We are anonymous, we are legion

BIS International Seminar on Internet of Things

Admin — 2017-11-25T16:35:42Z

To create awareness among Indian community and to provide a platform to all stakeholders to discuss the technology, challenges and the way forward with an emphasis on the role of standards, BIS organized a half day International seminar on Internet of Things on 15 November 2017 at India Habitat Centre in New Delhi. Amber Sinha attended the event.

Click to see the agenda.

For more details visit https://cis-india.org/internet-governance/news/bis-international-seminar-on-internet-of-things

Why should you keep a close eye on the net neutrality debate in the US

Admin — 2017-11-25T15:33:32Z

As the United State's FCC Chairman Ajit Pai gears up to repeal the net neutrality laws put in place in 2015, India should sit up and take note.

The blog post by Subhrojit Mallick was published by Digit on November 24, 2017.

Back in 2014, a group of Redditors started debating net neutrality in India after Airtel announced it would charge extra for Voice Over IP (VoIP) services like Skype. Soon, that snowballed into a nation-wide campaign with over a million internet users participating. Things didn’t help when Facebook too wanted to provide a bunch of internet services for free in India through its Internet.org or Free Basics initiative. However, a year-long discussion and public outrage against the two, led the Telecom Regulatory Authority of India (TRAI) to rule in favour of net neutrality and stop both Airtel and Facebook in their tracks of violating a free and open internet.

Fast forward three years down the line and America, the birthplace of the internet, is struggling with the problem of internet freedom. The Federal Communications Commission (FCC) under the Donald Trump Administration led by Chairman Ajit Pai submitted a final draft proposal yesterday to repeal the existing net neutrality laws put in force by the Obama administration in 2015. The draft proposal will be voted upon by FCC by the end of the year and considering the FCC has a Republican majority under Ajit Pai, the proposal is likely to pass.

The draft removes almost every net neutrality rule from 2015, making ISPs the gatekeepers of the internet. It states internet providers will have the freedom to implement fast and slow speed lanes, prioritise traffic and block apps and services. The only rule they have to follow -- publicly disclose when they are doing any of the things stated above.

Executive director of the Centre for Internet and Society, Sunil Abraham elaborated on what's on Pai's mind.

"Ajit Pai's ideology is pro-market. He believes the market will sort all problems out. According to Pai, the magic of competition will eliminate all the harms emerging from net neutrality violation," he said.

"Pai has said, you do what you want to do, but you have to disclose that to the public. You can block, throttle, have fast lanes, prioritise traffic, have discriminatory pricing, but you disclose them. If the customer doesn't like it, he can swith to another network. Pai believes the transparency requirements will allow the magic of the market to diminish and eliminate harm. His regulation of net neutrality is transparency," Abraham further added.

However, such a move will have drastic effects on the free flow of internet traffic. Telecom companies and ISPs can handpick services by charging customers to access some sites or by slowing down the speeds of others. For instance, ISPs can make consumers pay more to watch high-quality content on Netflix.

With net neutrality rules repealed, the internet will become a pay-to-play service. It will essentially divide the internet into fast and slow lanes. One will be a speedy service that could be priced higher and another, much slower and cheaper. While big players like Amazon, Facebook, Google, Netflix and the likes can easily pay the higher fees and stay unfettered, newcomers and smaller players will have it tough. Although, the move will lead to cuts in profits for everyone. A higher price to consumers will eat into the user base of these companies, while startups and new voices in the media will find entry and success prohibitive.

Although it’s true that no single ISP in the US has the entire market to itself and the market is indeed divided into a handful of players, they do operate in a de facto monopolised way. How? ISPs in the US have sliced up the entire country into areas such that users in a particular area have only one choice of service provider. That essentially leaves users at the mercy of whatever Comcast or Spectrum is offering (or not offering).

By putting the net neutrality rules in place in 2015, the US had ensured these ISPs won’t do anything grossly uncompetitive. The current rules make broadband in the country a public utility, same as electricity. And now, Ajit Pai-led FCC is about to repeal those very rules that kept them grounded.

Will the FCC ruling make apps and services expensive in other countries?

While Pai’s jurisdiction does not extend beyond the United States, his tirades against a free internet will most definitely have rippling effects across the world. More importantly, it will raise the cost of operations of companies like Netflix and Amazon who will have to hire legal experts and lobbyists to negotiate deals with service providers. That extra cost will be burdened on the US consumers of course, but since they have a large international presence, it is likely that the extra cost will trickle down to users outside the US as well.

And that’s not just the streaming companies. All the tech giants hail from the US and it is only logical that a rise in their costs of operation will have an impact on their global operations.

Although, if the level playing field in the US is disrupted, companies will look for greener pastures and if that means moving out of the US to other countries, it could happen.

How will FCC’s decision impact India?

While US is grappling with such a reality, Indians fought against it and won. Or did they? Last year, after Airtel and Facebook were asked to drop their plans for differential pricing, TRAI released a paper on net neutrality and differential pricing to finalise its views on the matter. The regulatory body released a 14-question long consultation paper seeking comments on internet traffic management from the public.

“Increasingly, concerns have been raised globally relating to discriminatory treatment of Internet traffic by access providers. These concerns relating to nondiscriminatory access have become the centre of a global policy debate. The purpose of this second stage of consultation is to proceed towards the formulation of final views on policy or regulatory interventions, where required, on the subject of NN,” the paper read.

“Net Neutrality being repealed in the US will hurt innovation in that country, and will lead to a consolidation of power with those Internet companies which have the money to partner with US carriers. This hurts Indian product startups, because it means that their apps may not be as easily available to users in the US. The Internet is one world, and we need the same Internet to be available everywhere, across the world: one Internet for the entire world,” Nikhil Pahwa, Co-Founder of Internet Freedom Foundation told Digit.

That means, essentially, the debate on net neutrality is not over in India. In fact, both RS Sharma, the Chairman of TRAI and FCC’s Ajit Pai agree on the need to bridge the digital divide. Both are exploring ways to keep the internet open while providing access to the unconnected. Thankfully, both differs on the approach to meet that goal.

Pai believes the internet should be left unregulated despite the “hypothetical harms” to the consumer. He thinks the current rules were put in place to avoid theoretical harms which were not based on hard evidence. Pai claims there should be evidence-based regulation of the internet.

Sharma, in contrast, disagrees on an evidence-based approach.

“The TRAI's view of Net Neutrality has so far been diametrically opposite to Ajit Pai's FCC, and with good reason. Net Neutrality ensures that all ISPs and telecom operators act as exchanges of data between users, and do not discriminate on the basis of the type or source of that data. This allows for permission-less innovation on the Internet, which has given us the Internet that we have today,” Pahwa added.

Will India’s stance on net neutrality change after the FCC’s decision?

Rajan Mathews, Director General of Cellular Operators Association of India believes the FCC’s decision will no doubt have some impact on the path India takes.

“I think the policymakers will look at the decision the US makes. They had taken their decision as a point of reference before and the FCC’s ruling is too large an issue to not look at it. Both the DoT (Department of Telecom) and TRAI will have to reevaluate their approach in the context of the what happens in the US,” he said.

“Net neutrality approach in both countries is still in flux and India is going to tread lightly on net neutrality issues,” he added. As per Mathews, in India, the situation is different from the US where a handful of telecom companies and ISPs wield control of the entire country. In India, there is a licensed environment which provides a minimal standard of net neutrality, which is applied across the board and everybody who is providing a similar service is made to follow similar guidelines.

However, Mathews did attribute India’s efforts to enforce net neutrality to the United States’ efforts to place the rules in the first place in 2015 under the Obama administration, when internet was deemed as a public utility, same as electricity or telephone.

“Net neutrality in India emerged from the US definition. Now that they are going to repeal it, people in India who were looking at the US as a model will evaluate the implications of the move,” Mathews elaborated.

The US is looking to implement an ex-post approach to regulating the internet wherein the ISPs and telcos will adopt a free market approach and will only be investigated if they violate a rule. India, Mathews says, is adopting an ex-ante approach where there will be some commonly accepted criteria of net neutrality, but operators will have the ability to manage their traffic to ensure quality of service.

Minister of Information and Broadcasting, Ravi Shankar Prasad also helped alleviate fears of India following suit. During the Global Summit for Cyberspace Security held yesterday, he said, "The citizens' right of accessing the internet is "non-negotiable" and the government will not allow any company to restrict people's entry to the worldwide web."

Prime Minister Narendra Modi also came in support of net neutrality in India. He tweeted, "The internet, by nature, is inclusive and not exclusive. It offers equity of access and equality of opportunity."

Pahwa, who fought hard against Airtel and Facebook to ensure the internet remains neutral, was confident the decision won’t affect India’s stance on net neutrality. However, he is apprehensive that Indian telecom companies might borrow a leaf from their US counterparts and lobby hard to repeal the rules.

“I don't think the FCC decision affects the Indian regulation in any way, because the Indian regulator TRAI has already established strong and well rooted principles for Net Neutrality regulations in India. The only thing that worries me is that Indian telecom operators will use the developments in the US to push back against Net Neutrality with renewed vigour,” he said.

So, on the face of it, while India is well insulated from the catastrophe the United States has embarked upon, it is important to watch what the US is doing closely and make sure we don’t repeat their mistakes here.

For more details visit https://cis-india.org/internet-governance/news/digit-subhrojit-mallick-november-24-2017-why-should-you-keep-a-close-eye-on-net-neutrality-debate-in-us

Govt working to set up financial CERT to tackle cyber threats

Admin — 2017-11-25T02:28:18Z

IT secretary Ajay Prakash Sawhney says the government is getting the framework in place for financial CERT, which will be followed by other sectoral CERTs later.

The article by Komal Gupta was published in Livemint on November 16, 2017

The government is working to set up a financial Computer Emergency Response Team (CERT) to tackle a rise in cyber threats to India’s financial institutions.

This will be the first sectoral CERT to be introduced in India, said IT secretary Ajay Prakash Sawhney on Wednesday.

“Right now, the one which is directly being worked on is the financial CERT. We are getting the framework in place and once that is there, we will look at other sectors, said Sawhney, responding to a question on the progress of setting up of sectoral CERTs in the country. “It will oversee the entire financial sector including banks and financial institutions,” he added.

He was addressing the Asia Pacific Computer Emergency Response Team (APCERT) Open Conference in the capital on Wednesday.

In March, the power ministry had announced setting up of four sectoral CERTs for cyber security in power systems—CERT (Transmission), CERT (Thermal), CERT (Hydro) and CERT (Distribution).

According to Sawhney, as of now, there is a national CERT and no other sectoral CERTs. While addressing the conference, he said one of the themes to be discussed will be “How sectoral CERTs can function in conjunction with the national CERT.”

CERT-In is the national nodal agency under the ministry of electronics and IT (MeitY), which deals with cyber security threats such as hacking and phishing. The agency is tasked with the collection, analysis and dissemination of information on cyber incidents and even taking emergency measures for handling cyber security incidents.

“The biggest task of sectoral CERT is to share information with the others in the industry. For example, if a bank undergoes an attack; normally the bank will perform all the necessary actions to limit the attack and to prevent it from happening in the future. But the obligation of sharing how the attack happened with all the other banks in India to make sure that they can protect their respective systems from such an attack, can be carried out by a financial CERT,” said Udbhav Tiwari, programme manager at the Centre for Internet and Society, a Bengaluru-based think tank

“From April to October 2017, around 50,000 cyber security incidents have been handled by CERT-In; including phishing, malware attacks, attacks on digital payments and targeted attacks on some of the critical industries,” said cyber security chief Gulshan Rai, who was also present at the event.

A total of 50 incidents of cyber attacks affecting 19 financial organizations have been reported from 2016 till June 2017, PTI reported in August.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-16-2017-komal-gupta-govt-working-to-set-up-financial-cert-to-tackle-cyber-threats

Roundtable on Data Integrity and Privacy

Admin — 2017-11-25T02:17:13Z

Amber Sinha attended a roundtable on data integrity and privacy organized by the Observer Research Foundation (ORF) on November 18, 2017 in New Delhi. The round table discussion was chaired by Shri Baijayant Panda, Hon'ble Member of Parliament.

With the 10-member committee headed by former Justice B.N. Srikrishna being mandated to recommend principles for a new data protection bill, the time is ripe for online platforms, service providers and citizen stakeholders to discuss what the substantive elements of the new data protection law should look like.

Regulatory principles around data should be informed by the impetus for innovation, the responsibility to deliver social benefits and most importantly the users’ expectation of privacy. Increasingly, the nature and number of actors collecting and processing user data is becoming unclear. The new data protection framework must clarify the relationship between the user and apps/ mobile platforms that collect her data, but should do so while acknowledging the heterogenous nature of the Indian digital economy, comprising operating systems, platforms and devices of varying security and sophistication.

To kick-start this project, ORF hosted a roundtable chaired by Shri Baijayant Panda to hear from a diverse set of stakeholders to understand what direction the data privacy regime in India should take. The roundtable took place at the Viceroy, Claridges Hotel, 12, Dr APJ Abdul Kalam Road, New Delhi, Delhi 110011.

The roundtable broadly covered the following aspects –

Role of user consent and choice
Importance of cross border data flows
Appropriate regulatory authority
International best practices and relevance to the Indian context
Reasonable restrictions
Private-public collaboration

For more details visit https://cis-india.org/internet-governance/news/roundtable-on-data-integrity-and-privacy

Internet Universality Indicators for a Safe, Secure and Inclusive Cyberspace for Sustainable Development

Admin — 2017-11-25T02:04:54Z

Amber Sinha attended an event organized by UNESCO in collaboration with the Ministry of Electronics and IT, Government of India in the run-up to the 5th Global Conferene on Cyberspace (GCCS 2017) on November 17, 2017 at UNESCO Conference Room in Chanakyapuri, New Delhi.

Agenda here

For more details visit https://cis-india.org/internet-governance/news/internet-universality-indicators-for-a-safe-secure-and-inclusive-cyberspace-for-sustainable-development

Why you should keep a close eye on the net neutrality debate in the US

Admin — 2018-01-18T14:50:52Z

As the United State's FCC Chairman Ajit Pai gears up to repeal the net neutrality laws put in place in 2015, India should sit up and take note.

The blog post by Subhrojit Mallick was published by Digital.in on November 24, 2017.

What is FCC chairman Ajit Pai doing?

Executive director of the Centre for Internet and Society, Sunil Abraham elaborated on what's on Pai's mind.

Will the FCC ruling make apps and services expensive in other countries?

And that’s not just the streaming companies. All the tech giants hail from the US and it is only logical that a rise in their costs of operation will have an impact on their global operations.

Although, if the level playing field in the US is disrupted, companies will look for greener pastures and if that means moving out of the US to other countries, it could happen.

How will FCC’s decision impact India?

While US is grappling with such a reality, Indians fought against it and won. Or did they? Last year, after Airtel and Facebook were asked to drop their plans for differential pricing, TRAI released a paper on net neutrality and differential pricingto finalise its views on the matter. The regulatory body released a 14-question long consultation paper seeking comments on internet traffic management from the public.

Sharma, in contrast, disagrees on an evidence-based approach.

Will India’s stance on net neutrality change after the FCC’s decision?

Rajan Mathews, Director General of Cellular Operators Association of India believes the FCC’s decision will no doubt have some impact on the path India takes.

For more details visit https://cis-india.org/internet-governance/news/digit-in-subhrojit-mallick-november-24-2017-why-you-should-keep-a-close-eye-on-the-net-neutrality-debate-in-the-us

Indian activists slam FCC decision to ditch net neutrality

Admin — 2017-12-18T15:27:04Z

Indian net neutrality activists are assured the ongoing net neutrality tussle in the US will have no impact on India.

The article by Kul Bhushan was published in the Hindustan Times on November 23, 2017.

Net neutrality is in the news again. This time it is because the US’ Federal Communications Commission (FCC) has decided to formally scrap existing protections that are meant to keep access to internet equitable.

India had its own tryst with the idea of net neutrality after it blocked the zero-rating programmes by social networking giant Facebook — which proposed to rollout the Internet.org or Free Basics project in February last year.

A powerful social media campaign made Facebook back down and the Telecom Regulatory Authority of India (TRAI) to announce that ‘differential pricing’ — a practice where some services or sites are priced in a special manner — will no longer be allowed.

Some people who were at the forefront of the net neutrality campaign in here almost three years ago have expressed their displeasure over the FCC’s move.

“I think the approach the FCC is taking is flawed. Spectrum is a public resource and it needs to be spent on maximisation of public good. That public good, and the utility of the Internet is based on the freedom that people have to create new apps and services, without needing permission from ISPs, or the fear that ISPs might discriminate against them or favour their competitors. This is what net neutrality enables,” said Nikhil Pahwa, founder of publication Medianama and one of the activists.

“By going against Net Neutrality, FCC chairman Ajit Pai is attacking the core of what makes the Internet tick. We didn’t let that happen in India, and instead, focused on increasing competition between ISPs and telecom operators, because of which we’ve see broadband prices drop, quality of service improve, a tremendous growth in Internet users in India. For this, we owe a great debt to all those who supported Net Neutrality, especially the TRAI,” he added.

Apar Gupta, who is closely associated with the ‘Save the Internet’ initiative and is the co-founder of Internet Freedom Foundation, said, “FCC’s move to take back the internet order is a huge setback to the global campaign to ensure open internet because it undermines the net neutrality.”

“I don’t think the development should impact the regulatory process in India considering TRAI’s strong support for net neutrality. I hope that TRAI comes out with a comprehensive network neutrality regulation in the future,” he responded when asked about the possible impact on India of the FCC move.

Sunil Abraham, executive director of Bangalore-based research organisation Centre for Internet and Society, said there should be no impact on India from the FCC move.

He also slammed FCC chief Pai’s attempt to change the existing net neutrality rules. “What Ajit Pai is trying to do he’s not saying he will not regulate. He is saying when companies violate net neutrality principles they should be transparent about it. He hopes the magic of market competition will help resolve the problem,” he said

“Pai’s approach to the net neutrality might work in a market where there is a lot of competition. In the US, there is no competition and that in case damage will be immediate,” he added.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-kul-bhushan-november-23-2017-indian-activists-slam-fcc-decision-to-ditch-net-neutrality

Global Technology Summit 2017

Admin — 2017-12-05T13:47:57Z

The 2017 Global Technology Summit will take place on December 7 and 8, 2017 at the Hotel Leela Palace, Bangalore. Sunil Abraham is a speaker at the event.

Link to the original published by Carnegie here

The inaugural edition of the Global Technology Summit convened leading scholars, experts, and officials from more than ten countries for wide-ranging discussions on policy frameworks for technological innovation.

Building on its success, leading innovators, researchers, and entrepreneurs in cutting-edge technologies from around the world will engage with regulators, policy experts, and civil society actors this December in Bangalore.

The Summit will focus on new directions in technology policy, such as tech-diplomacy, data protection, and building an innovation ecosystem, as well as fields like digital finance, e-mobility, robotics, and smart cities, where massive technological transformation is likely in the coming years.

Agenda here

Panel Description

Navigating Big Data Challenges: Access to data, and capabilities to analyze the same, redefine the business moat for corporations and governance opportunities for governments. Data dictates product and policy success. It also raises complex challenges. With ever increasing hacks and vulnerabilities, data security continues to confound us. Data-driven businesses and governments also question core assumptions of privacy and individual reputation. Machine learning and deep learning, facilitated by data crunching algorithms, can either be coded to discriminate or learn from human data sets and imbibe the very same prejudices. This panel will deliberate upon these varied challenges, and explore possible policy frameworks to address them.

The panelists are:

Ann Cavoukian
Rahul Matthan
Vishnu Shankar
Rob Sherman
Sunil Abraham

Chaired by B.N. Srikrishna, former judge, Supreme Court of India

For more details visit https://cis-india.org/internet-governance/news/global-technology-summit-2017

Cyberattacks a significant threat to democracy: Modi

Admin — 2017-11-24T13:29:17Z

We have to ensure that cyberspace does not become a playground for dark horses of radicalism, says PM Narendra Modi at the fifth Global Conference on Cyber Space in Delhi.

The article by Komal Gupta was published in Livemint on November 24, 2017.

Prime Minister Narendra Modi on Thursday said creating a safe and secure cyberspace is on the primary agenda of the government as cyberattacks were a threat to democracy.

Modi’s assurance of decisively dealing with cyberattacks comes at a time when policymakers are making an unprecedented push to popularize digital transactions and cut down use of cash in order to have a more transparent and accountable economic environment. The government is at present working on a draft policy for tackling ransomware, a malicious software.

“We have to ensure that cyberspace does not become a playground for dark horses of radicalism,” Modi said, while inaugurating the fifth Global Conference on Cyber Space (GCCS) in the national capital.

A total of 50 incidents of cyberattacks affecting 19 financial organizations were reported from 2016 until June 2017, PTI reported in August.

With multiple cyberattacks affecting key infrastructure assets like ports and major payment companies recently, the government has decided to come out with a draft policy for tackling ransomware, a senior government official told Mint during the conference. “CERT-In (The Indian Computer Emergency Response Team) is working on a draft policy for tackling ransomware which will be put up for consultation by various stakeholders, including organized enterprise users of IT (Information Technology), solution providers and internet service providers (ISPs),” Ajay Kumar, additional secretary in the ministry of electronics and information technology said.

Kumar said the draft policy will focus on the proprietary steps the country will take in case of a ransomware attack. This will include the steps for the sharing of information to try and restrict the loss as much as possible. A centre of excellence will be set up to find solutions to attacks or neutralise the malware, he added.

The need to set up a safe and secure cyberspace is one the major concerns of the government as it is moving to create a ‘less-cash’ economy. Earlier this year, the government announced the “DigiDhan Mission” to achieve a 25 billion digital transactions target, outlined in the Union budget for this fiscal.

Modi said empowerment through digital access is the aim of the government and digital technology has saved around $10 billion so far by eliminating middlemen.

The MyGov platform is a prime example of how technology strengthens offices. PRAGATI has resulted in faster governance decisions through general consensus, he added.

PRAGATI (Pro-Active Governance And Timely Implementation) is an interactive platform aimed at addressing the common man’s grievances and monitoring and reviewing programmes and projects of the central and state governments.

Umang stands for Unified Mobile Application for New-age Governance. It provides all pan India e-Gov services ranging from central to local government bodies and other citizen-centric services like Aadhaar and Digilocker on one single platform or mobile app.

Modi said, “the app will provide over hundred citizen-centric services. It will automatically add pressure among peers and result in a better performance.”

Law and IT minister Ravi Shankar Prasad, speaking at the event, said privacy of individuals was of utmost importance but “privacy cannot withhold innovation.” He further said the citizens’ right of accessing the internet is “non-negotiable” and the government will not allow any company to restrict people’s entry to the worldwide web.

Speaking on Facebook’s Free Basics programme, Prasad said the government did not allow social networking giant’s programme because it offered access to select internet services. Facebook had introduced its Free Basics programme in India in 2015 to offer free basic internet access to people in partnership with telecom operators. Prasad said the idea behind Free Basics was that everything will be free, namely eduction, health, entertainment and others, if one enters the Net through one gate (Facebook’s).

“I said India is a democracy, we don’t believe in one gate. We believe in multiple gates. Therefore, this gate locking for India will not be accepted and I did not allow it. This stems (from) our commitment that internet must be accessible to all,” he added.

Sri Lankan Prime Minister Ranil Wickremesinghe, who was present at the event, said there was no legal framework on cyberspace and he hoped the conference would lead to a consensus to finalize the terms of the framework. “Our government has a lot more to do in net neutrality but we have taken progressive and revolutionary step in this regard,” added Wickremesinghe.

Wickremesinghe is on a four-day visit to India with the aim of boosting bilateral ties.

On the first day of the conference, India agreed to establish a joint working group with Iran to work in different IT areas.

India will provide technical advice to Mauritius for setting up the digilocker infrastructure. An MoU has been signed with Denmark for future cooperation in the IT sector.

“While a policy on ransomware is welcome, there is much more to be done. Implementation of the 2014 National Cybersecurity Policy has been very slow. Even the simplest bits, such as a secure process for receiving vulnerability disclosure has been lacking,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bengaluru-based think tank.

PTI contributed to this story.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-24-2017-komal-gupta-cyberattacks-a-significant-threat-to-democracy-modi

Privacy issues exist even without Aadhaar

Admin — 2017-11-23T16:12:11Z

There is a critical need for a data privacy regulator to penalize unauthorized disclosure of personal information.

The article by Ronald Abraham was published by Livemint on November 15, 2017.

In part I, I argued that while Aadhaar can be a tool to infringe upon our right to privacy, it is merely one such; there exist other tools that can be similarly exploited. This becomes evident when you analyse each privacy issue related to Aadhaar using the National Privacy Principles framework, and compare Aadhaar’s data privacy risks to other national ID systems. We need an independent data privacy regulator, backed by a robust law, to safeguard against the risks.

Here, we explore two such data privacy issues: data disclosure and voluntariness (database linking was analysed in part I).

Data disclosure

According to the National Privacy Principle on data disclosure, “a data controller shall not disclose personal information to third parties, except after providing notice and seeking informed consent from the individual for such disclosure”.

On paper, the Aadhaar Act appears compliant with this principle as Section 29 prohibits the disclosure of personal information. Exceptions exist for courts to request demographic data, and for joint secretaries and higher ranks to request biometric data; the latter on the grounds of “national security”. However, greater clarity is required on whether individuals will be informed of data disclosures.

In practice, however, data disclosures well beyond these exceptions have taken place. A study by the Centre for Internet and Society found that nearly 130 million Aadhaar numbers had been published online by four government departments. In many cases, these were published along with information on “caste, religion, address, photographs and financial information”. If someone manages to steal these individuals’ fingerprints as well (which is becoming less difficult), one possibility is that Aadhaar-linked bank accounts can be cleaned out using micro-ATMs.

Demographic data disclosure, however, is not limited to Aadhaar. For transparency reasons, state election commission websites disclose the personal information of every person registered to vote online. Agencies scrape these databases and sell them.

Like database linking, the onus of abiding by the principle of data disclosure is on the “data controller”. The four government agencies that disclosed Aadhaar data—not the Unique Identification Authority of India (UIDAI)—are the relevant data controllers in this case. However, UIDAI has not pressed charges against them; under the Aadhaar Act, it is solely authorized to do so. Given UIDAI’s role of working with the government to enable and encourage the use of Aadhaar, it should not also be responsible for regulating them. Additionally, the Election Commission’s data disclosure norms demonstrate that the issue is bigger than Aadhaar.

This, therefore, points to the critical need for a data privacy regulator to investigate and penalize unauthorized disclosure of sensitive personal information. A strong regulator, with a clear law, will also serve as an effective deterrent for negligent disclosure practices.

Voluntariness

The ability to voluntarily opt in and out of data systems, based on informed consent, is central to the National Privacy Principle of “Choice and Consent”. Once an individual opts in, the principle clarifies that they “also have an option to withdraw (their) consent given earlier to the data controller”.

With regard to opting in, UIDAI has maintained that Aadhaar enrolment is voluntary. However, Section 7 of the Aadhaar Act and various orders by government agencies require Aadhaar to access basic services. Though exceptions are allowed, in practice they are implemented inconsistently, making Aadhaar near-mandatory.

To be sure, the choice principle states that data controllers can choose not to provide services if an individual doesn’t consent to provide data, “if such information is necessary for providing the goods or services”. However, we need more explicit guidelines on what features satisfy this condition, something that can be defined in a data privacy law.

With regard to opting out, no such UIDAI provision exists. One argument is that more data increases UIDAI’s capability to establish the uniqueness of new enrollees. However, it is unclear why this is the case because even if millions opt out of Aadhaar, UIDAI’s ability to guarantee the uniqueness of new enrollees compared to existing enrollees doesn’t diminish.

While voluntariness is actively discussed with Aadhaar, the same is not true for other IDs and data initiatives. For example, fingerprints are collected to issue Indian passports, but the use of this is not clear—raising concerns around voluntariness as well as purpose limitation.

Through this analysis, it becomes clear that data privacy issues exist even without Aadhaar. To tackle the risks to privacy, India requires a strong, competent and independent data privacy regulator, backed by a robust law.

With the recent Supreme Court judgement and upcoming hearings, we have a unique opportunity to strengthen our institutional ability to manage future risks. We must seize this opportunity to try and secure a privacy-protected future.

Ronald Abraham is a partner at IDinsight and co-author of ‘State of Aadhaar’ report 2016-17.

Research contributions from Shreya Dubey and Akash Pattanayak.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-23-2017-ronald-abraham-privacy-issues-exist-even-without-aadhaar

Financial CERT to combat cyber threats, says MoS home affairs

Admin — 2017-11-23T16:07:21Z

To tackle cyber threats to India’s financial institutions, the central government is mulling to establish a financial Computer Emergency Response Team (CERT).

This was published by CISO MAG on November 17, 2017

Addressing the 15th Asia Pacific Computer Emergency Response Team (APCERT) Open Conference in New Delhi on November 15, 2017, IT Secretary Ajay Prakash Sawhney said, “right now, the one which is directly being worked on is the financial CERT. We are getting the framework in place and once that is there, we will look at other sectors. It will oversee the entire financial sector including banks and financial institutions.”

In March this year, the power ministry had announced to create four sectoral CERTs for cybersecurity in power systems: CERT (Transmission), CERT (Thermal), CERT (Hydro), and CERT (Distribution).

Udbhav Tiwari, program manager at the Centre for Internet and Society, a Bengaluru-based think tank, highlighted the responsibilities of the financial CERT in a conversation with Live Mint. “The biggest task of sectoral CERT is to share information with the others in the industry. For example, if a bank undergoes an attack, normally the bank will perform all the necessary actions to limit the attack and to prevent it from happening in the future. But the obligation of sharing how the attack happened with all the other banks in India to make sure that they can protect their respective systems from such an attack, can be carried out by a financial CERT,” he said.

Cybersecurity Chief Gulshan Rai, who was also present at the event, said “from April to October 2017, around 50,000 cyber security incidents have been handled by CERT-In; including phishing, malware attacks, attacks on digital payments and targeted attacks on some of the critical industries.”

On August 1, 2017, MoS home affairs Hansraj Gangaram Ahir had said “as per the information by the Indian computer emergency response team (CERT-In), 50 incidents affecting 19 financial organizations have been reported during the period of November, 2016 to June, 2017.”

For more details visit https://cis-india.org/internet-governance/news/ciso-mag-financial-cert-to-combat-cyber-threats-says-mos-home-affairs

Global Commission on the Stability of Cyberspace (GCSC)

Admin — 2017-11-23T14:38:12Z

The Global Commission on the Stability of Cyberspace organized a meeting on November 21, 2017 in New Delhi. The meeting took place at Taj Diplomatic Enclave Hotel on the sidelines of the 5th Global Conference on Cyberspace. Pranesh Prakash participated in the event.

GSC commissioners engaged in discussions with leading experts on cyber diplomacy, cyber norms and counter-proliferation. See the Draft Agenda here.

For more details visit https://cis-india.org/internet-governance/news/global-commission-on-the-stability-of-cyberspace-gcsc

Counter Comments on TRAI's Consultation Paper on Privacy, Security and Ownership of Data in Telecom Sector

amber — 2017-11-23T14:29:06Z

The Centre for Internet & Society (CIS) has commented on the Consultation Paper on Privacy, Security and Ownership of Data in Telecom Sector published by the Telecom Regulatory Authority of India on August 9, 2017.

The submission is divided in three main parts. The first part 'Preliminary' introduces the document. The second part 'About CIS' is an overview of the organization. The third part contains the 'Counter Comments' on the Consultation Paper taking into account the submission made by other stakeholders.

Download the full submission here

For more details visit https://cis-india.org/internet-governance/blog/counter-comments-on-trais-consultation-paper-on-privacy-security-and-ownership-of-data-in-telecom-sector

Elements of a Decentralized Web

Admin — 2017-11-23T14:16:26Z

Gene Kogan will deliver a talk on the elements of a decentralized web at the Centre for Internet (CIS) office in Bengaluru on December 11, 5.30 p.m. to 7.30 p.m.

The internet is broken. Straying far from the original vision of democratizing access to knowledge, large tech companies now resemble the industrial barons of the 19th century, presiding over what many scholars regard as a public utility but nevertheless unregulated. As machine learning has entered the picture, the usual suspects like Facebook, Reddit, and Quora, have begun training sophisticated algorithms on personal data to route traffic in order to maximize attention, leading to a web which is more atomized, addictive, and anxiety-inducing.

In response to this, some have begun writing about, conceptualizing, and implementing the open-source protocols of what they consider the future web 3.0. Cryptocurrency enthusiasts have expanded their focus to more generalized blockchains which enable trust in decentralized platforms, while initiatives like IPDB and IPFS ambitiously promise to make hosting, storage, database querying, and even computation itself possible inside of peer-to-peer networks. But all is not well in this techno-utopia -- as the speculative bubble around this "internet of money" grows, so too does interest from the very institutions these new initiatives seek to overcome. The landscape is beginning to look like Silicon Valley of the 1990s and the threat of a crash looms. It's up to us to determine which way this one will play out.

Gene Kogan

Gene Kogan is an artist and a programmer who is interested in generative systems, computer science, and software for creativity and self-expression. He is a collaborator within numerous open-source software projects, and gives workshops and lectures on topics at the intersection of code and art. Gene initiated ml4a, a free book about machine learning for artists, activists, and citizen scientists, and regularly publishes video lectures, writings, and tutorials to facilitate a greater public understanding of the subject.

Links:

genekogan.com

twitter.com/genekogan

For more details visit https://cis-india.org/internet-governance/events/elements-of-a-decentralized-web-talk-by-gene-kogan

India’s internet missionaries: The women Google is relying on to spread its Next Billion message

Admin — 2017-11-23T02:33:35Z

Google’s internet saathis have brought 11.5 million women in 105,000 villages online. But there’s a catch: the women are taught to use only Google products.

The article by Sunny Sen was published by Livemint on November 21, 2017.

Until Google came calling at Khaula, one of the nearly 100,000 villages in Uttar Pradesh, early in 2016, few among the womenfolk there had heard about the internet. A few had seen their men watching videos on smartphones, but none had accessed the internet on her own.

Now, more than 1,100 women in Khaula and neighbouring villages know how to access the internet and regularly log in. They teach their children, they teach themselves new skills, they look up fixes to niggling medical problems, and watch YouTube videos.

Khaula is ground zero for an ambitious Google initiative called Next Billion to spread use of the internet in developing economies. The initiative rides on the shoulders of women—internet saathis, who have been roped in to carry the “here’s how to access the internet” message across India. The success or failure of the saathis (saathi means friend in Hindi) in the internet literacy project will make or break the programme.

India, whose over 400 million data consumers make it the No. 2 market by internet users, only behind China, is the top focus country in the Next Billion programme. The project also covers Brazil, Indonesia, Nigeria, and parts of Africa.

The internet saathi programme, run by Google along with Tata Trusts is designed in such a way that two-three women in a village are handpicked and trained to use the internet. They, then, further train thousands of village women—not men—on how to access it. This design is with good reason: less than one-third of internet users in India are women and the number is far lower in its villages, explained Rajan Anandan, Google’s vice president for Southeast Asia and India, in a Mint newspaper article in April.

Neetu’s story

Four years ago, Neetu Bhagour, now 22, had made news in the village when she won a state-level wrestling event and was selected at the national level. But, she never made it to the nationals. “My parents didn’t allow me to… girls in our villages are not allowed to play much,” Bhagour said, her disappointment showing in her smile.

After leaving wrestling, she decided to pursue studies. The college was far away from the village and she didn’t attend every day, yet completed her graduation in science earlier this year—one of the few to do so in Khaula.

It was on one of the days she was home, bunking college, that her uncle told her that if she had time, she could teach village women how to access the internet. That was about one-and-a-half years ago.

“I had only seen my brother using (the internet). He had an Android phone, but he would never let us use it,” Bhagour said. “I decided to learn how to use the internet. People from Google trained us for three-four days… That was the first time I used the internet.”

Google gave her a Lava smartphone and a Celkon tablet—both entry-level brands—to use and train other village women. The cost of the two devices was around Rs11,000, a price that the women of Khaula would perhaps never be able to afford. The trainers also get an umbrella and 2GB of monthly data for each device—all provided by Google.

Till now Google has spent about Rs50 crore on training 35,000 saathis. That’s a tab of between Rs14,000 and Rs15,000 per saathi which includes the Rs11,000 spent on the devices, umbrella and data.

It was not easy for Bhagour to convince women in her village that learning to access the internet would be useful. Often they would scoff at her: “We don’t need it.” She stayed persistent. “It’s okay if you don’t need the internet, but teach it to your children,” she told them. “Use Google to know anything in this world.”

Next billion

Bhagour is one of the 35,000 internet saathis in India Google is backing. And, in a move atypical of the search giant, it is pouring crores of rupees training them. “Tata Trusts are equally funding the initiative for us. Google brings in the devices, the data, and the technical know-how of training the saathis. And Tata Trusts are managing the on-ground implementation, the saathi stipend,” said Neha Barjatya, head of ads marketing & digitizing initiatives, Google India.

The saathis are trained on how the web works, especially how to use various Google products such as Chrome, Search, YouTube, and PlayStore. They are not trained to use any other product, not Facebook or WhatsApp.

Since the beginning of the internet saathis project in 2015, Google has covered 105,000 villages in 12 states and taught 11.5 million women how to use the internet—making it the biggest project by Google under its Next Billion initiative and perhaps the single largest such outreach programme anywhere in the world.

Google wants to take the programme to 300,000 villages. “These women discover the internet (through Google and its products), and eventually discover how to use the internet for their needs,” said Barjatya.

Internet hard-sell

It wasn’t easy for Bhagour or any of the other saathis, initially.

Deepa Rajput of Dehtora village (near Khaula) is a Ph.D in Hindi. She teaches at the Shree Jagdamba Degree College in Agra. She was introduced to the internet saathi initiative by a friend of her husband’s. “Our family is one of the progressive ones in the village, so it was easy to convince my in-laws,” said Rajput.

But when she went out to teach, it was a problem. At the start, women didn’t allow her to take their picture, which is needed to enrol them in the programme. Some even refused to fill the enrolment form.

Rajput’s pitch was simple, yet compelling. “Google pe saara vishwa ka jankari prapt kar sakte hai… Agar aapka bhains bimar ho jata hai toh aap uske karan dekh sakte hai (You can find the entire world’s information on Google… If your buffalo falls sick, you find the reasons there),” she told the village women.

Most women liked the idea but they had to take the permission of their in-laws and husbands. “Women are weak… their survival depends on how much their husbands provide,” Rajput said.

When Google first went to a few villages in 2013, it started by training women directly for three-four hours. This was done at a school or the village community centre. It didn’t work out. The turnout was dismal. Folks at Google knew that they had to fix it if they had to expand beyond towns.

A pilot was done in a village near the Maheshwar town in Madhya Pradesh. Google piloted something called the internet cart, like an ice cream cart, which had internet-enabled tablets. Google-contracted agents would go from village to village, home to home, with these carts and teach the village women how to use the internet.

But, even that wasn’t enough. Google realized that it was important to stay in the village for a long period of time and keep training the women. That’s when the internet saathi concept was born.

The other problem was that women didn’t have devices to access the internet on. So Google gave them devices and free data. In 2015, Google and Tata Trusts started identifying trainers. Initially, Google also provided the saathis with a cycle in 1,500 villages, but stopped it as the women preferred walking.

Changing lives

For many of these beneficiaries, the internet is the only form of empowerment. For Deepmala, a primary school teacher in Atus village not far from Khaula, the internet helps her children learn English. “Children often ask things we don’t know… I have started using Google to explain things to children,” she said.

Deepmala’s first acquaintance with the internet was when she enrolled to become a saathi. She has trained 1,500 women since then. It wasn’t easy to convince her husband to allow her to learn how to use the internet but his mother stepped in. “My mother-in-law allowed me to learn… she used to go with me for the training,” she said.

For all the world that the internet has opened up for her, some centuries-old habits haven’t changed. Deepmala doesn’t know much about her husband’s work or what he earns. All she knows is that her husband works in a shoe factory near Agra. Without her mother-in-law’s backing, Deepmala said, she wouldn’t have been able to become a saathi.

When she showed the village women the internet, they were initially afraid to use it. There are a lot of myths about the ills of the internet in the villages. Rightly so, as often boys and men in the villages click pictures of girls and upload them to porn sites.

Women are shy and shun anything that may intrude on their privacy. It is in such a context that the world of information—access to Bollywood, culture, lifestyle, pornography, information, email, voice calling, and dozens of applications—suddenly opened up to them.

The saathis need to have a minimum education of up to Class VIII and should be comfortable with English. But there are no restrictions on the saathis to pick educated women. Many of their students don’t know how to read or write. For them, Deepa Rajput of Dehtora village said, Google voice commands are the easiest way to search the internet. “Women are seeing videos condemning domestic violence and oppression of women… That is a big change,” she said.

Making money

Deepmala, the school teacher saathi, taught women to search for mehendi designs and facial makeup on Google and YouTube. “Some of them have even started searching new salwar and blouse designs… The women tailors make more money for these designs,” she said.

Some women have started charging Rs50 for drawing mehendi designs. Others have started using the internet to look for agriculture and health-related information.

There are other avenues of making money, too. Deepmala and few of the women she trained landed a contract from research firm Nielsen to do a survey of the villages and the shops, for which they were paid. A list of 96 shops was given to them with a list of 80 questions. “The form was on the internet, we surveyed these villages and filled the form. It was about things like what products are sold, which shops have shut down, updating contact information…,” said Deepmala.

Monica Sisodiya from Barhan village has trained 2,000 women, most of them who are young. After being trained by Monica, two of them opened a beauty parlour. “She gets customers from 10-12 villages because of the new ways she has introduced,” said Monica, who wanted to study law in Agra, but couldn’t because her family wouldn’t allow her to go to the city. She is now pursuing a nursing course at Maa Bhagwati College, 7km from her home.

Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Others like Babita Singh are evidence that the lack of information access is not a problem of the poor alone. Babita, 20, whose father is an intelligence officer with the Uttar Pradesh police, lives in a house that is prosperous by Dehtora standards. Her house has four CCTV cameras monitoring the front and rear of the building. The images are captured on a 42-inch LED television on the living room wall.

Yet, Babita used the internet for the first time only four months ago after getting trained by Deepa. Babita refers to the Chrome browser as ‘kromee’. She said she uses the internet to fill forms for banking entrance exams. At leisure, she browses designs of cushion covers and sweaters and tries out new food recipes that she pulls up from the Net.

Babita’s neighbour, Malti Rajput, teaches in a school for the mentally challenged in a nearby village. She isn’t well off and got her first phone from Google.

“We have started using the internet in our schools to teach the children dance steps… They also see craft designs. We sell some of these products to raise some money for the children,” said Malti.

It’s business, of course

For Google, this is not any corporate social responsibility activity. It is about getting every individual in India online. “This is not a social initiative for us. It is very much a business or marketing objective,” said Barjatya.

Getting more people to use the internet lies at the heart of Google’s business. Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Barjatya said Google does not measure what it is getting back from the initiative. “It’s very much to get these women online and the rest will follow,” she said. “We are only seeing how many villages and how many women are coming online, and how does it tie back into our Next Billion initiative.”

But experts say Google alone can’t change rural India. “Google is probably worried that rural India might end up like Myanmar where most users stay within Facebook and do not explore the rest of the internet,” said Sunil Abraham, executive director of Bengaluru-based research organization Centre for Internet and Society.

Click here for enlarge

Moving the needle

All the saathis FactorDaily spoke with said that at their training sessions they are taught only how to use Google products, apart from handling the hardware. Those, too, only on Android phones. No Facebook, no WhatsApp, no Snapchat, no Twitter, no Paytm, no Flipkart...

“This is a smart business decision for Google but it does not really bridge the digital divide. We need all stakeholders, including Google to work together to reduce the cost of hardware and connectivity,” Abraham said.

Still, a Google-commissioned study by research firm Ipsos suggests that the internet giant has made some headway in rural India. Here are some pointers from the study:

■ 90% of women who have attended the training have a better understanding of the internet

■ 25% of women continue to use the internet (Gujarat is the highest at 35%)

■ 7% of women trained under the program feel that their social standing has improved

■ 33% trained women think that their economic condition has improved by learning new skills

■ 1% increase in village income in instances where training was conducted

Even though most of the women are not taught to use Facebook and WhatsApp, most of them eventually get on to social media. This is little consolation for Facebook, which has failed to mainstream itself in rural India the way Google has.

While Google gets a large number of the first-time users, some of the women have also started buying things online. Mamta Mahour of Bijpuri village bought earphones and books from Amazon and a saree from Voonik. The products are delivered at one of the shops in the village and Mamta collects it from there.

Some of the households have also started disconnecting their cable connections, said Mamta. Her’s and Deepmala’s houses are two, for instance. Deepmala watches ‘Piya Albela’ and ‘Big Boss’ on YouTube. “We can watch it anytime. There is so much (power) load-shedding that you can’t watch an entire episode on television… that’s not the case on YouTube,” she said.

Slow going

Mamta has taken a Reliance Jio connection. She watches her shows on JioTV and YouTube. “JioTV is free. I don’t see the need of having a cable connection at home. Rather I would use that money to recharge my phone,” she said.

Still, the going is grindingly slow. While Google has been successful in teaching women in these villages to use the internet, three out of four stop using the internet after the training.

When the saathi project started, internet penetration in villages was about 10%, said Barjatya. A recent report by industry lobby Internet and Mobile Association of India and market researcher Kantar IMRB shows that it has gone up to 17%.

Barjatya said Google spent a lot of time understanding the needs of the rural India. These 11.5 million women trained by Google have at least been introduced to the internet. “Over time we have seen that they have found value in going and buying a smartphone,” Barjatya is optimistic.

The data story in India is changing, especially after the launch of Reliance Jio. Google is already in talks with Reliance Jio to provide 4GB of 4G data at Rs149 a month to the saathis. Right now it is 2GB of 2G data.

The feedback from the saathis, meanwhile, is that the training module needs to change: the time is too short to train someone who had never used the internet, according to them. The saathis were given the target of training 250 women in a week, based on which they would receive a stipend from Tata Trust. It varies between Rs4 and Rs8 for each woman trained.

Barjatya said the target has been brought down to 100 women a month.

Changing data story

While Google has set up a call centre to check how many beneficiaries use the internet after training, there is no way it can ensure that women continue to use it. Call centre agents make random calls to check if the training is sufficient and if they are using the internet. Google might also contemplate returning to the same village to train more women.

Also, very few women own devices in male-dominated rural Indian society. “We haven’t really got into creating access beyond spreading awareness. However, yes, this is something we are open to and can consider. But right now it is just the literacy part,” Barjatya said, talking about subsidising mobile phones for women in villages.

In the next two years, Google will need more devices and more data. For its target of covering 300,000 villages, it will need an army of about 100,000 saathis— nearly a 10-fold jump.

Meanwhile, back at Khaula, Bhagour, the former wrestler, has started studying for the entrance test to join Delhi police. YouTube, she said, is handy for her studies. She is learning tricks to solve math problems quicker. Something else happened on Dhanteras, the festival to worship wealth, that made Bhagour proud.

“I got Rs4,211 for training the women. I got the money on the day of Dhanteras,” she said. “I gave the money to my father to get the house painted.”

This story has been published in association with FactorDaily.

For more details visit https://cis-india.org/internet-governance/news/sunny-sen-livemint-november-23-2017-indias-internet-missionaries