listen to the conversation on so-called “lawfully intercepted” calls in near real-time, as well as to store all calls. Additionally, mTrail supports the interception of targeted calls from pre-defined suspect lists and the monitoring of SMS and protocol information.

In short, mTrail’s key features include the following:

- Designed for passive interception of GSM communications

- Intercepts Voice and SMS “off-the-air”

- Detects the location of the target

- Can be deployed as a fixed unit or mounted in a surveillance van

- No support required from GSM operator

5. Astra: Remote Monitoring and Infection framework

“Astra ” is a remote monitoring and infection framework which incorporates both conventional and proprietary infection methods to ensure bot delivery to the targeted devices. It also offers a varied choice in handling the behavior of bots and ensuring non-traceable payload delivery to the controller.

The conventional methods of infection include physical access to a targeted device by using exposed interfaces, such as a CD-ROM, DVD and USB ports, as well as the use of social media engineering techniques. However, Astra also supports bot deployment without requiring any physical access to the target device.

In particular, Astra can push bot to any targeted machine sharing the same LAN (wired, wi-fi or hybrid). The SEED is a generic bot which can identify a target’s location, log keystrokes, capture screen-shots, capture Mic, listen to Skype calls, capture webcams and search the target’s browsing history. Additionally, the SEED bot can also be remotely activated, deactivated or terminated, as and when required. Astra allegedly provides an un-traceable reporting mechanism that operates without using any proxies, which overrules the possibility of getting traced by the target.

Astra’s key features include the following:

- Proactive intelligence gathering

- End-to-end remote infection and monitoring framework

- Follow the target, beat encryption, listen to in-room conversations, capture keystrokes and screen shots

- Designed for centralized management of thousands of targets

- A wide range of deployment mechanisms to optimize success ration

- Non-traceable, non-detectable delivery mechanism

- Intrusive yet stealthy

- Easy interface for handling most complex tasks

- Successfully tested over the current top 10 anti-virus available in the market

- No third party dependencies

- Free from any back-door intervention

ClearTrail Technologies argue that they meet lawful interception regulatory requirements across the globe. In particular, they claim that their products are compliant with ETSI and CALEA regulations and that they are efficient to cater to region specific requirements as well.

The latest Spy Files also include data on foreign surveillance technology companies operating in India, such as Telesoft Technologies, AGT International and Verint Systems. In particular, Verint Systems has its headquarters in New York and offices all around the world, including Bangalore in India. Founded in 1994 and run by Dan Bodner, Verint Systems produces a wide range of surveillance technologies, including the following:

- Impact 360 Speech Analytics

- Impact 360 Text Analytics

- Nextiva Video Management Software (VMS)

- Nextiva Physical Security Information Management (PSIM)

- Nextiva Network Video Recorders (NVRs)

- Nextiva Video Business Intelligence (VBI)

- Nextiva Surveillance Analytics

- Nextiva IP cameras

- CYBERVISION Network Security

- ENGAGE suite

- FOCAL-INFO (FOCAL-COLLECT & FOCAL-ANALYTICS)

- RELIANT

- STAR-GATE

- VANTAGE

While Verint Systems claims to be in compliance with ETSI, CALEA and other worldwide lawful interception and standards and regulations, it remains unclear whether such products successfully help law enforcement agencies in tackling crime and terrorism, without violating individuals’ right to privacy and other human rights. After all, Verint Systems has participated in ISS World Trade shows which exhibit some of the most controversial spyware in the world, used to target individuals and for mass surveillance.

And what do the latest Spy Files mean for India?

Why is it even important to look at the latest Spy Files? Well, for starters, they reveal data about which Indian law enforcement agencies are interested in surveillance and which companies are interested in selling and/or buying the latest spy gear. And why is any of this important? I can think of three main reasons:

1. The Central Monitoring System (CMS)

2. Is any of this surveillance even legal in India?

3. Can such surveillance result in the violation of human rights?

Spy Files 3...and the Central Monitoring System (CMS)

Following the Mumbai 2008 terrorist attacks, the Telecom Enforcement, Resource and Monitoring (TREM) cells and the Centre for Development of Telematics (C-DOT) started preparing the Central Monitoring System (CMS ). As of April 2013, this project is being manned by the Intelligence Bureau, while agencies which are planned to have access to it include the Research & Analysis Wing (RAW) and the Central Bureau of Investigation (CBI). ISP and Telecom operators are required to install the gear which enables law enforcement agencies to carry out the Central Monitoring System under the Unified Access Services (UAS ) License Agreement.

The Central Monitoring System aims at centrally monitoring all telecommunications and Internet communications in India and its estimated cost is Rs . 4 billion. In addition to equipping government agencies with Direct Electronic Provisioning, filters and alerts on the target numbers, the CMS will also enable Call Data Records (CDR) analysis and data mining to identify personal information of the target numbers. The CMS supplements regional Internet Monitoring Systems , such as that of Assam, by providing a nationwide monitoring of telecommunications and Internet communications, supposedly to assist law enforcement agencies in tackling crime and terrorism.

However, data monitored and collected through the CMS will be stored in a centralised database, which could potentially increase the probability of centralized cyber attacks and thus increase, rather than reduce, threats to national security. Furthermore, some basic rules of statistics indicate that the bigger the amount of data , the bigger the probability of an error in matching profiles, which could potentially result in innocent people being charged with crimes they did not commit. And most importantly: the CMS currently lacks adequate legal oversight, which means that it remains unclear how monitored data will be used. The UAS License Agreement regarding the CMS mandates mass surveillance by requiring ISPs and Telecom operators to enable the monitoring and interception of communications. However, targeted and mass surveillance through the CMS not only raises serious questions around its legality, but also creates the potential for abuse of the right to privacy and other human rights.

Interestingly enough, Indian law enforcement agencies which attended last years ’ ISS World trade shows are linked to the Central Monitoring System. In particular, last years’ law enforcement, defense and interior security attendees include the Centre for Development of Telematics (C-DOT) and the Department of Telecommunications, both of which prepared the Central Monitoring System. The list of attendees also includes India’s Intelligence Bureau, which is manning the CMS, as well as the agencies which will have access to the CMS: the Central Bureau of Investigation (CBI), the Research and Analysis Wing (RAW), the National Technical Research Organization (NTRO) and various other state police departments and intelligence agencies.

Furthermore, Spy Files 3 entail a list of last years ’ ISS World security company attendees, which includes several Indian companies. Again, interestingly enough, many of these companies may potentially be aiding law enforcement with the technology to carry out the Central Monitoring System. ClearTrail Technologies, in particular, provides solutions for targeted and mass monitoring of IP and voice networks, as well as remote monitoring and infection frameworks - all of which would potentially be perfect to aid the Central Monitoring System.

In fact, ClearTrail states in its brochure that its ComTrail product is equipped to handle millions of communications per day, while its xTrail product can easily be integrated with any existing centralised monitoring system for extended coverage. And if that’s not enough, ClearTrail’s “Astra ” is designed for the centralized management of thousands of targets. While there may not be any concrete proof that ClearTrail is indeed aiding the Centralized Monitoring System, the facts speak for themselves: ClearTrail is an Indian company which sells target and mass monitoring products to law enforcement agencies. The Centralized Monitoring System is currently being implemented. What are the odds that ClearTrail is not equipping the CMS? And what are the odds that such technology is not being used for other mass electronic surveillance programmes, such as the Lawful Intercept and Monitoring (LIM)?

Spy Files 3...and the legality of India’s surveillance technologies

ClearTrail Technologies’ brochure -the only leaked document on Indian surveillance technology by the latest Spy Files- states that the company complies with ETSI and CALEA regulations. While it’s clear that the company complies with U.S. and European regulations on the interception of communications to attract more customers in the international market, such regulations don’t really apply within India, which is part of ClearTrail’s market. Notably enough, ClearTrail does not mention any compliance with Indian regulations in its brochure. So let’s have a look at them.

India has five laws which regulate surveillance:

1. The Indian Telegraph Act, 1885

2. The Indian Post Office Act, 1898

3. The Indian Wireless Telegraphy Act, 1933

4. The Code of Criminal Procedure (CrPc ), 1973: Section 91

5. The Information Technology (Amendment ) Act, 2008

The Indian Post Offices Act does not cover electronic communications and the Indian Wireless Telegraphy Act lacks procedures which would determine if surveillance should be targeted or not. Neither the Indian Telegraph Act nor the Information Technology (Amendment ) Act cover mass surveillance, but are both limited to targeted surveillance. Moreover, targeted interception in India according to these laws requires case-by-case authorization by either the home secretary or the secretary department of information technology. In other words, unauthorized, limitless, mass surveillance is not technically permitted by law in India.

The Indian Telegraph Act mandates that the interception of communications can only be carried out on account of a public emergency or for public safety. However, in 2008, the Information Technology Act copied most of the interception provisions of the Indian Telegraph Act, but removed the preconditions of public emergency or public safety, and instead expanded the power of the government to order interception for the “investigation of any offense”.

The interception of Internet communications is mainly covered by the 2009 Rules under the Information Technology Act 2008 and Sections 69 and 69 B are particularly noteworthy. According to these Sections, an Intelligence Bureau officer who leaked national secrets may be imprisoned for up to three years, while Section 69 not only allows for the interception of any information transmitted through a computer resource, but also requires that users disclose their encryption keys upon request or face a jail sentence of up to seven years.

While these laws allow for the interception of communications and can be viewed as widely controversial, they do not technically permit the mass surveillance of communications. In other words, ClearTrail’s products, such as ComTrail, which enable the mass interception of IP networks, lack legal backing. However, the Unified Access Services (UAS ) License Agreement regarding the Central Monitoring System mandates mass surveillance and requires ISP and Telecom operators to comply.

Through the licenses of the Department of Telecommunications, Internet service providers, cellular providers and telecoms are required to provide the Government of India direct access to all communications data and content even without a warrant, which is not permitted under the laws on interception. These licenses also require cellular providers to have ‘bulk encryption’ of less than 40 bits, which means that potentially any person can use off-the-air interception to monitor phone calls. However, such licenses do not regulate the capture of signal strength, target numbers like IMSI, TIMSI, IMEI or MSI SDN, which can be captured through ClearTrail’s mTrail product.

More importantly, following allegations that the National Technical Research Organization (NTRO) had been using off-the-air interception equipment to snoop on politicians in 2011, the Home Ministry issued a directive to ban the possession or use of all off-the-air phone interception gear. As a result, the Indian Government asked the Customs Department to provide an inventory of all all such equipment imported over a ten year period, and it was uncovered that as many as 73,000 pieces of equipment had been imported. Since, the Home Ministry has informed the heads of law enforcement agencies that there has been a compete ban on use of such equipment and that all those who possess such equipment and fail to inform the Government will face prosecution and imprisonment. In short, ClearTrail's product, mTrail, which undertakes off-the-air phone monitoring is illegal and Indian law enforcement agencies are prohibited from using it.

ClearTrail’s “Astra ” product is capable of remote infection and monitoring, which can push bot to any targeted machine sharing the same LAN. While India’s ISP and telecommunications licenses generally provide some regulations, they appear to be inadequate in regulating specific surveillance technologies which have the capability to target machines and remotely monitor them. Such licenses mandate mass surveillance, but legally, wireless communications are completely unregulated, which raises the question of whether the interception of public Internet networks is allowed. In other words, it is not clear if ClearTrail’s QuickTrail is technically legal or not. The UAS License agreement mandates mass surveillance, and while the law does not prohibit it, it does not mandate mass surveillance either. This remains a grey area.

The issue of data retention arises from ClearTrail ’s leaked brochure. In particular, ClearTrail states in its brochure that ComTrail - which undertakes mass monitoring of IP and Voice networks - retains data upon request, with a capacity that exceeds several years. xTrail - for targeted IP monitoring - has the ability to retain huge volumes of data which can potentially be used as proof in court. However, India currently lacks privacy legislation which would regulate data retention, which means that data collected by ClearTrail could potentially be stored indefinitely.

Section 7 of the Information Technology (Amendment) Act, 2008, deals with the retention of electronic records. However, this section does not state a particular data retention period, nor who will have authorized access to data during its retention, who can authorize such access, whether retained data can be shared with third parties and, if so, under what conditions. Section 7 of the Information Technology (Amendment) Act, 2008, appears to be incredibly vague and to fail to regulate data retention adequately.

Data retention requirements for service providers are included in the ISP and UASL licenses and, while they clarify the type of data they retain, they do not specify adequate conditions for data retention. Due to the lack of data protection legislation in India, it remains unclear how long data collected by companies, such as ClearTrail, would be stored for, as well as who would have authorized access to such data during its retention period, whether such data would be shared with third parties and disclosed and if so, under what conditions.

India currently lacks specific regulations for the use of various types of technologies, which makes it unclear whether ClearTrail ’s spy products are technically legal or not. It is clear that ClearTrail’s mass interception products, such as ComTrail, are not legalized - since Indian laws allow for targeted interception- but they are mandated through the UAS License agreement regarding the Central Monitoring System.

In short, the legality of ClearTrail’s surveillance technologies remains ambiguous. While India’s ISP and telecom licenses and the UAS License Agreement mandate mass surveillance, the laws - particularly the 2009 Information Technology Rules- mandate targeted surveillance and remain silent on the issue of mass surveillance. Technically, this does not constitute mass surveillance legal or illegal, but rather a grey area. Furthermore, while India ’s Telegraph Act, Information Technology Act and 2009 Rules allow for the interception, monitoring and decryption of communications and surveillance in general, they do not explicitly regulate the various types of surveillance technologies, but rather attempt to “legalize” them through the blanket term of surveillance.

One thing is clear: India’s license agreements ensure that all ISPs and telecom operators are a part of the surveillance regime. The lack of regulations for India’s surveillance technologies appear to create a grey zone for the expansion of mass surveillance in the country. According to Saikat Datta, an investigative journalist, a senior privacy telecom official stated:

“Do you really think a private telecom company can stand up to the government or any intelligence agency and cite law if they want to tap someone’s phone?”

Spy Files 3...and human rights in India

The facts speak for themselves. The latest Spy Files confirm that the same agencies involved in the development of the Central Monitoring System (CMS) are also interested in the latest surveillance technology sold in the global market. Spy Files 3 also provide data on one of India’s largest surveillance technology companies, ClearTrail, which sells a wide range of surveillance technologies to law enforcement agencies around the world. And Spy Files 3 show us exactly what these technologies can do.

In particular, ClearTrail’s ComTrail provides mass monitoring of IP and voice networks, which means that law enforcement agencies using it are capable of intercepting millions of communications every day through Gmail, Yahoo, Hotmail and others, of correlating our identities across networks and of targeting our location. xTrail enables law enforcement agencies to monitor us based on our “harmless” metadata, such as our IP address, our mobile number and our email ID. Think our data is secure when using the Internet through a cyber cafe? Well QuickTrail proves us wrong, as it’s able to assist law enforcement agencies in monitoring and intercepting our communications even when we are using public Internet networks.

And indeed, carrying a mobile phone is like carrying a GPS device, especially since mTrail provides law enforcement with off-the-air interception of mobile communications. Not only can mTrail target our location, listen to our calls and store our data, but it can also undertake passive off-the-air interception and monitor our voice, SMS and protocol information. Interestingly enough, mTrail also intercepts targeted calls from a predefined suspect list. The questions though which arise are: who is a suspect? How do we even know if we are suspects? In the age of the War on Terror, potentially anyone could be a suspect and thus potentially anyone’s mobile communications could be intercepted. After all, mass surveillance dictates that we are all suspicious until proven innocent .

And if anyone can potentially be a suspect, then potentially anyone can be remotely infected and monitored by Astra. Having physical access to a targeted device is a conventional surveillance mean of the past. Today, Astra can remotely push bot to our laptops and listen to our Skype calls, capture our Webcams, search our browsing history, identify our location and much more. And why is any of this concerning? Because contrary to mainstream belief, we should all have something to hide !

Privacy protects us from abuse from those in power and safeguards our individuality and autonomy as human beings. If we are opposed to the idea of the police searching our home without a search warrant, we should be opposed to the idea of our indiscriminate mass surveillance. After all, mass surveillance - especially the type undertaken by ClearTrail ’s products - can potentially result in the access, sharing, disclosure and retention of data much more valuable than that acquired by the police searching our home. Our credit card details, our photos, our acquaintances, our personal thoughts and opinions, and other sensitive personal information can usually be found in our laptops, which potentially can constitute much more incriminating information than that found in our homes.

And most importantly: even if we think that we have nothing to hide, it’s really not up to us to decide: it’s up to data analysts. While we may think that our data is “harmless”, a data analyst linking our data to various other people and search activities we have undertaken might indicate otherwise. Five years ago, a UK student studying Islamic terrorism for his Masters dissertation was detained for six days . The student may not have been a terrorist, but his data said this: “Young, male, Muslim... who is downloading Al-Qaeda’s training material” - and that was enough for him to get detained. Clearly, the data analysts mining his online activity did not care about the fact that the only reason why he was downloading Al-Qaeda material was for his Masters dissertation. The fact that he was a male Muslim downloading terrorist material was incriminating enough.

This incident reveals several concerning points: The first is that he was clearly already under surveillance, prior to downloading Al-Qaeda’s material. However, given that he did not have a criminal record and was “just a Masters student in the UK”, there does not appear to be any probable cause for his surveillance in the first place. Clearly he was on some suspect list on the premise that he is male and Muslim - which is a discriminative approach. The second point is that after this incident, it is likely that some male Muslims may be more cautious about their online activity - with the fear of being on some suspect list and eventually being prosecuted because their data shows that “they’re a terrorist”. Thus, mass surveillance today appears to also have implications on freedom of expression. The third point is that this incident reveals the extent of mass surveillance, since even a document downloaded by a Masters student is being monitored.

This case proves that innocent people can potentially be under surveillance and prosecuted, as a result of mass, indiscriminate surveillance. Anyone can potentially be a suspect today, and maybe for the wrong reasons. It does not matter if we think our data is “harmless”, but what matters is who is looking at our data, when and why. Every bit of data potentially hides several other bits of information which we are not aware of, but which will be revealed within a data analysis. We should always “have something to hide ”, as that is the only way to protect us from abuse by those in power.

In the contemporary surveillance state, we are all suspects and mass surveillance technologies, such as the ones sold by ClearTrail, can potentially pose major threats to our right to privacy, freedom of expression and other human rights. And probably the main reason for this is because surveillance technologies in India legally fall in a grey area. Thus, it is recommended that law enforcement agencies in India regulate the various types of surveillance technologies in compliance with the International Principles on Communications Surveillance and Human Rights.

Spy Files 3 show us why our human rights are at peril and why we should fight for our right to be free from suspicion.

This article was cross-posted in Medianama on 6th November 2013.

For more details visit https://cis-india.org/internet-governance/blog/spy-files-three

Mapping Digital Media: Broadcasting, Journalism and Activism in India — A Public Consultation

praskrishna — 2013-10-25T10:46:24Z

Alternative Law Forum, Maraa and the Centre for Internet and Society invite you to a public consultation on Mapping Digital Media in India, on October 27, 2013 at the Bangalore International Centre from 10 a.m. to 4.00 p.m.

Click to download the background note, press invite and press release and the poster of the event.

Here, reputed media lawyers, researchers, journalists, activists and other media professionals will be responding to a recent report that examines the progress of digitisation in India and its impact on media freedom and citizen’s access to quality news and information—the fundamental principles underpinning the Open Society Foundations’ work on media and communications.

Recently, India decided to make digitalise distribution of television signals across India in a phased manner, further contributing to the phenomenon of global digitisation, as citizens enter the fully digital broadcast world. While there may be perceived benefits of the ‘digital switchover’ in terms of freeing up spectrum, increase in quality of signals and so on, the full impact of digitalisation on plurality, diversity, ownership of media and content is yet to be comprehended fully.

Through this public consultation, hosts, Maraa, the Alternative Law Forum (ALF) and the Centre for Internet and Society (CIS), hope to shed light on key challenges confronting our emergent digital landscape while incorporating the input of those directly affected by this digitisation, India’s digital consumers, in a widened discussion on the matter. Speakers will directly respond to three sections of the country report – Regulation, Digital Activism and Journalism, and discussions to focus on trends in broadcasting (radio and television), cable operations and newspapers (print & online) as each of these sectors undergo digitalisation.

We would appreciate your participation at this public consultation so that we each may become better informed with regards to India’s digital media landscape and contribute to discussion as we strive to better comprehend the multifaceted picture that is emerging as this media digitisation takes place and look forward to hearing your input.

The India report is available for free download at http://www.opensocietyfoundations.org/reports/mapping-digital-media-india

Agenda

Policies, Laws and Regulators
10.00 a.m. - 10.30 a.m.	Lawrence Liang
10.30 a.m. - 11.00 a.m.	Mathew John
11.00 a.m. - 11.30 a.m.	Q & A
11.30 a.m. - 11.45 a.m.	Tea Break

Impact of Digital Media on Activism
11.45 a.m. - 12.15 p.m.	Arjun Venkatraman
12.15 p.m. - 12.45 p.m.	Meera K
12.45 p.m. - 1.15 p.m.	Q & A
1.15 p.m. - 2.00 p.m.	Lunch Break

Impact of Digital Media on Journalism
2.00 p.m. - 2.30 p.m.	Geeta Seshu
2.30 p.m. - 3.00 p.m.	Subhash Rai
3.00 p.m. - 3.30 p.m.	Q & A
Closing Remarks

For more details visit https://cis-india.org/internet-governance/events/mapping-digital-media-public-consultation-october-27-bangalore

India believes in Complete Freedom of Cyber Space: Kapil Sibal

praskrishna — 2013-10-25T07:13:44Z

The site of the impact of a cyber crime should determine jurisdiction, says information technology minister Kapil Sibal.

This article by Elizabeth Roche was published in Livemint on October 14, 2013. Moulishree Srivastava also contributed to this story. Sunil Abraham is quoted.

Minister for communications and information technology Kapil Sibal said on Monday that if a cyber crime had an impact on India or the subject matter was Indian, India should have the jurisdiction to investigate the crime and mete out justice.

India “believes in complete freedom of cyber space”, Sibal said, adding that the international community should arrive at a consensus on rules of jurisdiction and enforceability where cyber crimes are concerned. He was speaking at a conference on cyber security and cyber governance in New Delhi.

“Freedom of expression is central to our ideological stand on cyber space but at the same time there must be a de facto recognition of threats that are out there in cyber space and that we need to deal with those threats locally, nationally and globally and what we need is a consensus on those,” the minister said.

He was asked specifically about the need for changes in the global Internet governance structure following a US admission that its National Security Agency listened in on communications from the embassies of allies such as France, Italy and Greece, as well as Japan, Mexico, South Korea, India and Turkey.

The site of the impact of a cyber crime should determine jurisdiction, the minister said.

He gave an example: if anything happens in an Indian mission located in New York, it should be governed by Indian law because the mission would be considered Indian territory.

“So as long as the source of the data is Indian and the impact is on India then the jurisdiction must be Indian and that should apply across the world,” he said.

“If the harm has been caused to Indian citizens or Indian property then jurisdiction should be Indian,” said Sunil Abraham, executive director at Centre for Internet and Society. “This principle has already been developed by Justice Murlidhar in Banyan Tree case. So this principle already has legal precedent.”

But Abraham added that “even if Indian courts believe that it is their jurisdiction, foreign law enforcement agencies may not co-operate. This may be one of the biggest challenges in implementing this principle”.

“This move could be seen as one enhancing cyber security, but since there is no universally accepted definition to cyber security and some government include speech regulation, surveillance, cyber crime and hacktivism a part of cyber security—there can be damaging consequences for human rights online,” Abraham said.

The minister’s statement assumes significance against the backdrop of a number of countries including India protesting the spying by the US National Security Agency (NSA) on their missions in Washington and New York.

According to many news reports, India was among the top five countries whose missions in the US were targeted by the NSA as part of a clandestine effort to mine electronic data. Reports of the US snooping has caused unease world wide.

German Chancellor Angela Merkel raised the issue with US President Barack Obama in June while Brazil’s President Dilma Rouseff reportedly cancelled a summit with the US President in protest last month.

According to the ministry of external affairs in New Delhi, India raised the issue with the US embassy in New Delhi besides taking up the issue with the US state department in Washington. Both sides agreed to discuss the subject during their cyber security dialogue.

“That’s the law in the country...if anything happens there (in Indian embassies) that is part of Indian jurisdiction and similarly if you apply the same example and establish jurisdiction then anything that relates to Indian data and the impact on Indian data, it’s the courts in India that should have jurisdiction,” Sibal added later.

“We are talking about a principle and the principle is wherever there is Indian data wherever anything is done to impact on Indian data, the source of which is Indian then the jurisdiction must be of Indian courts,” the minister said adding that he was putting this view out as something the cyber security seminar should discuss.

India’s national security adviser Shiv Shankar Menon added that what the minister had voiced was India’s view but it was not a settled matter and that it had to be discussed at global forums.

With around 40% of the 120 million smartphone users in India accessing the Internet through mobile phones, network protection was an imperative. “The consequences of manipulation or distortion...can be potentially disastrous.” Menon said recalling how morphed pictures of violence seemingly targeting a particular ethnic group, circulated on the Internet and via cell phones, had resulted in thousands of people fleeing home from their places of work last year.

On certification of hardware security, Menon said: “India has recently received authorizing nation status for IT products and testing labs in the country will now gain global recognition,” adding that this was an opportunity for Indian industry.

Sibal, in his address, said the Internet had become a means of empowerment of people and most of this was due to the enormous freedom provided by the Internet. But “there can be no concept of sovereignty in cyber space because there are no territorial issues involved”, he said.

For more details visit https://cis-india.org/news/livemint-october-14-2013-elizabeth-roche-moulishree-srivastava-india-believes-in-complete-freedom-of-cyber-space

Location Tracking: Why the Govt-Mobile Manufacturer War Won’t End Soon

praskrishna — 2013-10-25T06:32:56Z

The Union government and mobile operators are at loggerheads on location based services (LBS) – the service through which mobile companies can provide real time location of mobile users to the government.

The article by Danish Raza was published in FirstPost on October 15, 2013. Sunil Abraham is quoted.

In the aftermath of Nirbhaya gangrape case in December, Delhi Police approached mobile operators to implement LBS, but the operators refused citing the costs involved in the process, said M M Oberoi, joint commissioner of Delhi police. Oberoi was talking at the India Conference on Cyber Security and Cyber Governance, conducted by FICCI in New Delhi on Tuesday. “Often the person in distress dials 100 but does not know his or her location. Therefore, it becomes difficult for the PCR vans to track the victim. A lot of time is spent trying to figure out the victim’s location, as it happened in the 16 December gangrape case,” said Oberoi.


Representational image. Agencies.

As reported by Firstpost, the government has already directed all telecom service providers to make location details a mandatory part of call data records (CDR) of all mobile users in the country starting mid- 2014.

India is the second-largest mobile phone user with over 900 million users, as per the union government data. However, mobile companies are not complying with the government order, Oberoi told Firstpost. “In our attempt to develop a better response mechanism, we are also exploring ways through which we can bypass mobile companies to track the person. We can do it through software,” he added.

The mobile companies have maintained that they can help the government in tracking people in distress, but the kind of accuracy the law enforcement forces are demanding involves huge costs.

The DoT directive says that while detecting the location of the mobile users in urban centres, the telecom operator should achieve 80 percent accuracy in the first year of implementing the technology followed by 95 percent accuracy in the second year. However, it is not clear from the DoT note which year will be taken into account while determining the degree of accuracy of the company’s technology – 2011 (when the order was issued) or 2014 (when location details shall be part of CDR for all mobile calls).

“For such accuracy, we need to put enhanced cell tracking software on cell towers which is a very expensive process,” Rajan S Mathews, director, Cellular Operators Associations of India, told Firstpost.

In the last meeting with the representatives of DoT, Cellular Operators Associations of India told the former that it was against the idea of LBS for all mobile users, but can cooperate in the case of targeted tracking, said Mathews.

He suggested two alternatives which can work to track a person in distress. It should be mandated by the government, he said, that people use only high end phones which send signals to cell towers when they make a call. “It is not easy to make everyone use such devices though.”

Another possibility, according to him, is that a person gets registered with the mobile operator for such service. “When this person is in distress and dials 100, he avails the service through which police can track his or her location,” said Mathews.

According to Sunil Abraham, director of Bangalore based Centre for Internet & Society, it is unethical implement LBS as a blanket order and the government, along with mobile operators, should find a way out to introduce targeted surveillance.

“There is an initial increase in security that accompanies increase in surveillance – after which increased surveillance actually undermines the security imperative and could make the security worse than when surveillance was initiated. Therefore surveillance should always be targeted, blanket surveillance is almost always a terrible idea,” he said.

For more details visit https://cis-india.org/news/first-post-october-15-2013-danish-raza-location-tracking

Bouquets & brickbats for Google's new privacy policy

praskrishna — 2013-10-25T05:40:56Z

Google's recent privacy policy change that allows the internet search company to use names, photographs and endorsements by its users in online advertisements is getting mixed reviews in India - advertisers love it, and activists love to hate it.

This article by Indu Nandakumar was published in the Economic Times on October 18, 2013. Sunil Abraham is quoted.

Internet rights activists called it another incursion into individual privacy by the California-based company that uses 'Don't be evil' as an informal corporate motto. Brand advisers and marketers praised the ingenuity of personalisation that can make advertising much more effective.

"From a user perspective, there is a higher chance of them buying a product if it is endorsed by a friend," said Kunal Jeswani, chief digital officer at Ogilvy & Mather India. To his mind, the argument about user privacy is "naive" because when a user enters a social network, he/she should know his/her personal information, such as profile photographs and names, is already on the web.

Google announced its policy change regarding user information will be effective on November 11, giving the company the right to use profile names, photos and comments alongside advertisements by clients who use its online advertising network of over 2 million websites.

For instance, if a user has endorsed a product by giving it a "+1" or rated a product on the Google Play app store, his/her image will appear next to the ad when it is displayed to people who are part of his/her social circle on the social networking service Google Plus. The move is seen as Google's attempt to catch up with rival Facebook, which first introduced the concept of 'social ads' that let corporations use the power of influence of people within a person's social network to sell products.

Internet rights activists said such practices raise privacy concerns as they do not take prior consent of users.

"We are not comfortable with user information being used without their permission, especially since Google's privacy standards are not very high," said Uday Mehta, associate director at Consumer Unity and Trust Society (CUTS International).

Last year, the agency complained to Competition Commission of India to investigate Google's alleged anti-competitive practices here. An investigation is ongoing.

In an emailed response, Google said it is notifying users about the change in policy, so that if a user does not like it, he/she can turn it off.

"Since we're updating an existing setting, we will continue to respect the choice you made about the old setting. That means if you already told us that you didn't want your +1s to appear in ads, none of your other shared endorsements will appear in ads," a Google spokesman said.

For example, Google said, if a user reviewed a restaurant, people who aren't in his/her Google Plus Circles of friends would not see that review in an ad that the restaurant might run through Google.

The latest ad strategy comes at a time when companies such as Google and Facebook have been attempting to increase their ad revenues by personalising advertisements to attract user attention. Over 90% of Google's $46-billion revenue in 2012 came from advertisements.

Sunil Abraham, executive director of the Center for Internet and Society said the issue highlights the need for a stronger internet privacy statute in India. The absence of clear privacy laws makes it impossible for government officials to understand the harm caused to personal rights because of the default settings of Google, he observed.

For more details visit https://cis-india.org/news/economic-times-october-18-2013-indu-nandakumar-bouquets-brickbats-google-new-privacy-policy

What India can Learn from the Snowden Revelations

elonnai — 2013-10-25T07:29:57Z

Big Brother is watching, across cyberspace and international borders. Meanwhile, the Indian government has few safeguards in theory and fewer in practice. There’s no telling how prevalent or extensive Indian surveillance really is.

The title of the article was changed in the version published by Yahoo on October 23, 2013.

Since the ‘Snowden revelations’, which uncovered the United States government’s massive global surveillance through the PRISM program, there have been reactions aplenty to their impact.

The Snowden revelations highlighted the issue of human rights in the context of the existing cross-border and jurisdictional nightmare: the data of foreign citizens surveilled and harvested by agencies such as the National Security Agency through programs such as PRISM are not subject to protection found in the laws of the country. Thus, the US government has the right to access and use the data, but has no responsibility in terms of how the data will be used or respecting the rights of the people from whom the data was harvested.

The Snowden revelations demonstrated that the biggest global surveillance efforts are now being conducted by democratically elected governments – institutions of the people, by the people, for the people – that are increasingly becoming suspicious of all people.

Adding irony to this worrying trend, Snowden sought asylum from many of the most repressive regimes: this dynamic speaks to the state of society today. The Snowden revelations also demonstrate how government surveillance is shifting from targeted surveillance, warranted for a specific reason and towards a specified individual, to blanket surveillance where security agencies monitor and filter massive amounts of information.

This is happening with few checks and balances for cross-border and domestic surveillance in place, and even fewer forms of redress for the individual. This is true for many governments, including India.

India’s reaction

After the first news of the Snowden revelations, the Indian Supreme Court agreed to hear a Public Interest Litigation requesting that foreign companies that shared the information with US security agencies be held accountable for the disclosure. In response to the PIL, the Supreme Court stated it did not have jurisdiction over the US government.

The response of the Supreme Court of India demonstrates the potency of jurisdiction in today’s global information economy in the context of governmental surveillance. Despite being upset at the actions of America’s National Security Agency (NSA), there is little direct legal action that any government or individual can take against the US government or companies incorporated there.

In the PIL, the demand that companies be held responsible is interesting and representative of a global debate, as it implies that in the context of governmental surveillance, companies have a responsibility to actively evaluate and reject or accept governmental surveillance requests. Although I do not disagree with this as a principle, in reality, this evaluation is a difficult step for companies to take.

For example, in India, under Section 69 of the Information Technology Act, 2000, service providers are penalized with up to seven years in prison for non-compliance with a governmental request for surveillance. The incentives for companies to actually reject governmental requests are minimal, but one factor that could possibly push companies to become more pronounced in their resistance to installing backdoors for the government and complying with governmental surveillance requests is market pressure from consumers.

To a certain extent, this has already started to happen. Companies such as Facebook, Yahoo and Google have created ‘transparency reports’ that provide – at different granularities – information about governmental requests and the company’s compliance or rejection of the same.

In India, P. Rajeev, Member of Parliament from Kerala, has started a petition asking that the companies disclose information on Indian data given to US security agencies. Although transparency by complying companies does not translate directly into regulation of surveillance, it allows the customer to make informed choices and decide whether a company’s level of compliance with governmental requests will impact his/her use of that service.

The PIL also called for the establishment of Indian servers to protect the privacy of Indian data. This solution has been voiced by many, including government officials. Though the creation of domestic servers would ensure that the US government does not have direct and unfettered access to Indian data, as it would require that foreign governments access Indian information through a formal Mutual Legal Assistance Treaty process, it does not necessarily enhance the privacy of Indian data.

As a note, India has MLAT treaties with 34 countries. If domestic servers were established, the information would be subject to Indian laws and regulations.

Snooping

The Snowden Revelations are not the first instance to spark a discussion on domestic servers by the Government of India.

For example, in the back-and-forth between the Indian government and the Canadian company RIM, now BlackBerry, the company eventually set up servers in Mumbai and provided a lawful interception solution that satisfied the Indian government. The Indian government made similar demands from Skype and Google. In these instances, the domestic servers were meant to facilitate greater surveillance by Indian law enforcement agencies.

Currently in India there are a number of ways in which the government can legally track data online and offline. For example, the interception of telephonic communications is regulated by the Indian Telegraph Act, 1885, and relies on an order from the Secretary to the Ministry of Home Affairs. Interception, decryption, and monitoring of digital communications are governed by Section 69 of the Information Technology Act, 2000 and again rely on the order of the executive.

The collection and monitoring of traffic data is governed by Section 69B of the Information Technology Act and relies on the order of the Secretary to the government of India in the Department of Information Technology. Access to stored data, on the other hand, is regulated by Section 91 of the Code of Criminal Procedure and permits access on the authorization of an officer in charge of a police station.

The gaps in the Indian surveillance regime are many and begin with a lack of enforcement and harmonization of existing safeguards and protocols. Presently, India is in the process of realizing a privacy legislation.

In 2012, a committee chaired by Justice AP Shah (of which the Center for Internet and Society was a member) wrote The Report of the Group of Experts on Privacy, which laid out nine national privacy principles meant to be applied to different legislation and sectors – including Indian provisions on surveillance.

The creation of domestic servers is just one example of how the Indian government has been seeking greater access to information flowing within its borders. New requirements for Indian service providers and the creation of projects that go beyond the legal limits of governmental surveillance in India enable greater access to details about an individual on a real-time and blanket basis.

For example, telecoms in India are now required to include user location data as part of the ‘call detail record’ and be able to provide the same to law enforcement agencies on request under provisions in the Unified Access Service and Internet Service Provider Licenses.

At the same time, the Government of India is in the process of putting in place a Central Monitoring System that would provide Indian security agencies the ability to directly intercept communications, bypassing the service provider.

Even if the Central Monitoring System were to adhere to the legal safeguards and procedures defined under the Indian Telegraph Act and Information Technology Act, the system can only do so partially, as both provisions create a clear chain of custody that the government and service providers must follow – that is, the service provider was included as an integral component of the interception process.

If the Indian government implements the Central Monitoring System, it could remove governmental surveillance completely from the public eye. Bypassing the service provider allows the government to fully determine how much the public knows about surveillance. It also removes the market and any pressure that consumers could exert from insight provided by companies on the surveillance requests that they are facing.

Though the Indian government could (and should) be transparent about the amount and type of surveillance it is undertaking, currently there is no legal requirement for the government of India to disclose this information, and security agencies are exempt from the Right to Information Act. Thus, unless India has a Snowden somewhere in the apparatus, the Indian public cannot hope to get an idea of how prevalent or extensive Indian surveillance really is.

Policy vacuum

For any government, the surveillance of its citizens, to some degree, might be necessary. But the Snowden revelations demonstrate that there is a vacuum when it comes to surveillance policy and practices. This vacuum has permitted draconian measures of surveillance to take place and created an environment of mistrust between citizens and governments across the globe.

When governments undertake surveillance, it is critical that the purpose, necessity and legality of monitoring, and the use of the material collected are built into the regime to ensure it does not violate the human rights of the people surveilled, foreign or domestic.

In 2013, the International Principles on the Application of Human Rights to Communications Surveillance were drafted, in part, to address this vacuum. The principles seek to explain how international human rights law applies to surveillance of communications in the current digital and technological environment. They define safeguards to ensure that human rights are protected and upheld when governments undertake surveillance of communications.

When the Indian surveillance regime is measured against these principles, it appears to miss a number of them, and does not fully meet several others. In the context of surveillance projects like the Central Monitoring System, and in order to avoid an Indian version of the PRISM program, India should take into consideration the safeguards defined in the principles and strengthen its surveillance regime to ensure not only the protection of human rights in the context of surveillance, but to also establish trust in its surveillance regime and practices with other countries.

Elonnai Hickok is the Program Manager for Internet Governance at the Centre for Internet and Society, and leads its research on privacy.

For more details visit https://cis-india.org/internet-governance/blog/yahoo-october-23-2013-what-india-can-learn-from-snowden-revelations

An Interview with Jacob Kohnstamm, Dutch Data Protection Authority and Chairman of the Article 29 Working Party

elonnai — 2013-10-25T04:50:56Z

The Centre for Internet and Society interviewed Jacob Kohnstamm, Dutch Data Protection Authority and Chairman of the Article 29 Working Party.

What activities and functions does your office undertake?

The activities and functions of the Dutch data protection authority can roughly be divided in 4 different categories: supervisory activities, giving advise on draft legislation, raising awareness and international tasks.

The Dutch DPA supervises the legislation applicable in the Netherlands with regard to the use of personal data. The most important law is the Dutch Data Protection Act, but the Dutch DPA also supervises for example the Acts governing data processing by police and justice as well as parts of the Telecoms Act.

The supervisory activities mainly consist of investigating, ex officio, violations of the law, with the focus on violations that are serious, structural and impact a large amount of people. Where necessary, the Dutch DPA can use its sanctioning powers, including imposing a conditional fine, to enforce the law. The Dutch DPA can also decide to examine sector-wide codes of conduct that are submitted to it and provide its views in the form of a formal opinion.

In addition to investigations, the Dutch DPA advises the government, and sometimes the parliament, on draft legislation related to the processing of personal data. Following the Data Protection Act, the government is obliged to submit both primary and secondary legislation related to data processing to the DPA for advice.

As regards awareness-raising, next to publishing the results of the investigations, its views on codes of conduct and its advice on legislation, the Dutch DPA also issues guidelines, on its own initiative, explaining legal norms. Via its websites, the Dutch DPA provides more information to both data subjects and controllers on how data can and cannot be processed. Specifically for data subjects, self-empowerment tools – including standard letters to exercise their rights – are made available. Furthermore, they can contact the Dutch DPA daily via a telephone hotline.

Last but not least, the Dutch DPA participates in several International and European fora, including the Article 29 Working Party of which I am the Chair, the European and the International Conference of data protection and privacy commissioners, of whose Executive Committee I am also the Chair.

What powers does your office have? in your opinion are these sufficient? Which powers have been most useful? If there is a lack, what do you feel is needed?

The Dutch DPA has a broad range investigative powers, including the power to order the controller to hand over all relevant information and entering the premises of the controller unannounced. All organisations subjected to the supervision of the Dutch DPA are obligated to cooperate.

The Dutch DPA also has a considerable range of sanctioning powers, it can for example order the suspension or termination of certain processing operations and can also impose a conditional fine. Currently a bill is before Parliament to provide the Dutch DPA with fining powers as well.

Especially when the bill providing the Dutch DPA with fining powers will be passed, I feel the powers are sufficient, giving us all the necessary enforcement tools to ensure compliance with the law.

How is your office funded?

The Dutch DPA is funded through the government who, together with the parliament, each year determines the budget for the next year. The budget is drafted on the basis of a proposal from the Dutch DPA.

What is the organizational structure of your office and the responsibilities of the key executives?

The Dutch DPA consists of a college of commissioners and the supporting Secretariat, itself consisting of 6 departments and headed by the Director. The Dutch DPA has 2 supervision departments, one for the private and one for the public sector, a legal department, a communications department, an international department and a department providing the operational support.

If India creates a framework of co-regulation, how would you suggest the overseeing body be structured?

Considering the many differences between India and the Netherlands - and Europe - this is a very hard question to answer. But whatever construction is chosen in India, it is of utmost importance to guarantee the independence of the supervisory authorit(y)(ies), who shall be provided with sufficient and scalable powers to be able to sanction violations.

What legal challenges has your office faced?

The biggest legal challenge we face at the moment is the new European legal framework currently being discussed. It is as yet uncertain whether and when this will enter into force, but it is clear that it will bring new challenges for our office.

What are the main differences between your offices?

Generally, I think that the differences between my office and the UK and Canadian offices mostly stem from our different legal and cultural backgrounds, especially the difference between the common law and codified law systems.

In addition, the norms and powers differ per supervisory authority. The Dutch DPA for example can enter a building without prior notice, while the ICO, if I understand correctly, can only enter with the consent of the supervised organisation.

I however prefer to look at the similarities and possibilities to overcome our differences, because I think that we all feel that providing a high level of data protection and ensuring user control are all of our main priorities.

Naturally, I am very curious to hear from Chrisopher and Chantal as well.

What are the most recent privacy developments for each of your respective offices?

The technological developments of the past decades and the increasing use of smartphones and tablets, have also made privacy developments necessary and have obliged us, as data protection authorities, to consider the rules and norms in this new environment.

What would you broadly recommend for a privacy legislation for India?

In my view the privacy legislation in India should in any case contain the basic principles of the protection of personal data, applicable to both the public and the private sector. Naturally with some exceptions for law enforcement purposes.

Furthermore, the Indian law should protect the imported data of citizens from other parts of the world as well, including the EU.

And as mentioned in my answer to question 5, it is of utmost importance that the Indian legislation guarantees the establishment of (a) completely independent supervisory authorit(y)(ies), provided with sufficient sanctioning powers, to supervise compliance with the legislation also of the government, including police and justice.

For more details visit https://cis-india.org/internet-governance/blog/interview-with-jacob-kohnstamm

'Free Speech and Media in South Asia: Human Rights Concerns in a Globalizing World'

praskrishna — 2013-11-08T05:33:22Z

A seminar organized by the Programme in Comparative Media Law and Policy, Centre for Socio-Legal Studies, University of Oxford, in collaboration with the Centre for Media and Governance, National Law University, Delhi. Chinmayi Arun is one of the speakers.

Click to read the original published by Oxford University Press here

Speakers:

Salil Tripathi, English PEN

Defending Freedom of Expression in India

Emrys Shoemaker, London School of Economics

Mobile Communication and Internet Regulation in Pakistan: Mapping Social Implications

Chinmayi Arun, National Law University, Delhi

Privacy and Surveillance

Kumaravadivel Guruparan, University College London

Digital Media as Part of the Sri Lankan State's 'Counter-insurgency' Programme

Chair: Nicole Stremlau, PCMLP

This panel discussion will explore contemporary issues that envelop both the digital and the traditional media in South Asia. It will look at the effects of surveillance, prior restraints on speech, intermediaries and other key factors on the public sphere. It will also consider, in this context, the relationship of the traditional media with the Internet. This discussion will take place in the backdrop of evolving democratic engagement in India, and the constitutional jurisprudence that attempts to keep pace with it and with developments in communication technology. It will offer comparative perspectives from other countries grappling with similar concerns.

For more details visit https://cis-india.org/news/university-of-oxford-october-25-2013-free-speech-and-media-in-south-asia

Interview with Dr. Alexander Dix - Berlin Data Protection and Freedom of Information Commissioner

maria — 2013-11-06T09:29:32Z

Maria Xynou recently interviewed Berlin's Data Protection and Freedom of Information Commissioner: Dr. Alexander Dix. View this interview and gain an insight on recommendations for better data protection in India!

Dr. Alexander Dix has been Berlin's Data Protection and Freedom of Information Commissioner since June 2005. He has more than 26 years of practical experience in German data protection authorities and previously served as Commissioner for the state of Bradenburg for seven years.

Dr. Dix is a specialist in telecommunications and media and has dealt with a number of issues regarding the cross-border protection of citizen’s privacy. He chairs the International Working Group on Data Protection in Telecommunications (“Berlin Group”) and is a member of the Article 29 Working Party of European Data Protection Supervisory Authorities. In this Working Party he represents the Data Protection Authorities of the 16 German States (Länder).

A native of Bad Homburg, Hessen, Dr. Alexander Dix graduated from Hamburg University with a degree in law in 1975. He received a Master of Laws degree from the London School of Economics and Political Science in 1976 and a Doctorate in law from Hamburg University in 1984. He has published extensively on issues of data protection and freedom of information. Inter alia he is a co-editor of the German Yearbook on Freedom of Information and Information Law.

The Centre for Internet and Society interviewed Dr. Alexander Dix on the following questions:

What activities and functions does the Berlin data commissioner's office undertake?
What powers does the Berlin data commissioner's office have? In your opinion, are these sufficient? Which powers have been most useful? If there is a lack, what would you feel is needed?
How is the office of the Berlin Data Protection Commissioner funded?
What is the organisational structure at the Office of the Berlin Data Protection Commissioner and the responsibilities of the key executives?
If India creates a Privacy Commissioner, what structure/framework would you suggest for the office?
What challenges has your office faced?
What is the most common type of privacy violation that your office is faced with?
Does your office differ from other EU data protection commissioner offices?
How do you think data should be regulated in India?
Do you support the idea of co-regulation or self-regulation?
How can India protect its citizens' data when it is stored in foreign servers?

VIDEO

For more details visit https://cis-india.org/internet-governance/blog/interview-with-berlin-data-protection-commissioner

Beyond the Searchlight

praskrishna — 2013-10-23T11:15:27Z

Should we be wary of Google’s all-pervasiveness?

This article Debarshi Dasgupta was published in the Outlook on October 23, 2013. Sunil Abraham is quoted.

Search Google

Some queries to type in the window

Is what is good for Google good for India, especially after Brazil and the EU question its actions?
Are politicians sending out the right signals by associating with Google’s initiatives?
Is Google directing the internet intellectual discourse in a way that will benefit it?
Does Google initiate the kind of offline activities it does here in other democracies?
Is Google shutting out potential competition by obtaining a stranglehold on the internet?

Google’s policy, its CEO Eric Schmidt had once said, was to get right up to the creepy line, but not cross it. It has generated contentious debate about the firm’s activities and products, whether it’s accessing your e-mails to feed you targeted ads, something we have now come to accept grudgingly, or its soon-to-be-released Google Glass that comes fitted with miniature cameras and has advocates all worried about the next big breach on the privacy frontier.

Not just online, where privacy violations and anti-competitive practices have raised concerns globally, some of Google’s offline activities in India too should have us asking questions based on conflict of interest and lack of transparency. Here too, the company seems to have placed itself right next to the creepy line. Especially the way it has gone about sponsoring research at key think-tanks and academia on areas that directly concern its business interests.

Nothing illustrates this better than the work of PRS Legislative Research, which Google has funded in the past. PRS produces policy briefings that are sent out to lawmakers and the media, including on internet governance. PRS hasn’t got a clearance to receive foreign funds since it became independent of the Centre for Policy Research in 2010, where it was launched, and has since then been largely funded by domestic sources.

Prashant Reddy, Blogger

“That an Indian user seeking arbitration
with Google has to do so in a California
court reeks of double standards.”

Does this growing network mean Google is having a say in shaping internet governance laws? Maybe yes. They should have a say by all means, just as other interested parties must get theirs. But given its influence and the certain opaqueness that marks its activities, some more transparency can only boost the credentials of a firm whose informal motto is—“Don’t be evil”. Google may have helped you find that bit of information from the googol tera bytes of online data but it has so far largely evaded discussion on how it has gone on to become big and influential in India.

But while it may have been forced to back out from funding PRS directly, Google’s web of research fellows in this country is growing. In August this year, the Asia Internet Coalition, of which Google is a founding member, selected its two inaugural India fellows—Shehla Rashid Shora and Astik Sinha, both of whom will analyse policies concerning the internet environment here. Sinha also happens to be a social media advisor for BJP MP Anurag Thakur.

So big that it hobnobs with Narendra Modi in the first of its Hangout series and, quite contrary to its espousal of free speech, has comfortable questions pitched to him. Or so influential that it has telecom minister Kapil Sibal, its bete noire from 2011 when his ministry was forcing them to pull down content, to attend the launch of chandnichowkonline.in, a business directory of Sibal’s constituency. Outlook made several attempts to get a reaction from Google but received none by the time this article had to go to the press.


Blurred lines Paid ads seem no different from search results for cameras

Google, since 2011, has also placed three fellows so far under its annual Google Public Policy Fellowship programme at the Bangalore-based Centre for Internet and Society (CIS). The research is supposed to focus on “access to knowledge, openness in India, freedom of expression, privacy, and telecom”. Yet another crucial funding in May 2013 went to the Centre for Communication Governance at the National Law University in New Delhi, which does research on areas directly linked to its business interests. The agreement contains a clause that says “Google will not be excluded from any future business opportunities”. Its research director Chinmayi Arun did not respond to Outlook’s e-mail and said she was too busy to speak when Outlook called her up.

A third institution Google has funded is the media watch website The Hoot. After the 26/11 attacks in Mumbai when the government hastily amended the IT Act, clamping down in a restrictive spirit, noted journalist and the website’s editor Sevanti Ninan was one of the many criticising the government publicly in her articles. Google, she says, contacted her somewhere around mid-2009 seeking a proposal on how they could help with what she was working on. Ninan sent one proposing a Free Speech Hub and received a grant of $22,000 in January 2010 (approximately Rs 10 lakh at 2010 exchange rates) from Google to do so. The hub is an online forum to track free speech violation and highlight problems surrounding freedom of speech and expression and regulation of media.

The commitment was renewed in February 2012 with another grant of Rs 42 lakh. Ninan says that while Google was “not interested in media ethics but free speech”, its approach was entirely “hands-off” to what the site could include on the hub. “I think it’s entirely up to the organisation being funded to decide how it handles a grant. At the same time, anything Google does should be under scrutiny just like other corporations.”

“More transparency
and accountability
can only be good,
both for Google and for the organisation
it funds.”
Anja Kovacs, Internet Democracy Project

So just as it is necessary to publicise that Shell has ties with the India chapter of Brookings Institution or that Reliance sponsors the Observer Research Foundation, it is important that people know where Google is putting its money and for what gains. In fact, more so in the case of Google, a firm that touches our lives in so many more ways that Shell or Reliance does. Yet, a lot of what Google has been doing has gone without adequate publicity and scrutiny. Should we be any less sceptical of Google funding research that helps formulate policies on internet governance than we should be of, let’s say, the Tatas and Jindals on mining? “Google has huge money and its funding of research can be a very contentious issue, especially if it seeks to influence research. Therefore, parties who swear by full disclosure and transparency must adhere to it,” says senior journalist Paranjoy Guha Thakurta. “More transparency and accountability can only be good, both for Google and the organisations it funds,” adds Anja Kovacs, who works with the Internet Democracy Project.


The great connector Hangout with Narendra Modi

But there has been little of that transparency online. For instance, the Rules and Regulations Review of The Information Technology Rules, 2011, put out and sent to MPs by PRS Legislative Research has no mention that an interested party (Google) has funded its work. Similarly, The Hoot has no mention of Google funding it on the ‘About the Hub’ page even though it has details of Google’s funding on the ‘Support The Hoot’ page. Google has also funded numerous ngos, in areas such as health and education, and has sought to promote the use of technology (often theirs, such as in the ongoing Google Impact Challenge Award).

“Because there is
no privacy
commissioner,
Indian citizens are
left vulnerable to
Google when it comes to
privacy.”
Sunil Abraham, CIS, Bangalore

This offline influence apart, Google’s hold online is worrying enough to call for action. The way it manipulates search results to favour clients of its AdSense programme is a global concern. For instance, a search for a popular phone model throws up matches of Google’s clients and features them more prominently than the actual site of the product. The Jaipur-based Consumer Unity and Trust Society (CUTS) conducted a survey that found most internet users could not tell an ad from an organic search result from Google. Says Madhav Dar, an independent anti-trust economist, “Given its financial clout and dominance of e-commerce, Google can directly deny traffic to downstream sites. And because the internet ecosystem is still in a formative stage here, this is something that requires intense and urgent scrutiny by the Competition Commission of India (CCI).”

CUTS filed a formal complaint with the CCI in June last year alleging anti-competitive practices and abuse of its dominant position. BharatMatrimony.com too filed a complaint with the CCI in 2012 accusing it of directing online users’ search for “Bharat+Matrimony” to its rivals.

For many, Google crossed the creepy line when it declared, in a court filing in August this year, that people sending e-mails to any of Google’s 425 million Gmail users need have no “reasonable expectation” that their communications are confidential. This is something that concerns Sunil Abraham, the executive director of CIS, which hosts Google fellows but has received no funding from the firm. “India has no omnibus horizontal statutes, neither sufficiently evolved vertical statutes in specific areas of telecommunication or the internet,” he says. “And because of that there is no office of the privacy commissioner in India and the absence of this regulator doesn’t tame the voracious appetite that Google has for personal information. This happens in other jurisdictions, but the Indian citizen is left vulnerable to Google when it comes to privacy.” “Part of Google’s practice can be absolutely abhorrent, such as the way in which it seeks to have a monopoly in digitising information and being the only one to organise it,” adds Kovacs.


Amitabh Bachchan Google maps his home at WEF in Davos

Another controversial move online has been the decision between Airtel and Google to allow the former’s subscribers free usage of Google’s service up to 1 GB. This has thrown up concerns of violation of “network neutrality”, a widely acknowledged concept that requires internet service providers to not discriminate against third party applications and service.

Journalist and blogger Shivam Vij, however, thinks concerns surrounding Google’s offline activities are misplaced. “As long as they keep coming out with transparency reports that show the majority of requests for user data and content removal are refused, I’d consider them an ally. One should be grateful that Google is funding to protect free speech and ashamed that Indian firms aren’t,” he says. “And if they really have been trying to influence MPs, they would have bribed them, not put out research.”

Nikhil Pahwa, who runs Medianama, a digital media news and analysis website, is another person who says “he won’t look a gift horse in the mouth”. “I don’t know what the motives are, but I support what they are doing, especially given the way the state and Indian firms are failing us when it comes to protecting free speech online,” he adds. The only concern he has about Google is regarding its reported unwillingness to agree to a deal between the Advertising Agencies Association of India (AAAI) and the Internet and Mobile Association of India (IAMAI). The deal seeks to ensure smaller online publishers and advertising networks are paid on time by advertisers, who, in most cases, delay payments to smaller entities but always pay bigger players like Google on time. “Smaller players are suffering due to delay in payments, which can extend up to a year, a problem that Google does not face. The IAMAI initiative is something that Google is unwilling to support because it does not impact them,” he adds.

"Anything that
Google does should
be under scrutiny
just like other corporations."
Sevanti Ninan, Editor, The Hoot


The outreach Sibal attends the launch of chandnichowkonline, a business directory of his constituency; Qutub Minar, digitised

Criticising or questioning some of Google’s policies does not amount to siding with the government on cracking down on free speech on the internet. Outlook ran a cover in December 2011 where it was severely critical of the government’s attempt to muzzle online dissent. Neither does concern about Google’s activities stem from a fear of the foreign hand. Its expansion into Indian civil society has to be seen as an attempt by a profits-driven corporation to ensure its market interests in India are protected. The country becomes all the more important given the trouble it has been having in Brazil and in Europe, where the firm has been slapped with a slew of anti-trust charges. Keeping a close watch will only help enforce Google’s policy in India—not crossing the creepy line.

For more details visit https://cis-india.org/news/outlookindia-october-28-2013-debarshi-dasgupta-beyond-the-searchlight

Bali meet to discuss Internet governance issues

praskrishna — 2013-10-23T08:29:23Z

Four-day event hosted by Internet Governance Forum to also discuss Internet access and diversity, privacy, security.

This article by Moulishree Srivastava was published in Livemint on October 22, 2013. Sunil Abraham is quoted.

Representatives of governments around the world, technology executives and activists will discuss issues such as Internet access and diversity, privacy, security, inter-governmental corporation, and Internet governance at a four-day event hosted by the Internet Governance Forum (IGF) that begins on Tuesday in Bali, Indonesia.

J. Satyanarayana, secretary, ministry of communications and information technology, confirmed India’s participation in the forum and said the country would be represented by Dr Govind, a senior director and head of department, e-infrastructure and Internet governance division, department of information technology.

“We will also be taking part in a working group on Internet governance and enhanced cooperation, which will be convened by the United Nations Commission on Science and Technology for Development in November,” said Satyanarayana.

“IGF is a valuable learning forum wherein different stakeholders can discuss Internet governance policy issues without any antagonism. Other fora for Internet policy like ICANN, WIPO (World Intellectual Property Organization), ITU (International Telecommunication Union), etc., are places where international law and policy are developed, and do not allow for such learning because negotiations are always very acrimonious. Since IGF is only meant for learning, it does not directly address the global policy vacuum that exists for cyber crime, data protection and privacy,” said Sunil Abraham, executive director of Bangalore-based Centre for Internet and Society, who will be participating in the Bali event.

“Indian government, private sector, civil society, technical and academic community can become more competent and effective through such a dialogue in other multilateral and multi-stakeholder fora where international Internet standards, policies and laws are formulated. It also helps the stakeholders contribute to the development of internationally interoperable domestic policy,” he added.

In 2006, the UN secretary general established a small secretariat in Geneva to assist him in the convening of IGF. The first meeting was convened in October-November 2006 in Athens. In December 2010, IGF’s mandate was extended for five years.

In its eighth edition, IGF will have detailed discussions on issues such as free flow of information on the Internet, regulatory approaches to privacy, and protection of interests of individuals and communities in cyberspace, Internet surveillance and legal framework for cyber crime, said the forum in a statement on its website.

During the four-event, for instance, one of the workshops “will explore what core principles and strategies are needed to achieve a balanced and fair approach to data protection that is effective internationally and regionally”, according to IGF.

Some of the prominent speakers in the event include Jari Arkko, chairman, Internet Engineering Task Force, Finland; Virat Bhatia, president, South Asia, AT&T Inc.; Chris Painter, coordinator for cyber issues, US department of state; Karen Mulberry, policy adviser, Internet Society; and Matthew Shears, director of Internet policy and human rights, Center for Democracy and Technology.

According to industry estimates, over 2.5 billion Internet users interact in shared cross-border online spaces where they can post content potentially accessible worldwide.

“No clear frameworks exist yet to handle the tensions between these competing normative orders or values and enable peaceful cohabitation in cross-border cyberspace. This challenge constitutes a rare issue of common concern for all stakeholder groups,” said IGF on its website.

According to a UN estimate, nearly 40% of the world’s population will be online by the end of 2013. “The Internet has become an essential tool for the creation of jobs and the delivery of basic public services,” said the UN undersecretary-general for economic and social affairs, Wu Hungbo, in a statement, adding that it is also essential “for improving access to knowledge and education, for empowering women, for enhancing transparency, and for giving marginalized populations a voice in decision-making processes”.

For more details visit https://cis-india.org/news/livemint-moulishree-srivastava-october-22-2013-bali-meet-to-discuss-internet-governance-issues

Indian politicians yet to tap voters online: CIS’s Abraham

praskrishna — 2013-10-23T05:31:34Z

Sunil Abraham talks about the role online media will play in forthcoming elections and the behaviour of online readers of news.

The interview (taken by Venkatesh Upadhyay) was published in Livemint on October 22, 2013.

Sunil Abraham, 40, is executive director of the Centre for Internet and Society, a not-for-profit research organization that works on issues related to freedom of expression and privacy. Abraham was in New Delhi to speak on the impact of media, social media and technology on governance and democracy, organized by the Observer Research Foundation together with the Rosa Luxemburg Stiftung. On the sidelines of the conference, he talked about the role that online media will play in forthcoming elections as well the behaviour of online readers of news.

Edited excerpts from the interview:

How important will digital media be for the forthcoming elections?

I think the Internet in India is very different from, say, the one found in the US. So, our capacity to read from similar experience in their elections is limited. If you take the extensive exposure that the (Barack) Obama campaign had on the online space and the manner in which it supposedly helped the campaign, I don’t see that happening here.

Politicians and political parties very active on social media. You don’t think that will have an effect on elections?

I think the missing part of the equation till now is that there has not been any devising—to my knowledge—of targeting of voters through Facebook or Twitter. Our digital footprint leads to immense big-data opportunities, which I do not see politicians in India being able to exploit. Again, to give an example from the United States, there were certain instances there from where if you were member of a particular community, you could be targeted by political campaigns. Here, I don’t see that happening that easily.


Above: Sunil Abraham on the role of digital media in elections

So our politicians are wasting their time on social media?

Not entirely. In my view, one of the good things that the Internet does is that it has the capacity to democratize public opinion. One must also keep in mind that networks such as the ones available through social media are not homogenous. So nodes such as users who are opinion-makers and journalists are active on these networks, and so politicians can use these methods to reach out to more people.

Does the traditional media still have a role?
Of course. Traditional media is more likely to determine political outcomes in comparison to social media because most of the links that we see in social media are related to content that is created on traditional media. Now, of course, we can be sceptical of the role that traditional media plays in influencing the general mood of the country, but that is a different question.

Is there something peculiar about the manner in which readers interact with newspaper reports online?
I think one can usually see the comments section of some news sites littered with hurtful and hateful comments. So, some readers such as myself basically go through these comments to look at trolling and also sometimes for comic relief. But again, every news organization seems to be dealing with this differently. The Times of India, doesn’t, in my view, regulate its comments section. But one can see, say, in The Hindu, that readers’ comments are regulated and are usually very thoughtful.

Is there any particular reason why certain news readers respond the way they do?

Well, a part of the reason why people consuming news online comment and interact the way they do is that anonymity produces a level of freedom that allows people to be more brutal in their behaviour online.

At the same time, you can also see, in some instances, the chilling effects of surveillance, where people end up censuring their thoughts on issues. Of course, surveillance is not the answer. Societies need to deal with hateful threats on their own terms.

What will it take for politicians and public figures to get their message across, given the idiosyncrasies of the Indian digital media?
I think two components are crucial: trust and authenticity. For example, in the case of Wikipedia, there is an assumed amount of trust that the user has. The trust relationship between public figures who are active online and the public also is a two-way street. Politicians must also trust their common party members to use their social media presence as and when they want to. For example, why don’t they allow each and every member of the political party to man their Twitter handle for a day?

As for authenticity, the human mind can say whether an act by someone online is authentic or not.

Finally, what is your view on the role that larger Internet monopolies such as Facebook and Google are playing across the digital plane?

The Internet has also changed over the past 15 years. It used to be a decentralized network. Everybody was hopeful that it would have democratizing potential and, therefore, techno-utopianism was born. Now, it is increasingly clear that a small proportion of websites have 90% of the traffic and large corporations such as Google and Facebook play a significant role in configuring the attention economy. They are now also beginning to take this role very seriously themselves. In the case of Google, increasingly Google is using its power over the attention economy to play a role in the electoral process in India. They have been holding Google Hangouts and what they have been able to do is bring the public to the politicians.

Other concerns such as Facebook and Twitter through their walled-garden arrangements with telecom companies also play a similar role in configuring the attention economy. One is more innocuous—like the manner in which their algorithms are structured determining who shows up in their feeds.

For more details visit https://cis-india.org/news/livemint-venkatesh-upadhyay-october-22-2013-indian-politicians-yet-to-tap-voters-online

Open Letter to Members of the European Parliament of the Civil Liberties, Justice and Home Affairs Committee

elonnai — 2013-10-23T05:00:02Z

An open letter was sent to the Members of the European Parliament of the Civil Liberties, Justice and Home Affairs Committee on the proposed EU Regulation. The letter was apart of an initiative that Privacy International and a number of other NGO's are undertaking.

Dear Members of the European Parliament of the Civil Liberties, Justice and Home Affairs Committee,

On behalf of The Centre for Internet and Society, Bangalore, India, we are writing to express our support of the European Commission’s proposed General Data Protection Regulation (COM (2012) 11).

The legal framework established under the 1995 Data Protection Directive (95/46/EC) in Europe has positively influenced many existing privacy regimes worldwide, serving as a model legal framework in jurisdictions that are in the process of developing privacy regimes, including India. The positive impact of the Data Protection Directive shows the potential of the Regulation to become a global model for the protection of personal data. The Regulation seeks to address new scenarios that have arisen in the context of rapidly changing technologies and practices, increasing its potential for positively influencing privacy rights for individuals globally.

India is currently in the process of considering the enactment of privacy legislation, in part with the aim of ensuring adequate safeguards to enable and enhance information flows into India from countries around the world, including Europe. At the same time, India is seeking Data Secure Status from the EU, on the basis of its current regime.

It is clear that the EU framework for data protection has a major influence on the current and emerging privacy regime in India. India is only one country of many that are in the beginning stages of developing a comprehensive privacy regime. Thus, we ask that you keep in mind how the Regulation will impact the rights of individual in countries outside of Europe, particularly in countries that are in the process of developing privacy regimes.

We ask that you take into consideration the four following points that we believe need to be addressed in the Regulation to help ensure adequate protection of the rights of individuals in the European Union and around the world.

Strengthen the principle of purpose limitation: The Regulation should incorporate a strong purpose limitation principle that strictly limits present and future uses of personal data to the purposes for which it was originally collected. Currently, Article 6(4) allows for the further processing of data when the processing is “not compatible with the one for which the personal data have been collected”. Though the provision establishes legal requirements, one of which must be before information can be used for a further purpose, this is has proven insufficient in the existing Directive. The current provision in the Regulation dilutes the principle of purpose limitation as well as weakening an individual’s ability to make informed decisions about their personal data.
Define principles for interpretation of broad terms: The Regulation should create principles for interpreting broad terms such as “legitimate interest” and “public interest”. These vague terms are used throughout the Regulation, and create the potential for loopholes or abuse. Because these terms can be interpreted in many different ways, it is important to create a set of principles to guide their interpretation by data protection authorities and courts to avoid inconsistent application and enforcement of the Regulation.
Clarify the scope of the Regulation: The Regulation should clearly describe the jurisdictional scope and reach of its provisions. Currently Article 3(1) states that the Regulation will apply to the processing of data “in the context of the activities of an establishment of a controller or a processor in the Union”. The flow of information on the online environment coupled with trends such as cloud computing, outsourcing, and cross border business creates a scenario where defining what constitutes “context of the activities of an establishment”, is difficult and could lead to situations where personal data is not protected, as the collection, use, or storage of it does not necessarily fall within the “context of the activities”.
Address access by foreign alliance bodies: In light of growing demands by law enforcement for access, use, and transfer of personal information for investigative purposes across jurisdictions– the Regulation should define the circumstances in which personal data protected by its provisions can be accessed and used by foreign intelligence bodies, and the procedure by which to do so. The Regulation should address challenges such as access by foreign intelligence bodies to data stored on the cloud and data that has passed through/is stored on foreign networks/servers.

For more details visit https://cis-india.org/internet-governance/blog/open-letter-members-european-parliament-civil-liberties-justice-home-affairs-committee