We are anonymous, we are legion

Packets, net neutrality and gaming public policy outcomes

Admin — 2019-08-28T15:15:37Z

Gurshabad Grover attended Prof. Vishal Misra's lecture on net neutrality at Has Geek in Bangalore on August 15, 2019.

For more details visit https://cis-india.org/internet-governance/news/packets-net-neutrality-and-gaming-public-policy-outcomes

Government plans tighter rules for social media brands like Facebook, TikTok, ShareChat

Sunny Sen — 2019-08-28T15:11:38Z

The government is planning to impose higher levels of accountability on social media platforms as it grapples with the problem of bringing about order in a fast-growing industry where regulations are still nebulous.

The blog post by Sunny Sen was published by CNBC TV 18 on August 28, 2019. Sunil Abraham was quoted.

One important measure it is considering is to tell social media brands such as TikTok, Facebook and ShareChat that they will be legally liable for content that they have had a hand in either creating or curating.

Which means that even if there is the slightest fingerprint of a social media company on a piece of content, platforms cannot claim to be mere intermediaries and disclaim responsibility for consequences.

“Social media companies can’t bring out original content or they should take responsibility for them,” said a senior government source, explaining the centre’s thinking on the issue.

The explosion increase in user-generated content, especially short videos, has become a regulation headache for the authorities. When user-generated social media content crosses the bounds of decency, spreads hate or propagates fake news, intermediary status also confers legal immunity because the platforms can claim they do not know what the user is putting up unless an individual or software raises a red flag.

While in the case of traditional media such as newspapers and television there is editorial control over what is printed or goes on air, social media is still a free-for-all world. Social media companies have so far argued that they are only intermediaries, and users generate content over which they have no control. But in practice, it is not all that clear-cut.

“Safe harbour is for non-curated content,” said Subho Ray, President of Internet and Mobile Association of India (IAMAI). “Safe harbour is not applicable to platform, but to the piece of content. If the content is curated by a company they can’t claim safe harbour because if you are curating it or have exclusive rights over it, you have seen it.”

The government is also considering to stop intermediaries from having exclusive user-generated content on the platform.

“Discussions are on, but there is no decision on that yet,” said another source.

Sunil Abraham, Executive Director of Bangalore-based research organisation, Centre for Internet and Society, said, “An intermediary is providing a two-sided market. If they participate in that market there could be competition harms.”

For context, TikTok owned by Chinese internet conglomerate ByteDance sent a notice to ShareChat to take down content for which the former had signed exclusive rights. ShareChat took it off, but also sent a letter to Ajay Sawhney, Secretary of Ministry of Electronics and Information Technology (Meity), on August 23, copy of which is with Moneycontrol, asking for clarity on laws governing intermediaries.

“Instead of acting as intermediaries (that are protected by safe harbour liability exemptions), such exclusivity deals result in these platforms being considered broadcasters or streaming services (and therefore directly liable for the nature of the content distributed by them),” Berges Y. Malu, Head of Public Policy and Policy Communications at Mohalla Technology Pvt. Ltd. (owners of ShareChat) wrote in the letter.

TikTok engages with users who can promote the platform and teach other users on how use it. It also encourages and incentivises content creation by some of these users, but does not exercise any editorial control over content creation. “TikTok may enter into a mutual contractual agreement with some creators, where TikTok may enjoy certain exclusivity rights over the content of these creators,” said a TikTok spokesperson commenting of ShareChat sending a letter to the government. “In this regard, TikTok has undertaken legal action as part of its commitment to protect its users from copyright infringement.”

But, there is a catch there. “They can claim all rights. Because the user had granted such a liberal license. But the user as the copyright holder can license it again and again to multiple parties because these licenses are non-exclusive,” said Abraham.

For more details visit https://cis-india.org/internet-governance/news/cnbc-tv-18-august-28-2019-government-plans-tighter-rules-for-social-media-brands-like-facebook-tiktok-sharechat

Linking Aadhaar with social media or ending encryption is counterproductive

sunil — 2019-08-28T01:39:47Z

Should Aadhaar be used as KYC for social media accounts? We have recently seen a debate on this question with even the courts hearing arguments in favour and against such a move.

The article was published in Prime Time on August 26, 2019.

The case began in Madras High Court and later Facebook moved the SC seeking transfer of the petition to the Apex court. The original petition was filed in July, 2018 and sought linking of Aadhaar numbers with user accounts to further traceability of messages.

Before we try and answer this question, we need to first understand the differences between the different types of data on social media and messaging platforms. If a crime happens on an end to end cryptographically secure channel like WhatsApp the police may request the following from the provider to help solve the case:

Identity data: Phone numbers of the accused. Names and addresses of the accused.
Metadata: Sender, receiver(s), time, size of message, flag identifying a forwarded messages, delivery status, read status, etc.
Payload Data: Actual content of the text and multimedia messages.

Different countries have taken different approaches to solving different layers of the surveillance problem. Let us start with identity data. Some like India require KYC for sale of SIM cards while others like the UK allow anonymous purchases. Corporations also have policies when it comes to anonymous speech on their platforms – Facebook for instance enforces a soft real ID policy while Twitter does not crack down on anonymous speech. The trouble with KYC the old fashioned way is that it exposes citizens to further risk. Every possessor of your identity documents is a potential attack surface. Indian regulation should not result in Indian identity documents being available in the millions to foreign corporations. Technical innovations are possible, like tokenisation, Aadhaar paperless local e-KYC or Aadhaar offline QR code along with one time passwords. These privacy protective alternatives must be mandatory for all and the Aadhaar numbers must be deleted from previously seeded databases. Countries that don’t require KYC have an alternative approach to security and law enforcement. They know that if someone like me commits a crime, it would be easy to catch me because I have been using the same telecom provider for the last fifteen years. This is true of long term customers regardless if they are pre-paid or post-paid. The security risk lies in the new numbers without this history that confirms identity. These countries use targeted big data analytics to determine risk and direct surveillance operations to target new SIM cards. My current understanding is that when it comes to basic user data – all the internet giants in India comply with what they consider as legitimate law enforcement requests. Some proprietary and free and open source [FOSS] alternatives to services offered by the giants don’t provide such direct cooperation in India.

When it comes to payload data – it is almost impossible (meaning you will need supercomputers) to access the data unless the service/software provider breaks end-to-end cryptography. It is unwise, like some policy-makers are proposing, to prohibit end-to-end cryptography or mandate back doors because our national sovereignty and our capacity for technological self-determination depends on strong cryptography. A targeted ban or prohibition against proprietary providers might have a counterproductive consequence with users migrating to FOSS alternatives like Signal which won’t even give the police identity data. As a supporter of the free software movement, I would see this as a positive development but as a citizen I am aware that the fight against crime and terror will become harder. So government must pursue other strategies to getting payload data such as a comprehensive government hacking programme.

Meta-data is critical when it comes to separating the guilty from the innocent and apportioning blame during an investigation. For example, who was the originator of a message? Who got it and read it last? WhatsApp claims that it has implemented the Signal protocol faithfully meaning that they hold no meta-data when it comes to the messages and calls. Currently there is no regulation which mandates data retention for over the top providers but such requirements do exist for telecom providers. Just like access to meta-data provides some visibility into illegal activities it also provides visibility into legal activities. Therefore those using end-to-end cryptography on platforms with comprehensive meta-data retention policies will have their privacy compromised even though the payload data remains secure. Here is a parallel example to understand why this is important. Early last year, the Internet Engineering Task Force chose a version of TLS 1.3 that revealed less meta-data over one that provided greater visibility into the communications. This hardening of global open standards, through the elimination of availability of meta-data for middle-boxes, makes it harder for foreign governments to intercept Indian military and diplomatic communications via imported telecom infrastructure. Courts and policy makers across the world have to grapple with the following question: Are meta-data retention mandates for the entire population of users a “necessary and proportionate” legal measure to combat crime and terror. For me, it should not be illegal for a provider who voluntarily wishes to retain data, provided it is within legally sanctioned limits but it should not be requirement under law.

There are technical solutions that are yet to be properly discussed and developed as an alternative to blanket meta-data retention measures. For example, Dr. V Kamakoti has made a traceability proposal at the Madras High Court. This proposal has been critiqued by Anand Venkatanarayanan as being violative in spirit of the principles of end-to-end cryptography. Other technical solutions are required for those seeking justice and for those who wish to serve as informers for terror plots. I have proposed client side metadata retention. If a person who has been subjected to financial fraud wishes to provide all the evidence from their client, it should be possible for them to create a digital signed archive of messages for the police. This could be signed by the sender, the provider and also the receiver so that technical non-repudiation raises the evidentiary quality of the digital evidence. However, there may be other legal requirements such as the provision of notice to the sender so that they know that client side data retention has been turned on.

The need of the hour is sustained research and development of privacy protecting surveillance mechanisms. These solutions need to be debated thoroughly amongst mathematicians, cryptographers, scientists, technologists, lawyers, social scientists and designers so that solutions with the least negative impact can be rolled out either voluntarily by providers or as a result of regulation.

For more details visit https://cis-india.org/internet-governance/blog/prime-time-august-26-2019-sunil-abraham-linking-aadhaar-with-social-media-or-ending-encryption-is-counterproductive

A judicial overreach into matters of regulation

gurshabad — 2019-08-28T01:28:52Z

A PIL on Aadhaar sheds light on some problematic trends

The article by Gurshabad Grover was published in the Hindu on August 27, 2019.

The Madras High Court has been hearing a PIL petition since 2018 that initially asked the court to declare the linking of Aadhaar with a government identity proof as mandatory for registering email and social media accounts. The petitioners, victims of online bullying, went to the court because they found that law enforcement agencies were inefficient at investigating cybercrimes, especially when it came to gathering information about pseudonymous accounts on major online platforms. This case brings out some of the most odious trends in policymaking in India.

The first issue is how the courts, as Anuj Bhuwania has argued in the book Courting the People, have continually expanded the scope of issues considered in PILs. In this case, it is absolutely clear that the court is not pondering about any question of law. In what could be considered as abrogation of the separation of powers provision in the Constitution, the Madras High Court started to deliberate on a policy question with a wide-ranging impact: Should Aadhaar be linked with social media accounts?

After ruling out this possibility, it went on to consider a question that is even further out of its purview: Should platforms like WhatsApp that provide encrypted services allow forms of “traceability” to enable finding the originator of content? In essence, the court is now trying to regulate one particular platform on a very specific technical question, ignoring legal frameworks entirely. It is worrying that the judiciary is finding itself increasingly at ease with deliberations on policy and regulatory measures, and its recent actions remind us that the powers of the court also deserve critical questioning.

Government’s support

Second, not only are governments failing to assert their own powers of regulation in response to the courts’ actions, they are on the contrary encouraging such PILs. The Attorney General, K.K. Venugopal, who is representing the State of Tamil Nadu in the case, could have argued for the case’s dismissal by referring to the fact that the Ministry of Electronics and Information Technology has already published draft regulations that aim to introduce “traceability” and to increase obligations on social media platforms. Instead, he has largely urged the court to pass regulatory orders.

Third, ‘Aadhaar linking’ is becoming increasingly a refrain whenever any matter even loosely related to identification or investigation of crime is brought up. While the Madras High Court has ruled out such linking for social media platforms, other High Courts are still hearing petitions to formulate such rules. The processes that law enforcement agencies use to get information from platforms based in foreign jurisdictions rely on international agreements. Linking Aadhaar with social media accounts will have no bearing on these processes. Hence, the proposed ‘solution’ misses the problem entirely, and comes with its own threats of infringing privacy.

Problems of investigation

That said, investigating cybercrime is a serious problem for law enforcement agencies. However, the proceedings before the court indicate that the cause of the issues have not been correctly identified. While legal provisions that allow agencies to seek information from online platforms already exist in the Code of Criminal Procedure and the Information Technology Act, getting this information from platforms based in foreign jurisdictions can be a long and cumbersome process. For instance, the hurdles posed by the mutual legal assistance treaty between India and the U.S. effectively mean that it might take months to receive a response to information requests sent to U.S.-based platforms, if a response is received at all.

To make cybercrime investigation easier, the Indian government has various options. India should push for fairer executive agreements possible under instruments like the United States’ CLOUD Act, for which we need to first bring our surveillance laws in line with international human rights standards through reforms such as judicial oversight. India could use the threat of data localisation as a leverage to negotiate bilateral agreements with other countries to ensure that agencies have recourse to quicker procedures. As a first step, however, Indian courts must wash their hands of such questions. For its part, the Centre must engage in consultative policymaking around these important issues, rather than support ad-hoc regulation through court orders in PILs.

(Disclosure: The CIS is a recipient of research grants from Facebook.)

For more details visit https://cis-india.org/internet-governance/blog/the-hindu-august-27-2019-a-judicial-overreach-into-matters-of-regulation

Linking Aadhaar to Facebook, Twitter: Possible witch-hunt or key to curb crime & fake news?

Taran Deol and Revathi Krishanan — 2019-08-27T00:25:14Z

The Supreme Court has cautioned against linking users’ social media accounts with Aadhaar, saying it will impinge on citizens’ privacy.

The article by Taran Deol and Revathi Krishanan appeared in the Print on August 21, 2019. Gurshabad Grover was quoted.

Madras High Court is not adjudicating on a question of law, but acting as a forum for policy-making

The proceedings in the Aadhaar and social media linkage case in the Madras High Court are very worrying. It is another example of how the courts are continuously expanding the scope of what is permitted as public interest litigation. In this case, the Madras High Court is not adjudicating on a question of law, but acting as a forum for policy-making.

Having said that, cybercrime is a legitimate problem. If law enforcement agencies are unable to investigate crimes, we need to think of other more effective legal instruments.

Unfortunately, even the measures that are being deliberated in the court are not identifying the root cause of these problems — retrieving information from online platforms based outside India. And this could be a long and cumbersome process.

Instead of thinking about how India can sign bilateral agreements with other countries that can make the process for requesting legal information easier, an entirely unrelated solution is being given. It is in line with the worrying trend of the unchecked issues with the Aadhaar programme, which are now being used as a common excuse to refrain from looking at cases where criminal investigation is required. The solution misses the scope of solving the issue at hand entirely, and carries its own massive risks of infringing privacy and violating freedom of expression.

For more details visit https://cis-india.org/internet-governance/news/the-print-august-21-2019-taran-deol-and-revathi-krishnan-linking-aadhaar-to-facebook-twitter

Policies for the Platform Economy

Admin — 2019-08-27T00:19:26Z

Anubha Sinha and Amber Sinha will be panelists in this event being organized by IT for Change at India Habitat Centre in New Delhi on August 30, 2019.

The agenda for the event is here.

For more details visit https://cis-india.org/internet-governance/news/policies-for-the-platform-economy

Impact of Industrial Revolution 4.0 - IT and Automotive Sector in India by the Dialogue and FES

Admin — 2019-08-27T00:13:32Z

On August 21, 2019, Aayush Rathi, attended a report launch event and focus group discussion on the "Impact of Industrial Revolution 4.0 - IT and Automotive Sector in India". Research conducted by the Dialogue in collaboration with the Friedrich-Ebert-Stiftung (FES) were being presented.

At CIS, we have previously produced research on the future of work in these sectors. Aayush attended the event to understand how other researchers are approaching the subject of the future of work in terms of the methodological approach and the questions being asked and policy responses being proposed. In what may be treated as validation of our research design, FES and the Dialogue have addressed similar questions and adopted an empirical+desk based approach to do so as well.

For more details visit https://cis-india.org/internet-governance/news/impact-of-industrial-revolution-4-0-it-and-automotive-sector-in-india-by-the-dialogue-and-fes

Pycon India 2019

Admin — 2019-08-27T00:04:03Z

K. Bhuvana Meenakshi gave a talk at BangPypers organized by Python Software Society in Bangalore on August 25, 2019. She spoke on Let the world experience WebXR!

For more info, click here

For more details visit https://cis-india.org/internet-governance/news/pycon-india-2019

AI is biased, you’ll see if you Google ‘hands’

Rajmohan Sudhakar — 2019-08-26T23:53:38Z

As it is, the world is unfair. The question now is, do we want automated tech to be unfair too? As we build more and more AI-dependent smart digital infrastructure in our cities and beyond, we have pretty much overlooked the emerging character of artificial intelligence that would have a profound bearing on our nature and future.

The article by Rajmohan Sudhakar was published in Deccan Herald on August 25, 2019. Radhika Radhakrishnan was quoted.

Are we happy with algorithms making decisions for us? Naturally, one would expect the algorithm to possess discretion. Herein lies the dilemma. Do you trust an AI algorithm? Though an algorithm can evolve over time drawing on the nature and accuracy of the dataset, it shall nevertheless pick up the prejudices and biases it is exposed to.

“Questions on fairness arise at multiple stages of AI design. For instance, who has access to large datasets? The private sector in India. There may not be data at all on marginalised communities while there can be excessive surveillance data on targeted communities. Historic biases in datasets add up: widely used leading datasets of word embeddings associate women as homemakers and men as computer programmers. Focus on FAT (Fairness, Accountability and Transparency) is crucial,” says Radhika Radhakrishnan, programme officer at The Centrefor Internet and Society.

For example, a whopping 90% of the Wikipedia editors are men.

As AI is expected to add 15 trillion US dollars by 2030 to the global economy, at present, the data it relies upon comes from a few nations (45% from the US) while a major chunk of users are elsewhere. As it is vital to any social mechanism, diversity will be key if we are to reap the true benefits of AI. Or else, a non-diverse data set or a programmer crafting an algorithm could chart the most unpleasant course.

“Research recommends the inclusion of social scientists in AI design and ensuring they have decision-making power. The AI Now Institute, for instance. However, there is a dearth of social scientists working on AI. In India, we ignore the social impact of AI in favour of the purely technical solutions of computer scientists. Lack of women, gender-queers, and individuals from under-represented communities reflects poor diversity within the AI industry,” Radhakrishnan points out.

The G20 adopted AI Principles in June, which stressed “AI actors should respect the rule of law,human rights and democratic values, throughout the AI system life-cycle. These include freedom, dignity and autonomy, privacy and data protection, non-discrimination and equality,diversity, fairness, social justice, and internationally recognised labour rights.”

The UK recently set up the Centre for Data Ethics and Innovation. Canada and France are spearheading the International Panel on Artificial Intelligence (IPAI) on the sidelines of the G7summit. Meanwhile, India and France agreed on a slew of measures to advance cooperation ondigital tech. Of course, the EU’s General Data Protection Regulation (GDPR) is a promising start.

All of that is well and welcome. But what such efforts and international bodies could achieve in reality is to be seen as questions loom large over private corporations that own tech exercising clout, henceforth leaving AI vulnerable to manipulation.

“To achieve this, panel members will need to be protected from direct or indirect lobbying by companies, pressure groups and governments — especially by those who regard ethics as a brake on innovation. That also means that panel members will need to be chosen for their expertise, not for which organisation they represent,” reads an August 21 editorial in Nature journal on IPAI.

Whatever one may do to de-bias AI, much damage is done already. Try a google search for images of hands. How many black/brown hands do you see? There you go.

“Whose needs are being reflected in AI — those of the poor or those of the big tech looking to‘dump’ their products in an easily exploitable market? Instead of asking, what is the AI solution,we should be wondering, is an AI-based solution necessary in this case?” adds Radhakrishnan.

Where are the big tech located? In the United States. When a white male sitting in that country crafts an algorithm based on a bought dataset, for the benefit of an aboriginal community in the Amazon, something’s amiss.

“Engineers and data scientists who design algorithms are often far removed from the socioeconomic contexts of the people they are designing the tools for. So, they reproduce ideologies that are damaging. They end up reinforcing prejudices. Direct engagement is rare. Engineers should actively and carefully challenge their biases and assumptions by engaging meaningfully with communities to understand their histories and needs,” explains Radhakrishnan.

The march of AI cannot be stopped as more and more datasets get integrated. An ethical approach to computer science and engineering should begin from our institutions of excellence.

“Computer science and engineering disciplines at the undergraduate level teach AI as a purelytechnical subject, not as an interdisciplinary subject. Engineers should be trained in the socialimplications of the systems they design. Technology inevitably re􀁻ects its creators, consciousor not. Therefore, deeper attention to the social contexts of AI and the potential impact of suchsystems when applied to human populations should be incorporated to university curricula,”notes Radhakrishnan.

For more details visit https://cis-india.org/internet-governance/news/deccan-herald-rajmohan-sudhakar-august-25-2019-ai-is-biased-you-see-if-you-google-hands

Linking Aadhaar to Facebook, WhatsApp won't curb fake news, but may undermine its legislation: Experts

Swathi Moorthy — 2019-08-22T01:59:34Z

The Supreme Court’s move to look into the petition regarding the linking of social media accounts with Aadhaar has opened a pandora’s box.

The blog post by Swathi Moorthy was published by Moneycontrol on August 20, 2019. Pranesh Prakash was quoted.

The Supreme Court’s move to look into the petition regarding the linking of social media accounts with Aadhaar has opened a pandora’s box.

Linkage with Aadhaar will not help in curbing fake news and may also end up weakening the Aadhaar legislation, experts said.

The petition initially filed in Tamil Nadu argues that linking Aadhaar with social media accounts will help keep in check fake messages, pornographic and anti-national and terror messages in check. Similar petitions were filed in Mumbai and Madhya Pradesh.

Facebook and WhatsApp have argued against the proposal, stating that such a move will violate user privacy and asked for all the cases to be transferred to the Supreme Court.

Hearing the pleas, the Supreme Court said that it will examine the case and has asked both the parties to submit responses by September 13.

Weakens Aadhaar legislation

Pavan Duggal, Supreme Court advocate specialised in cyberlaw, told Moneycontrol, “Linking Aadhaar and social media accounts is a violation of Right to Privacy, which is a fundamental right and raise questions about India’s sovereignty and integrity.”

“Given that we do not have a data privacy and protection law as yet, it will also weaken Aadhaar legislation,” Duggal added.

Facebook or any social media for that matter store their data overseas since data localisation is not mandatory as of yet. The draft data protection and privacy bill, which mandates storage of local data within the country, is yet to be placed before the Parliament.

At this juncture, linking Aadhaar with social media accounts would mean that Aadhaar data will be stored in data centres in other parts of the world, compromising integrity of Aadhaar, Duggal pointed out.

Fake news

Pranesh Prakash from Centre for Internet & Society, asked, “How does linking Aadhaar and social media accounts curb fake news?” He explained based on the SC's previous judgement, Aadhaar's scope is restricted to the government's benefits and subsidies.

Duggal said, “There is no way it is going to help curb fake new.” If anything people who are starting fake news will be more careful so as not go get caught, he added.

Prakash pointed out that, all social media accounts can be traced either using their phone numbers and email linked to their account or IP addresses.

As such, there is no need to link Aadhaar specifically for this purpose since police are free to use these tools to trace offenders, he added. The exception is that when users are sophisticated and have knowledge of advanced tools to hide their identity, which is usually not the case for most purveyors of fake news.

What can be done?

Duggal said that there are so many other ways of dealing with fake news. For one, this could be opened up for public discussion.

“We could have a dedicated legal framework like in Malaysia for curbing fake news that is much more efficient than linking Aadhaar," he added.

According to Duggal, the platforms should be more proactive rather than being a mere spectator and take stringent steps to fight fake news.

The government can also amend Section 79 of the Information Technology Act that protects intermediaries from being liable for any third party information data or communication link hosted on their site. Changing this will also help combat fake news, he added.

For more details visit https://cis-india.org/internet-governance/news/money-control-swathi-moorthy-august-20-2019-linking-aadhaar-to-facebook-whatsapp-wont-curb-fake-news-impinge-on-privacy-experts

US pressure threatens to weaken data - localisation mandate in India's landmark data-protection bill

Sandhya Sharma — 2019-08-22T01:41:21Z

Sources say the bill may have to concede vital ground to technology companies.

The article by Sandhya Sharma was published by ET Prime on August 19, 2019. Arindrajit Basu was quoted.

Indian law-enforcement agencies have repeatedly expressed their unhappiness with America’s reticence on the sharing of critical data — whether it was around the 26/11 Mumbai attacks or procuring electronic evidence under the Mutual Legal Assistance Treaty (MLAT) from technology companies.

Top cybersecurity sources in the government tell ET prime that India’s own Personal Data Protection (PDP) Bill 2019 is in response to this. Cabinet nod to the bill is expected anytime, and it is likely to be tabled in the next session of Parliament. However, thanks to diplomatic pulls and pressures, a vital provision of the bill could end up markedly diluted. Sources in the Indian government say the US has conveyed it does not want the bill at all.

“We expect it will be a better mechanism than MLAT” for procuring data from technology companies, says a person aware of the development, while adding that the thorny question of data localisation is now a very small part of the bill. Across key bilateral engagements — US Secretary of State Mike Pompeo’s June visit to India, G20 meetings between Prime Minister Narendra Modi and President Donald Trump, and a US trade representative delegation visiting India for talks — American unease with the growing “protectionism” in Indian policy has remained a key talking point.

"Forum members oppose data localisation policies, and we look forward to sharing our concerns when the data protection bill gets introduced in Parliament,” says Susan Ritchie, vice-president of technology, media, and telecommunications at lobby group U.S. India Strategic Partnership Forum (USISPF).

“An environment where regulatory coherence is a governmental priority provides industry with greater predictability and stability resulting in increased investment." A toothless treaty? According to policy experts, MLATs have been the most widely used method for cross-border data sharing. India has signed MLATs with 39 countries, including the US. These treaties give India access to data stored on the cloud and call for data stored by multinational service providers within the jurisdiction of the partner country. However, MLATs are time consuming and have failed in their basic function in the past, sources say, and hence the government was keen to hold the data of Indians back in India, including data pertaining to e-commerce transactions, banking, healthcare, etc.

According to the Justice Srikrishna Committee report, eight of the 10 most accessed websites by Indians are owned by US entities. If data is exclusively processed in India, it will potentially cut off foreign surveillance, the report also notes, while highlighting a three-pronged approach to Indian data to reduce dependence on MLATs.

Talking exclusively to ET Prime, Justice BN Srikrishna says, “MLAT is a long-drawn process and hence the process goes through several diplomatic and judicial channels. It takes anywhere between 18 months to two years to get the information from the foreign technology companies for any investigation [and] much more time for extracting information on taxation and other financial matters…. Once the data of Indian citizens is in India, it will be much easier for law enforcement agencies to take the data for investigation purposes. In the past, the technology companies have dilly-dallied on the information requests of Indian law enforcement agencies.” To be sure, the report does not claim "perfect compliance" through data localisation and it clarifies that for data owned by companies like Google a "conflict of law" might arise if the country of registration — in this case the US — also asserts jurisdiction.

According to the report, between January and June 2017, Google received 3,843 user data-disclosure requests by Indian governmental agencies. Google refused to provide data in 46% of the cases. Now with the PDP Bill, Indian officials can easily get their hands on the data of Indian citizens not residing in India, says Justice Srikrishna. US resistance US tech-industry insiders tell ET Prime on condition of anonymity that no law-enforcement agency should be allowed 100% unfettered access to information. They claim MLATs have been successful in most cases of intelligence sharing around terrorism and national security.

“National security” is a very wide concept in India, unlike in the US where it generally refers to international activities, they say. Jacob Gullish, senior director for digital economy at the lobby group US India Business Council (USIBC), says the term MLAT is often used incorrectly as a catch-all. MLATs are designed for a very narrow and a specific purpose: where the transmitted information is admissible in the foreign country’s judicial system, he says. “In these cases, information has to be handled carefully to ensure the request complies with domestic laws and the transmission is certified for authenticity and a chain of custody, as well as packaged to allow its use as evidence in a foreign court. This process takes time, and the business community supports MLAT reform.

“Just like in the physical world, due process rights for the citizens of the world’s largest and the world’s oldest democracies must be respected in the digital domain. Companies also need legal certainty when operating between different jurisdictions. The bottom line is that law enforcement agencies (LEAs) on both sides need to develop clear processes and procedures, as well as trusted relationships, which will facilitate information exchange during an investigation.” A Google spokesperson echoes Gullish. “On urging from us and other Internet companies, MLAT processes have improved and in most cases responses are provided in a week or two,” the spokesperson says.

“In addition, we are also advocating for MLAT reform, including supporting calls to invest over [USD20 million] to address insufficient staffing, and helping investigators around the world better understand the MLAT process, to help expedite requests.” Other industry insiders claim that US companies field a high volume of requests and respond quickly for the most part, and that ultimately all of this goes back to trust. In December 2011, a Delhi court had issued summons to 21 companies, including Facebook, Microsoft, Google, Yahoo, and YouTube, to face trial for allegedly hosting objectionable content promoting hatred or communal disharmony.

The then IT Minister Kapil Sibal had asked Google and Facebook to ensure prompt removal of offensive material, complaining that the companies had not cooperated in the past. Concerns with data-localisation norms in the present state 1. Diplomatic and political: Data-localisation mandates could impact India’s trade relationships with partners like the US. 2. Security risks (“Regulatory stretching of the attack surface”): Storing data in multiple physical centres increases the exposure to exploitation by malicious actors. 3. Economic impact: Restrictions on cross-border data flow may harm economic growth by increasing compliance costs and entry barriers for foreign service providers, thereby reducing investment or forcing businesses to pass on these costs to the consumers. The major cost pertains to setting up data centres in India.

Further, for startups looking to attain global stature, reciprocal restrictions slapped by other countries can be a serious hurdle. “Data localisation would be most effective if it is — (a) done after India updates its privacy and security standards by passing the Personal Data Protection Bill 2019; (b) done sectorally, after considering how critical it is to store the data in India; (c) done conditionally in (i) the country where data is transferred having equivalent privacy and security safeguards, both de jure and de facto and (ii) the presence of an executive data sharing agreement,” says Arindrajit Basu, senior policy officer at New Delhi-based think tank Centre for Internet and Society. This is essentially what the international community describes as “free flow of data with trust” — the G20 mandate which India recently rejected. Can the US CLOUD Act solve for the lack of information access? A section of policy experts argues that the localisation mandate proposed in India’s new bill does not solve an important problem: What happens when law-enforcement agencies need access to data relating to a foreigner stored in a server located in another jurisdiction by a company incorporated in the US? Will the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) passed in the US last year help?

The US has recently amended the CLOUD Act after a dispute between Microsoft and the US government. The law now ensures two things: American law-enforcement agencies will get access to data held by US cloud service providers (CSPs) regardless of jurisdiction, and allow “qualified foreign governments” to access data stored by US CSPs. This has given rise to a view that the CLOUD Act could be the silver bullet countries like India need to push US tech companies to share data in a timely fashion. Basu of the Centre for Internet and Society says, “India should use the threat of data localisation to negotiate an executive arrangement under the CLOUD Act. India would fare better if it were to use the language of international law to articulate its position in the MLAT reform process, or to propel itself to a better position under the CLOUD Act (which requires countries to demonstrate a commitment to a free and open Internet) or potentially pursue negotiations for a multilateral data sharing treaty.” Siddharth Jain, assistant commissioner in Delhi Police and an expert in investigating cyber-crime issues, says Indian technology firms do provide adequate and timely information about suspicious transactions; however, US firms are lax in sharing information.

Telangana IPS officer Rema Rajeshwari concurs that it’s a problem for law-enforcement agencies to cull out information from some US technology companies. Data-protection bill already diluted? ET Prime has learned that the net result of the pulls and pressures exerted by US commercial and diplomatic interests is that data localisation now remains just a small part of India’s data-protection bill. The Ministry of External Affairs maintains that the US-India relationship is “extremely important”. After President Trump’s controversial comments on offering mediation on the Kashmir issue, ministry spokesperson Raveesh Kumar said, “We are very strong strategic partners and we have brought in deep convergences across a range of issues.

We have excellent trade and investment linkages and are moving toward high defence and technology tie-up.” It’s not just political posturing by India to maintain the tricky relationship at a time when the Trump administration is coming up with reports one after the other criticising the country’s proposed data-protection policies. The PDP Bill was listed to be tabled in Parliament in the first session of the Modi 2.0 government but is yet to see the light of the day. If India tables the draft bill without making concessions that ease the demands on US technology companies, it will severely harm the India-US technology relationship, according to some US policy lobbyists. However, government sources tell ET Prime that the bill now has “data localisation as a very small part”, meaning that it is already likely diluted due to US pressure tactics. Sources say the non-critical data of an individual like height, weight, bank-account number, etc., will not need to be mandatorily stored in India. However, biometric data will have to be stored locally.

Top policymakers who were consulted for the Justice Srikrishna Committee report say should the bill be diluted under duress, it will be a sorry statement for India’s data-protection regime. Meanwhile, with nationalistic sentiments in full flourish during the new Modi government’s first Parliament session, the Ministry of Electronics and Information Technology issued a note that “the bill being prepared will address India’s sovereign data concerns and provide a framework to boost innovation in India while complying with the directives contained in the judgment of [the Honourable Supreme Court]”.

India and EU: a potential template In contrast to the Indo-US friction, India’s understanding with the European Union (EU) on the issue of data protection offers a potential template. India is looking at dialing EU to seek ‘adequacy’ status with the General Data Protection Regulation (GDPR) once it passes the PDP Bill. Tomasz Kozlowski, EU Ambassador to India, said at the recent ET 5G Congress, “Data protection is an important element of EU-India cooperation.

With such a law in place, India will be joining the global trend of global convergence toward a modern data-protection law, and take a leadership role in the region and globally, at a time when the need to address challenges to data privacy and security requires a common approach.” Kozlowski added that the “adoption of strong data protection law will also pave way for EU-India discussions and further facilitate data flows.” Top cybersecurity sources in the Indian government point out that the US has agreed to GDPR, which is far more stringent than the Indian Bill. If so, why make noise about India’s data-localisation demands?

For more details visit https://cis-india.org/internet-governance/news/et-prime-sandhya-sharma-august-19-2019-us-pressure-threatens-to-weaken-data-localisation-mandate-in-indias-landmark-data-protection-bill

Perché l'India ha tagliato internet al Kashmir

Raffaele Angius — 2019-08-22T01:31:46Z

Lo stato di isolamento imposto a più di 12,5 milioni di persone rischia di causare importanti disagi al Paese, nel quale è diventato praticamente impossibile comunicare con l’esterno. Problemi per ospedali e farmacie

The article by Raffaele Angius was published in WIRED.IT on August 19, 2019. Gurshabad Grover was quoted.

Dopo dodici giorni di blocco totale delle telecomunicazioni, l’India ha concesso il parziale ripristino delle linee telefoniche del Kashmir. Il 5 agosto il governo centrale di Nuova Delhi aveva sospeso lo statuto speciale di cui gode la regione, schierando decine di migliaia di soldati, arrestando diversi rappresentanti politici e sospendendone le linee telefoniche e iltraffico internet.

La decisione, presa unilateralmente dal primo ministro indiano Narendra Modi, mira a rimuovere i privilegi sanciti dalla costituzione del Kashmir, che settant’anni fa crearono le basi per l’unione dei due Paesi. Principale obiettivo di Nuova Delhi è l’abrogazione della legge che vieta l’acquisto di proprietà immobiliari ai cittadini non kashmiri, che secondo Modi impedirebbe la piena integrazione dell’area – l’unica a maggioranza musulmana – con l’India.

Blackout nelle comunicazioni

Ma lo stato di isolamento imposto a più di 12,5 milioni di persone rischia di causare importanti disagi al Paese confinante con il Pakistan, nel quale è diventato praticamente impossibile comunicare con l’esterno e in cui le infrastrutture critiche che fanno affidamento a Internet vivono profondi disagi. Come nel caso di ospedali e farmacie, che utilizzano la rete per ordinare nuovi medicinali.

“Le reti per le telecomunicazioni sono infrastrutture critiche e stavolta [il loro blocco] ha avuto un impatto decisivo sul funzionamento del Kashmir”, ha spiegato a Wired Gurshabad Grover, funzionario del Center for Internet and Society di Bangalore: “Alcuni report indicano che le linee di comunicazione non sono accessibili neanche per ospedali e cliniche: il risultato è che il personale si sta arrangiando per soddisfare le esigenze sanitarie”.

“Il governo indiano ha un record di sospensione delle telecomunicazioni e dei servizi internet nel Kashmir: secondo i dati rilevati dallo strumento di monitoraggio della rete del Software Freedom Law Center, questa è la sessantesima volta che succede solamente quest’anno”, ha spiegato Grover via mail.

Ma stavolta l’operazione di isolamento dell’area è stata più incisiva, con un blocco totale “di internet, reti mobili, linee terrestri, posta e televisione via cavo”, giustificate con l’esigenza di contenere la diffusione di informazioni false e gli episodi di violenza, come hanno spiegato gli stessi rappresentanti del governo. “Ma impedire ai giornalisti di fare il proprio lavoro, al contrario, favorisce la diffusione di notizie false -, ha obiettato Grover -. Inoltre, numerosi studi mostrano come lo spegnimento dei canali di comunicazione renda il coordinamento delle proteste pacifiche molto più difficili, con il rischio di portare a episodi di violenza”.

Dopo che per quasi due settimane anche le forze dell’ordine hanno dovuto utilizzare i telefoni satellitari per comunicare, parte delle linee telefoniche del Kashmir sono state ripristinate. Una ragione potrebbe essere che proprio il blackout informativo ha creato ulteriori allarmismi, avendo di fatto impedito a milioni di persone di comunicare con i propri familiari. “Ora i social network sono pieni di post allarmati provenienti da cittadini kashmiri che vivono in altri posti”, osserva Grover. Ma le contromisure non si sono fatte attendere, con la richiesta a Twitter da parte del governo indiano di rimuovere decine di account che scrivono della crisi, tra cui quelli di giornalisti e attivisti.

La crisi

Apparentemente lontana dal suo epilogo, l’ennesima crisi del Kashmir è approdata sul tavolo del Consiglio di sicurezza delle Nazioni Unite il 16 agosto, per la prima volta dal 1971. In una riunione a porte chiuse, come riporta la Cnn, sono intervenuti anche i diplomatici di Pakistan – il Paese musulmano direttamente confinante con la regione e che da anni sostiene segretamente i gruppi paramilitari dell’area – e Cina, che hanno chiesto all’India di garantire una risoluzione del conflitto. Così come negli ultimi settant’anni, gli emissari di Nuova Delhi hanno replicato che il Kashmir è una questione domestica che non riguarda la diplomazia internazionale. E per assicurarsi che la situazione rimanga tale, sembra che l’unica strategia sia quella di sottoporre a isolamento più di dodici milioni di persone.

For more details visit https://cis-india.org/internet-governance/news/raffaele-angius-august-19-2019-india-kashmir-internet

India Shut Down Kashmir’s Internet Access. Now, ‘We Cannot Do Anything.’

Vindu Goel, Karan Deep Singh and Sameer Yasir — 2019-08-22T01:20:47Z

Masroor Nazir, a pharmacist in Kashmir’s biggest city, Srinagar, has some advice for people in the region: Do not get sick, because he may not have any medicine left to help.

The article by Vindu Goel, Karan Deep Singh and Sameer was published in New York Times on August 14, 2019. Gurshabad Grover was quoted.

“Shutting down the internet has become the first go-to the moment the police think there will be any kind of disturbance,” said Mishi Choudhary, founder of SFLC.in, a legal advocacy group in New Delhi that has tracked the sharp rise in web shutdowns in India since 2012.

In Jammu and Kashmir, a Muslim-majority territory where security forces constantly worry about attacks by separatist militants, the internet has been blocked in at least part of the region 54 times this year, according to SFLC.in’s data. The authorities simply order internet service providers and phone companies to stop providing access to the web or to mobile networks.

But this latest shutdown has been far more sweeping than others, Kashmiris said.

“We used the internet for everything,” said Mr. Nazir, 28, whose pharmacy is near the city’s famed clock tower. He said he normally went online to order new drugs and to fulfill requests from other pharmacies in more rural parts of Kashmir Valley. But now, “we cannot do anything.”

As the Indian government’s shutdown of internet and phone service in the contested region enters its 11th day, Kashmir has become paralyzed.

Shopkeepers said that vital supplies like insulin and baby food, which they typically ordered online, were running out. Cash was scarce, as metal shutters covered the doors and windows of banks and A.T.M.s, which relied on the internet for every transaction. Doctors said they could not communicate with their patients.

Only a few government locations with landlines have been available for the public to make phone calls, with long waits to get a few minutes of access.

The information blockade was an integral part of India’s unilateral decision last week to wipe out the autonomy of Jammu and Kashmir, an area of 12.5 million people that is claimed by both India and Pakistan and has long been a source of tension. That has brought everyday transactions, family communications, online entertainment and the flow of money and information to a halt.

While Prime Minister Narendra Modi has promoted the rapid adoption of the internet, particularly on smartphones, to modernize India and bring it out of poverty, the country is also the world leader in shutting down the internet.

The country has increasingly deployed communications and internet stoppages to suppress potential protests, prevent rumors from spreading on WhatsApp, conduct elections and even stop students from cheating on exams. Last year, India blocked the internet 134 times, compared with 12 shutdowns in Pakistan, the No. 2 country, according to Access Now, a global digital rights group, which said its data understates the number of occurrences.

Umar Qayoom, who used to spend his days running around Srinagar signing up merchants for Paytm, a digital payments service, is now stuck in his house. He said he had not been able to contact his girlfriend since the shutdown began, and his smartphone — his primary source of entertainment, with its endless supply of videos and social media — is an inert hunk of metal.

“I don’t know when to sleep, when to wake up, what to do with my life,” he said during a rare foray outside on Monday evening for Eid al-Adha, the holiest festival in Islam. “There is no life without internet, even in Kashmir.”

Muheet Mehraj, founder and chief executive of Kashmir Box, a start-up that buys traditional handicrafts like pashmina shawls and pottery from local artisans and sells them online, said he could not check incoming orders or communicate with his suppliers. His 25 employees are idle. If the shutdown lingers, they will soon be out of work.

“We’ve seen more than 400 shutdowns,” he said. “This has been the worst of them all.”

No one knows how long the blackout will last. In 2016, the internet was blocked in Kashmir for more than four months. The unpredictable access wreaked havoc with students, businesses and even musicians, who had relied on YouTube, Instagram and other digital services to reach potential audiences.

At a hearing on Tuesday, India’s Supreme Court declined to lift any of the current restrictions, accepting the government’s argument that the shutdown was needed to maintain order and would be “settled soon.” The next day, the police indicated that most of the valley would remain on lockdown, including on Thursday, India’s Independence Day.

“Kashmir has become invisible even to itself,” said Gurshabad Grover, a senior policy officer at the Center for Internet and Society in Bangalore, quoting a recent line in The Indian Express. The center published a report last year on the social and economic toll of internet shutdowns across India.

The United Nations has repeatedly condemned government-ordered internet shutdowns as a violation of human rights.

But that has not deterred India from routinely using the tool. Under India’s laws, authorities at even the local level can easily shut down internet access in the name of ensuring “peace and tranquillity.”

“It helps in any kind of situation which can flare up the sentiments of people and flare up the bulk mobilization of people,” said Rahul Pandey, deputy superintendent of police in Darjeeling in northeastern India, where the internet was blocked for about 100 days in 2017.

Raman Jit Singh Chima, Asia Pacific policy director at Access Now, said that Indian officials have seen few negative consequences from shutdowns, so they keep using them. “It has become standard operating procedure among police,” he said.

But the true costs of such blockades are high. Internet shutdowns from 2012 to 2017 cost India’s economy more than $3 billion, the Indian Council for Research on International Economic Relations estimated last year. And the number of stoppages has spiked since then. The Darjeeling shutdown, one of the longest in the country, occurred after the state government decided it needed to quash a separatist movement that had clashed violently with security forces.

Darjeeling’s fabled tea industry, the lifeblood of the local economy, lost most of a year’s harvest as workers went on strike. Production was hurt the next year, too.

Many corporate tea buyers and traders sought tea elsewhere during the disruption and never came back, said Girish Sarda, director of Nathmulls, a tea exporter in the region.

“We lost many customers,” he said, estimating that the company’s revenue dropped more than 30 percent at the time. “Even when the internet is on, people think that this business is probably shut down.”

The government has argued that one reason for suppressing the internet in Kashmir was to stop the spread of false information.

But in the digital blackout, rumors have continued spreading the old-fashioned way: by word of mouth.

When thousands of protesters marched through Srinagar on Friday and security forces fired gunshots in response, word spread that there had been a massacre. Reporters who investigated found that at least seven people had been injured, but no one had died. Other unverified reports of people being killed by the police have also circulated.

The enforced idleness creates another risk, said Mr. Qayoom, the Paytm employee stuck at home. When young people have nothing else to do, leaving the house to protest — or throw stones at the police — looks a lot more appealing. “There is going to be bloodshed,” he said.

For more details visit https://cis-india.org/internet-governance/news/new-york-times-august-14-2019-vindu-goel-karan-deep-singh-and-sameer-yasir-india-shut-down-kashmir-internet-access-now-we-cannot-do-anything

Cyber Policy 2.0

Admin — 2019-08-19T14:18:13Z

National Law University organized an executive education program in Bangalore on August 17, 2019. Arindrajit Basu was a speaker. He spoke on Deconstructing the India regulatory approach to data governance and cyber security.

For more details about the program, click here

For more details visit https://cis-india.org/internet-governance/news/cyber-policy-2.0

Emergence of Chinese Technology:Rising stakes for innovation, competition and governance

Admin — 2019-08-19T14:03:21Z

Omidyar Network in partnership with the Esya Centre organized a private discussion on the theme “Emergence of Chinese technology - rising stakes for innovation, competition and governance” on Monday, 12 August 2019 in New Delhi. Arindrajit Basu attended the event.

China Ascendant: Soft Power report by ON focuses on three prongs of power-digital power, fore power and sharp power. Standards have been a major avenue for proliferation of Chinese competition.This is combined with knowledge transfer as 2.8 million Chinese students in the US have largely returned to tech companies in China. Core strength is still not in basic research so by 2020, aiming for 15 per cent of PhD.s to be in basic research. China uses nudges in shaping global governance outcomes by targeting the right stakeholders as opposed to altering the ground rules entirely, Universities in China have focused on how cultural connections can be linked upto negotiating prowess at multilateral fora.

China takes a whole of government approach to technology innovation. Continues to be consumer focused.
China does not look at India as a R+D partner,more as a market.Stability and unpredictability has been an issue.None of India's tech policies were drafted with China in mind.

For more details visit https://cis-india.org/internet-governance/news/emergence-of-chinese-technology-rising-stakes-for-innovation-competition-and-governance