We are anonymous, we are legion

IETF Indian Community Meetup: RFCs We Love (IoT edition)

Admin — 2018-05-26T00:46:05Z

On May 19, 2018, Gurshabad Grover and Sandeep Kumar attended a 'RFCs We Love Meetup' of the Indian IETF Community held at Zoomcar's office in Bangalore. This meetup was dedicated to discussing IETF RFCs/Active Internet Drafts meant for Internet of Things (IoT) devices.

The agenda of the meeting was:

State of compression in IoT; Related RFCs: 6282, 6775, 8138 (Speaker: Rahul Arvind Jadhav, Huawei)
IoT Mesh Networks; Related RFCs: 6550, 3561, and draft-ietf-roll-efficient-npdao (Speaker: Rabi Sahoo, Huawei)
IoT protocols in moving Vehicles (Speaker: Vinayak Hegde, Zoomcar)
Update from IETF101

All the presentations used by the speakers, and the video recordings of the discussions can be found at this blog post by Dhruv Dhody, one of the attendees,

For more details visit https://cis-india.org/internet-governance/news/ietf-indian-community-meetup-rfcs-we-love-iot-edition

Emerging Technologies: Issues & Way Forward

Admin — 2018-05-26T00:39:11Z

Aayush Rathi and Gurshabad Grover attended a two day conference on 'Emerging Technologies: Issues & Way Forward' organised by the Technology Policy team at the National Institute of Public Finance and Policy (NIPFP), held on 23rd and 24th May in Bangalore.

The themes for discussion included:

Privacy, surveillance and data protection
Regulation of emerging technologies
Building sound regulators for technology policy, and
Fintech regulation

Click here to read the agenda

For more details visit https://cis-india.org/internet-governance/news/emerging-technologies-issues-way-forward

DIDP Request #30 - Employee remuneration structure at ICANN

Paul Kurian and Akriti Bopanna — 2018-08-24T06:57:39Z

We have requested ICANN to disclose the employee pay structure at ICANN with specific enquiries about the payment across the institutional hierarchy, gender, and region.

We have requested ICANN to disclose information pertaining to the income of each employee based on the following grounds. We had hoped this information will increase ICANN's transparency regarding their remuneration policies however ths was not the case, they either referred to their earlier documents who do not have concrete information or stated that the relevant documents were not in their possession. Their response to the respective questions were:

Average salary across designations

ICANN responded by referring to their FY18 Remuneration Practices document which states, “ICANN uses a global compensation expert consulting firm to provide comprehensive benchmarking market data (currently Willis Towers Watson, Mercer and Radford). The market study is conducted before the salary review process. Estimates of potential compensation adjustments typically are made during the budgeting process based on current market data. The budget is then approved as part of ICANN’s overall budget planning process.”

Average salary for female and male employees

ICANN responded by saying “ICANN org’s remuneration philosophy and practice is not based upon gender” which is why they said that they have “no documentary information in ICANN org’s possession, custody or control that is responsive to this request.” However, the exact average salaries of female and male employees was not provided nor any information that could that could give us an idea as to whether the remuneration of their employees was in accordance with the above claim.

Bonuses - frequency at which it is given and upon what basis

ICANN responded by referring to “Discretionary At-Risk Component” section in their FY18 Remuneration Practices document which states,”The amount of at-risk pay an individual can earn is based on a combination of both the achievement of goals as well as the behaviors exhibited in achieving those goals… The Board has approved a framework whereby those with ICANN Org are eligible to earn an at-risk payment of up to 20 percent of base compensation as at-risk payment based on role and level in the organization, with certain senior executives eligible for up to 30 percent.” The duration over which the employees are eligible to receive an “at-risk” payment was given to be “twice a year".

Average salary across regions for the same region

ICANN responded by saying,”compensation may vary across the regions based on currency differences, the availability of positions in a given region, market conditions, as well as the type of positions that are available in a given region. “ They also added that they have no documentary information in their possession, custody or control that is responsive to this request.

The request filed by Paul Kurian may be found here. ICANN's response can be read here.

For more details visit https://cis-india.org/internet-governance/blog/didp-request-30-enquiry-about-the-employee-pay-structure-at-icann

Complying with Europe’s GDPR will be a “matter of survival” for Indian IT firms

Admin — 2018-05-26T00:22:42Z

Europe’s new data laws could shake up Indian IT companies.

The blog post by Ananya Bhattacharya was published in Quartz India on May 24, 2018

The European Union’s (EU) General Data Protection Regulation (GDPR), which comes into effect on May 25, will put consumers in charge of their online data.

The law affects not just companies in the 28 EU member states but also those across the world that collect and process data from customers residing in EU nations.

“The first companies to be affected will be any outsourcing firms that deal with the EU, as well as the software firms that have personnel in the EU and in India,” Ryan Johnson, senior manager of international public policy at Access Partnership, a Mumbai-based consultancy, told Quartz. “In addition to the internal compliance issues, a lot of their contracts will need to be amended to reflect GDPR standards, both for vendors and clients. It will also change the kind of products that customers will want, as they change their IT environments to ensure compliance.”

Scores of companies in India’s $160 billion IT sector—Europe is its second-biggest market after North America—may now have to watch their backs.

So what exactly is the GDPR?

The GDPR, enacted in May 2016, is replacing the EU’S severely outdatedData Protection Directive regulation of 1995.

The data monitored under the new regulation will not only include personal information such as names, genders, and e-mail addresses that users voluntarily share, but also background tracking of cookies and browser history, and so on. Even identifiers like location data and IP addresses are explicitly included under personal data now, according to a report by consulting firm Deloitte.

“As regulations catch up, data privacy has fast evolved to become a matter of survival for companies,” said Rana Gupta, an identity and data protection expert at Gemalto, a digital security company.

The new EU rules mandate that companies dealing with high-risk and high-volume data regularly must appoint a data protection officer. Taking transparency up a notch, the regulations give companies a tight 72-hour runway to report data breaches.

Any violation will draw a fine of up to 4% of the firm’s annual turnover or €20 million (around Rs160 crore), whichever is higher. “With those kinds of stakes, investing in compliance now is the only right move for a sustainable business model,” said George Chang, vice-president at US-based cybersecurity firm Forcepoint.

That should be a wake-up call for Indian firms.

Ready or not?

While Indian IT giants like Infosys, Tata Consultancy Services (TCS), and Mindtree, which service European clients, will see an outsized impact of the new regulations, smaller Indian firms aren’t immune. Be it e-commerce sites with users logging in from, say, Belgium, or an India-based e-payments gateway accessed by someone in France, all companies—tech and otherwise—will need to tweak their terms and conditions to reflect the new rules.

“Digital marketing will be most affected once GDPR comes into effect, as promotional e-mails sent without the recipient’s prior consent fall afoul of the legislation’s diktat,” said Arun Balasubramanian, managing director of Qlik India, a software company.

Still, it seems like most companies haven’t prepared themselves for the altered regulation. A mere 13% of Indian companies have a plan to comply with the GDPR, a 2018 Ernst & Young survey revealed.

But India isn’t alone. More than half the companies located outside Europe aren’t ready either. “Even within the EU, small companies are struggling as there is a lot of fear-mongering about it (GDPR) and a general lack of awareness,” said Amber Sinha, senior programme manager at the Centre for Internet and Society (CIS).

Meanwhile, GDPR compliance can be an expensive affair, experts warn. This is so especially for large firms that may need to spend big on legal and consulting fees, besides bringing changes to their IT services. But all that will pay off in the future.

“Compliance can drive operational efficiencies, cost-savings, and even fuel innovation,” Gupta of Gemalto said. “…customers will place greater confidence in businesses, and businesses will minimise the all too common reputational and financial fallout of a breach.”

And as India looks at drafting its own privacy rules this year, Access Partnerships’ Johnson recommends it should look to “create a privacy law for India that’s substantively similar to GDPR, to help harmonise the two markets.”

For more details visit https://cis-india.org/internet-governance/news/quartz-india-may-24-2018-ananya-bhattacharya-complying-with-europes-gdpr-is-a-struggle-for-indian-it-firms

Inter Movements Open Forum: Trafficking Bill

Admin — 2018-08-18T09:21:02Z

On 18 May 2018 Gurshabad Grover on behalf of CIS presented comments on the Trafficking (Prevention, Protection and Rehabilitation) Bill 2018 at a meeting of the Inter Movements Open Forum jointly organised by Sangram, Naz Foundation, NNSW, Tarshi and VAMP. The meeting was held at India International Centre in New Delhi.

Gurshabad's presentation was based on Swaraj's blogpost and subsequent research by Kumarjeet that highlights certain problematic sections (36, 39, 41, 59) in the Bill which may have an adverse impact on freedom of expression, and may additionally change the landscape of intermediary liability rules in India.

Read the agenda here

Clarification (18th August, 2018): A letter sent to the Ministry of Women and Child Development mentioned the Centre for Internet & Society as instituionally endorsing a critique of the The Trafficking of Persons (Prevention, Protection and Rehabilitation) Bill, 2018. We seek to clarify that the Centre for Internet & Society did not endorse the letter to the Ministry.

For more details visit https://cis-india.org/internet-governance/news/inter-movements-open-forum-trafficking-bill

The law tries to catch up with tech

Admin — 2018-09-06T02:11:08Z

At his testimony before the U.S. Congress, Facebook CEO Mark Zuckerberg spoke about the upcoming elections in India.

The article by Arnika Thakur was published in Fortune India on May 22, 2018

“2018 is an incredibly important year for elections not just with the U.S. midterms, but around the world. There are important elections in India, in Brazil, in Mexico, in Pakistan, and in Hungary,” he said. “We want to make sure we do everything we can to protect the integrity of those elections.”

But is Zuckerberg’s assurance enough? Can Facebook truly ensure that there is no meddling in India’s general elections; political consulting firm Cambridge Analytica is accused of harvesting Facebook data of millions of people, and targeting them with ads designed to influence the Brexit referendum and the U.S. presidential election?

Instead, shouldn’t India proactively strengthen its data privacy laws?

India’s existing regulation on data protection—the Information Technology (IT) Act, 2000 in its original form, experts say, did not explicitly protect data. And even subsequent amendments were “retrofitting of the law”, says Sunil Abraham, executive director of the Centre for Internet & Society, a Bengaluru-based research and advocacy firm.

One amendment, Section 43-A, makes a “body corporate” possessing, dealing or handling any sensitive personal data or information liable to pay damages if it has been negligent in implementing and maintaining reasonable security practices, and thereby causing “wrongful loss or wrongful gain” to any person. The other amendment, Section 72-A, provides criminal remedy imprisonment of up to three years or a fine of up to Rs 5 lakh or both for disclosure of personal information in breach of lawful contract.

But Abraham says by specifying sensitive personal data, the law excludes breach or misuse of data that aren’t biometrics or the like. “Whenever you produce regulations in this manner those regulations are rarely comprehensive, and, therefore, we are in this situation,” he says. In other words, seemingly innocuous information such as a person’s pop culture interests, political ideology, literary preference, shopping history is not protected.

Under the current law, companies are also not responsible for notifying users if their data are breached. “The entire framework around notification, or how does a user know that their data has actually been affected by a breach; none of these provisions actually exist under Indian law,” says Amlan Mohanty, senior associate, technology and policy, PLR Chambers, a law firm.

Sahir Hidayatullah, CEO of Smokescreen Technologies, a cybersecurity firm, says since Indians are not culturally attuned to the idea of privacy, a comprehensive law is important.

India understands that the existing data protection law is behind the times. Last year, the government constituted a committee of experts chaired by former Supreme Court Justice B.N. Srikrishna to study the matter, make specific suggestions, and suggest a draft Data Protection Bill. In February, speaking on the sidelines of an international conference, India’s electronics and information technology minister Ravi Shankar Prasad said the committee will soon submit its report.

The lawmakers can perhaps take a cue from the European Union’s General Data Protection Regulation (GDPR), which will come into effect this May. Among other things, GDPR gives individuals greater rights to access data on them, correct inaccuracies, erase personal data in certain cases, and to even transfer their data from one firm to another.

GDPR also clearly defines consent. “The request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language,” it says. The law gives the users the right to withdraw their consent at any time. Currently, most Internet companies seek consent to multiple matters at once, usually when a new user registers for or downloads its service and it is often difficult, if at all, to review it. GDPR will change that in the EU.

Supratim Chakraborty, associate partner at law firm Khaitan & Co, says a clear regulation on consent is requisite in India, where many are first-time Internet users or do not understand English or are even illiterate. “When you obtain consent, it has to be understood in a proper manner by the people, and secondly, the people who are receiving the data are also obligated to protect it in a particular manner. That is something that we should gun for in the new law,” says Chakraborty.

Mohanty of PLR Chambers says GDPR also spells out the principles of applicability with clarity by stating the law will be applicable even on a foreign entity if the breach impacts an EU citizen. “The problem in India is ensuring that foreign companies operating in India are held accountable,” he says. “One of the key issues that India has to deal with is ensuring that the law that India passes is going to be applicable to entities that function outside India.”

Sivarama Krishnan, partner and leader, cybersecurity, at consultancy PwC India, says India also needs to address the issue of who or which body will implement the data protection law. “In the Western world, there is usually a privacy commission or authority, and resources to enforce the regulation. In India, there is lack of enforcement capability in the government to implement the existing regulation,” he says.

There is also the matter of the government’s priority. The union government’s biometric identification programme, Aadhaar, does not have a spotless record on data protection users’ data have on multiple times been breached, or even published online, by third party service providers, hackers, and even by government websites.

But India has seen serious consequences of weak data protection: A judge’s report on the 1993 Bombay riots found that voters’ lists and business registers were used by perpetrators to identify victims and their businesses.

Today, there is a lot more data a criminal can get access to, from a government identification programme to your Facebook profile to your smartphone’s GPS signal. No data breach is innocuous.

For more details visit https://cis-india.org/internet-governance/news/fortune-india-arnika-thakur-may-22-2018-law-tries-to-catch-up-with-tech

Privacy in the Digital Age: Addressing Common Challenges, Seizing Opportunities

Admin — 2018-05-24T10:45:56Z

DG Justice and Consumers and European Union is organizing a conference on privacy in the digital age on May 25, 2018 in New Delhi.

Agenda

Friday 25 May 2018, Reception to follow, The Lalit Hotel, Barakhamba Avenue, Connaught Place, New Delhi, India

9:00 a.m. Registration and welcome coffee
9:20 a.m. Welcome: Vera Jourova, EU Commissioner for Justice and Consumers (by video)
9:30 a.m. Opening remarks: Justice B.N. Srikrishna, chair of the Committee of Experts on a Data Protection Framework for India
Tomasz Kozlowski, Ambassador of the European Union to India

10:00 a.m. Panel 1 - Setting the scene: India at the crossroads

Moderator: Sunil Abraham, Executive Director, Centre for Internet and Society, India
Vinayak Godse, Senior Director, Data Protection, Data Security Council of India
Raman Jit Singh Chima, Policy Director, Access Now, India
Amba Kak, Public Policy Advisor, Mozilla, India
11:00 a.m.: Coffee break

11:15 a.m. Panel 2 - Modern data protection laws: towards global convergence

Moderator: Clarisse Girot, Data Privacy Project Lead, Asian Business Law Institute, Singapore
Ralf Sauer, Deputy Head of Unit, International data flows and protection, European Commission, Brussels
Malavika Jayaram, Executive Director, Digital Asia Hub, Hong Kong
Graham Greenleaf, Professor of Law & Information Systems, University of New South Wales, Australia (by video)

12:15 p.m. Panel 3 - Privacy and data security: a business opportunity

Moderator: Ralf Sauer, Deputy Head of Unit, International data flows and protection, European Commission, Brussels
Srinivas Poorsarla, Vice President and Head (Global), Privacy and Data Protection, Infosys, India
Ravi Sogi, Head - Product Security and Privacy, Philips
Riccardo Masucci, Global Director of Privacy Policy, Intel, Washington DC

1:15 p.m.: Reception

For more details visit https://cis-india.org/internet-governance/news/privacy-in-the-digital-age-addressing-common-challenges-seizing-opportunities

Indian Intermediary Liability Regime: Compliance with the Manila Principles on Intermediary Liability

divij — 2018-05-20T15:14:21Z

This report assesses the compliance of the Indian intermediary liability framework with the Manila Principles on Intermediary Liability, and recommends substantive legislative changes to bring the legal framework in line with the Manila Principles.

The report was edited by Elonnai Hickok and Swaraj Barooah

The report is an examination of Indian laws based upon the background paper to the Manila Principles as the explanatory text on which these recommendations have been based, and not an assessment of the principles themselves. To do this, the report considers the Indian regime in the context of each of the principles defined in the Manila Principles. As such, the explanatory text to the Manila Principles recognizes that diverse national and political scenario may require different intermediary liability legal regimes, however, this paper relies only on the best practices prescribed under the Manila Principles.

The report is divided into the following sections

Principle I: Intermediaries should be shielded by law from liability for third-party content
Principle II: Content must not be required to be restricted without an order by a judicial authority
Principle III: Requests for restrictions of content must be clear, be unambiguous, and follow due process
Principle IV: Laws and content restriction orders and practices must comply with the tests of necessity and proportionality
Principle V: Laws and content restriction policies and practices must respect due process
Principle VI: Transparency and accountability must be built into laws and content restriction policies and practices
Conclusion

Download the Full report here

For more details visit https://cis-india.org/internet-governance/blog/indian-intermediary-liability-regime

Fairness, Transparency and Accountable AI

Admin — 2018-05-20T14:26:59Z

Amber Sinha participated remotely in the inaugural meeting of Fairness, Transparency and Accountable AI working group of the Partnership on Artificial Intelligence on May 10, 2018. The meeting was held at DeepMind's office in London.

Agenda of the meeting here

For more details visit https://cis-india.org/internet-governance/news/fairness-transparency-and-accountable-ai

More errors in Aadhaar data in Andhra Pradesh than in voter database

Admin — 2018-05-20T14:04:00Z

As much as eight per cent of Aadhaar data collected in Andhra Pradesh has errors, mostly related to name, address and date of birth, which is more than the errors in the voter ID database. But still, 87% of rural residents approve mandatory linking of the unique ID with various schemes and services.

The article by U Sudhakar Reddy was published in the Times of India on May 18, 2018.

This was revealed in the State of Aadhaar report 2017-18 based on a survey carried out in three states — Andhra Pradesh, Rajasthan and West Bengal. The survey revealed that a majority of people in AP and Rajasthan preferred Aadhaar-based PDS delivery as they believed biometric authentication prevents identity fraud. On the flip side, at least 3 lakh people, which is 0.8% of PDS beneficiaries, were denied ration benefits due to Aadhaar issues, it found.

The survey found that among the three states, it was easiest to enrol for Aadhaar in AP. As many was 67% of people used Aadhaar as proof for opening bank accounts and 17% used it for Know Your Customer (KYC) verification. The survey also found that 96% of respondents valued privacy and wanted to know what the government will do with their data.

“The survey covered 2,947 rural households in 21 districts across the three states from Nov 2017 and Feb 2018,” the report by IDinsight, a development analytics firm, said. “Compared to voter IDs, the error-rate in Aadhaar was 1.5 times higher. While exclusion from PDS due to Aadhaar-related factors is significant, it is lower than exclusion explained by factors unrelated to Aadhaar,” said Ronald Abraham of IDinsight.

Reacting to the findings, Dr Ajay Bhushan Pandey, CEO of UIDAI, said: “The report highlights that Aadhaar has wide-scale support from people. Exclusion from PDS is due to failure of the local administration and should be taken very seriously.”

But critics found fault with the survey methodology. “If IDinsight asked respondents whether they preferred the UK system where you can get a SIM card without KYC or the Indian system with mandatory biometric authentication, then 100% of respondents would have opted for the UK approach. They have got an endorsement for use of biometrics due to their disingenuous survey design,” said Sunil Abraham, executive director, Centre for Internet and Society.

For more details visit https://cis-india.org/internet-governance/news/times-of-india-may-18-2018-u-sudhakar-reddy-more-errors-in-aadhaar-data-in-andhra-pradesh-than-in-voter-database

Rootconf 2018

Admin — 2018-05-18T06:40:31Z

Rootconf is an annual conference on DevOps and IT Infrastructure and is organised by HasGeek. On May 11 and 12, 2018, Gurshabad Grover, Natallia Khaniejo and Aayush Rathi attended Rootconf 2018.

Rootconf 2018 had two major themes - an infrastructure and systems security track and an infrastructure architecture track. All talks at the event were streamed live and videos of the same can be found at HasGeek's YouTube channel here.

Of special interest were the talks entitled 'Death of enterprise security: introduction to abstraction and machine-to-machine orchestration' by Pukhraj Singh and 'On ground realities of Aadhaar' by Rachna Khaira. Of special interest were the talks entitled 'Death of enterprise security: introduction to abstraction and machine-to-machine orchestration' byPukhraj Singh and 'On ground realities of Aadhaar' by Rachna Khaira.

Additionally, the community table was helpful for the purposes of outreach within the tech community about CIS' work and potential ways in which interested parties may engage with CIS.

For more details visit https://cis-india.org/internet-governance/news/rootconf-2018

India's Data Protection Framework Will Need to Treat Privacy as a Social and Not Just an Individual Good

amber — 2018-05-18T06:22:57Z

The idea that technological innovations may compete with privacy of individuals assumes that there is social and/or economic good in allowing unrestricted access to data. However, it must be remembered that data is potentially a toxic asset, if it is not collected, processed, secured and shared in the appropriate way.

Published in Economic & Political Weekly, Volume 53, Issue No. 18, 05 May, 2018. Article can be accessed online here.

In July 2017, the Ministry of Electronics and Information Technology (MeITy) in India set up a committee headed by a former judge, B N Srikrishna, to address the growing clamour for privacy protections at a time when both private collection of data and public projects like Aadhaar are reported to pose major privacy risks (Maheshwari 2017). The Srikrishna Committee is in the process of providing its input, which will go on to inform India’s data-protection law.

While the committee released a white paper with provisional views, seeking feedback a few months ago, it may be discussing a data protection framework without due consideration to how data practices have evolved.

In early 2018, a series of stories based on investigative journalism by Guardianand Observer revealed that the data of 87 million Facebook users was used for the Trump campaign by a political consulting firm, Cambridge Analytica, without their permissions. Aleksandr Kogan, a psychology researcher at the University of Cambridge, created an application called “thisisyourdigitallife” and collected data from 270,000 participants through a personality test using Facebook’s application programming interface (API), which allows developers to integrate with various parts of the Facebook platform (Fruchter et al 2018). This data was collected purportedly for academic research purposes only. Kogan’s application also collected profile data from each of the participants’ friends, roughly 87 million people.

The kinds of practices concerning the sharing and processing of data exhibited in this case are not unique. These are, in fact, common to the data economy in India as well. It can be argued that the Facebook–Cambridge Analytica incident is representative of data practices in the data-driven digital economy. These new practices pose important questions for data protection laws globally, and how these may need to evolve to address data protection, particularly for India, which is in the process of drafting its own data protection law.

Privacy as Control

Most modern data protection laws focus on individual control. In this context, the definition by the late Alan Westin (2015) characterises privacy as:

The claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to other.

The idea of “privacy as control” is what finds articulation in data protection policies across jurisdictions, beginning with the Fair Information Practice Principles (FIPP) from the United States (US) (Dixon 2006). These FIPPs are the building blocks of modern information privacy law (Schwartz 1999) and not only play a significant role in the development of privacy laws in the US, but also inform data protection laws in most privacy regimes internationally (Rotenberg 2001), including the nine “National Privacy Principles” articulated by the Justice A P Shah Committee in India. Much of this approach is also reflected in the white paper released by the committee, led by Justice Srikrishna, towards the creation of data protection laws in India (Srikrishna 2017)

This approach essentially involves the following steps (Cate 2006):

(i) Data controllers are required to tell individuals what data they wish to collect and use and give them a choice to share the data.
(ii) Upon sharing, the individuals have rights such as being granted access, and data controllers have obligations such as securing the data with appropriate technologies and procedures, and only using it for the purposes identified.

The objective in this approach is to make the individual empowered and allow them to weigh their own interests in exercising their consent. The allure of this paradigm is that, in one elegant stroke, it seeks to “ensure that consent is informed and free and thereby also (seeks) to implement an acceptable tradeoff between privacy and competing concerns.” (Sloan and Warner 2014). This approach is also easy to enforce for both regulators and businesses. Data collectors and processors only need to ensure that they comply with their privacy policies, and can thus reduce their liability while, theoretically, consumers have the information required to exercise choice. In recent years, however, the emergence of big data, the “Internet of Things,” and algorithmic decision-making has significantly compromised the notice and consent model (Solove 2013).

Limitations of Consent

Some cognitive problems, such as long and difficult to understand privacy notices, have always existed with regard to the issue of informed consent, but lately these problems have become aggravated. Privacy notices often come in the form of long legal documents, much to the detriment of the readers’ ability to understand them. These policies are “long, complicated, full of jargon and change frequently” (Cranor 2012).

Kent Walker (2001) lists five problems that privacy notices typically suffer from:

(i) Overkill: Long and repetitive text in small print.
(ii) Irrelevance: Describing situations of little concern to most consumers.
(iii) Opacity: Broad terms that reflect limited truth, and are unhelpful to track and control the information collected and stored.
(iv) Non-comparability: Simplification required to achieve comparability will lead to compromising of accuracy.
(v) Inflexibility: Failure to keep pace with new business models.

Today, data is collected continuously with every use of online services, making it humanly impossible to exercise meaningful consent.
The quantity of data being generated is expanding at an exponential rate. With connected devices, smartphones, appliances transmitting data about our usage, and even the smart cities themselves, data now streams constantly from almost every sector and function of daily life, “creating countless new digital puddles, lakes, tributaries and oceans of information” (Bollier 2010).

The infinitely complex nature of the data ecosystem renders consent of little value in cases where individuals may be able to read and comprehend privacy notices. As the uses of data are so diverse, and often not limited by a purpose identified at the beginning, individuals cannot conceptualise how their data will be aggregated and possibly used or reused.

Seemingly innocuous bits of data revealed at different stages could be combined to reveal sensitive information about the individual. While the regulatory framework is designed such that individuals are expected to engage in cost–benefit analysis of trading their data to avail services, this ecosystem makes such individual analysis impossible.

Conflicts Between Big Data and Individual Control

The thrust of big data technologies is that the value of data resides not in its primary purposes, but in its numerous secondary purposes, where data is reused many times over (Schoenberger and Cukier 2013).

On the other hand, the idea of privacy as control draws from the “data minimisation” principle, which requires organisations to limit the collection of personal data to the minimum extent necessary to obtain their legitimate purpose and to delete data no longer required. Control is excercised and privacy is enhanced by ensuring data minimisation. These two concepts are in direct conflict. Modern data-driven businesses want to retain as much data as possible for secondary uses. Since these secondary uses are, by their nature, unanticipated, their practices run counter to the very principle of purpose limitation (Tene and Polonetsky 2012).

It is evident from such data-sharing practices, as demonstrated by the Cambridge Analytica–Facebook story, that platform architectures are designed with a clear view to collect as much data as possible. This is amply demonstrated by the provision of a “friends permission” feature by Facebook on its platform to allow individuals to share information not just about themselves, but also about their friends. For the principle of informed consent to be meaningfully implemented, it is necessary for users to have access to information about intended data practices, purposes and usage, so they consciously share data about themselves.

In reality, however, privacy policies are more likely to serve as liability disclaimers for companies than any kind of guarantee of privacy for consumers. A case in point is Mark Zuckerberg’s facile claim that there was no “data-breach" in the Cambridge Analytica–Facebook incident. Instead of asking each of the 87 million users whether they wanted their data to be collected and shared further, Facebook designed a platform that required consent in any form only from 270,000 users. Not only were users denied the opportunity to give consent, their consent was assumed through a feature which was on by default. This is representative of how privacy trade-offs are conceived by current data-driven business models. Participation in a digital ecosystem is by itself deemed as users’ consent to relinquish control over how their data is collected, who may have access to it, and what purposes it may be used for.

Yet, Zuckerberg would have us believe that the primary privacy issue of concern is not about how his platform enabled the collection of users’ data without their explicit consent, but in the subsequent unauthorised sharing of the data by Kogan. Zuckerberg’s insistence that collection of data of people without their consent is not a data breach is reminiscent of the UIDAI’s recent claims in India that publication of Aadhaar numbers and related information by several government websites is not a data breach, so long as its central biometric database in secure (Sharma 2018). In such cases also, the intended architecture ensured the seeding of other databases with Aadhaar numbers, thus creating multiple potential points of failure through disclosure. Similarly, the design flaws in direct benefit transfers enabled Airtel to create payments bank accounts with the customers’ knowledge (Hindu Business Line 2017). Such claims clearly suggest the very limited responsibility data controllers (both public and private) are willing to take for personal data that they collect, while wilfully facilitating and encouraging data practices which may lead to greater risk to data.

On this note, it is also relevant to point out that the Srikrishna committee white paper begins with identifying informational privacy and data innovation as its two key objectives. It states that “a firm legal framework for data protection is the foundation on which data-driven innovation and entrepreneurship can flourish in India.”

Conversations around privacy and data have become inevitably linked to the idea of technological innovation as a competing interest. Before engaging in such conversations, it is important to acknowledge that the value of innovation as a competing interest itself is questionable. It is not a competing right, nor a legitimate public interest endeavour, nor a proven social good.

The idea that in policymaking, technological innovations may compete with privacy of individuals assumes that there is social and/or economic good in allowing unrestricted access to data. The social argument is premised on the promises of mathematical models and computational capacity being capable of identifying key insights from data. In turn, these insights may be useful in public and private decision-making. However, it must be remembered that data is potentially a toxic asset, if it is not collected, processed, secured and shared in the appropriate way. Sufficient research suggests that indiscriminate data collection is greatly increasing the ratio of noise to signal, and can lead to erroneous insights. Further, the greater the amount of data you collect, the greater is the attack surface that leads to cybersecurity risks. Further, incidents such as Facebook–Cambridge Analytica demonstrate that toxicity of data in various ways and underscores the need for data regulation at every stage of the data lifecycle (Scheiner 2016). These are important tempering factors that need to be kept in mind while evaluating data innovation as a key mover of policy or regulation.

Privacy as Social Good

As long as privacy is framed as arising primarily from individual control, data controllers will continue to engage in practices that compromise the ability to exercise choice. There is a need to view privacy as a social good, and policymaking should ensure its preservation and enhancement. Contractual protections and legal sanctions can themselves do little if platform architectures are designed to do the exact opposite.

More importantly, policymaking needs to recognise privacy not merely as an individual right, available for individuals to forego when engaging with data-driven business models, but also as a social good. The recognition of something as a social good deems it desirable by definition, and a legitimate goal of law and policy, rather than rely completely on market forces for its achievement.

The Puttaswamy judgment (K Puttaswamy v Union of India 2017) lends sufficient weight to privacy’s social value by identifying it as fundamental to any individual development through its dependence on solitude, anonymity, and temporary releases from social duties.

Sociological scholarship demonstrates that different types of social relationships, be it Gesellschaft (interest groups and acquaintances) or Gemeinschaft (friendship, love, and marriage), and the nature of these relationships depend on the ability to conceal certain things (Simmel 1906). Demonstrating this in the context of friendships, it has been stated that such relationships “present a very peculiar synthesis in regard to the question of discretion, of reciprocal revelation and concealment.” Friendships, much like most other social relationships, are very much dependent on our ability to selectively present ourselves to others. Contrast this with Zuckerberg’s stated aim of making the world more “open” where information about people flows freely and effectively without any individual control. Contrast this also with government projects such as the Aadhaar which intends to act as one universal identity which can provide a 360-degree view of citizens.

Other scholars such as Julie Cohen (2012) and Anita Allen (2011) have demonstrated that data that a person produces or has control over concerns both herself and others. Individuals can be exposed not only because of their own actions and choices, but also made vulnerable merely because others have been careless with their data. This point is amply demonstrated in the Facebook–Cambridge Analytica incident. What this means is that protection of privacy requires not just individual action, but in a sense, requires group co-ordination. It is my argument that this group interest of privacy as a social good must be the basis of policymaking and regulation of data in the future, in addition to the idea of privacy as an individual right. In the absence of attention to the social good aspect of privacy, individual consumers are left to their own devices to negotiate their privacy trade-offs with large companies and governments and are significantly compromised.

What this translates into is a regulatory framework and data protection frameworks should not be value-neutral in their conception of privacy as a facet of individual control. The complete reliance of data regulation on the data subject to make an informed choice is, in my opinion, an idea that has run its course. If privacy is viewed as a social good, then the data protection framework, including the laws and the architecture must be designed with a view to protect it, rather than leave it entirely to the market forces.

The Way Forward

Data protection laws need to be re-evaluated, and policymakers must recognise Lawrence Lessig’s dictum that “code is law.” Like laws, architecture and norms can play a fundamental role in regulation. Regulatory intervention for technology need not mean regulation of technology only, but also how technology itself may be leveraged for regulation (Lessig 2006; Reidenberg 1998). It is key that the latter is not left only in the hands of private players.
Zuckerberg, in his testimony (Washington Post 2018) before the United States Senate's Commerce and Judiciary committees, asserted that "AI tools" are central to any strategy for addressing hate speech, fake news, and manipulations that use data ecosystems for targeting.

What is most concerning in his testimony is the complete lack of mention of standards, public scrutiny and peer-review processes, which “AI tools” and regulatory technologies need to be subject to. Further, it cannot be expected that data-driven businesses will view privacy as a social good or be publicly accountable.

As policymakers in India gear up for writing the country’s data protection law, they must acknowledge that their responsibility extends to creating norms and principles that will inform future data-driven platforms and regulatory technologies.

Since issues of privacy and data protection will have to be increasingly addressed at the level of how architectures enable data collection, and more importantly how data is used after collection, policymakers must recognise that being neutral about these practices is no longer enough. They must take normative positions on data collection, processing and sharing practices. These positions cannot be implemented through laws only, but need to be translated into technological solutions and norms. Unless a multipronged approach comprising laws, architecture and norms is adopted, India’s new data protection regime may end up with limited efficacy.

For more details visit https://cis-india.org/internet-governance/blog/epw-amber-sinha-may-18-2018-for-indias-data-protection-regime-to-be-efficient-policymakers-should-treat-privacy-as-a-social-good

Indian Cricket Board Exposes Personal Data of Thousands of Players

Admin — 2018-05-18T05:01:50Z

The IT security researchers at Kromtech Security Center discovered a trove of personal and sensitive data belonging to around 15,000 to 20,000 Indian applicants participating in cricket seasons 2015-2018.

The blog post was published on Hack Read on May 15, 2018.

The authority responsible for protecting this data was The Board of Control for Cricket in India (BCCI) but it was left exposed to the public in two misconfigured AWS (Amazon Web Service) S3 cloud storage buckets.

According to the analysis from Kromtech researchers, the data was divided into different categories of players including those under 19 years old. The data was accessible to anyone with an Internet connection and basic knowledge of using AWS cloud storage.

The data was discovered earlier this month and included names, date of birth, place of birth, permanent addresses, email IDs, proficiency details, medical records, birth certificate number, passport number, SSC certificate number, PAN card number, mobile number, landline and phone number of the person who can be contacted in case of emergency.

Screenshot of one of the files that were exposed (Image credit: Kromtech)

At the time of publishing this article, the BCCI was informed by Kromtech researchers and both misconfigured buckets were secured. However, this is not the first time when such sensitive information was leaked online. In 2017, Bangalore-based Centre for Internet and Society (CIS) found that names, addresses, date of birth, PAN card details, Aadhaar card numbers and other relevant details of millions of Indian citizen could be found with just a simple Google search.

On the other hand, lately, AWS buckets have been making headlines for the wrong reasons. Until now, there have been tons of cases in which misconfigured AWS buckets have been found carrying highly sensitive and confidential data such as classified NSA documents or details about US Military’s social media spying campaign.

In two such cases, malicious hackers were able to compromise AWS buckets belonging to Tesla Motors and LA Times to secretly mine cryptocurrency. Therefore, if you are an AWS user make sure your cloud server is properly secured.

For more details visit https://cis-india.org/internet-governance/news/hack-read-waqas-may-15-2018-indian-cricket-board-exposes-personal-data-of-thousands-of-players

Internet Shutdown Stories

ambika — 2019-09-03T09:57:40Z

The Centre for Internet & Society (CIS) has published a collection of stories of the impact of internet shutdowns on people's lives in the country. This book seeks to give a glimpse into the lives of those directly affected by these internet shutdown experiments. When seen in a larger context, we hope that the stories in this book also demonstrate that access to the internet and freedom of speech is not just about an individual’s rights, but are also required for the collective good. This is a project funded by Facebook and MacArthur Foundation, and the stories were provided by 101 Reporters. Case studies from the states of Jammu & Kashmir, Haryana, Rajasthan, Gujarat, Telangana, West Bengal, Tripura, Manipur, Nagaland, and Uttar Pradesh have been highlighted in this compilation.

Read the report here: Download (PDF)

The report is shared under Creative Commons Attribution-NoDerivatives 4.0 International license.

Edited by Debasmita Haldar, Ambika Tandon, and Swaraj Barooah

Print Design by Saumyaa Naidu

Advisor: Nikhil Pahwa, Founder and Editor at MediaNama

Foreword

Aside from the waves of innovation that the digital revolution brought with it, the ever increasing pervasiveness of the internet has had a tremendous impact on empowerment and freedoms in society. We are seeing unprecedented levels of access to information, along with a democratization of the means of creation, production and dissemination of information to anyone with an internet connection. This in turn has greatly amplified, and in many cases even created the ability, particularly for those traditionally left in the margins, to more meaningfully participate in their global as well as local societies. Recognising the significance of the internet to the freedom of expression as well as for the development and exercising of human rights more broadly, the United Nations Human Rights Council unanimously passed a resolution confirming internet access being a fundamental human right.

Simultaneously however, we are seeing Indian states discover and experiment with their power to clamp down on these new modes of communication for a variety of reasons, ranging from the ill-intentioned to the ill-informed. An internet shutdown tracker maintained by the Software Freedom Law Centre, shows that the number of shutdowns in India is increasing every year, with 70 shutdowns reported in 2017,and 45 shutdowns already reported from 1st Jan, 2018 to 4th May, 2018. These shutdowns also come at a significant economic cost. A 2016 Brookings report estimates that India faced a loss of about $968 million due to internet shutdowns. However, the democratic harms we have been accruing are more difficult to quantify and demonstrate.

This book seeks to give a glimpse into the lives of those directly affected by these internet shutdown experiments. From Jammu and Kashmir to Telangana, from Gujarat to Nagaland, we have collected 30 stories from across the country for an up-close look at how the everyday lives of common citizens have been impacted by internet shutdowns and website blocks. From CRPF members posted in Srinagar who use the internet to connect with their family, to students who have been cut off from education resources for competitive exams; from the disruptions in day to day life brought about by non-functional bank services in Darjeeling, to stock brokers in Ahmedabad who faced costly slowdowns; the idea of a Digital India is facing severe setbacks with these continuously increasing internet shutdowns.

When seen in a larger context, we hope that the stories in this book also demonstrate that access to the internet and freedom of speech is not just about an individual’s rights, but are also required for the collective good. The diversity of perspectives and activities that a healthy democracy demands is not met by the versioning of dominant narratives, but by allowing for, if not directly encouraging, the voices and activities of the unheard, oppressed and marginalised. We hope that in the telling of these personal stories of the day-to-day of people affected by such internet shutdowns, this book joins in the effort to position the dehumanized internet kill switches more aptly as dangers to democracy.

Sunil Abraham
Executive Director
The Centre for Internet and Society

For more details visit https://cis-india.org/internet-governance/blog/internet-shutdown-stories

AI in the Banking and Finance Industry in India

Saman Goudarzi, Elonnai Hickok and Amber Sinha — 2018-06-19T11:48:39Z

This is a draft report that seeks to map the present state of use of AI in the banking and financial sector in India.

This draft report was prepared by Saman Goudarzi, Elonnai Hickok and Amber Sinha. It was edited by Shyam Ponappa. Mapping was done by Shweta Mohandas. Pranav M Bidare, Sidharth Ray, and Aayush Rathi provided research assistance in preparing this report.

Executive Summary

In the last couple of years, the finance and banking sectors in India have increasingly deployed and implemented AI technologies. Such technologies are being implemented for front-end and back end processes – offering solutions for both financial and business management operations. At the moment, the AI landscape appears to be overwhelmingly populated by natural language processing and natural language generation technologies culminating in numerous chatbot initiatives by various banking and financial actors. Arguably more significant – but less documented – is the usage of said technologies for financial decision making on a variety of issues including, credit-scoring, transactions, wealth and risk management, and fraud detection. These trends are largely facilitated by technology service companies – both large-scale firms and startups – that either work with established banking and financial institutions to deploy AI technologies or develop and offer their own financial services directly to consumers.

This draft report seeks to map the present state of use of AI in the banking and financial sector in India. In doing so, it explores:

Uses: What is the present use of AI in banking and finance? What is the narrative and discourse around AI and banking/finance in India?
Actors: Who are the key stakeholders involved in the development, implementation and regulation of AI in the banking/finance sector?
Impact: What is the potential and existing impact of AI in the banking and finance sectors?
Regulation: What are the challenges faced in policy making around AI in the banking and finance sectors?

The draft report first offers an overview of the ways in which AI is being used in the sector. This is followed by an examination of existing challenges to the adoption of AI and the significant legal and ethical concerns that need to be considered in light of these trends. Lastly, the draft report draws attention to a number of key government actions and initiatives surrounding AI related to the banking and finance industry, discusses challenges to the adoption and implementation of AI and articulates recommendations towards addressing the same.

Download the draft report here

19th June Update: This case study has been modified to remove interview quotes, which are in the process of being confirmed. The link above is the latest draft of the report.

For more details visit https://cis-india.org/internet-governance/blog/ai-in-banking-and-finance