We are anonymous, we are legion

Design and Uses of Digital Identities - Research Plan

Amber Sinha and Pooja Saxena — 2019-08-17T07:58:44Z

In our research project about uses and design of digital identity systems, we ask two core questions: a) What are appropriate uses of ID?, and b) How should we think about the technological design of ID? Towards the first research question, we have worked on first principles and will further develop definitions, legal tests and applications of these principles. Towards the second research question, we have first identified a set of existing and planned digital identity systems that represent a paradigm of how such a system can be envisioned and implemented, and will look to identify key design choices which are causing divergence in paradigm.

Read the research plan here.

For more details visit https://cis-india.org/internet-governance/blog/digtial-identities-research-plan

Holding ID Issuers Accountable, What Works?

Shruti Trikanad and Amber Sinha — 2019-08-08T10:23:58Z

Together with the Institute of Technology & Society (ITS), Brazil, and the Centre for Intellectual Property and Information Technology Law (CIPIT), Kenya, CIS participated at a side event in RightsCon 2019 held in Tunisia, titled Holding ID Issuers Accountable, What Works?, organised by the Omidyar Network. The event was attended by researchers and advocates from nearly 20 countries. Read the event report here.

For more details visit https://cis-india.org/internet-governance/blog/holding-id-issuers-accountable-what-works

The Appropriate Use of Digital Identity

amber — 2019-08-08T10:24:40Z

As governments across the globe implement new, foundational, digital identification systems (“Digital ID”), or modernize existing ID programs, there is dire need for greater research and discussion about appropriate uses of Digital ID systems. This significant momentum for creating Digital ID in several parts of the world has been accompanied with concerns about the privacy and exclusion harms of a state issued Digital ID system, resulting in campaigns and litigations in countries such as UK, India, Kenya, and Jamaica. Given the very large range of considerations required to evaluate Digital ID projects, it is necessary to think of evaluation frameworks that can be used for this purpose.

At RightsCon 2019 in Tunis, we presented working drafts on appropriate use of Digital ID by the partner organisations of this three-region research alliance - ITS from Brazil, CIPIT from Kenya, and CIS from India.

In the draft by CIS, we propose a set of principles against which Digital ID may be evaluated. We hope that these draft principles can evolve into a set of best practices that can be used by policymakers when they create and implement Digital ID systems, provide guidance to civil society examinations of Digital ID and highlight questions for further research on the subject. We have drawn from approaches used in documents such as the necessary and proportionate principles, the OECD privacy guidelines and scholarship on harms based approach.

Read and comment on CIS’s Draft framework here.

Download Working drafts by CIPIT, CIS, and ITS here.

For more details visit https://cis-india.org/internet-governance/blog/the-appropriate-use-of-digital-identity

Comments to the ID4D Practitioners’ Guide

Yesha Tshering Paul, Prakriti Singh, and Amber Sinha — 2019-08-08T10:25:13Z

This post presents our comments to the ID4D Practitioners’ Guide: Draft For Consultation released by ID4D in June, 2019. CIS has conducted research on issues related to digital identity since 2012. This submission is divided into three main parts. The first part (General Comments) contains the high-level comments on the Practitioners’ Guide, while the second part (Specific Comments) addresses individual sections in the Guide. The third and final part (Additional Comments) does not relate to particulars in the Practitioners' Guide but other documents that it relies upon. We submitted these comments to ID4D on August 5, 2019. Read our comments here.

For more details visit https://cis-india.org/internet-governance/blog/comments-to-the-id4d-practitioners2019-guide

Private Sector and the cultivation of cyber norms in India

basu — 2019-08-07T15:18:27Z

Information Communication Technologies (ICTs) have become a regular facet of modern existence. The growth of cyberspace has challenged traditional notions of global order and uprooted the notion of governance itself. All over the world, the private sector has become a critical player, both in framing cyber regulations and in implementing them.

The article by Arindrajit Basu was published by Nextrends India on August 5, 2019.

While the United Nations ‘Group of Governmental experts’ (GGE), tried and failed to establish a common law for governing the behavior of states in cyberspace, it is Big Tech who led the discussions on cyberspace regulations. Microsoft’s Digital Geneva Convention which devised a set of rules to protect civilian use of the internet was a notable initiative on that front. Microsoft was also a major driver of the Tech Accords — a public commitment made by over 100 companies “agreeing to defend all customers everywhere from malicious attacks by cyber-criminal enterprises and nation-states.” The Paris Call for Trust and Security in Cyberspace was a joint effort between the French government and Microsoft that brought in (as of today) 66 states, 347 private sector entities, including Indian business guilds such as FICCI and the Mobile Association of India and 139 organisations from civil society and academia from all over the globe.

However, the entry of Big tech into the business of framing regulation has raised eyeballs across jurisdictions. In India, the government has attempted to push back on the global private sector due to arguably extractive economic policies adopted by them, alongside the threats they pose to India’s democratic fabric. The Indian government has taken various steps to constrain Big Tech, although some of these policies have been hastily rolled out and fail to address the root of the problem.

I have identified two regulatory interventions that illustrate this trend. First, on intermediary liability, Rule 3(9) of the Draft of the Information Technology 2018 released by the Ministry of Electronics and Information Technology (MeiTy) last December. The rule follows the footsteps of countries like Germany and France by mandating that platforms use “automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.” These regulations have resulted in criticism from both the private sector and civil society as they fail to address concerns around algorithmic discrimination, excessive censorship and gives the government undue power. Further, the regulations paint all the intermediaries with the same brush, thus not differentiating between platforms such as Whatsapp who thrive on end-to-end encryption and public platforms like Facebook.

Another source of discord between the government and the private sector has been the government’s localisation mandate, featuring in a slew of policies. Over the past year, the Indian government has introduced a range of policy instruments which
demand that certain kinds of data must be stored in servers located physically within India — termed “data localization.”

While this serves a number of policy objectives, the two which stand out are (1) the presently complex process for Indian law enforcement agencies to access data stored in the U.S. during criminal investigations, and (2) extractive economic models used by U.S. companies operating in India.

A study I co-authored earlier this year on the issue found that foreign players and smaller Indian private sector players were against this move due to the high compliance costs in setting up data centres.

On this question, we recommended a dual approach that involves mandatory sectoral localisation for critical sectors such as defense or payments data while adopting ‘conditional’ localisation for all other data. Under ‘conditional localisation,’
data should only be transferred to countries that (1)Agree to share the personal data of Indian citizens with law enforcement authorities based on Indian criminal procedure laws and (2) Have equivalent privacy and security safeguards.

These two instances demonstrate that it is important for the Indian government to engage with both the domestic and foreign private sector to carve out optimal regulatory interventions that benefit the Indian consumer and the private sector as a whole rather than a few select big players. At the same time, it is important for the private sector to be a responsible stakeholder and comply both with existing laws and accepted norms of ‘good behaviour.’

Going forward, there is no denying the role of the private sector in the development of emerging technologies. However, a balance must be struck through continued engagement and mutual respect to create a regulatory ecosystem that fosters innovation while respecting the rule of law with every stakeholder – government, private sector and civil society. India’s position could set the trend for other emerging economies coming online and foster a strategic digital ecosystem that works for all
stakeholders.

For more details visit https://cis-india.org/internet-governance/blog/nextrends-india-arindrajit-basu-august-5-2019-private-sector-and-the-cultivation-of-cyber-norms-in-india

National Stakeholders Consultation on the National Digital Health Blueprint

Admin — 2019-08-07T14:21:29Z

Ambika Tandon and Aayush Rathi attended the National Stakeholders Consultation on the National Digital Health Blueprint organised by the Ministry of Health and Family Welfare on 6 August 2019 at Constitution Club of India in New Delhi.

It was also attended by representatives from MeitY apart from industry and civil society. We raised questions about the provisions for privacy andinteroperability in the NDHB, in relation to provisions in the DISHA Act and the Srikrishna report. The public call for the event can be found here.

For more details visit https://cis-india.org/internet-governance/news/national-stakeholders-consultation-on-the-national-digital-health-blueprint

‘I’m just helpless’: Concern about Kashmir mounts as communication blackout continues

Niha Masih — 2019-08-07T14:03:43Z

For the last 36 hours, Arusha Farooq has been hooked to her phone — making frantic calls, messaging repeatedly and then checking news sites in despair.

The article by Niha Masih was published by Washington Post on August 6, 2019. Pranesh Prakash was quoted.

But none of the calls connect, and none of the messages get read. News reports also have nothing from her hometown Srinagar, the capital of the state of Jammu and Kashmir, amid an Internet shutdown imposed by the Indian government.

“Right now, I’m just helpless,” said Farooq, 26, who teaches at a private college in Delhi. “I need to know that my family is safe.”

On Monday, in an incendiary move, the Indian government stripped the state of its autonomy guaranteed under the constitution. The change is expected to anger and alienate many in Kashmir, raising the prospect of protracted violence in the restive region bordering Pakistan.

Revocation of Kashmir’s special status has been a long-standing demand of hard-line Hindu nationalists. Prime Minister Narendra Modi won a thumping victory in the national elections in May following a polarizing campaign based on muscular Hindu nationalism.

The step was taken amid a harsh clampdown in the Muslim-majority Kashmir valley. Thousands of people were forced to stay home as troops patrolled barricaded streets. The Indian government suspended phone and Internet service. Schools remained shut and two former chief ministers of the state were arrested. On the website of the largest circulating local paper, there is only a blank page under “today’s paper.”

A day later, there has been almost no word from inside Kashmir, a situation many described as a “siege.”

Internet shutdowns are not new to Kashmir. The current shutdown is the 53rd this year. In fact, Kashmir accounts for more than 70 percent of all government-imposed blackouts in the country. In one instance, mobile Internet remained suspended for 133 days in the wake of protests following the killing of popular militant Burhan Wani in 2016.

But Farooq says this is the first time even landline networks have been shut down, leaving thousands of Kashmiris across the country with no means of getting in touch with their families.

Additional troop deployment has also left people concerned about the safety of their loved ones, given frequent violent clashes between civilian protesters or militants and security forces. 2018 marked the deadliest year in a decadewith 586 deaths, including 160 civilians.

Mudasir Amin, a doctoral student in Delhi, has been wracked with worry. On Sunday, he received a panicked call from a 20-year-old neighbor who recently had a kidney transplant. The young man requested that Amin send him a three months’ supply of medicine as uncertainty spread before the government announcement. Amin is concerned that the lack of medication could endanger his friend’s life.

He has no idea if he can or will even be allowed to travel to his village if he flies to Srinagar. He has not heard from his friends who have departed for Kashmir in the last two days. “Once you land there, you disappear in a black hole,” said Amin.

Calling the suspension of mobile and Internet services an “abrogation” of the rights of the people of Kashmir and their freedom of speech, Pranesh Prakash a fellow at the Center for Internet and Society, said, “This is in essence the declaration of internal emergency without official proclamation.”

While government sources called it a “precautionary” measure to contain violence as a result of the announcement, it is unclear how long the ban will remain in place. Vasudha Gupta, a spokesperson for the Interior Ministry, said she had “no answer.”

“It’s like a pressure cooker situation,” said Iltija Javed, describing the prevailing atmosphere from Srinagar. The daughter of Mehbooba Mufti, a prominent Kashmir leader under arrest, she is one of the few people who have managed to communicate through an erratic broadband connection.

“By depriving people of their right to even protest, the government of India has just vindicated the feeling that everybody here shares — that what has happened is a violation of their right,” she said in a WhatsApp voice note sent to The Washington Post.

The constitutional provision in contention gave Kashmir, the only Muslim-majority state, certain autonomous powers and was part of the terms of its accession to the Indian union in the aftermath of the partition of India and Pakistan. It gave special privileges to residents, like the sole right to buy property or hold government jobs, both of which will be now available to people from elsewhere in India.

The state has also been bifurcated into two federal territories. That will limit the authority of the state governments, giving more control to the central Indian government.

Since 1989, India has battled with militants in Kashmir fighting for independence from the country or seeking more autonomy. While India succeeded in curbing the influx of cross-border militants from Pakistan over the years, it has struggled to restrain local youths from taking up arms. India and Pakistan control parts of the region, and the two countries have gone to war previously over Kashmir.

Radha Kumar, a former government-appointed interlocutor to the state of Kashmir, called the government’s move a “death blow,” saying this would only mean losing the people of the Kashmir valley.

“My guess is Pakistan will try to flood the valley with troops,” she said. “We may not see an immediate rise in militancy, but again I would be extremely surprised if we don’t see more youth turning to the gun.

Pakistan has condemned India’s decision as illegal. In a tweet, Pakistan’s armed forces declared support for the struggle of Kashmiris, saying they would go to “any extent to fulfill our obligations in this regard.”

Media reports say India deployed more than 40,000 additional troops to Kashmir in the past week. Kashmir is considered one of the world’s most heavily militarized zones, with human rights groups claiming the presence of 500,000 to 700,000 troops. Residents have long accused the armed forces of excesses.

Amin, the doctoral student in Delhi, is haunted by his mother’s last phone call. She told him they had no idea when they would be able to speak next. He recalled holding back tears when she said she wished he was with them: “ ‘Even we if die, at least we would be together,’ she told me.”

Tania Dutta contributed to this report.

For more details visit https://cis-india.org/internet-governance/news/washington-post-august-6-2019-niha-masih-internet-mobile-blackout-shuts-down-communication-with-kashmir

Will Modi govt move on Kashmir’s Article 370 stand the scrutiny of Supreme Court?

Admin — 2019-08-07T13:44:26Z

Many scholars have questioned the constitutional validity of Narendra Modi government's decision to scrap Article 370 that gives special status to Jammu & Kashmir.

The article by Print was published on August 6, 2019. Pranesh Prakash was consulted.

Legally, Supreme Court should not stand by Modi govt’s decision to scrap Article 370

In the first case regarding Article 370 (Prem Nath Kaul v. State, 1959), the Supreme Court underscored the importance of the Jammu & Kashmir constituent assembly’s role. But in two other cases (Sampat Prakash v. State, 1968, and MM Damnoo v. State, 1972), it differed without even citing the 1959 case.

Some might argue that given the number of presidential orders passed under Article 370, starting with the Nehru government, there is little left to protect in the article. That’s partially true, but it is also true that Article 370 symbolises a contract between the state of Jammu & Kashmir and the Indian Union, which was negotiated as a condition of its accession to India. It doesn’t allow for the President to unilaterally abolish the article without the recommendation of the constituent assembly of the state. Monday’s presidential order will not stand judicial scrutiny. That’s why, despite the constant erosion of Article 370, it is still politically and legally unacceptable.

If this is allowed by the Supreme Court, then the federal nature of the country will cease to be, along with its democratic nature.

For more details visit https://cis-india.org/internet-governance/news/the-print-august-6-2019-will-modi-govt-move-on-kashmir-article-370-stand-the-scrutiny-of-supreme-court

Comments on the National Digital Health Blueprint

Samyukta Prabhu, Ambika Tandon, Torsha Sarkar and Aayush Rathi — 2019-08-07T13:24:55Z

The Ministry of Health and Family Welfare had released the National Digital Health Blueprint on 15 July 2019 for comments. The Centre for Internet & Society submitted its comments.

This submission presents comments by the Centre for Internet and Society (CIS), on the National Digital Health Blueprint (NDHB) Report, released on 15th July 2019 for publicconsulations. It must be noted at the outset that the time given for comments was less than three weeks, and such a short window of time is inadequate for all stakeholdersinvolved to comprehensively address the various aspects of the Report. Accordingly, on behalf of all other interested parties, we request more time for consultations.

We also note that the nature of data which would be subject to processing in the proposed digital framework pre-supposes a robust data protection regime in India, onewhich is currently absent. Accordingly, we also urge ceasing the implementation of the framework until the Personal Data Protection Bill is passed by the parliament. We wouldbe explaining our reasonings on this particular point below.

Click to download the full submission here.

For more details visit https://cis-india.org/internet-governance/blog/samyukta-prabhu-ambika-tandon-torsha-sarkar-and-aayush-rathi-august-4-2019-comments-on-national-digital-health-blueprint

Facebook Data for Good in Bangalore

Admin — 2019-07-31T02:14:06Z

When data is shared responsibly with the communities that need it, it can improve well being and save lives. Shweta Mohandas participated in a session organized by Facebook on 25 July 2019 at Indian Institute of Science in Bangalore.

For more details visit https://cis-india.org/internet-governance/news/facebook-data-for-good-in-bangalore

In India, Privacy Policies of Fintech Companies Pay Lip Service to User Rights

shweta — 2019-07-31T02:21:40Z

A study of the privacy policies of 48 fintech companies that operate in India shows that none comply with even the basic requirements of the IT Rules, 2011.

The article by Shweta Mohandas highlighting the key observations in Fintech study conducted by CIS was published in the Wire on July 30, 2019.

Earlier this month, an investigation revealed that a Hyderabad-based fintech company called CreditVidya was sneakily collecting user data through their devotional and music apps to assess people’s creditworthiness.

This should be unsurprising as the privacy policies of most Indian fintech companies do not specify who they will be sharing the information with. Instead, they employ vague terminology to identify sharing arrangements such as ‘third-party’, ‘affiliates’ etc.

This is one of the many findings that we came across while analysing the privacy policies of 48 fintech companies that operate in India.

The study looked at how the privacy policies complied with the requirements of the existing data protection regime in India – the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

The IT Rules, among other things, require that privacy policies specify the type of data being used, the purpose of collection, the third parties the data will be shared with, the option to withdraw consent and the grievance redressal mechanism.

The rules also require the privacy policy to be easily accessible as well as easy to understand. The problem is that they are not as comprehensive and specific as, say, the draft Personal Data Protection Bill, which is awaiting passage through parliament, and hence require the companies to do much less than privacy and data protection practices emerging globally.

Nevertheless, despite the limited requirements, none of the companies in our sample of 48 were fully compliant with the parameters set by the IT Rules.

While 95% of the companies did fulfil the basic requirement of actually formulating and having a privacy policy, two major players stood out as defaulters: Airtel Payments Bank and Bhim UPI, for which we were not able to locate a privacy policy.

Though a majority of the privacy policies contained the statement “we take your privacy and security seriously”, 43% of the companies did not provide adequate details of the reasonable security practices and procedures followed.

The requirement in which most companies did not provide information for was regarding a grievance redressal mechanism, where only 10% of the companies comply.

While 31% of the companies provided the contact of a grievance redressal officer (some without even mentioning the redressal mechanism), 37% of the companies provided contact details of a representative but did not specify if this person could be contacted in case of any grievance.

Throughout the study, it was noted that the wording of the IT Rules allowed companies to use ambiguous terms to ensure compliance without exposing their actual data practices. For example, Rule 5 (7) requires a fintech company to provide an option to withdraw consent. Twenty three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums but they did not allow the user to withdraw their consent completely. While several of 17 companies did provide the option to withdraw consent, they did not clarify whether the withdrawal also meant that the user’s data was no processed or shared.

However, when it came to data retention, most of the 27 companies that provided some degree of information about the retention policy stated that some data would be stored for perpetuity either for analytics or for complying with law enforcement. The remaining 21 companies say nothing about their data retention policy.

In local languages

The issue of ambiguity most clearly arises when the user is actually able to cross the first hurdle – reading an app’s privacy policy.

With fintech often projected as one of the drivers of greater financial inclusion in India, it is telling that only one company (PhonePe) had the option to read the privacy policy in a language other than English. With respect to readability, we noted that the privacy policies were difficult to follow not just because of legalese and length, but also because of fonts and formatting – smaller and lighter texts, no distinction between paragraphs etc. added to the disincentive to read the privacy policy.

Privacy policies act as a notice to individuals about the terms on which their data will be treated by the entity collecting data. However, they are a monologue in terms of consent where the user only has the option to either agree to it or decline and not avail the services. Moreover, even the notice function is not served when the user is unable to read the privacy policy.

They, thus, serve as mere symbols of compliance, where they are drafted to ensure bare minimum conformity to legal requirements. However, the responsibility of these companies lies in giving the user the autonomy to provide an informed consent as well as to be notified in case of any change in how the data is being handled (this could be when and whom the data is being shared with, if there has been a breach etc).

With the growth of fintech companies and the promise of financial inclusion, it is imperative that the people using these services make informed decisions about their data. The draft Personal Data Protection Bill – in its current form – would encumber companies processing sensitive personal data with greater responsibility and accountability than before. However, the Bill, similar to the IT Rules, endorses the view of blanket consent, where the requirement for change in data processing is only of periodic notice (Section 30 (2)), a lesson that needs to be learnt from the CreditVidya story.

In addition to blanket consent, the SPD/I Rules and well as the PDP Bill does not require the user to be notified in all cases of a breach. While the information that is provided to data subjects is necessary to be designed keeping the user in mind, neither the SPD/I Rules, nor the PDP Bill take into account the manner in which data flows operate in the context of ‘disruptive’ business models that are a hallmark of the ‘fintech revolution’.

For more details visit https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights

Facebook Data for Good in New Delhi

Admin — 2019-07-31T02:10:23Z

When data is shared responsibly with the communities that need it, it can improve well being and save lives. Anubha Sinha participated in a session organized by Facebook on 29 July 2019 at University of Chicago Center in New Delhi.

Click to download the brochure

For more details visit https://cis-india.org/internet-governance/news/facebook-data-for-good-delhi

July 2019 Newsletter

praskrishna — 2019-08-09T13:50:49Z

Centre for Internet & Society (CIS) newsletter for July 2019.

Highlights for July 2019
CIS presented its comments on the proposed rules 29,30,31 of the Draft Copyright (Amendment) Rules, 2019 to the Department for Promotion of Industry and Internal Trade, Ministry of Commerce and Industry, Govt. of India. The comments were made in response to Notification G.S.R 393(E) published in the Gazette of India on May 30, 2019. CIS submitted that in the domestic approach to modernising our copyright legislation, we must refrain from considering distribution of born-digital/ digitised works over the public Internet equivalent to the function of broadcasting works over cable/ satellite. The Indian National Trust for Art & Heritage Pune Chapter is working with various organisations to preserve the natural heritage places like rivers in Pune district of Maharashtra, India. After the presentation of 'Project Jalbodh' by CIS-A2K in River Dialogue organised by INTACH in April 2018, several organisations have shown keen interest in collaboration. Subodh Kulkarni shares some insights in his report. ICANN has Advisory Committees which help guide the policy recommendations that the ICANN community develops while its Supporting Organizations are charged with developing policy recommendations for a particular aspect of ICANN's operations. ICANN publishes a combined budget for all these bodies under the head of policy development. CIS inquired about the financial resources allocated to each of them specifically. CIS in partnership with the Internet Society organized an event on the impact of consolidation in the Internet economy. It was divided into two roundtable discussions, the first one focusing on the policies and regulation while the latter dealt with the technical evolution of the Internet. The roundtables aimed to analyze how growing forces of consolidation, including concentration, vertical and horizontal integration, and barriers to market entry and competition would influence the Internet in the next 3 to 5 years. The report by Akriti Bopanna and Gurshabad Grover provides an insight into the developments. As part of its Researchers at work programme on key thematics at the intersections of internet and society, CIS called for abstracts for essays that explore social, economic, cultural, political, infrastructural, or aesthetic dimensions of the ‘list’. Ten abstracts would be shortlisted by August 9 from the list of submissions and the selected authors would be requested to submit the full essay of their draft by September 15. Final versions of the essays are expected to be published in October. With the rise and popularity of app-based platforms such as Ola, Uber, Swiggy Zomato, and others, there is a growing public conversation about regulation of such 'gig-work' platforms and the working conditions of people who work for them. To explore this further CIS conducted a panel discussion at its Bangalore office. Researchers associated with the project presented their preliminary findings. Panelists preliminary field insights along with reflections on what it meant to do such studies, how they went about studying gig-work, and challenges that arose in their work. An excerpt from an essay by Maya Indira Ganesh, written for and published as part of the Bodies of Evidence collection of Deep Dives titled You auto-complete me: romancing the bot explains human relations with bots. The Bodies of Evidence collection, edited by Bishakha Datta and Richa Kaul Padte, is a collaboration between Point of View and the Centre for Internet and Society, undertaken as part of the Big Data for Development Network supported by International Development Research Centre, Canada.

CIS and the News

The following articles were authored by CIS secretariat during the month:

Fostering Strategic Convergence in US-India Tech Relations: 5G and Beyond (Justin Sherman and Arindrajit Basu; The Diplomat; July 3, 2019).
Fix Problems Before Complete Failure (Shyam Ponappa; Business Standard; July 4, 2019).
What is the problem with ‘Ethical AI’? An Indian Perspective (A rindrajit Basu and Pranav M.B; cyberBRICS; July 17, 2019).
Old Isn't Always Gold: FaceApp and Its Privacy Policies (Mira Swaminathan and Shweta Reddy; The Wire; July 20, 2019).
The worrying survival of moon landing conspiracy theorists (Nishant Shah; Indian Express; July 22, 2019).
India Is Falling Down the Facial Recognition Rabbit Hole (Karan Saini and Prem Sylvester; The Wire; July 23, 2019).
Why I’m not going to tell you about the dangers of apps like FaceApp (Nishant Shah; Indian Express; July 28, 2019).
The Digital Identification Parade (Aayush Rathi and Ambika Tandon; Indian Express; July 29, 2019). The authors acknowledge Sumandro Chattapadhyay, Amber Sinha and Arindrajit Basu for their edits and Karan Saini for his inputs.
In India, Privacy Policies of Fintech Companies Pay Lip Service to User Rights (Shweta Mohandas; The Wire; July 30, 2019).

CIS in the News

CIS secretariat was consulted for the following articles published during the month in various publications:

PIB plans a fact-checking unit to counter fake news (Smriti Kak Ramachandran; Hindustan Times; July 3, 2019).
How Sai Baba Was Made To Spy On Your Phone For Credit Ratings (Gopal Sathe; Huffington Post; July 4, 2019).
Mozilla is funding a way to support Julia in Firefox (Catalin Cimpanu; ZD Net; July 8, 2019).
Deepfakes: Algorithms at war, trust at stake (Rajmohan Sudhakar; Deccan Herald; July 14, 2019).
Digital public information system design: Talk to experts, find the right way (Prachatai; July 18, 2019).
Easing the US-India divergence on data localisation (Shashidhar KJ and Kashish Parpiani; Observer Research Foundation; July 22, 2019).
For sex workers, mobile phone becomes a double-edged sword (Tushar Kaushik; Economic Times; July 23, 2019).
Twitter reacts to the India's cryptocurrency drama (Rajarshi Mitra; FXStreet; July 26, 2019).

Access to Knowledge

Access to Knowledge is a campaign to promote the fundamental principles of justice, freedom, and economic development. It deals with issues like copyrights, patents and trademarks, which are an important part of the digital landscape.

Copyright and Patent

Research on harms caused to consumers, developing countries, human rights, and creativity/innovation from excessive regimes of copyright, patents, and other such monopolistic rights over knowledge:

Submission

Comments on the Draft Copyright (Amendment) Rules, 2019 concerning Statutory Licensing (Anubha Sinha; July 11, 2019). This submission presents comments to the Department for Promotion of Industry and Internal Trade (“DPIIT”), Ministry of Commerce and Industry pertaining to the notification G.S.R 393(E) containing the draft Copyright (Amendment) Rules, 2019 issued on 30th May 2019.

Wikipedia

Under a grant from Wikimedia Foundation we are doing a project for the growth of Indic language communities and projects by designing community collaborations and partnerships that recruit and cultivate new editors and explore innovative approaches to building projects.

Blog Entries

Orientation programme, Wikipedia workshop & Action Plan meeting in PAH Solapur University (Subodh Kulkarni; July 19, 2019).
Wikimedia Workshop on Rivers under Project Jalbodh (Subodh Kulkarni; July 30, 2019).
Re-licensing Sessions with Authors and Organisations (Subodh Kulkarni; July 31, 2019).

Openness

Our work in the Openness programme focuses on open data, especially open government data, open access, open education resources, open knowledge in Indic languages, open media, and open technologies and standards - hardware and software:

Participation in Event

Learning and Understanding the Frameworks of Rights at Work (Organized by Kai Hsin Hung; IT for Change; Bangalore; July 13, 2019). Torsha and Mira attended the workshop.

Internet Governance

The Tunis Agenda of the second World Summit on the Information Society has defined internet governance as the development and application by governments, the private sector and civil society, in their respective roles of shared principles, norms, rules, decision making procedures and programmes that shape the evolution and use of the Internet. As part of internet governance work we work on policy issues relating to freedom of expression primarily focusing on the Information Technology Act and issues of liability of intermediaries for unlawful speech and simultaneously ensuring that the right to privacy is safeguarded as well.

Freedom of Speech & Expression

Under a grant from the MacArthur Foundation, CIS is doing research on the restrictions placed on freedom of expression online by the Indian government and contribute studies, reports and policy briefs to feed into the ongoing debates at the national as well as international level. As part of the project we bring you the following outputs:

Blog Entry

DIDP #34 On granular detail on ICANN's budget for policy development process (Akriti Bopanna; July 6, 2019).

Participation in Events

13th European Summer School on Internet Governance (Organized by European Summer School on Internet Governance; Meissen; July 13 - 20, 2019). Akriti Bopanna attended the school.
ICANN 65 De-briefing Meeting (Organized by Indian Council for Research on International Economic Relations ; July 16, 2019). Akriti Bopanna remotely presented on the Human Rights related developments that took place at the Marrakech meeting, over the course of the 4 days.

Privacy

Under a grant from Privacy International and IDRC we are doing a project on surveillance. CIS is researching the history of privacy in India and how it shapes the contemporary debates around technology mediated identity projects like Aadhar. As part of our ongoing research, we bring you the following outputs:

Blog Entry

The Impact of Consolidation in the Internet Economy on the Evolution of the Internet (Akriti Bopanna and Gurshabad Grover; July 3, 2019). The blog post was edited by Swaraj Barooah, Elonnai Hickok and Vishnu Ramachandran. Swagam Dasgupta provided inputs.

Participation in Events

Digital ID Forum 2019 (Organized by UNDP; Chulalongkorn University, Thailand; July 3, 2019). Sunil Abraham was one of the panelists at this event.
BIS LITD 17 meeting (Organized by Bureau of Indian Standards; New Delhi; July 3, 2019). Gurshabad Grover attended the sixteenth meeting of the Information Systems Security and Biometrics Section Committee (LITD17).
Facebook Data for Good in Bangalore (Organized by Facebook; Indian Institute of Science, Bangalore; July 25, 2019).
Roundtable with the WhatsApp leadership (Organized by WhatsApp; Mountbatten, The Oberoi, New Delhi; July 26, 2019). Will Cathcart, WhatsApp's new global head, visited India and invited Sunil Abraham for a discussion.
Facebook Data for Good in New Delhi (Organized by Facebook; University of Chicago Center, New Delhi; July 29, 2019).

IT / Information Technology

A research on the usage of systems (computers and telecommunications) for storing, retrieving and sending information as well as the IT Act:

Participation in Event

Leveraging Web Application Vulnerabilities for Reconnaissance and Intelligence Gathering (Organized by Has Geek; GRD College of Science, Coimbatore; July 5, 2019). Karan Saini gave a talk at the JSFoo Conference.

Artificial Intelligence

With origins dating back to the 1950s Artificial Intelligence (AI) is not necessarily new. However, interest in AI has been rekindled over the recent years due to advancements of technology and its applications to real-world scenarios. We conduct research on the existing legal and regulatory parameters:

Participation in Events

Roundtable Discussion on “The Future of AI Policy in India” (Organized by Indian Council for Research on International Economic Relations, New Delhi; July 1, 2019).
Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward (Organized by HEaL (Health, Ethics, and Law Institute of Training, Research and Advocacy) of FMES (Forum for Medical Ethics Society) in collaboration with CPS (Centre for Policy Studies), Indian Institute of Technology-Bombay; July 13, 2019). Radhika Radhakrishnan, participated in a roundtable discussion on "Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward."

Gender

Presentation to Amnesty International on researching the Future of Work (Organized by Amnesty Interntional, New Delhi; July 18, 2019). Aayush Rathi and Ambika Tandon made a presentation on CIS research on Future of Work.

Telecom

The growth in telecommunications in India has been impressive. While the potential for growth and returns exist, a range of issues need to be addressed for this potential to be realized. One aspect is more extensive rural coverage and the second aspect is a countrywide access to broadband which is low at about eight million subscriptions. Both require effective and efficient use of networks and resources, including spectrum.

Monthly Blog

Fix Problems Before Complete Failure (Shyam Ponappa; Organizing India Blogspot; July 4, 2019).

Researchers@Work

The researchers@work programme at CIS produces and supports pioneering and sustained trans-disciplinary research on key thematics at the intersections of internet and society; organise and incubate networks of and fora for researchers and practitioners studying and making internet in India; and contribute to development of critical digital pedagogy, research methodology, and creative practice.

Event Organized

#MappingDigitalLabour - Panel discussion on platform-work in Mumbai and New Delhi (CIS, Bangalore; July 19, 2019). Watch the session recording video here.

Blog Entries

Studying the Internet Discourse in India through the Prism of Human Rights (Deva Prasad M.; July 1, 2019).
#DigitalPedagogies (Ashutosh Potdar, Maya Dodd, Nidhi Kalra, and Ravikant Kisana; July 1, 2019).
#OpenAccessScholarlyPublishing (Abhishek Shrivastava, Dibyaduti Roy, and Nirmala Menon; July 11, 2019).
#RenarrationWeb (Anuja Mirchandaney, Deepak Prince, Dinesh and Shalini; July 23, 2019).

About CIS

CIS is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. The areas of focus include digital accessibility for persons with disabilities, access to knowledge, intellectual property rights, openness (including open data, free and open source software, open standards, open access, open educational resources, and open video), internet governance, telecommunication reform, digital privacy, and cyber-security. The academic research at CIS seeks to understand the reconfigurations of social and cultural processes and structures as mediated through the internet and digital media technologies.

Follow CIS on:

Twitter: http://twitter.com/cis_india
Twitter - Access to Knowledge: https://twitter.com/CISA2K
Twitter - Information Policy: https://twitter.com/CIS_InfoPolicy
Facebook - Access to Knowledge: https://www.facebook.com/cisa2k
E-Mail - Access to Knowledge: a2k@cis-india.org
E-Mail - Researchers at Work: raw@cis-india.org
List - Researchers at Work: https://lists.ghserv.net/mailman/listinfo/researchers

Support CIS:

Please help us defend consumer and citizen rights on the Internet! Write a cheque in favour of 'The Centre for Internet and Society' and mail it to us at No. 194, 2nd 'C' Cross, Domlur, 2nd Stage, Bengaluru - 5600 71.

Collaborate with CIS:

We invite researchers, practitioners, artists, and theoreticians, both organisationally and as individuals, to engage with us on topics related internet and society, and improve our collective understanding of this field. To discuss such possibilities, please write to Sunil Abraham, Executive Director, at sunil@cis-india.org (for policy research), or Sumandro Chattapadhyay, Research Director, at sumandro@cis-india.org (for academic research), with an indication of the form and the content of the collaboration you might be interested in. To discuss collaborations on Indic language Wikipedia projects, write to Tanveer Hasan, Programme Officer, at tanveer@cis-india.org.

CIS is grateful to its primary donor the Kusuma Trust founded by Anurag Dikshit and Soma Pujari, philanthropists of Indian origin for its core funding and support for most of its projects. CIS is also grateful to its other donors, Wikimedia Foundation, Ford Foundation, Privacy International, UK, Hans Foundation, MacArthur Foundation, and IDRC for funding its various projects.

For more details visit https://cis-india.org/about/newsletters/july-2019-newsletter

Easing the US-India divergence on data localisation

Shashidhar KJ and Kashish Parpiani — 2019-07-30T01:40:24Z

Addition of data localisation to the basket of persisting trade issues warrants greater compartmentalisation and consultative approaches to US-India ties.

The article by Shashidhar KJ and Kashish Parpiani was published by Observer Research Foundation on July 22, 2019.

The Reserve Bank of India’s (RBI) finally clarified its position eight months after it issued the controversial April 2018 circular mandating the storage of all payment data of Indians in the country and allowing the central bank “unfettered access”. The circular particularly aimed at US-based companies such as Mastercard, Visa, American Express, PayPal, Facebook and Google, as they scrambled to comply. The clarification was a welcome relief for companies seeking guidance on how to comply, what kind of data needs to be stored in India, and if the payment companies needed to move their processing infrastructure. Note, the RBI has yet to issue a formal directive with these clarifications.

Meanwhile, media reports have indicated that Facebook-owned WhatsApp would obey the RBI norm as it looks to kick off its payments business. This runs counter to what Facebook CEO Mark Zuckerberg had told investors in April:

“You should expect that we won’t store sensitive data in countries where it might be improperly accessed because of weak rule of law or governments that can forcibly get access to your data.”

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

This has revealed yet another faultline in the persisting trade issues between the US and India.

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

Indian data rights vs. American IPR protectionism

New Delhi has started to assert its right over its citizens’ data as India’s footprint on the Internet increases. Moreover, without clear guidance from Personal Data Protection legislation, there has been a glut of policy prescriptions from sector regulators. The Centre for Internet and Society published a paper in which it chronicles 10 policy measures for both ‘soft’ and ‘hard’ data localisation across health, telecommunications, e-commerce, insurance and others. These measures range from storing copies of specific data, local content production requirements, or imposing conditions on cross-border data transfers that act as a localisation mandate.

This oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip. For example, one of the reasons for insisting on localisation is security, but even if companies localise data, there is no framework to access this data by the local security apparatus.

India’s policy thinking on the matter often begins with the idea: ‘data is the new oil.’ The thinking is that data generated by Indians should be viewed as a natural resource that must be protected by the state through localisation. This notion is problematic. Data, unlike oil, which is found in limited quantities, has different properties. Newer ideas of regulation must be thought of and that’s where Indian policy makers have not been accommodative.

Oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip.

A gripe that US-based companies mention is that there is a distinctive domestic tilt and that company representatives have turned away from consultations as they do not serve the “national interests.” This was best exemplified in October 2018 when a closed-door discussion between the RBI and the US-India Strategic Partnership Forum (USISPF representing the interests of US companies) broke downand the latter accused the RBI of having a bias. During the discussions, the RBI placed a lot of emphasis on the inputs from iSPIRT (Indian Software Product Industry Roundtable), an Indian think tank which has been advocating for data protectionism.

The aforementioned sentiment has been carried over to international summits. At the recently concluded G20 summit, India boycotted the Osaka Track on the digital economy as it felt that it would undermine multilateral consensus-based decisions on trade and deny policy space for digital industrialisation. The Osaka Track pushed hard for the creation of laws which would allow data flows between countries and the removal of data localisation.

India’s foreign secretary, Vijay Gokhale, mentioned that data is a new form of wealth and wanted latitude on domestic rule-making on data. And in the age of digital commerce, this may signify a broader trend of a developed-developing nations’ impasse. The tussle has now moved beyond the security angle with the United States enacting the Clarifying Lawful Overseas Use of Data (CLOUD) Act for security agencies to procure data stored in servers regardless of whether in the US or foreign soil. With monetisation now at the core of the dispute, the discussed divergences on data localisation tie into the US’ broader, long-standing issues pertaining to US-India bilateral trade.

Divergence on data localisation issue crosses path with trade tensions

The 2019 National Trade Estimate (NTE) by the Office of the United States Trade Representative (USTR) focuses on reducing “barriers to digital trade.” Taking a tone of American stewardship on open liberal market economics, it notes:

“When governments impose unnecessary barriers to cross-border data flows or discriminate against foreign digital services, local firms are often hurt the most, as they cannot take advantage of cross-border digital services that facilitate global competitiveness.”

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

President Trump’s ‘America First’ worldview in many ways upended conventional tenets of US foreign policy. But on some fronts, it has presented opportunities for marginal establishment agendas. For instance, Trump’s heightened focus on ties with Israel and the US’ Sunni allies in the Middle East, complements the realisation of neoconservatives’ penchant for regime change in Iran.

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

On Trump’s fixation with recalibrating US trade relationships on “fair and reciprocal” footing, the American trade establishment successfully addressed US’ belated concerns over absence of digital trade rules in case of the North American Free Trade Agreement (NAFTA) with Canada and Mexico. Similarly, the emerging divergences over data localisation with India are subsumed under the ongoing — albeit repeatedly stalled, US-India trade negotiations.

Hence, the NTE underscores India’s decision with regards to payment service suppliers to be part of trade barriers hampering digital commerce and US-India trade at-large.

Fixing the strained Carter mantra via compartmentalisation and consultation

India has approached trade talks from the standpoint of addressing the Trumpian aberration of the US pushing for reduction of its trade deficits with other countries. Whereas, USTR negotiators have approached negotiations with India with regards to, what they view as longstanding issues in bilateral trade, such as market access for dairy products and price caps on medical equipment.

In the past, those outstanding issues were downplayed in view of the promising long-term trajectory of US-India strategic ties. The same has come to be known as the understated dictum of the Carter mantra — named after former US Secretary of Defense Ashton Carter and architect of the US-India Defense Technology and Trade Initiative. The approach encompassed the US to focus on harnessing strategic ties and not let differences on other fronts like trade to crowd out minimal-yet-positive developments.

In recent times, that dictum has come under strain as trade tensions have resurfaced. Cases in-point being, the Trump administration’s recent revocation of India’s designation as a “beneficiary developing country” under its Generalised System of Preferences programme, and India’s imposition of retaliatory tariffs on 28 US products.

The US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels.

Furthermore, ahead of Secretary of State Mike Pompeo’s visit to New Delhi last month, the Trump administration reportedly mulled capping the issuance of H1B visas to about 15 percent for any country that “does data localisation.” It bore ominous prospects for India’s $150 billion IT sector as 70 percent of the 85,000 H1B visas issued every year go to Indians. With regards to the broader trajectory of US-India ties, the report came to be seen as another blow to the Carter mantra’s prescription for compartmentalisation of issues from promising aspects of the bilateral relationship.

Both sides however, have attempted to temper tensions, and keep the Carter mantra in place with the continued focus on evolving strategic ties — with continued impetus on US-India defence trade and force interoperability agreements.

More importantly, there seems to be an overt attempt to reinstitute a sense of compartmentalisation. For instance, Secretary Pompeo, during his visit to New Delhi eased fears by denouncing reports about the US considering H1B visa caps. Whereas, India, too, has sought to institute a sense of compartmentalisation with Commerce Minister Piyush Goyal announcing that the contentious data protection issue will be kept out of the e-commerce policy draft, and will be dealt with by the IT ministry instead.

Lastly, the US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels. Examples of which include, the US-India 2+2 consultative platform between foreign and defense portfolio chiefs, and the India-US Strategic Energy Partnership working groups between India’s Petroleum Minister and US Energy Secretary. The upcoming editions of these forums are set to be critical in addressing outstanding issues in the strategic realm, like India’s purchase of the Russian S-400 systems inviting the prospect of American CAATSA sanctions, and India’s push for a gas-based economy in light of reduced oil purchases from Iran following recent tensions between Washington and Tehran.

Similarly, on easing the hardening American and Indian stances on data localisation, in addition to compartmentalisation, a consultative approach must be explored. Towards that end, the India-US Commercial Dialogue and India-US CEO Forum could serve as appropriate starting points for a joint working group involving a diverse set of stakeholders from the public and private realm.

For more details visit https://cis-india.org/internet-governance/news/observer-research-foundation-shashidhar-kj-and-kashish-parpiani-july-22-2019-easing-the-us-india-divergence-on-data-localisation

For sex workers, mobile phone becomes a double-edged sword

Tushar Kaushik — 2019-07-30T01:01:26Z

Our research on the use of mobile phones by sex workers, as part of the project on Feminist Information Infrastructure in collaboration with Sangama, was cited in an article in the Economic Times.

The article by Tushar Kaushik was published in the Economic Times on July 23, 2019. CIS research was quoted.

A mobile phone makes sex workers more vulnerable to harassment and abuse; however, it also helps them protect themselves better, according to recent reports. The report compiled by research and advocacy group Centre for Internet and Society (CIS) in May was based on surveys and interviews of 64 sex workers in rural Bengaluru and Hassan conducted by the nonprofit Sangama, which works with sexual minorities and sex workers. It said most sex workers use basic phones rather than smartphones.

Some respondents said phones helped them conduct sex work discreetly and avoid solicitation on roads and in public spaces. “This was especially advantageous for workers employed in addition to sex work, allowing them to schedule appointments for sex work for short periods during the day,” the report said. Some respondents said it helped them stay connected with friends and family while working.

But, in some cases, clients circulated workers’ contacts, leading to frequent calls and messages, some of which turned abusive. Some said clients would circulate photos and videos that had them in a compromising situation, or record calls with them, and threaten to circulate the content among families and communities of the workers. Pooja S (name changed), 27, said many clients shared her numbers with others, who would then call and harass her. “Clients have sometimes taken my photos and videos without my knowledge,” she said. However, Pooja is also aware of the advantage of having a mobile phone — in case of any problem with any client, she can immediately call someone for help.

Many transgender sex workers also said the advantages of a mobile phone far outweigh the disadvantages. Trans-activist Uma Umesh, who works to help many sex workers from the community, said, “Some clients call workers for frivolous reasons, and when workers don’t respond well, clients turn abusive.” Some sex workers use a separate sim card when with clients, she said.

A journal published in February, titled ‘Female Sex Workers’ Use of Mobile Phones in India,’ made similar conclusions based on discussions with 67 sex workers and 18 staff members from local NGOs in Mumbai and parts of Karnataka between January and May 2015. The journal highlighted how phones helped workers to be less dependent on brokers. It also mentioned cases where the police, upon apprehending sex workers, called clients whose contacts were saved on the workers’ phone to use them as a witness.

Shubha Chacko, one of the authors and executive director at Solidarity Foundation, which works with sex workers, said the workers are being trained to use phones to minimise threats. “For instance, some clients don’t pay. We advise workers to seek digital payment in advance.”

For more details visit https://cis-india.org/internet-governance/news/economic-times-july-23-2019-tushar-kaushik-for-sex-workers-mobile-phone-becomes-a-double-edged-sword