We are anonymous, we are legion

Artificial Intelligence for Growth: Leveraging AI and Robotics for India's Economic Transformation

Admin — 2018-05-05T09:08:07Z

Amber Sinha took part in the second international conference organized by ASSOCHAM at Hotel Shangri-La in New Delhi on April 27, 2018.

Keynote Address

12.15 p.m. - 12.30 p.m.: Shri Gopalakrishnan S., Joint Secretary, Ministry of Electronics and IT, Government of India

Special Address

12.30 p.m. - 12.45 p.m.: Dr. Pushpak Bhattacharyya, Director and Professor, Computer Science and Engg, IIT Patna and Chairman, BIS Committee for Standardisation in Artificial Intelligence

Panel Discussion

Session Moderator

12.45 p.m. - 1.40 p.m.: Shri Sudipta Ghosh, India Leader, Data and Analytics, PwC

Panelists

Shri Amber Sinha, Senior Programme Manager, Centre for Internet and Society
Shri Utpal Chakraborty, Lead Architect - AI, L&T Infotech
Shri Atul Rai, CEO & Co-Founder, Staqu Technologies
Shri Prabhat Manocha, IBM

For more details visit https://cis-india.org/internet-governance/news/artificial-intelligence-for-growth-leveraging-ai-and-robotics-for-indias-economic-transformation

#NAMApolicy on Online Content Regulation

Admin — 2018-05-05T01:52:21Z

Swaraj Barooah attended the #NAMApolicy on Online Content Regulation organized by Media Nama at India Habitat Centre in New Delhi on May 3, 2018.

Agenda

01:30 p.m. - 03:00 p.m.: Panel #1 & Open House - News

03:00 p.m. - 03:15 p.m.: Tea break

03:15 p.m. - 04:45 p.m.: Panel #2 & Open House - Entertainment

04:45 p.m. - 05:15 p.m.: Remaining issues

05:15 p.m. - 06:00 p.m.: High-tea

01:30 p.m. - 03:00 p.m.: Panel #1 & Open House - News03:00 p.m. - 03:15 p.m.: Tea break03:15 p.m. - 04:45 p.m.: Panel #2 & Open House - Entertainment
04:45 p.m. - 05:15 p.m.: Remaining issues
05:15 p.m. - 06:00 p.m.: High-tea

For more details visit https://cis-india.org/internet-governance/news/namapolicy-on-online-content-regulation

Cyber experts say 'playground open' for influencing elections

Admin — 2018-05-03T03:17:33Z

Cyber experts said that under the provisions provided by 43 (A) of Indian IT Act, two types of data collection are completely legal: first, the data shared by the user in the public domain and secondly, the data published by the social platforms, like Facebook.

This article was published in the Economic Times on May 2, 2018. Sunil Abraham was quoted.

With the Karnataka Assembly elections round the corner, the cyber experts have said that it is quite possible to influence elections in India.

Talking to ANI, cyber expert Sunil Abraham did not rule out the possibility of influencing the voters as India does not have data protection law in place.

He said under the provisions provided by 43 (A) of Indian IT Act, two types of data collection are completely legal: first, the data shared by the user in the public domain and secondly, the data published by the social platforms, like Facebook and Twitter, which was shared by the user for his/her friends.

"Both these types of data are not considered sensitive personal data. Under Indian law, if they are collecting your biometrics, passwords and health information only then they need your consent," Abraham told in an exclusive interview.

Replying a question about the chances of political parties influencing elections, Abraham said, "One cannot answer this question with a clear yes or no. But, the more a political party has in its database about you; the more they can micro-target you for various types of advertising."

He, however, said with the literacy level of Indian internet users, the chances are high that they can be manipulated.

"Once they do this, especially in a country where 30 percent of the public is illiterate and only 10 percent of public knows English and many-many users have just come online, there is a high chance that these users can be manipulated," the cyber expert said.

When asked can it be termed influence, he said, "It will definitely be an influence. Most of the internet users in India have just come online, they don't have media literacy; they have not consumed older technologies like television and broadcast media like radio sufficiently enough so it is easy for these users to get fooled by the content that is propaganda and fake news etcetera."

Abraham said it is unlikely that India will have a data protection law before 2019 general elections, which means the playground is open for people with a clever idea to manipulate voters.

"India is working on data protection laws from last eight years. With the existing laws; all the political parties, social media companies, and search engine optimization companies etcetera can do what they want and they won't get into trouble. So, it is very unlikely that this data protection law is going to be approved by Parliament the 2019 elections. So for the 2019 elections, it is going to be very exciting times because anybody who has any clever idea when it comes to manipulating voters, they will definitely try it. Because, there is no law to stop them from trying those tricks," the cyber expert said.

Replying to another question about India's position in data security, he said, 'India is lagging as per the global trend across the world. The European Union's world-class data protection law called 'General Data Protection Regulation' is being followed by all the countries with the exception of the US. About 108 countries have the data protection laws which look similar to the EU's General Data Protection Regulation."

He, however, added, "We shouldn't be upset because making a law in a big country like India takes time. Shri Krishna Committee is going to present the draft of the Indian data protection law and hopefully, within one or two years India will have data protection law."

Another expert Shubhamangala Sunil told ANI that "In India, our data is not secure today. Be it politicians or businesses, they want the database of people. Many data breaches have already happened and they are being used for different propagandas".

She said the union government and state governments should come forward and tell people about data security measures instead of people complaining about the data breach.

She also said India is at least 10 years behind in comparison with the world in the cyber security domain.

The comments of the experts have come in the backdrop of recently data breach in the Facebook wherein its CEO Mark Zuckerberg faced US Congress for two days over the data theft. The Facebook-Cambridge Analytica data scandal involves the collection of personally identifiable information of up to 87 million Facebook users and almost certainly a much greater number that Cambridge Analytica began collecting in 2014.

For more details visit https://cis-india.org/internet-governance/news/economic-times-may-2-2018-cyber-experts-say-playground-open-for-influencing-elections

Data Usage by Political Parties

Admin — 2018-05-03T03:14:02Z

Sunil Abraham spoke to ANI regarding collection of data and its use by political parties for electoral gains.

In law, if bio metrics, passwords & health info are collected, only then consent is needed. The more a political party has in its database, the more they can micro-target you. It'll be an influence: Sunil Abraham,cyber expert on date usage by political parties #KarnatakaElections pic.twitter.com/eUk478jJbB
— ANI (@ANI) 1 May 2018

See the original here

For more details visit https://cis-india.org/internet-governance/news/ani-may-2-2018-data-usage-by-political-parties

Now, Twitter too caught up in Cambridge Analytica controversy

Admin — 2018-05-02T02:49:25Z

Twitter does not share a break-up of users by region, the platform has less than 100 million users in India.

The article by Prasun Sonwalkar and Vidhi Choudhury was published in the Hindustan Times on April 30, 2018. Sunil Abraham was quoted.

Social media company Twitter Inc sold data to the University of Cambridge academic Aleksandr Kogan who harvested millions of Facebook users’ information without their knowledge, it has emerged, although the company has clarified that no private data was accessed.

It isn’t clear whether any of the data pertained to Indian users.

Twitter does not share a break-up of users by region, the platform has less than 100 million users in India.

Kogan, who created tools that allowed political consultancy Cambridge Analytica to psychologically profile and target voters, bought the data from the microblogging website in 2015, well before the recent scandal, involving use of the data of Facebook users, came to light.

According to The Daily Telegraph, Kogan bought data on tweets, user names, photos, profiles and locations over a five-month period between December 2014 and April 2015 through his company Global Science Research (GSR). Twitter said it had banned GSR and Cambridge Analytica from buying data or running advertisements on the website and that no private data had been accessed, while Kogan insisted the data had only been used to create "brand reports" and "survey extender tools" and that he had not violated Twitter's policies.

The daily reported that Twitter charges companies and organisations for large data sets that are particularly useful for gleaning public opinion or receptiveness to certain topics and ideas, although Twitter bans companies from using the data to derive sensitive political information or matching it with personal information obtained elsewhere.

A Twitter spokesman confirmed the ban and said: "Twitter has also made the policy decision to off-board advertising from all accounts owned and operated by Cambridge Analytica. This decision is based on our determination that Cambridge Analytica operates using a business model that inherently conflicts with acceptable Twitter Ads business practices. "Cambridge Analytica may remain an organic user on our platform, in accordance with the Twitter Rules."

The company said it does not allow "inferring or deriving sensitive information like race or political affiliation, or attempts to match a user's Twitter information with other personal identifiers" and that it had staff in place to police this "rigorously".

Sunil Abraham, founder for think tank Centre for Internet and Society said: “Even though Twitter claims it has contracts in place and staff for contractual enforcement, I cannot understand how they will prevent those buying their data from inferring race and political affiliation. Especially in jurisdictions like ours without comprehensive data protection law.”

A Cambridge Analytica spokesman said the company used Twitter for political advertising but insisted that it had never "undertaken a project with GSR focusing on Twitter data and Cambridge Analytica has never received Twitter data from GSR”.

Delhi-based lawyer Apar Gupta said, “Since we do not have a data protection law at present we are more or less dependent on the proactive disclosures by Twitter. Facebook is not a gold standard of upholding user rights and it is hoped that we soon have a regulator that can enforce such disclosures and place penalties.”

On 5 April, Facebook said user data of more than 560,000 Indians may have been harvested by British researcher Cambridge Analytica, at the centre of a recent storm over data breaches and potential privacy violations on the social media network.

“Twitter or Facebook are not alone in harvesting and storing user data. This is a widespread industry practice that relies on profiling. Such breaches and malpractices will continue to occur till we have a set of defined norms and enforceable penalties to protect user rights,” Gupta further added.

Only 335 users in India installed the thisisyourdigitallife app developed by academic Kogan and his company Global Science Research that may have been possibly at the centre of the data breaches, according to Facebook. The 335 people make up just 0.1% of the app’s total worldwide installs. Users agreed to take a personality test and have their data collected by the app, which then went on to also access information about the test-takers’ Facebook friends, leading to the accumulation of a much larger data pool.

Twitter Inc’s spokesperson said in an e-mail that an internal review conducted by it showed GSR had not accessed any private data.

“Unlike many other services, Twitter is public by its nature. People come to Twitter to speak publicly, and public Tweets are viewable and searchable by anyone. In 2015, Global Science Research (GSR) did have one-time API access to a random sample of public Tweets from a five-month period from December 2014 to April 2015,” the company statement added.

This is basically information that users chose to make public.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-april-30-2018-prasun-sonwalkar-vidhi-choudhury-now-twitter-too-caught-up-in-cambridge-analytica-controversy

April 2018 Newsletter

praskrishna — 2018-05-20T14:57:47Z

Dear readers,

Previous issues of the newsletters can be accessed here.

Highlights
In 2016, WhatsApp Inc announced it was rolling out end-to-end encryption, but is the company doing what it claims to be doing? Sunil Abraham and Aayush Rathi explores this in an article which was published in Asia Times on April 20, 2018. CIS submitted comments to the Ministry of Health & Family Welfare, Government of India on the draft Digital Information Security in Healthcare Act on April 21, 2018. CIS had conducted research on the issues of privacy, data protection and data security since 2010 and is thankful for the opportunity to put forth its views. A blog post by Swaraj Paul Barooah examines two badly drafted provisions of the new Anti-Trafficking bill that have the potential to severely impinge upon the Freedom of Expression, including through a misunderstanding of intermediary liability. A chapter by P.P. Sneha was published in 'Making Things and Drawing Boundaries: Experiments in the Digital Humanities' edited by Jentery Sayers. The chapter throws light on some of the questions that arise around the processes by which digital objects are ‘made’ and made available for arts and humanities research and practice, by drawing on recent work in text and film archival initiatives in India. CIS made a submission to the Indian Patent Office on the issue of Statement of Working as per Form 27 under the Patents Act, 1970. Select stakeholders were invited to the consultation meeting held on April 6, 2018. Anubha Sinha attended it along with a few other public-spirited stakeholders. She made a statement stressing on the requirement of the patent system to serve the welfare-purpose and not create mere non-working/ blocking monopolies; and that the argument of representatives of patentees about non-working of patents being the existing norm, and that they cannot be questioned about this, is absolutely against the central tenets of patent law.

Highlights

In 2016, WhatsApp Inc announced it was rolling out end-to-end encryption, but is the company doing what it claims to be doing? Sunil Abraham and Aayush Rathi explores this in an article which was published in Asia Times on April 20, 2018.
CIS submitted comments to the Ministry of Health & Family Welfare, Government of India on the draft Digital Information Security in Healthcare Act on April 21, 2018. CIS had conducted research on the issues of privacy, data protection and data security since 2010 and is thankful for the opportunity to put forth its views.

A blog post by Swaraj Paul Barooah examines two badly drafted provisions of the new Anti-Trafficking bill that have the potential to severely impinge upon the Freedom of Expression, including through a misunderstanding of intermediary liability.

A chapter by P.P. Sneha was published in 'Making Things and Drawing Boundaries: Experiments in the Digital Humanities' edited by Jentery Sayers. The chapter throws light on some of the questions that arise around the processes by which digital objects are ‘made’ and made available for arts and humanities research and practice, by drawing on recent work in text and film archival initiatives in India.
CIS made a submission to the Indian Patent Office on the issue of Statement of Working as per Form 27 under the Patents Act, 1970. Select stakeholders were invited to the consultation meeting held on April 6, 2018. Anubha Sinha attended it along with a few other public-spirited stakeholders. She made a statement stressing on the requirement of the patent system to serve the welfare-purpose and not create mere non-working/ blocking monopolies; and that the argument of representatives of patentees about non-working of patents being the existing norm, and that they cannot be questioned about this, is absolutely against the central tenets of patent law.

Articles:

Digital Native: Delete Facebook? (Nishant Shah; Indian Express; April 8, 2018).

Digital Native: The e-wasteland of our times (Nishant Shah; Indian Express; April 22, 2018).
What’s up with WhatsApp? (Aayush Rathi and Sunil Abraham; Asia Times; April 23, 2018).

CIS in the News:

Cambridge Analytica row: Facebook data breach hit 560K Indian users (Vidhi Choudhury and Yashwant Raj; Hindustan Times; April 5, 2018).
Govt websites face major outage; hacking ruled out (Hindu Businessline; April 6, 2018).
After data leak row, Facebook imposes restrictions on user data access (Romita Majumdar and Kiran Rathee; Business Standard; April 6, 2018).
It Took Just 355 Indians to Mine the Data of 5.6 Lakh Facebook Users. Here's How (CNN-News 18; April 7, 2018).
It feeds on you! (Anita Babu; The Week; April 8, 2018).
Pension won’t be denied for want of Aadhaar, says EPFO (Prashant K. Nanda and Komal Gupta; Livemint; April 11, 2018).
Facebook’s fake news clean-up hits language barrier (Nilesh Christopher; Economic Times; April 13, 2018).
Is This The Beginning Of The End For Facebook? (Bloomberg Quint; April 15, 2018).
Metrolife: Brutality porn has sadly many takers in India (Nina C. George; Deccan Herald; April 18, 2018).
Aadhaar data of over 89 lakh MNREGA workers in Andhra Pradesh leaked online (New Indian Express; April 27, 2018).
You Are Not the Only One: India stares at a loneliness epidemic (Asad Ali and Tabassum Barnagarwala; Indian Express; April 29, 2018).
Now, Twitter too caught up in Cambridge Analytica controversy (Prasun Sonwalkar and Vidhi Choudhury; Hindustan Times; April 30, 2018).

-----------------------------------
Access to Knowledge
-----------------------------------
Our Access to Knowledge programme currently consists of two projects. The Pervasive Technologies project, conducted under a grant from the International Development Research Centre (IDRC), aims to conduct research on the complex interplay between low-cost pervasive technologies and intellectual property, in order to encourage the proliferation and development of such technologies as a social good. The Wikipedia project, which is under a grant from the Wikimedia Foundation, is for the growth of Indic language communities and projects by designing community collaborations and partnerships that recruit and cultivate new editors and explore innovative approaches to building projects.

►Copyright and Patent

Submission

CIS' Submission on Statement of Working of Patents (Anubha Sinha; April 10, 2018).

►Wikipedia

Event Organized

Sambad Health and Women Edit-a-thon (April 15, 2018).

Blog Entries

Telugu Wikisource Feature Book in Pustakam.net (Pavan Santhosh; April 17, 2018).
Institutional Partnership with Tribal Research & Training Institute (Subodh Kulkarni; April 18, 2018).
Exploring Wikimedia platforms in Dialogue on the Urban Rivers of Maharashtra (Subodh Kulkarni; April 22, 2018).

-----------------------------------

Internet Governance
-----------------------------------

As part of its research on privacy and free speech, CIS is engaged with two different projects. The first one (under a grant from Privacy International and IDRC) is on surveillance and freedom of expression (SAFEGUARDS). The second one (under a grant from MacArthur Foundation) is on restrictions that the Indian government has placed on freedom of expression online.

►Privacy

Submission

Comments on the Draft Digital Information Security in Healthcare Act (Amber Sinha and Shweta Mohandas; April 22, 2018).

Analysis

Revenge Porn Laws across the World (Shradha Nigam; April 25, 2018).

Blog Entries

Government gives free publicity worth 40k to Twitter and Facebook (Akriti Bopanna; April 10, 2018).

Artificial Intelligence in Governance: A Report of the Roundtable held in New Delhi (Saman Goudarzi and Natallia Khaniejo; April 19, 2018).

►Free Speech and Expression

Blog Entries

A look at two problematic provisions of the draft Anti-trafficking bill (Swaraj Paul Barooah; April 21, 2018).

DIDP Request #29 - Revenue breakdown by source for FY 2017 (Akriti Bopanna; April 26, 2018).

►Cyber Security

Event Organized

Workshop on Python (April 14, 2018; CIS, Bengaluru).

-----------------------------------
Researchers at Work
-----------------------------------

The Researchers at Work (RAW) programme is an interdisciplinary research initiative driven by an emerging need to understand the reconfigurations of social practices and structures through the Internet and digital media technologies, and vice versa. It aims to produce local and contextual accounts of interactions, negotiations, and resolutions between the Internet, and socio-material and geo-political processes:

Article

Making Humanities in the Digital: Embodiment and Framing in Bichitra and Indiancine.ma (P.P. Sneha; Making Things and Drawing Boundaries: Experiments in the Digital Humanities (2017), edited by Jentery Sayers, University of Minnesota Press, Minneapolis, London April 1, 2018).

-----------------------------------

About CIS
-----------------------------------
The Centre for Internet and Society (CIS) is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. The areas of focus include digital accessibility for persons with disabilities, access to knowledge, intellectual property rights, openness (including open data, free and open source software, open standards, open access, open educational resources, and open video), internet governance, telecommunication reform, digital privacy, and cyber-security. The academic research at CIS seeks to understand the reconfigurations of social and cultural processes and structures as mediated through the internet and digital media technologies.

► Follow us elsewhere

Twitter: http://twitter.com/cis_india
Twitter - Access to Knowledge: https://twitter.com/CISA2K
Twitter - Information Policy: https://twitter.com/CIS_InfoPolicy
Facebook - Access to Knowledge: https://www.facebook.com/cisa2k
E-Mail - Access to Knowledge: a2k@cis-india.org
E-Mail - Researchers at Work: raw@cis-india.org
List - Researchers at Work: https://lists.ghserv.net/mailman/listinfo/researchers

► Support Us

Please help us defend consumer and citizen rights on the Internet! Write a cheque in favour of 'The Centre for Internet and Society' and mail it to us at No. 194, 2nd 'C' Cross, Domlur, 2nd Stage, Bengaluru - 5600 71.

► Request for Collaboration

We invite researchers, practitioners, artists, and theoreticians, both organisationally and as individuals, to engage with us on topics related internet and society, and improve our collective understanding of this field. To discuss such possibilities, please write to Sunil Abraham, Executive Director, at sunil@cis-india.org (for policy research), or Sumandro Chattapadhyay, Research Director, at sumandro@cis-india.org (for academic research), with an indication of the form and the content of the collaboration you might be interested in. To discuss collaborations on Indic language Wikipedia projects, write to Tanveer Hasan, Programme Officer, at tanveer@cis-india.org.

CIS is grateful to its primary donor the Kusuma Trust founded by Anurag Dikshit and Soma Pujari, philanthropists of Indian origin for its core funding and support for most of its projects. CIS is also grateful to its other donors, Wikimedia Foundation, Ford Foundation, Privacy International, UK, Hans Foundation, MacArthur Foundation, and IDRC for funding its various projects.

For more details visit https://cis-india.org/about/newsletters/april-2018-newsletter

You Are Not the Only One: India stares at a loneliness epidemic

Admin — 2018-04-29T16:15:42Z

“To anyone looking at me from the outside, I seem like a fairly successful woman. I have a good job with great pay. I am in a relationship and have a bunch of close friends. I couldn’t figure out why I felt so angry or so lonely all the time.

The article by Asad Ali and Tabassum Barnagarwala was published in the Indian Express on April 29, 2018.

Most people will presume that throwing a bunch of hangers on the bed is a harmless act of venting. Akanksha Joshi knew it was the tipping point for her. Her mood swings had become more mercurial and she had been lashing out at people close to her or simply shutting herself in her room, watching Netflix for hours. But that day was different. “I had opened my cupboard and a hanger fell out. I don’t know what happened to me, but I suddenly picked up all the hangers and threw them on the bed in rage. The impulse lasted for 30 to 40 seconds, but it left me shaken. I had changed my job recently. It was a good one with great pay. It was what I wanted. I was in a relationship, had a bunch of close friends. I couldn’t figure out why I felt so angry or so lonely,” says Joshi, 32, who had moved to Mumbai from Dehradun in 2008 to look after her ageing grandparents and to work with a business process outsourcing firm.

The first inkling of trouble had come when her three-year-old marriage ended in divorce in 2013. Joshi underwent counselling for nearly two years, and, slowly, life seemed to get back on track. She entered into a new relationship, moved up the job ladder, formed new friendships. But the anger and the loneliness wouldn’t go. “To anyone looking at me from the outside, I seem like a fairly successful woman,” she says. But it has come at a cost.

In 2004, the National Sample Survey Office reported that 4.91 million people in India were living alone and suffered from loneliness. More recently, the National Mental Health Survey of India (2015-16) reported that high suicidal risk is an increasing concern in India; that children and adolescents are vulnerable to mental disorders; and, mental disorders, including depression and anxiety, affect nearly 10 per cent of the population. In 2016, the Centre for the Study of Developing Societies in partnership with Konrad Adenauer Stiftung conducted a survey of the attitudes, anxieties and aspirations of India’s young population (aged 15-34 years). The findings, released in April 2017, revealed that 12 per cent of the youth reported feeling depressed often, and 8 per cent said they felt lonely quite frequently.

“Youngsters who move from tier-II and III cities to metropolises find a sudden change in lifestyle. Even if you have friends, it is difficult to meet them in a city like Mumbai. Having a social life does not mean they have good social support,” says Dr Vishal Sawant, who is currently treating Joshi. When she first approached Dr Sawant, Joshi had great reservations. “Opening up to treatment makes you feel vulnerable. I am at a senior marketing position. To talk about mental health issues is also to put myself out in the open at this point in my career. But I knew I needed intervention,” she says. Now, after six months, she says her reactions to situations are more even.

In January this year, British Prime Minister Theresa May announced a minister for loneliness to address the condition that afflicts 14 per cent of UK’s population. In Japan, it has been an affliction that has affected generations. In India, though, conversations around mental health are only getting started. Apart from a lack of information and widespread social stigma, the cost of treatment also remains prohibitively expensive. Each session, depending on the therapist, may cost between Rs 2,000 and Rs 7,000. Besides the cost of medication, therapy and consultations, there is also the possibility of reduced work efficiency. In addition to these, despite multiple reports and surveys indicating that there might be a serious health problem at hand, the conversation around loneliness doesn’t go beyond conventional markers, such as the isolation of the elderly. But loneliness can be an equally debilitating experience for other demographies, including the youth. A 2010 research in the Indian Journal of Psychiatry finds that women suffer more from depression than men. The National Mental Health Survey (2015-16) in 12 states of India covering 39,532 people found that one in 20 people suffers from depression. “Depression was reported to be higher in females, in the age-group of 40-49 years and among those residing in urban metros,” the report observes.

In India, psychologists say, conversations around loneliness need to expand in scope and look at the condition born out of conflicts in gender identity, class, or isolation even within the framework of a family or a relationship. When 18-year-old Harshit Patel (name changed), a resident of south Mumbai’s plush Charni Road, visited psychiatrist Dr Sagar Mundada at his Fort clinic last November, he already had suicidal thoughts. He lived in a joint family of 10 in a well-to-do Gujarati household. He had just joined engineering college and was struggling to find his feet. Patel had tried discussing his feelings with his parents, but they had brushed it off as adolescent mood swings. They also refused to entertain thoughts of therapy when a tutor brought it up. Patel had called Mundada on his own, seeking help. The doctor advised him to call whenever he felt suicidal. Within 10 days, a call came: “Nobody notices me at home. What is the point of living?” Patel was contemplating throwing himself in front of a train, he said. Mundada immediately called him to his clinic and got in touch with his parents.

The road to therapy has been littered with obstacles for Patel. His parents are still not entirely convinced about therapy and refuse to attend sessions at the clinic. Instead, they meet at a McDonald’s outlet near the clinic.

Even as a 10-year-old child with a physically abusive father, Dharmesh Mekala knew — through all the loneliness and trauma that he hadn’t yet developed a vocabulary to articulate — that he had to escape. He wrote the entrance test for Navodaya Vidyalaya in Nalgonda, Telengana. “I just knew that I had to leave home somehow,” says Mekala, 29, a freelance artist, now based in Delhi. The arc of his loneliness had started developing early in his childhood — the beatings he received; the bouts of sadness that enveloped him; the isolation he felt from his family; and, finally, the suicidal thoughts that he had all the time.

Mekala made it to boarding school, but the reprieve that he had sought did not come to pass. His sense of isolation grew more acute when Mekala started discovering his sexuality, much later, he says, than his friends. By the time Mekala reached college he knew he was homosexual, but could not bring himself to admit it. “Being homosexual in a hetero world is a lonely life in any case, but when I first came to Delhi in 2010 — a dusky South Indian man with an accent, not well read or fluent in English, with far too little money — I felt adrift,” he says.

Dr Neetu Rana, psychologist at the Vidya Sagar Institute of Mental Health and Neurosciences, Delhi, says, people like Mekala are more prone to mental health issues. “When we can’t find our social anchor we feel lonely. It could be a result of bullying, isolation and being ostracised, but it could also reflect changes in the family structures due to urbanisation and a shift towards an individualistic society,” she says.

More recently, the National Mental Health Survey of India (2015-16) reported that high suicidal risk is an increasing concern in India; that children and adolescents are vulnerable to mental disorders.

The UK-based National Society for the Prevention and Cruelty to Children (NSPCC) released data in 2017 on the number of calls received by its helpline to deal with loneliness. In 2016-17, the helpline counselled 4,063 children on loneliness, 73 per cent of whom were girls. Parul Tank, a psychiatrist who counsels students studying in a foreign country, says, many Indian students who venture abroad for higher studies, come to her with complaints of loneliness and depression. “In the US or UK, students have no structured classes. They lead an isolated life, the only idea of socialisation is to go out in cafes or pubs. Many do not know how to deal with this lifestyle,” she says.

Sahil, 45, a media professional, remembers how things started spiralling out of control for him when he went to London for a post-graduate degree. He had lived in Mumbai all his life and found London disconcerting. Soon, he wanted to “remain in my room all day” or spent time in the college library “figuring out a way to kill myself”. A friend took him to the university psychiatrist but the drugs he was prescribed didn’t help. By the time he came to Delhi in the mid-’90s for a job, he could barely hold it together; he had also become addicted to drugs and alcohol. “You feel lonely, and then you drink, and you feel even more lonely,” he says. Around this time, he got married. The thoughts of suicide receded somewhat, only to be replaced by an insatiable appetite for sex. “You don’t talk about things like loneliness when you are married. My wife and I never discussed my sex addiction either, though she was aware of it,” says Sahil, who is undergoing therapy at Sex Addicts Anonymous.

According to the Economic Survey 2016-17, the inter-state migration of workers in India has increased to 9 million annually during 2011-16 compared to previous years. A large section of these people leave their families behind in search of better prospects. In the hierarchy of visible discourse on loneliness, perhaps the migrant worker is the most affected, says Surinder Jodhka, professor of sociology at Jawaharlal Nehru University, Delhi. “The family structure is non-existent in the urban cities, and even in rural societies, there has been a disintegration. So, their feeling of loneliness is more pronounced.”

When his father died, Manik left his hometown in West Bengal’s Malda district for Delhi, more than 10 years ago. He was about 20 years old then. A distant uncle of his, a driver with a private company in the city, had promised to set him up with a job. But when Manik showed up, the uncle looked “surprised that I had actually come and grew distant.” Desperate, Manik began taking up odd jobs to survive. “I didn’t have friends and didn’t speak Hindi. The only person I knew refused to acknowledge me. I felt lonely and lost,” says Manik. He found a job as a cook/peon at a small company, but the pay was minimal and Manik says he spent it on “cheap alcohol and women”. “Otherwise, I’d be crying in my room all the time. I used to keep the radio on, not to feel less lonely but to not hear myself cry. I was so ashamed of my feebleness,” says Manik. He still can’t bear to be in a room without the radio on, but he doesn’t believe that his condition merits medical attention. In any case, it is a luxury he can’t afford. “It’s a personal battle, which only you can fight, no?” he asks.

A first-of-its-kind study conducted by Brihanmumbai Municipal Corporation, between October 2015 till September 2017 analysing patients in its major hospitals — KEM, Sion, Nair and RN Cooper — found that 31 per cent patients visiting these hospitals suffered from mental disorders. At least 1,70,000 patients attended these four major hospitals for psychiatric aid. Depression formed the second-most common mental disorder in out-patient departments forming 20 per cent of the total chunk. All of them came from a low income group. “We realised that there is a need to have more treatment facilities in primary healthcare centres for mental health. Rates of depression are high even in urban poor, and diagnosis shouldn’t be delayed until they reach a tertiary centre,” says dean of KEM hospital, Dr Avinash Supe. “For poor people, it is unemployment, frustrated political environment that affects their livelihood, that leads to depression. Take for instance, the farmers who are committing suicide. They feel isolated in the agrarian and financial distress, they have no one to seek aid from,” says Dr Vinayak Kale, head of psychiatry department in JJ Group of Hospitals, Mumbai. For affluent sections, he says, it’s the opposite. Steady career growth is not enough. The stress to win the corporate race often leads to loneliness.

One of the biggest contributors to loneliness, say psychologists and social scientists is our increasing reliance on technology. “One may have hundreds of friends on social media, but communication on that platform is virtual. Our culture is not individualised and we still need physical proximity. Social media has widened the gap of physical interaction,” says Dr Shubhangi Parkar, head of psychiatry at KEM hospital.

Nishant Shah, co-founder of The Centre for Internet and Society, Bengaluru, points out how “technologies have transformed what we understand as sociality, friendship and intimacy”. He says that young people — constant consumers of social media like Snapchat and WhatsApp — are “being told that they are always connected. Which means that they can, by definition, not feel lonely”. Yet, especially within the Indian context, says Shah, the pace of life and the rapid transformation of societies means that we no longer pay attention to the emotional needs of belonging, which actually alleviate loneliness. “We have replaced belonging with connectivity and this is going to have dire consequences in how we reshape our cities and lives,” he says.

Rachna Saxena (name changed), 31, agrees. Saxena migrated to Mumbai from a small town in Uttar Pradesh 14 years ago. “It was a big shift from the protective environment of home,” she says. She moulded herself to the demands of her new life once she joined the creative team in a multinational FMCG firm. She had been dating a Christian boy, but, at 28, when she finally broached the topic of marriage, the boy dithered on grounds of religious differences. The relationship crumbled, but something shifted inside her. “On Facebook, I’d look at photographs of my friends on their honeymoon. Everyone looked so happy, I felt depressed. I really wanted to get married, have a stable relationship. But that was just one part of my problems. I was a star performer at work, my social media feed showcased my ‘happening’ life, but no one could sense the immense pressure to live up to it,” she says.

Last year, a colleague she was close to died of a sudden heart attack at the age of 36. She saw his family squabble over property and his pregnant widow shunted out. “Another very close friend of mine, with whom I would share my distress, committed suicide. One fine day, he just shot himself,” says Saxena. She stopped meeting friends or inviting people over. In February this year, Saxena fell unconscious in her office. She had been sleeping fitfully and now had constant headaches. During her medical leave, she went home. “I ate and slept well, and, after a long time, felt happy. My parents are super supportive. But when I returned to Mumbai, it all came back. I realised I live two lives and I just couldn’t handle the stress of it,” she says. She started undergoing counselling sessions, and, a month ago, she deactivated her WhatsApp and Facebook accounts, choosing to travel and forge real friendships instead. “Now that I observe things more closely, I see that a lot of people around me are lonely even if they don’t look it. It can happen to anyone, you know,” she says.

For more details visit https://cis-india.org/internet-governance/news/indian-express-asad-ali-tabassum-barnagarwala-april-29-2018-you-are-not-the-only-one-india-stares-at-a-loneliness-epidemic

Aadhaar data of over 89 lakh MNREGA workers in Andhra Pradesh leaked online

Admin — 2018-05-05T08:43:53Z

Independent security researcher Kodali Srinivas tweeted screenshots of Aadhaar data of 89,38,138 MNREGA workers available on the Andhra Pradesh Benefit Disbursement Portal.

The article was published in New Indian Express on April 27, 2018.

Independent security researcher Kodali Srinivas, who exposed the leakage of Aadhaar and other personal data of 1.34 lakh beneficiaries on the State Housing Corporation website, on Thursday tweeted screenshots of Aadhaar data of 89,38,138 MNREGA workers availalbe on the Andhra Pradesh Benefit Disbursement Portal, which is maintained by APOnline, a joint venture between the Tata Consultancy Services (TCS) and the State government.

Hours after he blew the whistle, the website administrators began masking the data. In May 2017, Srinivas had co-authored a report for the Centre for Internet and Society, exposing how the Aadhaar data of 13.5 crore card holders was leaked online. The data was then leaked by four government portals, National Social Assistance Programme, National Rural Employment Guarantee Scheme, Chandranna Bima Scheme of the Government of Andhra Pradesh and Daily Online Payment Reports of NREGA of the Government of Andhra Pradesh.

It appears that almost a year later, nothing much has changed. Srinivas told TNIE he had sent a mail to the chief operating officer, APOnline and Universal Identification Authority of India, the National Critical Information Infrastructure Protection Centre, and CERT-In, the Centre's cyber response wing. When contacted, Balasubramanyam, Joint Secretary (NREGS) told TNIE, "I have seen it. It is Benefit Disbursement Portal... not maintained by us. We have been very careful ever since that massive leak of data last year."

Executive (operations), APOnline, S Chandramouleeswara Reddy refused comment saying that he was not the competent authority to speak on the issue. APOnline developed ICT solution for MGNREGA scheme, a framework involving Department of Posts, for disbursement of entitlements after accurate authentication of the entitlements through finger print authentication. TCS implements the ICT solution for MGNREGA in the State.

For more details visit https://cis-india.org/internet-governance/news/new-indian-express-april-26-2018-aadhaar-data-over-89-lakh-mnrega-workers-in-andhra-pradesh-leaked-online

DIDP Request #29 - Revenue breakdown by source for FY 2017

akriti — 2018-04-26T11:06:16Z

We requested ICANN for financial information they have not yet provided for the period ending June 2017.

ICANN publication of its financial records for 2017 were missing a crucial document which lists down their revenue as per the all the legal entities as sources who contributed to it including Regional Internet Registries, various registrars and their source of origin among other details. We have requested them for this document in order to get a better idea of the how these entities contribute to ICANN.

In response to our DIDP, ICANN notified us that they are in the process of compiling this report for the year ending June 2017 and will publish the same by 31st of May, 2018. Further they remarked that this procedure of making public their revenue by source was developed as part of ICANN’s enhancements to transparency in response to CIS’s earlier DIDP which was submitted in 2015.

The said report will be published on their Financial page within the time frame mentioned.

For more details visit https://cis-india.org/internet-governance/blog/didp-request-29-revenue-breakdown-by-source-for-fy-2017

PAI WG Labor and Economy Meeting

Admin — 2018-05-05T09:35:07Z

Elonnai Hickok co-chaired the first PAI Labor and Economy WG in NYC on April 25, 2018.

Agenda

For more details visit https://cis-india.org/internet-governance/news/pai-wg-labor-and-economy-meeting

Revenge Porn Laws across the World

Shradha Nigam — 2018-04-25T16:58:26Z

The following is a compilation of laws dealing with revenge porn if and how they exist across multiple countries and jurisdictions.

Country-wise legislation on “revenge porn” laws, click to download the file (PDF, 636 Kb)

Europe

United Kingdom
England and Wales
Scotland
Northern Ireland
Malta
Germany
France

United States of America

Alabama
Alaska
Arizona
Arkansas
California
Colorado
Connecticut
Delaware
District of Columbia
Florida
Georgia
Hawaii
Idaho
Illinois
Iowa
Kansas
Louisiana
Maine
Maryland
Michigan
Minnesota
Nevada
New Hampshire
New Jersey
New Mexico
North Carolina
North Dakota
Oklahoma
Oregon
Pennsylvania
South Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Washington
West Virginia. 20
Wisconsin. 20

Australia

New South Wales
South Australia.
Western Australia
Victoria

Asia and Rest of the World

Canada
Philippines
Israel
Japan

1. Europe

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
United Kingdom
England and Wales	Section 33, Criminal Justice and Courts Act 2015	2015	Makes it an offence in England and Wales to disclose private sexual photographs and films without the consent of the individual depicted and with the intent to cause distress.	There is a maximum sentence of two years imprisonment	A call has been made to cover a wider range of offences through enactment of a new Act. The law is not applicable retroactively.
Scotland	Part 1, Section 2, Abusive Behaviour and Sexual Harm Act, 2016	2016	A person (“A”) commits an offence if— (a)A discloses, or threatens to disclose, a photograph or film which shows, or appears to show, another person (“B”) in an intimate situation, (b)by doing so, A intends to cause B fear, alarm or distress or A is reckless as to whether B will be caused fear, alarm or distress, and (c)the photograph or film has not previously been disclosed to the public at large, or any section of the public, by B or with B’s consent.	A person who commits such an offence is liable— (a)on summary conviction, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both), (b) on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).
Northern Ireland	Part 3, Section 51, Amendment to Justice Act	2016	It is an offence for a person to disclose a private sexual photograph or film if the disclosure is made— (a)without the consent of an individual who appears in the photograph or film, and (b)with the intention of causing that individual distress.	A person guilty of an offence under this section is liable— (a) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both), and (b) on summary conviction, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both).
Malta	Article 208E, Maltese Criminal Code 2016	2016	It punishes whoever, with an intent to cause distress, emotional harm or harm of any nature, discloses a private sexual photograph or film without the consent of the person or persons displayed or depicted in such photograph or film.	Such person would, on conviction be liable to imprisonment for a term of up to two years or to a fine of not less than €,3000 and not more than €5,000, or to both such imprisonment and fine
Germany	General Data Protection Regulation Art Copyright Law		Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation (GDPR) A person also has the right to object to the unauthorised dissemination or public display of his/her photograph (section 22, Art Copyright Law)	If privacy rights are infringed, the individual affected can seek civil law remedies, which include: Cease and desist orders, rectification and Compensatory damages.	In 2014, The Bundesgerichtshof (BGH), upheld an earlier ruling from a regional court in Koblenz, Germany, that said a man did not have the right to keep intimate photos of his ex-lover just because she had consented to taking them in the first place.
France	Digital Republic Act	2016	Under the new law, the persons have a right to oppose the use of their personal data.	Revenge porn may be sanctioned by 2 years of imprisonment and a 60.000 euro fine.

2. United States of America

State	Statute	Year	Constituents of the offence	Punishment	Remarks
Alabama	SB301. Code of Alabama 1975 Secs 15-20A-4 to 15-20A-43 amended.	2017	Distribution of an intimate, private image, also known as "revenge porn" or "nonconsensual pornography." The law applies when the depicted person has not consented to the transmission and the sender intends to harass or intimidate the depicted person.	A first offense is a Class A misdemeanor, punishable by up to a year in jail. Subsequent offenses are Class C felonies, punishable by up to 10 years in prison.
Alaska	Title 11. Criminal Law § 11.61.120		Provides that whoever publishes or distributes electronic or printed photographs, pictures, or films that show the genitals, anus, or female breast of the other person or show that person engaged in a sexual act commits a crime of harassment in second degree.	Harassment in the second degree is a class B misdemeanor. Class B misdemeanors are less serious crimes, punishable by up to 90 days in jail and a fine of up to $2,000.
Arizona	Unlawful Distribution of Private Images, 2016 through amending Section 13‑1425 of the Arizona Revised Statutes	2016	It provides that the distribution of images depicting states of nudity or specific sexual activities of another person is unlawful. If such disclosure is by electronic means, it is a Class 4 felony. If the person threatens to disclose but does not disclose, then it is a Class 1 Misdemeanor.	· Class 4 felonies are punishable up to 3.75 years in prison. · A class 1 misdemeanor is the most serious misdemeanor offense and is punishable by up to 6 months in jail, 3 years of probation (5 years maximum probation for DUI offenses) and a $2,500 fine plus surcharges.	· The earlier state revenge porn bill was scrapped due to an ACLU Lawsuit.
Arkansas	Arkansas Code 5-26-314	July, 2015	It criminalizes the distribution of an image, picture, video, or voice or audio recording of a sexual nature to harass, frighten, intimidate, threaten, or abuse a family or household member or a person in a current or former dating relationship; and for other purposes. Such an offence is a Class A misdemeanour.	· A Class A misdemeanor is the most serious type of misdemeanor in Arkansas and it is punishable by up to one year in jail and a fine of up to $2,500.	Defines a “dating relationship” as romantic/ intimate relationship between two individuals and provides additional factors.
California	Section 647(j)(4) of California Penal Code	2014	Under this provision an act of revenge porn is defined as someone who “photographs or records by any means the image of the intimate body part or parts of another identifiable person, under circumstances where the parties agree or understand that the image shall remain private, and the person subsequently distributes the image taken, with the intent to cause serious emotional distress, and the depicted person suffers serious emotional distress.	It shall be a disorderly conduct, misdemeanour.
Colorado	Colorado Revised Statutes 18-7-107 and 18-7-108.	2014	Posting a Private Image for Harassment and Posting a Private Image for Pecuniary Gain is a Class 1 Misdemeanor.	The defendant can be fined up to $10,000.
Connecticut	Section 53a-189a, Connecticut General Statutes	October 1, 2015	It provides that whoever indulges in Unlawful dissemination of an intimate image is guilty	The offence is a class A misdemeanor.
Delaware	§ 1335, Title 11 of the Delaware Code	2014	When a person knowingly reproduces, distributes, exhibits, publishes, transmits, or otherwise disseminates a visual depiction of a person who is nude, or who is engaging in sexual conduct, when the person knows or should have known that the reproduction, distribution, exhibition, publication, transmission, or other dissemination was without the consent of the person depicted and that the visual depiction was created or provided to the person under circumstances in which the person depicted has a reasonable expectation of privacy, such person shall be guilty of violation of privacy.	It is a class A misdemeanor; class G felony.
District of Columbia	Criminalization of Non-Consensual Pornography Act	2014	It provides that a person knowingly discloses one or more sexual images of another identified or identifiable person when: (1) The person depicted did not consent to the disclosure of the sexual image; (2) There was an agreement or understanding between the person depicted and the person disclosing that the sexual image would not be disclosed; and (3) The person disclosed the sexual image with the intent to harm the person depicted person depicted or to receive financial gain. (b) A person who violates this subsection shall be guilty of a misdemeanour.	Upon conviction such person shall be fined not more than the amount set forth in section 101 of the Criminal Fine Proportionality Amendment Act of 2012, approved June 11, 2013 (D.C. Law 19-317; D.C.42 Official Code § 22-3571.01), imprisoned for not more than 180 days, or both.
Florida	Florida Statute Section 784.049	2015	· “Sexually cyberharass” means to publish a sexually explicit image of a person that contains or conveys the personal identification information of the depicted person to an Internet website without the depicted person’s consent, for no legitimate purpose, with the intent of causing substantial emotional distress to the depicted person.	A person who willfully and maliciously sexually cyberharasses another person commits a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083. If a person who has one prior conviction for sexual cyber harassment and who commits a second or subsequent sexual cyber harassment commits a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.	Aggrieved person can also initiate civil action to recover damages.
Georgia	Article 3 of Chapter 11 of Title 16 of the Official Code of Georgia	2014	· Whoever Electronically transmits or posts or causes such transmission or posting, in one or more transmissions or posts, a photograph or video which depicts nudity or sexually explicit conduct of an adult when the transmission or post is harassment or causes financial loss to the depicted person and serves no legitimate purpose to the depicted person.	Such person shall be guilty of a misdemeanor of a high and aggravated nature; provided, however, that upon a second or subsequent violation of this Code section, he or she shall be guilty of a felony and, upon conviction thereof, shall be punished by imprisonment of not less than one nor more than five years, a fine of not more than $100,000.00, or both.	There is a rebuttable presumption on the Internet Service Provider that it was not aware of the content of such post
Hawaii	Section 711-1110.9, Hawaii Revised Statutes	2014	A person commits the offense of violation of privacy in the first degree if The person knowingly discloses an image or video of another identifiable person either in the nude, as defined in section 712-1210, or engaging in sexual conduct, as defined in section 712-1210, without the consent of the depicted person, with intent to harm substantially the depicted person with respect to that person’s health, safety, business, calling, career, financial condition, reputation, or personal relationships.	Violation of privacy in the first degree is a class C felony. In addition to any penalties the court may impose, the court may order the destruction of any recording made in violation of this section	Exception has been carved out for When the person was voluntarily nude in public or voluntarily engaging in sexual conduct in public.
Idaho	Idaho Code 18-6609(2)(b)	2017	Intentionally or with reckless disregard disseminating, publishing or selling (or conspiring) any image or images of the intimate areas of another person or persons without the consent of such other person or persons and he knows or reasonably should have known that one or both parties agreed or understood that the images should remain private.	The punishments are decided on a case by case basis, but seem to range from state prison terms of three to five years, and/or a fine of up to $5,000 based on the cases that have emerged
Illinois	Section 11-23.5 of The Illinois Criminal Code of 2012	2015	Criminalises the Non-Consensual Dissemination of Private Sexual Images.	It is a Class 4 Felony.
Iowa	Section708.7 of the Code of 2017	2017	Dissemination, publication, distribution or causing it thereof of photograph or film showing another person in partial or full nudity or engaged in a sex act, without consent, is harassment.	Such an offence is harassment in first degree and is an aggravated misdemeanour
Kansas	Section 21-6101(a)(8) of Kansas State Act	2016	Breach of privacy is knowingly and without lawful authority: disseminating any videotape, photograph, film or image of another identifiable person 18 years of age or older who is nude or engaged in sexual activity and under circumstances in which such identifiable person had a reasonable expectation of privacy, with the intent to harass, threaten or intimidate such identifiable person, and such identifiable person did not consent to such dissemination	Such an offence is a Severity level 8, person felony
Louisiana	R.S. 14:283.2	2015	A person commits the offense of non-consensual disclosure of a private mage when all of the following occur: (1) The person intentionally discloses an image of another person who is seventeen years of age or older, who is identifiable from the image or information displayed in connection with the image, and whose intimate parts are exposed in whole or in part. (2) The person who discloses the image obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private. (3) The person who discloses the image knew or should have known that the person in the image did not consent to the disclosure of the image. (4) The person who discloses the image has the intent to harass or cause emotional distress to the person in the image, and the person who commits the offense knew or should have known that the disclosure could harass or cause emotional distress to the person in the image	Whoever commits the offense of non-consensual disclosure of a private image shall be fined not more than ten thousand dollars, imprisoned with or without hard labour for not more than two years, or both	No liability is imposed on the computer service used for posting such image
Maine	Section 1 17-A MRSA §511-A	2015	A person is guilty of unauthorized dissemination of certain private images if the person, with the intent to harass, torment or threaten the depicted person or another person, knowingly disseminates, displays or publishes a photograph, videotape, film or digital recording of another person in a state of nudity or engaged in a sexual act or engaged in sexual contact in a manner in which there is no public or newsworthy purpose when the person knows or should have known that the depicted person: (1) Is 18 years of age or older; (2) Is identifiable from the image itself or information displayed in connection with the image; and (3) Has not consented to the dissemination, display or publication of the private image.	Unauthorized dissemination of certain private images is a Class D crime.
Maryland	§ 3-809, Maryland Code.	2014	A person may not intentionally cause serious emotional distress to another by intentionally placing on the internet an identifiable a photograph, film, videotape, recording, or any other reproduction of the image of the other person that reveals the identity of the other person with his or her intimate parts exposed or while engaged in an act of sexual contact: (1) knowing that the other person did not consent to the placement of the image on the internet; and (2) under circumstances in which the other person had a reasonable expectation that the image would be kept private.	A person who violates this section is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 2 years or a fine not exceeding $5,000 or both.
Michigan	Sec 145e of MCL	2016	If a person threatens, coerces, or intimidates dissemination of any sexually explicit visual material of another person shall be punishable under section 145f.	Section 145f- first offense punishable by 93 day sentence or fine up to $500.
Minnesota	§ 617.261, Minnesota Statutes	2016	A cause of action against a person for the non-consensual dissemination of private sexual images exists when: (1) a person disseminated an image without the consent of the person depicted in the image; (2) the image is of an individual depicted in a sexual act or whose intimate parts are exposed in whole or in part; (3) the person is identifiable: (i) from the image itself, by the person depicted in the image or by another person; or (ii) from the personal information displayed in connection with the image; and (4) the image was obtained or created under circumstances in which the person depicted had a reasonable expectation of privacy. The fact that the individual depicted in the image consented to the creation of the image or to the voluntary private transmission of the image is not a defense to liability for a person who has disseminated the image without consent.	Conviction for nonconsensual dissemination of private sexual images qualifies as a prior “qualified domestic violence-related offense” that enhances penalties for convictions for domestic assault, 4th & 5th degree assault, stalking, and violation of a harassment restraining order.	Consent to such image being taken is no defense
Nevada	Sections 2-6 of Chapter 200 of NRS	2015	A person commits the crime of unlawful dissemination of an intimate image when, with the intent to harass, harm or terrorize another person, the person electronically disseminates or sells an intimate image which depicts the other person and the other person: (1) did not give prior consent to the electronic dissemination or sale; (2) had a reasonable expectation that the intimate image would be kept private and would not be made visible to the public; and (3) was at least 18 years of age when the intimate image was created	Such person is guilty of a category D felony
New Hampshire	§ 644:9-a, N.H. Rev. Stat.	2016	Nonconsensual dissemination of private sexual images with the intent to harass, intimidate, threaten, or coerce the depicted person.	It is a felony.
New Jersey	§ 2C:14-9, New Jersey Code	2015	Making a nonconsensual recording that reveals another person’s "intimate parts" or shows the person engaged in a sexual act without consent.	Felony, three to five years in prison, a fine not to exceed $15,000.
New Mexico	HB 142, new section added to the New Mexico Criminal Code	2015	Unauthorised distribution of sensitive images without that person’s consent with the intent to harass, humiliate or intimidate that person or cause substantial emotional distress is a misdemeanour.	It is a misdemeanour. Upon a second or subsequent conviction, the offender is guilty of a fourth degree felony
North Carolina	§ 14-190.5A, Article 26 of Chapter 14 of the General Statutes	2015	A person is guilty of disclosure of private images if all of the following apply: (1) The person knowingly discloses an image of another person with the intent to do either of the following: a. Coerce, harass, intimidate, demean, humiliate, or cause financial loss to the depicted person. b. Cause others to coerce, harass, intimidate, demean, humiliate, or cause financial loss to the depicted person. (2) The depicted person is identifiable from the disclosed image itself or information offered in connection with the image. (3) The depicted person's intimate parts are exposed or the depicted person is engaged in sexual conduct in the disclosed image. (4) The person discloses the image without the affirmative consent of the depicted person. (5) The person discloses the image under circumstances such that the person knew or should have known that the depicted person had a reasonable expectation of privacy.	For an offense by a person who is 18 years of age or older at the time of the offense, the violation is a Class H felony. For a first offense by a person who is under 18 years of age at the time of the offense, the violation is a Class 1 misdemeanor. For a second or subsequent offense by a person who is under the age of 18 at the time of the offense, the violation is a Class H felony	The Court may order destruction of such image. This provision is in addition to civil and criminal remedies.
North Dakota	Section 12.1-17-07.2 of the North Dakota Century Code	2015	· A person commits the offense of distribution of intimate images if the person knowingly or intentionally distributes to any third party any intimate image of an individual eighteen years of age or older, if: (1) The person knows that the depicted individual has not given consent to the person to distribute the intimate image; (2) The intimate image was created by or provided to the person under circumstances in which the individual has a reasonable expectation of privacy; and (3) Actual emotional distress or harm is caused to the individual as a result of the distribution under this section.	Distribution of an intimate image is a class A misdemeanor
Oklahoma	Section 1040.13b of Title 21, Oklahoma Statutes	2016	· A person commits nonconsensual dissemination of private sexual images when he or she: (1) Intentionally disseminates an image of another person: a. who is at least eighteen (18) years of age, b. who is identifiable from the image itself or information displayed in connection with the image, and c. who is engaged in a sexual act or whose intimate parts are exposed, in whole or in part; (2) Disseminates the image with the intent to harass, intimidate or coerce the person, or under circumstances in which a reasonable person would know or understand that dissemination of the image would harass, intimidate or coerce the person (3) Obtains the image under circumstances in which a reasonable person would know or understand that the image was to remain private; and (4) Knows or a reasonable person should have known that the person in the image has not consented to the dissemination.	Any person who violates the provisions of this section shall be guilty of a misdemeanour punishable by imprisonment in a county jail for not more than one (1) year or by a fine of not more than. One Thousand Dollars ($1,000.00), or both such fine and imprisonment	The court shall have the authority to order the defendant to remove the disseminated image should the court find it is in the power of the defendant to do so.
Oregon	ORS 161.005	2015	· (1) A person commits the crime of unlawful dissemination of an intimate image if: (a) The person, with the intent to harass, humiliate or injure another person, knowingly causes to be disclosed through an Internet website an identifiable image of the other person whose intimate parts are visible or who is engaged in sexual conduct; (b) The person knows or reasonably should have known that the other person does not consent to the disclosure; (c) The other person is harassed, humiliated or injured by the disclosure; and (d) A reasonable person would be harassed, humiliated or injured by the disclosure.	Unlawful dissemination of an intimate image is a Class A misdemeanor. Unlawful dissemination of an intimate image is a Class C felony if the person has a prior conviction under this section at the time of the offense.
Pennsylvania	Title 18 Pennsylvania Consolidated Statutes § 3131	2014	A person commits the offense of unlawful dissemination of intimate image if, with intent to harass, annoy or alarm a current or former sexual or intimate partner, the person disseminates a visual depiction of the current or former sexual or intimate partner in a state of nudity or engaged in sexual conduct.	· An offense shall be: (1) A misdemeanor of the first degree, when the person depicted is a minor. (2) A misdemeanor of the second degree, when the person depicted is not a minor.
South Dakota	Section 4 of Chapter 22-21 of South Dakota Code of Laws	2015	No person may use or disseminate in any form any visual recording or photographic device to photograph or visually record any other person without clothing or under or through the clothing, or with another person depicted in a sexual manner, for the purpose of viewing the body of, or the undergarments worn by, that other person, without the consent or knowledge of that other person, with the intent to self-gratify, to harass, or embarrass and invade the privacy of that other person, under circumstances in which the other person has a reasonable expectation of privacy.	A violation of this section is a Class 1 misdemeanor. However, a violation of this section is a Class 6 felony if the victim is seventeen years of age or younger and the perpetrator is at least twenty-one years old.
Tennessee	Chapter 872 Tenn. Pub. Act	2017	(a) A person commits unlawful exposure who, with the intent to cause emotional distress, distributes an image of the intimate part or parts of another identifiable person if: (1) The image was photographed or recorded under circumstances where the parties agreed or understood that the image would remain private; and (2) The person depicted in the image suffers emotional distress. (b) As used in this section: (1) "Emotional distress" has the same meaning as defined in § 39-17-315; and (2) "Intimate part" means any portion of the primary genital area, buttock, or any portion of the female breast below the top of the areola that is either uncovered or visible through less than fully opaque clothing.	A violation of subsection (a) is a Class A misdemeanor. However, nothing in this section precludes punishment under any other section of law providing for greater punishment.
Texas	Chapter 98B, ATitle 4, Civil Practice and Remedies Code	2015	(a)A defendant is liable, as provided by this chapter, to a person depicted in intimate visual material for damages arising from the disclosure of the material if: (1)the defendant discloses the intimate visual material without the effective consent of the depicted person; (2)the intimate visual material was obtained by the defendant or created under circumstances in which the depicted person had a reasonable expectation that the material would remain private; (3)the disclosure of the intimate visual material causes harm to the depicted person; and (4)the disclosure of the intimate visual material reveals the identity of the depicted person in any manner, including through: (A)any accompanying or subsequent information or material related to the intimate visual material; or (B)information or material provided by a third party in response to the disclosure of the intimate visual material (b) defendant is liable, as provided by this chapter, to a person depicted in intimate visual material for damages arising from the promotion of the material if, knowing the character and content of the material, the defendant promotes intimate visual material described by Subsection (a) on an Internet website or other forum for publication that is owned or operated by the defendant.	An offense under this section is a Class A misdemeanor. If conduct that constitutes an offense under this section also constitutes an offense under another law, the actor may be prosecuted under this section, the other law, or both.	Aggrieved person may recover actual and exemplary damages. The provisions shall be liberally construed by the courts to promote its underlying purpose to protect Persons from, and provide adequate remedies to victims of, the disclosure or promotion of intimate visual material.
Utah	§ 76-5b-203, Utah Code.	2014	An actor commits the offense of distribution of intimate images if the actor, with the intent to cause emotional distress or harm, knowingly or intentionally distributes to any third party any intimate image of an individual who is 18 years of age or older, if: (a) the actor knows that the depicted individual has not given consent to the actor to distribute the intimate image; (b) the intimate image was created by or provided to the actor under circumstances in which the individual has a reasonable expectation of privacy; and (c) actual emotional distress or harm is caused to the person as a result of the distribution under this section.	Distribution of an intimate image is a class A misdemeanour.
Vermont	Sec. 2. 13 V.S.A. § 2606	2015	A person violates this section if he or she knowingly discloses a visual image of an identifiable person who is nude or who is engaged in sexual conduct, without his or her consent, with the intent to harm, harass, intimidate, threaten, or coerce the person depicted, and the disclosure would cause a reasonable person to suffer harm. A person may be identifiable from the image itself or information offered in connection with the image. Consent to recording of the visual image does not, by itself, constitute consent for disclosure of the image.	A person who violates this provision shall be imprisoned not more than two years or fined not more than $2,000.00, or both. A person who violates this provision with the intent of disclosing the image for financial profit shall be imprisoned not more than five years or fined not more than $10,000.00, or both.	In addition, the Court may order equitable relief, including a temporary restraining order, a preliminary injunction, or a permanent injunction ordering the defendant to cease display or disclosure of the image. The Court may grant injunctive relief maintaining the confidentiality of a plaintiff using a pseudonym.
Virginia	§ 18.2-386.2, Code of Virginia	2014	Any person who, with the intent to coerce, harass, or intimidate, maliciously disseminates or sells any videographic or still image created by any means whatsoever that depicts another person who is totally nude, or in a state of undress so as to expose the genitals, pubic area, buttocks, or female breast, where such person knows or has reason to know that he is not licensed or authorized to disseminate or sell such videographic or still image is guilty.	Such an offense is a Class 1 misdemeanor.
Washington	Title 9A RCW	2015	A person commits the crime of disclosing intimate images when the person knowingly discloses an intimate image of another person and the person disclosing the image: (a) Obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private; (b) Knows or should have known that the depicted person has not consented to the disclosure; and10 (c) Knows or reasonably should know that disclosure would cause harm to the depicted person.	The crime of disclosing intimate images: (a) Is a gross misdemeanor on the first offense; or (b) Is a class C felony if the defendant has one or more prior convictions for disclosing intimate images.	A person who is under the age of eighteen is not guilty of the crime of disclosing intimate images unless the person: (a) Intentionally and maliciously disclosed an intimate image of another person; (b) Obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private; and (c) Knows or should have known that the depicted person has not consented to the disclosure
West Virginia	§61-8-28a, Code of West Virginia	2017	No person may knowingly and intentionally disclose, cause to be disclosed or threaten to disclose, with the intent to harass, intimidate, threaten, humiliate, embarrass, or coerce, an image of another which shows the intimate parts of the depicted person or shows the depicted person engaged in sexually explicit conduct which was captured under circumstances where the person depicted had a reasonable expectation that the image would not be publicly disclosed.	A person convicted is guilty of a misdemeanor and, upon conviction thereof, shall be confined in jail for not more than one year, fined not less than $1,000 nor more than $5,000, or both confined and fined.
Wisconsin	§ 942.09, Code of Wisconsin	2014	It provides for posting or publishing a sexually explicit image without consent and providing a penalty. Such an offence is a Class A misdemeanour.	Class A misdemeanors can result in fines up to $10,000, imprisonment up to 9 months or a combination of the two.

3. Australia

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
New South Wales	Section 91Q, Crimes Act 1900	2018	A person who intentionally distributes an intimate image of another person: (a) without the consent of the person, and (b) knowing the person did not consent to the distribution or being reckless as to whether the person consented to the distribution, is guilty of an offence. "intimate image" means: (a) an image of a person's private parts, or of a person engaged in a private act, in circumstances in which a reasonable person would reasonably expect to be afforded privacy, or (b) an image that has been altered to appear to show a person's private parts, or a person engaged in a private act, in circumstances in which a reasonable person would reasonably expect to be afforded privacy.	Maximum penalty: 100 penalty units or imprisonment for 3 years, or both.
South Australia	Summary Offences Act 1953	2018	A person who distributes an invasive image of another person, knowing or having reason to believe that the other person— (a) does not consent to that particular distribution of the image; or (b) does not consent to that particular distribution of the image and does not consent to distribution of the image generally, is guilty of an offence. An image of a person will be taken to be an invasive image of the person if it depicts the person in a place other than a public place— (a) engaged in a private act; or (b) in a state of undress such that— (i) in the case of a female—the bare breasts are visible; or (ii) in any case—the bare genital or anal region is visible. (3) However, an image of a person that falls within the standards of morality, decency and propriety generally accepted by reasonable adults in the community will not be taken to be an invasive image of the person.	Maximum penalty: (a) if the invasive image is of a person under the age of 17 years—$20000 or imprisonment for 4 years; (b) in any other case—$10 000 or imprisonment for 2 years.
Western Australia	Section 10G/61, Restraining Orders and Related Legislation Amendment (Family Violence) Act 2016	2016	A court may restrain the respondent from doing all or any of the following in the case of a family violence restraining order: distributing or publishing, or threatening to distribute or publish, intimate personal images of the person seeking to be protected;	2 years imprisonment.	Check comes into play only in case of a family violence restraining order and is not general protection.
Victoria	Section 41C, Summary Offences Act 1966	2012	A person who visually captures or has visually captured an image of another person's genital or anal region must not intentionally distribute that image.	2 years imprisonment.

4. Asia and Rest of the World

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
Canada	Section 162.1, Criminal Code through Bill C-13 or Cyberbullying Act	2015	Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty. In this section, “intimate image” means a visual recording of a person made by any means including a photographic, film or video recording, (a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity; (b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and (c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.	Punishment is: (a) of an indictable offence and liable to imprisonment for a term of not more than five years; or (b) of an offence punishable on summary conviction.
Philippines	Anti-Photo and Video Voyeurism Act of 2009		It is hereby prohibited and declared unlawful for any person: (a) To take photo or video coverage of a person or group of persons performing sexual act or any similar activity or to capture an image of the private area of a person/s such as the naked or undergarment clad genitals, public area, buttocks or female breast without the consent of the person/s involved and under circumstances in which the person/s has/have a reasonable expectation of privacy; (b) To copy or reproduce, or to cause to be copied or reproduced, such photo or video or recording of sexual act or any similar activity with or without consideration; (c) To sell or distribute, or cause to be sold or distributed, such photo or video or recording of sexual act, whether it be the original copy or reproduction thereof; or (d) To publish or broadcast, or cause to be published or broadcast, whether in print or broadcast media, or show or exhibit the photo or video coverage or recordings of such sexual act or any similar activity through VCD/DVD, internet, cellular phones and other similar means or device. The prohibition under paragraphs (b), (c) and (d) shall apply notwithstanding that consent to record or take photo or video coverage of the same was given by such person/s. Any person who violates this provision shall be liable for photo or video voyeurism as defined herein.	The penalty of imprisonment of not less that three (3) years but not more than seven (7) years and a fine of not less than One hundred thousand pesos (P100,000.00) but not more than Five hundred thousand pesos (P500,000.00), or both, at the discretion of the court shall be imposed upon any person found guilty of violating Section 4 of this Act. If the violator is a juridical person, its license or franchise shall be automatically be deemed revoked and the persons liable shall be the officers thereof including the editor and reporter in the case of print media, and the station manager, editor and broadcaster in the case of a broadcast media. If the offender is a public officer or employee, or a professional, he/she shall be administratively liable. If the offender is an alien, he/she shall be subject to deportation proceedings after serving his/her sentence and payment of fines.
Israel	Prevention of Sexual Harassment Law, 5758-1998 amended in 2014	2014	The distribution of still pictures or video recordings of a person’s image that focuses on his/her sexuality, including by editing or incorporation, is unlawful if made: 1. without the person’s consent; 2. in a way that facilitates identification of the person; and 3. under circumstances that may degrade or shame him/her The distribution of such an image constitutes sexual harassment under section 3(a) of the Prevention of Sexual Harassment Law and intentional harm to a person’s privacy under section 5 of the Protection of Privacy Law.	The crimes are punishable with five years of imprisonment, in addition to subjecting the perpetrator to civil liability and the duty to pay monetary compensation to the victim.
Japan	Act on Prevention of Damage by Provision of Private Sexual Image Records Act	2014	It criminalizes the provision of a private sexual image of another person without the person’s approval via a means of telecommunication to an unspecified number of or to many people. It allows Internet service providers to delete suspected revenge porn images without the uploader’s consent, in cases where: 1. the victim had notified the provider of the existence of the image; 2. the provider had requested the consent of the uploader to delete the image; and 3. the uploader did not respond or delete the image.	A maximum sentence of 500,000 yen or three years in jail.	The Act also obligates the national and local governments to ease victims’ embarrassment when they report the crime. For especially young potential victims, the Act further obligates the governments to educate people on how to avoid revenge porn.

For more details visit https://cis-india.org/internet-governance/blog/revenge-porn-laws-across-the-world

What’s up with WhatsApp?

Aayush Rathi and Sunil Abraham — 2018-04-23T16:45:51Z

In 2016, WhatsApp Inc announced it was rolling out end-to-end encryption, but is the company doing what it claims to be doing?

The article by Aayush Rathi and Sunil Abraham was published in Asia Times on April 20, 2018.

Back in April 2016, when WhatsApp Inc announced it was rolling out end-to-end encryption (E2EE) for its billion-plus strong user base as a default setting, the messaging behemoth signaled to its users it was at the forefront of providing technological solutions to protect privacy.

Emphasized in the security white paper explaining the implementation of the technology is the encryption of both forms of communication – one-to-one and group and also of all types of messages shared within such communications – text as well as media.

Simply put, all communication taking place over WhatsApp would be decipherable only to the sender and recipient – it would be virtual gibberish even to WhatsApp.

This announcement came in the backdrop of Apple locking horns with the FBI after being asked to provide a backdoor to unlock the San Bernardino mass shooter’s iPhone. This further reinforced WhatsApp Inc’s stand on the ensuing debate between the interplay of privacy and security in the digital age.

Kudos to WhatsApp, for there is growing discussion around how encryption and anonymity is central to enabling secure online communication which in turn is integral to essential human rights such as those of freedom of opinion and expression.

WhatsApp may have taken encryption to the masses, but here we outline why WhatsApp’s provisioning of privacy and security measures needs a more granular analysis – is the company doing what it claims to be doing? Security issues with WhatsApp’s messaging protocol certainly are not new.

Man-in-the-middle attacks

A study published by a group of German researchers from Ruhr University highlighted issues with WhatsApp’s implementation of its E2EE protocol to group communications. Another paper points out how WhatsApp’s session establishment strategy itself could be problematic and potentially be targeted for what are called man-in-the-middle (MITM) attacks.

An MITM attack takes the form of a malicious actor, as the term suggests, placing itself between the communicating parties to eavesdrop or impersonate. The Electronic Frontier Foundation also highlighted other security vulnerabilities, or trade-offs, depending upon ideological inclinations, with respect to WhatsApp allowing for storage of unencrypted backups, issues with WhatsApp’s web client and also with its approach to cryptographic key change notifications.

Much has been written questioning WhatsApp’s shifting approach to ensuring privacy too. Quoting straight from WhatsApp’s Privacy Policy: “We joined the Facebook family of companies in 2014. As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies.” Speaking of Facebook …

Culling out larger issues with WhatsApp’s privacy policies is not the intention here. What we specifically seek to explore is right at the nexus of WhatsApp’s security and privacy provisioning clashing with its marketing strategy: the storage of data on WhatsApp’s servers, or ‘blobs,’ as they are referred to in the technical paper. Facebook’s rather. In WhatsApp’s words: “Once your messages (including your chats, photos, videos, voice messages, files and share location information) are delivered, they are deleted from our servers. Your messages are stored on your own device.”

In fact, this non-storage of data on their ‘blobs’ is emphasizes at several other points on the official website. Let us call this the deletion-upon-delivery model.

A simple experiment

While drawing up a rigorous proof of concept, made near-impossible thanks to WhatsApp being a closed source messaging protocol, a simple experiment is enough to raise some very pertinent questions about WhatsApp’s outlined deletion-upon-delivery model. It should, however, be mentioned that the Signal Protocol developed by Open Whisper Systems and pivotal in WhatsApp’s rolling out of E2EE is open source. Here is how the experiment proceeds:

Rick sends Morty an attachment.

Morty then switches off the data on her mobile device.

Rick downloads the attachment, an image.

Subsequently, Rick deletes the image from his mobile device’s internal storage.

Rick then logs into a WhatsApp’s web client on his browser. (Prior to this experiment, both Rick and Morty had logged out from all instances of the web client)

Upon a fresh log-in to the web client and opening the chat with Morty, the option to download the image is available to Rick.

The experiment concludes with bewilderment at WhatsApp’s claim of deletion-upon-delivery as outlined earlier. The only place from which Morty could have downloaded the image would be from Facebook’s ‘blobs.’ The attachment could not have been retrieved from Morty’s mobile device as it had no way of sending data and neither from Rick’s mobile device as it no longer existed in the device’s storage.

As per the Privacy Policy, the data is stored on the ‘blobs’ for a period of 30 days after transmission of a message only when it can’t be delivered to the recipient. Upon delivery, the deletion-upon-delivery model is supposed to kick in.

Another straightforward experiment that leads to a similar conclusion is seeing the difference in time taken for a large attachment to be forwarded as opposed to when the same large attachment is uploaded. Forwarding is palpably quicker than uploading afresh: non-storage of attachments on the ‘blob’ would entail that the same amount should be taken for both.

The plot thickens. WhatsApp’s Privacy Policy goes on to state: “To improve performance and deliver media messages more efficiently, such as when many people are sharing a popular photo or video, we may retain that content on our servers for a longer period of time.” The technical paper offers no help in understanding how WhatsApp systems assess frequently shared encrypted media messages without decrypting it at its end.

A possible explanation could be the usage of metadata by WhatsApp, which it discloses in its Privacy Policy while simultaneously being sufficiently vague about the specifics of it. That WhatsApp may be capable of reading encrypted communication through the inclusion of a backdoor bodes well for law enforcement, but not so much for unsuspecting users.

The weakest link in the chain

Concerns about backdoors in WhatsApp’s product have led the French government to start developing their own encrypted messaging service. This will be built using Matrix – an open protocol designed for real-time communication. Indeed, the Privacy Policy lays out that the company “may collect, use, preserve, and share your information if we have a good-faith belief that it is reasonably necessary to respond pursuant to applicable law or regulations, to legal process, or to government requests.”

The Signal Protocol is the undisputed gold standard of E2EE implementations. It is the integration with the surrounding functionality that WhatsApp offers which leads to vulnerabilities. After all, a chain is only as strong as its weakest link. Assuming that the attachments stored on the ‘blobs’ are in encrypted form, indecipherable to all but the intended recipients, this does not pose a privacy risk for the users from a technological point of view.

However, it is easy lose sight of the fact that the Privacy Policy is a legally binding document and it specifically states that messages are not stored on the ‘blobs’ as a matter of routine. As a side note, WhatsApp’s Privacy Policy and Terms of Service are refreshing in their readability and lack of legalese.

As we were putting the final touches to this piece, news from WABetaInfo, a well-reputed source of information on WhatsApp features, has broken that newer updates of WhatsApp for Android are permitting users to re-download media deleted up to three months back. WhatsApp cannot possibly achieve this without storing the media in the ‘blobs,’ or in other words, in violation of its Privacy Policy.

As the aphorism goes: “When the service is free, you are the product.”

For more details visit https://cis-india.org/internet-governance/blog/asia-times-april-20-2018-aayush-rathi-sunil-abraham-what-s-up-with-whatsapp

Comments on the Draft Digital Information Security in Healthcare Act

Amber Sinha and Shweta Mohandas — 2018-05-01T02:05:58Z

The Centre for Internet & Society submitted comments to the Ministry of Health & Family Welfare, Government of India on the draft Digital Information Security in Healthcare Act on April 21, 2018.

This submission presents comments by the Centre for Internet and Society, India (“CIS”) on the Draft Digital Information Security in Healthcare Act, released by Ministry of Health & Family Welfare, Government of India. CIS has conducted research on the issues of privacy, data protection and data security since 2010 and is thankful for the opportunity to put forth its views. This submission was made on April 21, 2018.

Download the full submission here

For more details visit https://cis-india.org/internet-governance/blog/comments-on-the-draft-digital-information-security-in-healthcare-act

A look at two problematic provisions of the draft Anti-trafficking bill

swaraj — 2018-08-18T09:21:55Z

This post examines two badly drafted provisions of the new Anti-Trafficking bill that have the potential to severely impinge upon the Freedom of Expression, including through a misunderstanding of intermediary liability.

On 28 Feb 2018, the Union Cabinet approved ‘The Trafficking of Persons (Prevention, Protection and Rehabilitation) Bill, 2018’ (‘the bill’) for introduction to the Parliament. This comes after a series of consultations on an earlier 2016 draft bill, that had faced its fair share of criticism. As per the Press Information Bureau announcement, the Ministry of Women and Child Development met with various stakeholders including 60 NGOs and have incorporated many of the suggestions put forth. They’ve also stated that ‘the new law will make India a leader among South Asian countries to combat trafficking.’

However, at first glance, there appear to be several issues with overbroad or vague language used in the drafting of the bill, that stretch it into potentially problematic areas. This current post will focus on two such provisions that could lead to a deleterious effect on the Freedom of Expression. As the bill is currently not publicly available, a stakeholder’s copy of the draft is being used to source these provisions. The relevant sections have been reproduced below for convenience. (Emphasis in bold is as provided by the author).

Section 39: Buying or Selling of any person

39. (l) Whoever buys or sells any person for a consideration, shall be punished with rigorous imprisonment for a term which shall not be less than seven years but may extend to ten years, and shall also be liable to fine which shall not be less than one lakh rupees.

(2) Whoever solicits or publicises electronically, taking or distributing obscene photographs or videos or providing materials or soliciting or guiding tourists or using agents or any other form which may lead to the trafficking of a person shall be punished with rigorous imprisonment for a term which shall not be less than five years but may extend to ten years, and shall also be liable to fine which shall not be less than fifty thousand rupees but which may extend to one lakh rupees.

The grammatical acrobatics of section 39(2) aside, this anti-solicitation provision is severely problematic in that it mandates punishment even for a vaguely defined action or actions that may not actually be connected to the trafficking of a person. In other words, the provision doesn’t require any of the actions to be connected to trafficking in their intent or even outcome, but only in potential connection to the outcome. At the same time, it says these ‘shall’ be punished!

This vagary that ignores actual or even probabilistic causation flies in the face of standard criminal law which requires mens rea along with actus rea. The excessively wide scope of this badly drafted provision leaves it prone to abuse. For example, currently the provision allows the following interpretation to be included: ‘Whoever publicizes electronically, by providing materials in any form, which may lead to trafficking of a person shall be punished…’. Even the electronic publicizing of an academic study on trafficking could fall under the provision as it currently reads, if it is argued that publishing studies that show the prevalence of trafficking ‘may lead to the trafficking of a person’! It is not hard to imagine that an academic study that shows trafficking numbers at embarrassingly high rates could be threatened with this provision. Similarly, any of our vast number of self-appointed moral guardians could also pull within this provision any artistic work that they may personally find offensive or ‘obscene’. Simply put, without any burden of showing a causal connect, it could be argued that anything ‘may lead’ to the trafficking of a person. Needless to say, this paves the way for a severe chilling effect on free speech, especially on critical speech around trafficking issues.

Section 41: Offences related to media

41. (l) Whoever commits trafficking of a person with the aid of media, including, but not limited to print, internet, digital or electronic media, shall be punished with rigorous imprisonment for a term which shall not be less than seven years but may extend to ten years and shall also be liable to fine which shall not be less than one lakh rupees.

(2) Whoever distributes, or sells or stores, in any form in any electronic or printed form showing incidence of sexual exploitation, sexual assault, or rape for the purpose of exploitation or for coercion of the victim or his family members, or for unlawful gain shall be punished with rigorous imprisonment for a term which shall not be less than three years but may extend to seven years and shall also be liable to fine which shall not be less than one lakh rupees.

The drafters of this bill have perhaps overlooked the fact that unlike the physical world, the infrastructure of the electronic / digital world requires 3rd party intermediaries to handle information during most forms of electronic activities, whether it is transmission, storage or display. As it is not feasible, desirable or even practically possible for intermediaries to verify the legality of every bit of data that gets transferred or stored by the intermediary, ‘safe harbours’ are provided in law for intermediaries, protecting them from liability of the information being transmitted through them. These ensure that entities that act as architectural requirements and intermediary platforms are able to operate smoothly and without fear. If intermediaries are not granted this protection, it puts them in the unenviable position of having to monitor un-monitorable amounts of data, and face legal action for the slip-ups that are bound to happen regularly. Furthermore, there are several levels of free speech and privacy issues associated with having multiple gatekeepers on the expression of speech online. A charitable reading of the intent of a provision which does not recognise safe harbours for 3rd party intermediaries, would be that the drafters of the bill have simply not realised that users who upload and initiate transfer of information online, are not the same parties who do the actual transmission of the information.

Distribution, selling or storing of information online would require the transmission of information over intermediaries, as well as the temporary storage of such information on intermediary platforms. In India, intermediaries engaging with transmission or temporary storage of information are provided safe harbour[1] by Section 79 of the Information Technology Act, 2000 (‘IT Act’), so long as they:

(i) act as a mere ‘conduit’ and do not initiate the transmission, select the receiver of the transmission, or select or modify the information contained in the transmission.

(ii) exercise due diligence while discharging duties under this Act, and observes other guidelines that the Central Government may prescribe.

The Information Technology (Intermediary Guidelines) Rules, 2011, list out the nature of the due diligence to be followed by intermediaries to claim exemption under Section 79 of the IT Act.

Intermediaries will not be granted safe harbour if they have conspired, abetted, aided or induced commission of the unlawful act, or if they do not remove or disable access to information upon receiving actual knowledge, or notice from the Government, of the information that is transmitted or stored by the intermediary being used for unlawful purposes.

Thus it can be seen that the IT Act already provides an in-depth regime for intermediary liability, and given its non-obstante clause which states that Section 79 of the IT Act would apply “Notwithstanding anything contained in any law for the time being in force” , as well as the reiteration of the IT Act’s overriding effect via Section 81, which states that the provisions of the Act ‘shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force’ (barring the exercise of copyright or patent rights), it is generally considered the appropriate legal framework for this issue. However, it appears that the drafters of the 2018 Anti-trafficking bill have not considered this aspect at all, since they have not referenced the IT Act in this context in the bill, and have additionally added their own non-obstante clause in Section 59 of the bill:

59. The provisions of this Act, shall be in addition to and not in derogation of the provisions of any other law for the time being in force and, in case of any inconsistency, the provisions of this Act shall have overriding effect on the provisions of any such law to the extent of the inconsistency.

So the regime as prescribed by the IT Act allows for safe harbours, whereas the regime as prescribed by the Anti-Trafficking bill does not allow for safe harbours, and both say that they would an overriding effect for any conflicting law. This legislative bumble could potentially be solved by using the settled principle that a special Act prevails over a general legislation. This is still a little tricky as they are technically both special Acts. It could be argued that given the context of the Anti-trafficking bill as focusing on trafficking, and the context of the IT Act focusing on the interface of law and technology, that for the purposes of Section 41(2) of the Anti-trafficking bill, the IT Act is the special legislation. And thus Section 79 of the IT Act should make redundant the relevant portion of Section 41(2) of the Anti-trafficking bill. This reading would require the bill to be modified so as to remove the redundancy and the conflicting portion of Section 41(2).

[1] In 2016, a division bench of the Delhi High Court held in the case of Myspace Inc vs Super Cassettes Industries Ltd that a safe harbour immunity for intermediaries was necessary as it was not technically feasible to pre-screen content from third parties, and that tasking intermediaries with this responsibility could have a chilling effect on free speech, It held that their responsibility was limited to the extent of acting upon receiving ‘actual knowledge’. Earlier, in determining what ‘actual knowledge’ refers to, in 2015 the Supreme Court of India in the landmark case of Shreya Singhal vs Union of India, required this to be in the form of a notice via a court or government order. Thus under our current law, intermediaries are granted a safe harbour from liability so long as they act upon court or government orders which notify them of content that is required to be taken down.

Clarification (18th August, 2018): A letter sent to the Ministry of Women and Child Development mentioned the Centre for Internet & Society as instituionally endorsing a critique of the The Trafficking of Persons (Prevention, Protection and Rehabilitation) Bill, 2018. We seek to clarify that the Centre for Internet & Society did not endorse the letter to the Ministry.

For more details visit https://cis-india.org/internet-governance/blog/a-look-at-two-problematic-provisions-of-the-draft-anti-trafficking-bill

Short-term Consultant (IETF)

elonnai — 2018-04-21T15:44:49Z

The Centre for Internet & Society is seeking an individual with a strong understanding of IETF standards to work with us on writing 7 Human Rights Considerations for Internet standards and active drafts that are relevant to public interest. Additionally, the individual will help develop a longer term work-plan, expertise and approach for engagement in the IETF.

Note: This position is consultancy based on output.

Compensation: Based on experience and output.

Application requirements: two writing samples or other examples of technical work and CV

Contact: sunil@cis-india.org

For more details visit https://cis-india.org/jobs/vacancy-for-short-term-consultant-ietf

We are anonymous, we are legion

Artificial Intelligence for Growth: Leveraging AI and Robotics for India's Economic Transformation

Keynote Address

Special Address

Panel Discussion

Session Moderator

Panelists

#NAMApolicy on Online Content Regulation

Agenda

Cyber experts say 'playground open' for influencing elections

Data Usage by Political Parties

Now, Twitter too caught up in Cambridge Analytica controversy

April 2018 Newsletter

You Are Not the Only One: India stares at a loneliness epidemic

Aadhaar data of over 89 lakh MNREGA workers in Andhra Pradesh leaked online

DIDP Request #29 - Revenue breakdown by source for FY 2017

PAI WG Labor and Economy Meeting

Revenge Porn Laws across the World

1. Europe

United Kingdom

2. United States of America

3. Australia

4. Asia and Rest of the World

What’s up with WhatsApp?

Man-in-the-middle attacks

A simple experiment

The weakest link in the chain

Comments on the Draft Digital Information Security in Healthcare Act

A look at two problematic provisions of the draft Anti-trafficking bill

Short-term Consultant (IETF)