We are anonymous, we are legion

‘UID is being forced’

praskrishna — 2011-04-02T12:20:18Z

CIS feels that the UID project is forced on the citizens.

The Centre for Internet and Society on Wednesday said the UID project — Aadhaar — is being forced on the citizens. Speaking to reporters, the centre’s executive director Sunil Abraham said: “The 16-digit UID number will be mentioned on the driver’s license, PAN card, ration card and voter’s identity card with other important data. It is not transparent. Since the UID database is available online, hackers can easily obtain vital information.’’

Read the article in the Times of India

For more details visit https://cis-india.org/news/UID-is-forced

‘Learn from failed UK NIR project’

praskrishna — 2011-04-01T15:12:12Z

The new government in the UK recently scrapped its decade-long work spending millions of pounds on establishing the National Identity Registration (NIR) number simply because it realised it wasn't workable. This article by Madhumita was published in the Deccan Chronicle on March 22, 2011.

There might just be a lesson in this for India that has begun the ambitious Unique Identification (UID) project. The fact, experts says, is that the technology to make this project work successfully in India, that is attempting to cover the largest biometric registry in the world so far, does not exist, at the moment.

According to Dr Ian Brown, senior research fellow at the Oxford Internet Institute, University of Oxford, there was very little evidence that the NIR in UK met the objectives it laid for the initiative. Dr Brown, who has worked extensively on privacy with regard to biometrics, asserted that in the area of privacy and trust there was already a lot of distrust among citizens concerning identity registration. Additionally the UK government losing the CDs that contained information of 25 million people, led to the debate of data breach, a major issue for India concerning the UID.

“The reasons behind the need for the card included politically popular goals that varied depending on the demands of that political moment. From anti-terrorism to reducing social security fraud, identification fraud, illegal immigration and creating a sense of community, the UK government's response was thin when it came to checking for evidence on the project successfully meeting these objectives. If it was for the largest argument of fitting into the wider perspective of criminal justice and security, then studies have shown that cost-effective measures such as streetlights managed to reduce crime by 30 per cent as against surveillance cameras that reduced crime a mere three per cent in the UK,” stated Dr Brown during a lecture at IISc.

India too has argued the same reasons of terrorism and security along with literacy and eradicating poverty. But where is the evidence that one cannot breach this system? Asked advocate Malavika Jayaram.

Prashant Iyengar of the Centre for Internet and Society (CIS) reiterating this stated that there was no guarantee that an individual's information would be safeguarded. The general consensus was that nobody is opposed to the UID, just its current form.

UK’s NIR disaster

The introduction of the UK’s National Identity Register (NIR) scheme was much debated, and various degrees of concern about the scheme were expressed by human rights lawyers, activists, security professionals and IT experts, as well as politicians.

Many of the concerns focused on the databases which underlie the identity cards rather than the cards themselves.

Biometrics consists of methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits. In computer science, in particular, biometrics is used as a form of identity access management and access control.

It is also used to identify individuals in groups that are under surveillance. India is undertaking an ambitious mega project (the Multipurpose National Identity Card) to provide a unique identification number to each of its 1.25 billion people.

Read the original in the Deccan Chronicle here

For more details visit https://cis-india.org/news/failed-uk-nir-project

Zuckerberg's Plan Spurned as India Backs Full Net Neutrality

praskrishna — 2016-02-15T02:18:54Z

Facebook Inc.’s plans for expansion in India have suffered a major setback.

The article by Adi Narayan and Bhuma Srivastava was published in Bloomberg on February 8, 2016. Pranesh Prakash was quoted.

Telecom regulator bans differential Internet data plans
Facebook had lobbied India to approve its Free Basics plan

After the company spent months lobbying the country to accept its Free Basics service -- a way of delivering a limited Internet that included Facebook, plus some other tools, for no cost -- India’s telecom regulator ruled against any plans from cellular operators that charge different rates to different parts of the Web.

Telecom operators can’t offer discriminatory tariffs for data services based on content, and aren’t allowed to enter into agreements with Internet companies to subsidize access to some websites, the Telecom Regulatory Authority of India said in a statement Monday. Companies violating the rules will be fined, it said.

“This is the most extensive and stringent regulation on differential pricing anywhere in the world,” Pranesh Prakash, policy director at the Centre for Internet and Society, said via phone. “Those who suggested regulation in place of complete ban have clearly lost.”

With this decision, India joins countries such as the U.S., Brazil and the Netherlands in passing laws that restrict telecom operators from discriminating Internet traffic based on content. It is a big blow to Facebook’s Internet sampler plan known as Free Basics, which is currently offered in about three dozen countries including Kenya and Zambia, none of which come close to the scale or reach that could’ve been achieved in India.

With 130 million Facebook users, 375 million people online, and an additional 800 million-plus who aren’t, India is the biggest growth market for the social network, which remains blocked in China.

Facebook said in a statement that it’s “disappointed with the outcome.”

Chief Executive Officer Mark Zuckerberg said the decision won’t cause Facebook to give up on connecting people to the Internet in India, “because more than a billion people in India don’t have access to the Internet.” The company will continue to focus on its other initiatives, like extending networks using satellites, drones and lasers.

Freebies Curtailed

The rule will put an end to prepaid plans that offered free access to services such as Google searches, the WhatsApp messaging application and Facebook. These packages were popular with low-income users by giving them an incentive to get online, said Rajan Mathews, director general of the lobby group Cellular Operators Association of India.

“These types of plans were being used by operators to meet the policy goals of connecting one billion people,” Matthews said. “With these gone, the government needs to tell us what alternatives are there.”

The regulator’s decision comes after months of public lobbying by Facebook for India to approve Free Basics, which allows customers to access the social network and other services such as education, health care, and employment listings from their phones without a data plan.

Free Basics was criticized by activists who said it threatened net neutrality, the principle that all Internet websites should be equally accessible, and could change pricing in India for access to different websites.

The regulator, which had sought stakeholders’ views, said it was seeking to ensure data tariffs remain content agnostic. Operators will have six months to wind down existing differential pricing services.

Google Unaffected

“Anything on the Internet can’t be priced based on content, applications, source and destination,” R.S. Sharma, the regulator’s chairman, told reporters in New Delhi. Some Internet companies’ plans to offer free WiFi at public venues, like Google Inc.’s project with Indian Railways, are not affected by this ruling, he said.

For Free Basics, one or two carriers in a given country offer the package for free at slow speeds, betting that it will help attract new customers who’ll later upgrade to pricier data plans. In India, Facebook had tied up with Reliance Communications Ltd., though the service was suspended in December as the government solicited comments from proponents and opponents.

Since the government’s telecommunications regulator announced the suspension, Facebook bought daily full-page ads in major newspapers and plastered billboards with pictures of happy farmers and schoolchildren it says would benefit from Free Basics. Zuckerberg has frequently made the case himself via phone or newspaper op-eds, asking that Indians petition the government to approve his service.

Entrepreneurs, business people and activists took to Twitter to share their views after the decision came out on Monday.

“Great to see TRAI backing #NetNeutrality,” Kunal Bahl, founder of Snapdeal.com, one of India’s biggest e-commerce sites, said. “Let’s keep the Internet free and independent.”

For more details visit https://cis-india.org/internet-governance/news/bloomberg-adi-narayan-bhuma-srivastava-february-8-2016-zuckerberg-plan-spurned-as-india-backs-full-net-neutrality

Zuckerberg's India Backlash Imperils Free Global Web Vision

praskrishna — 2016-01-06T14:51:42Z

When Facebook's co-founder proposed bringing free Web services to India, his stated aim was to help connect millions of impoverished people to unlimited opportunity. Instead, critics have accused him of making a poorly disguised land grab in India's burgeoning Internet sector. The growing backlash could threaten the very premise of Internet.org, his ambitious, two-year-old effort to connect the planet.

The blog post by Bhuma Shrivastava was published by NDTV on January 4, 2016. Pranesh Prakash gave inputs.

Indian authorities are circumspect because the Facebook initiative provides access to only a limited set of websites -- undermining the equal-access precepts of net neutrality. The telecommunications regulator is calling for initial comments by Jan 7, extending the deadline from today, on whether wireless carriers can charge differently for data usage across websites, applications and platforms.

Losing this fight could imperil Facebook's Free Basics, which allows customers to access the social network and select services such as Messenger and Microsoft's Bing without a data plan.

"The India fight is helping shape debates elsewhere," said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bangalore-based non-profit advocacy group. "Activists in other countries such as Brazil, Venezuela and Colombia are watching this debate and will seize the momentum created in India."

Zuckerberg's argument for free Web access is based in part on Deloitte research showing that for every 10 people who are connected to the Web, one is lifted out of poverty and one job is created.

Facebook argues that by giving people free access to a small slice of the Internet, they will quickly see the value in paying for the whole thing. Zuckerberg has said his biggest challenge in connecting people to the Web isn't access to cellular networks, but a social hurdle: he needs to prove to people who have never been online that the Internet is useful.

"Who could possibly be against this?" Zuckerberg wrote in an impassioned op-ed in the Times of India this week. "Surprisingly, over the last year there's been a big debate about this in India."

Zuckerberg's pleas underscore what's at stake. Facebook already attracts 1.55 billion people monthly, or about half of the Internet-connected global population. To keep growing, the world's largest social network needs to get more people online. Hence the billions of dollars Facebook is spending on projects to deliver the Web to under-served areas via drones, satellites and lasers. And Internet.org, which now spans 37 nations.

India, as the world's second most populous nation, is arguably the most important piece of Zuckerberg's Free Basics strategy. But the opposition is fierce. Critics note that the Facebook service doesn't offer Web favorites such as Google's search. Facebook has said it would be open to adding more features from competitors, but critics are skeptical of giving the social-networking giant such influence on the Internet.

Critics also say that by offering a limited swath of the Internet at comparatively slow speeds, the company is creating a diluted version of the Web. That could stifle innovation by causing disadvantages for Indian startups building rival apps, or allow Facebook and its telecommunications carrier-partners to act as Internet gatekeepers.

In a sign of the importance he attaches to the issue, Zuckerberg on Tuesday called one of India's most prominent entrepreneurs to make his case.

One97 Communications, the mobile payments startup backed by Alibaba Group Holding, is one of several tech companies that have come out against Facebook's plans.

"We are totally against telcos preferring one developer over another," One97 founder Vijay Shekhar Sharma said in a phone interview before that call. "We are asking for access neutrality. We are hoping that all startups will be treated equally."

Sonia Dhawan, a spokeswoman for One97's payment website Paytm, said the call took place but didn't describe the conversation further. Sharma wasn't available for further comment.

Facebook is now scrambling to drum up support. It's started a "Save Free Basics In India" campaign, asking Indian users to support "digital equality" by filling out a form that shoots an e-mail to regulators. That also has the effect of sending notifications to user's friends unless they opt out.
Facebook has also taken out full-page advertisements, including one featuring a smiling Indian farmer and his family who the ads say used new techniques to double his crop yield.

While countries such as the Philippines have embraced Free Basics, India has been "the outlier and more challenging," Chris Daniels, vice president of Internet.org, said in a Dec. 26 chat on Reddit.

For more details visit https://cis-india.org/internet-governance/news/ndtv-bhuma-shrivastava-january-4-2016-zuckerberg-india-backlash-imperils-free-global-web-vision

Zomato hack: You need to enhance online security with a password manager

praskrishna — 2017-05-23T15:54:50Z

Hacking incident at Zomato underlines need to employ different passwords for different accounts.

The article by Sanjay Kumar Singh was published in the Business Standard on May 23, 2017.

Recently, food-tech company Zomato suffered a security breach where 17 million user records were stolen, including email addresses and passwords. Such hacking incidents can have wider consequences, including, in the gravest of scenarios, financial losses. They emphasise the need for people to adopt newer protection mechanisms, such as password managers.

In Zomato's case, the passwords are said to be hashed, which means they were converted into unintelligible characters. However, experts say that depending on the hashing protocol used, hashes can be re-engineered to generate the password.

The hacking of one account can have wider ramifications. "By hacking one account, hackers get access to your email ID and password. To save themselves the bother of remembering many passwords, users often use the same password in all their accounts. So, the hackers get access to your email and other accounts. Sometimes, they use your email account to reset the passwords in your other accounts," explains Shomiron Das Gupta of NetMonastery, a threat management provider. He adds that people often store sensitive information, including their net banking and credit card numbers and passwords within their email accounts. Also, on a website like Amazon, you can only view the last four digits of your credit card number. Other websites may not blur this information, in which case hackers would get access to this and other sensitive information.

Experts recommend you create complex passwords and use different ones for different accounts. Since generating complex passwords and remembering them all is difficult, you should use a password manager. Some of the good ones are LastPass, 1Password, Dashlane and TrueKey.

Password managers can generate long and complex passwords that are difficult to replicate. They also remember on your behalf the passwords on all the sites and apps you use. Also, hackers sometimes steal passwords by inserting a malware that copies keystrokes. Since a password manager inputs the password, you don't have to type them in, thereby doing away with the risk of your keystrokes being captured and stolen.

A password manager is a secure vault that stores all your passwords. You get access to the vault with a master password. Instead of remembering many passwords, you have to remember just one.

Browsers like Google Chrome and Mozilla Firefox also offer password managers. However, if you wish to use your password manager across browsers and apps, use a third-party one like those mentioned above. And while a password manager that is stored locally is safer, one that is cloud-based is more convenient, since you can use it across devices having internet connection. Password managers also offer two-factor authentication. They either send a password to your phone or generate it on your device. Unless your device also gets stolen, the password manager is difficult to break into.

As for whether password managers are themselves safe, experts concede they are a prime target for hackers who know that the information stored within will be valuable. "The password manager is safe provided you set a strong master password. Your password should have at least 13 characters of which two should be small, two should be in capital, two should be random numbers, and two should be special characters. Using a word that is not there in the dictionary will enhance its strength. Keep changing your master password every three-six months," says Udbhav Tiwari, policy officer at the Centre for Internet and Society, Bengaluru. Since their primary job is to provide security, most password managers do have strong security practices, he adds.

Most password managers offer a free account but you have to pay to use their advanced security features.

For more details visit https://cis-india.org/internet-governance/news/business-standard-sanjay-kumar-singh-may-23-2017-zomato-hack-you-need-to-enhance-online-security-with-a-password-manager

Zero Draft of Content Removal Best Practices White Paper

jyoti — 2014-09-10T07:11:09Z

EFF and CIS Intermediary Liability Project is aimed towards the creation of a set of principles for intermediary liability in consultation with groups of Internet-focused NGOs and the academic community.

The draft paper has been created to frame the discussion and will be made available for public comments and feedback. The draft document and the views represented here are not representative of the positions of the organisations involved in the drafting.

http://tinyurl.com/k2u83ya

3 September 2014

Introduction

The purpose of this white paper is to frame the discussion at several meetings between groups of Internet-focused NGOs that will lead to the creation of a set of principles for intermediary liability.

The principles that develop from this white paper are intended as a civil society contribution to help guide companies, regulators and courts, as they continue to build out the legal landscape in which online intermediaries operate. One aim of these principles is to move towards greater consistency with regards to the laws that apply to intermediaries and their application in practice.

There are three general approaches to intermediary liability that have been discussed in much of the recent work in this area, including CDT’s 2012 report called “Shielding the Messengers: Protecting Platforms for Expression and Innovation.” The CDT’s 2012 report divides approaches to intermediary liability into three models: 1. Expansive Protections Against Liability for Intermediaries, 2. Conditional Safe Harbor from Liability, 3. Blanket or Strict Liability for Intermediaries.^[1]

This white paper argues in the alternative that (a) the “expansive protections against liability” model is preferable, but likely not possible given the current state of play in the legal and policy space (b) therefore the white paper supports “conditional safe harbor from liability” operating via a ‘notice-to-notice’ regime if possible, and a ‘notice and action’ regime if ‘notice-to-notice’ is deemed impossible, and finally (c) all of the other principles discussed in this white paper should apply to whatever model for intermediary liability is adopted unless those principles are facially incompatible with the model that is finally adopted.

As further general background, this white paper works from the position that there are three general types of online intermediaries- Internet Service Providers (ISPs), search engines, and social networks. As outlined in the recent draft UNESCO Report (from which this white paper draws extensively);

“With many kinds of companies operating many kinds of products and services, it is important to clarify what constitutes an intermediary. In a 2010 report, the Organization for Economic Co-operation and Development (OECD) explains that Internet intermediaries “bring together or facilitate transactions between third parties on the Internet. They give access to, host, transmit and index content, products and services originated by third parties on the Internet or provide Internet-based services to third parties.”

Most definitions of intermediaries explicitly exclude content producers. The freedom of expression advocacy group Article 19 distinguishes intermediaries from “those individuals or organizations who are responsible for producing information in the first place and posting it online.” Similarly, the Center for Democracy and Technology explains that “these entities facilitate access to content created by others.” The OECD emphasizes “their role as ‘pure’ intermediaries between third parties,” excluding “activities where service providers give access to, host, transmit or index content or services that they themselves originate.” These views are endorsed in some laws and court rulings. In other words, publishers and other media that create and disseminate original content are not intermediaries. Examples of such media entities include a news website that publishes articles written and edited by its staff, or a digital video subscription service that hires people to produce videos and disseminates them to subscribers.

For the purpose of this case study we will maintain that intermediaries offer services that host, index, or facilitate the transmission and sharing of content created by others. For example, Internet Service Providers (ISPs) connect a user’s device, whether it is a laptop, a mobile phone or something else, to the network of networks known as the Internet. Once a user is connected to the Internet, search engines make a portion of the World Wide Web accessible by allowing individuals to search their database. Search engines are often an essential go-between between websites and Internet users. Social networks connect individual Internet users by allowing them to exchange messages, photos, videos, as well as by allowing them to post content to their network of contacts, or the public at large. Web hosting providers, in turn, make it possible for websites to be published and to be accessed online.”^[2]

General Principles for ISP Governance - Content Removals

The discussion that follows below outlines nine principles to guide companies, government, and civil society in the development of best practices related to the regulation of online content through intermediaries, as norms, policies, and laws develop in the coming years. The nine principles are: Transparency, Consistency, Clarity, Mindful Community Policy Making, Necessity and Proportionality in Content Restrictions, Privacy, Access to Remedy, Accountability, and Due Process in both Legal and Private Enforcement. Each principle contains subsections that expand upon the theme of the principle to cover more specific issues related to the rights and responsibilities of online intermediaries, government, civil society, and users.

Principle I: Transparency

“Transparency enables users’ right to privacy and right to freedom of expression. Transparency of laws, policies, practices, decisions, rationale, and outcomes related to privacy and restrictions allow users to make informed choices with respect to their actions and speech online. As such - both governments and companies have a responsibility in ensuring that the public is informed through transparency initiatives.” ^[3]

Government Transparency

In general, governments should publish transparency reports:

As part of the democratic process, the citizens of each country have a right to know how their government is applying its laws, and a right to provide feedback about the government’s legal interpretations of its laws. Thus, all governments should be required to publish online transparency reports that provide information about all requests issued by any branch or agency of government for the removal or restriction of online content. Further, governments should allow for the submission of comments and suggestions by a webform hosted on the same webpage where that government’s transparency report is hosted. There should also be some legal mechanism that requires the government to look at the feedback provided by its citizens, ensure that relevant feedback is passed along to legislative bodies, and provide for action to be taken on the citizen-provided feedback where appropriate. Finally, and where possible, the raw data that constitutes each government’s transparency report should be made available online, for free, in a common file format such as .csv, so that civil society may have easy access to it for research purposes.

Governments should be more transparent about content orders that they impose on ISPs
The legislative process proceeds most effectively when the government knows how the laws that it creates are applied in practice and is able to receive feedback from the public about how those laws should change further, or remain the same. Relatedly, regulation of the Internet is most effective when the legislative and judicial branches are aware of what the other is doing. For all of these reasons, governments should publish information about all of the court orders and executive requests for content removals that they send to online intermediaries. Publishing all of this information in one place necessarily requires that some single entity within the government collects the information, which will have the benefits of giving the government a holistic view of how it is regulating the internet, encouraging dialogue between different branches of government about how best to create and enforce internet content regulation, and encouraging dialogue between the government and its citizens about the laws that govern internet content and their application.

Governments should make the compliance requirements they impose on ISPs public
Each government should maintain a public website that publishes as complete a picture as possible of the content removal requests made by any branch of that government, including the judicial branch. The availability of a public website of this type will further many of the goals and objectives discussed elsewhere in this section. The website should be biased towards high levels of detail about each request and towards disclosure that requests were made, subject only to limited exceptions for compelling public policy reasons, where the disclosure bias conflicts directly with another law, or where disclosure would reveal a user’s PII. The information should be published periodically, ideally more than once a year. The general principle should be: the more information made available, the better. On the same website where a government publishes its ‘Transparency Report,’ that government should attempt to provide a plain-language description of its various laws related to online content, to provide users notice about what content is lawful vs. unlawful, as well as to show how the laws that it enacts in the Internet space fit together. Further, and as discussed in section “b,” infra, government should provide citizens with an online feedback mechanism so that they may participate in the legislative process as it applies to online content.

Governments should give their citizens a way to provide input on these policies
Private citizens should have the right to provide feedback on the balancing between their civil liberties and other public policies such as security that their government engages in on their behalf. If and when these policies and the compliance requirements they impose on online intermediaries are made publicly available online, there should also be a feedback mechanism built into the site where this information is published. This public feedback mechanism could take a number of different forms, like, for example, a webform that allowed users to indicate their level of satisfaction with prevailing policy choices by choosing amongst several radio buttons, while also providing open text fields to allow the user to submit clarifying comments and specific suggestions. In order to be effective, this online feedback mechanism would have to be accompanied by some sort of legal and budgetary apparatus that would ensure that the feedback was monitored and given some minimum level of deference in the discussions and meetings that led to new policies being created.

Government should meet users concerned about its content policies in the online domain. Internet users, as citizens of both the internet and the country their country of origin, have a natural interest in defining and defending their civil liberties online; government should meet them there to extend the democratic process to the Internet. Denying Internet users a voice in the policymaking processes that determine their rights undermines government credibility and negatively influences users’ ability to freely share information online. As such, content policies should be posted in general terms online and users should have the ability to provide input on those policies online.

ISP Transparency
“The transparency practices of a company impact users’ freedom expression by providing insight into the scope of restriction that is taking in place in specific jurisdiction. Key areas of transparency for companies include: specific restrictions, aggregate numbers related to restrictions, company imposed regulations on content, and transparency of applicable law and regulation that the service provider must abide by.”^[4]

“Disclosure by service providers of notices received and actions taken can provide an important check against abuse. In addition to providing valuable data for assessing the value and effectiveness of a N&A system, creating the expectation that notices will be disclosed may help deter fraudulent or otherwise unjustified notices. In contrast, without transparency, Internet users may remain unaware that content they have posted or searched for has been removed pursuant due to a notice of alleged illegality. Requiring notices to be submitted to a central publication site would provide the most benefit, enabling patterns of poor quality or abusive notices to be readily exposed.”^[5] Therefore, ISPs at all levels should publish transparency reports that include:

Government Requests

All requests from government agencies and courts should be published in a periodic transparency report, accessible on the intermediary’s website, that publishes information about the requests the intermediary received and what the intermediary did with them in the highest level of detail that is legally possible. The more information that is provided about each request, the better the understanding that the public will have about how laws that affect their rights online are being applied. That said, steps should be taken to prevent the disclosure of personal information in relation to the publication of transparency reports. Beyond redaction of personal information, however, the maximum amount of information about each request should be published, subject as well to the (ideally minimal) restrictions imposed by applicable law. A thorough Transparency Report published by an ISP or online intermediary should include information about the following categories of requests:

Police and/or Executive Requests
This category includes all requests to the intermediary from an agency that is wholly a part of the national government; from police departments, to intelligence agencies, to school boards from small towns. Surfacing information about all requests from any part of the government helps to avoid corruption and/or inappropriate exercises of governmental power by reminding all government officials, regardless of their rank or seniority, that information about the requests they submit to online intermediaries is subject to public scrutiny.

Court Orders
This category includes all orders issued by courts and signed by a judicial officer. It can include ex-parte orders, default judgments, court orders directed at an online intermediary, or court orders directed at a third party presented to the intermediary as evidence in support of a removal request. To the extent legally possible, detailed information should be published about these court orders detailing the type of court order each request was, its constituent elements, and the actions(s) that the intermediary took in response to it. All personally identifying information should be redacted from any court orders that are published by the intermediary as part of a transparency report before publication.

First Party
Information about court orders should be further broken down into two groups; first party and third party. First party court orders are orders directed at the online intermediary in an adversarial proceeding to which the online intermediary was a party.

Third Party
As mentioned above, ‘third party’ refers to court orders that are not directed at the online intermediary, but rather a third party such as an individual user who posted an allegedly defamatory remark on the intermediary’s platform. If the user who obtains a court order approaches an online intermediary seeking removal of content with a court order directed at the poster of, say, the defamatory content, and the intermediary decides to remove the content in response to the request, the online intermediary that decided to perform the takedown should publish a record of that removal. To be accepted by an intermediary, third party court orders should be issued by a court of appropriate jurisdiction after an adversarial legal proceeding, contain a certified and specific statement that certain content is unlawful, and specifically identify the content that the court has found to be unlawful, by specific, permalinked URL where possible.

This type of court order should be broken out separately from court orders directed at the applicable online intermediary in companies’ transparency reports because merely providing aggregate numbers that do not distinguish between the two types gives an inaccurate impression to users that a government is attempting to censor more content than it actually is. The idea of including first party court orders to remove content as a subcategory of ‘government requests’ is that a government’s judiciary speaks on behalf of the government, making determinations about what is permitted under the laws of that country. This analogy does not hold for court orders directed at third parties- when the court made its determination of legality on the content in question, it did not contemplate that the intermediary would remove the content. As such, the court likely did not weigh the relevant public interest and policy factors that would include the importance of freedom of expression or the precedential value of its decision. Therefore, the determination does not fairly reflect an attempt by the government to censor content and should not be considered as such.

Instead, and especially considering that these third party court order may be the basis for a number of content removals, third party court orders should be counted separately and presented with some published explanation in the company’s transparency report as to what they are and why the company has decided it should removed content pursuant to its receipt of one.

Private-Party Requests
Private-party requests are requests to remove content that are not issued by a government agency or accompanied by a court order. Some examples of private party requests include copyright complaints submitted pursuant to the Digital Millennium Copyright Act or complaints based on the laws of specific countries, such as laws banning holocaust denial in Germany.

Policy/TOS Enforcement
To give users a complete picture of the content that is being removed from the platforms that they use, corporate transparency reports should also provide information about the content that the intermediary removes pursuant to its own policies or terms of service, though there may not be a legal requirement to do so.

User Data Requests
While this white paper is squarely focused on liability for content posted online and best practices for deciding when and how content should be removed from online services, corporate transparency reports should also provide information about requests for user data from executive agencies, courts, and others.

Principle II: Consistency

Legal requirements for ISPs should be consistent, based on a global legal framework that establishes baseline limitations on legal immunity
Broad variation amongst the legal regimes of the countries in which online intermediaries operate increases compliance costs for companies and may discourage them from offering their services in some countries due to the high costs of localized compliance. Reducing the number of speech platforms that citizens have access to limits their ability to express themselves. Therefore, to ensure that citizens of a particular country have access to a robust range of speech platforms, each country should work to harmonize the requirements that it imposes upon online intermediaries with the requirements of other countries. While a certain degree of variation between what is permitted in one country as compared to another is inevitable, all countries should agree on certain limitations to intermediary liability, such as the following:

Conduits should be immune from claims about content that they neither created nor modified
As noted in the 2011 Joint Declaration on Freedom of Expression and the Internet, “[n]o one who simply provides technical Internet services such as providing access, or searching for, or transmission or caching of information, should be liable for content generated by others, which is disseminated using those services, as long as they do not specifically intervene in that content or refuse to obey a court order to remove that content, where they have the capacity to do so (‘mere conduit principle’).”^[6]

Court orders should be required for the removal of content that is related to speech, such as defamation removal requests
In the Center for Democracy and Technology’s Additional Responses Regarding Notice and Action, CDT outlines the case against allowing notice and action procedures to apply to defamation removal requests. They write:

“Uniform notice-and-action procedures should not apply horizontally to all types of illegal content. In particular, CDT believes notice-and-takedown is inappropriate for defamation and other areas of law requiring complex legal and factual questions that make private notices especially subject to abuse. Blocking or removing content on the basis of mere allegations of illegality raises serious concerns for free expression and access to information. Hosts are likely to err on the side of caution and comply with most if not all notices they receive, because evaluating notices is burdensome and declining to comply may jeopardize their protection from liability. The risk of legal content being taken down is especially high in cases where assessing the illegality of the content would require detailed factual analysis and careful legal judgments that balance competing fundamental rights and interests. Intermediaries will be extremely reluctant to exercise their own judgment when the legal issues are unclear, and it will be easy for any party submitting a notice to claim a good faith belief that the content in question is unlawful. In short, the murkier the legal analysis, the greater the potential for abuse.

To reduce this risk, removal of or disablement of access to content based on unadjudicated allegations of illegality (i.e., notices from private parties) should be limited to cases where the content at issue is manifestly illegal – and then only with necessary safeguards against abuse as described above.

CDT believes that online free expression is best served by narrowing what is considered manifestly illegal and subject to takedown upon private notice. With proper safeguards against abuse, for example, notice-and-action can be an appropriate policy for addressing online copyright infringement. Copyright is an area of law where there is reasonable international consensus regarding what is illegal and where much infringement is straightforward. There can be difficult questions at the margins – for example concerning the applicability of limitations and exceptions such as “fair use” – but much online infringement is not disputable.

Quite different considerations apply to the extension of notice-and-action procedures to allegations of defamation or other illegal content. Other areas of law, including defamation, routinely require far more difficult factual and legal determinations. There is greater potential for abuse of notice-and-action where illegality is less manifest and more disputable. If private notices are sufficient to have allegedly defamatory content removed, for example, any person unhappy about something that has been written about him or her would have the ability and incentive to make an allegation of defamation, creating a significant potential for unjustified notices that harm free expression. This and other areas where illegality is more disputable require different approaches to notice and action. In the case of defamation, CDT believes “notice” for purposes of removing or disabling access to content should come only from a competent court after full adjudication.

In cases where it would be inappropriate to remove or disable access to content based on untested allegations of illegality, service providers receiving allegations of illegal content may be able to take alternative actions in response to notices. Forwarding notices to the content provider or preserving data necessary to facilitate the initiation of legal proceedings, for example, can pose less risk to content providers’ free expression rights, provided there is sufficient process to allow the content provider to challenge the allegations and assert his or her rights, including the right to speak anonymously.”^[7]

Principle III: Clarity

All notices that request the removal of content should be clear and meet certain minimum requirements
The Center for Democracy and Technology outlined requirements for clear notices in a notice and action system in response a European Commission public comment period on a revised notice and action regime.^[8] They write:

“Notices should include the following features:

Specificity. Notices should be required to specify the exact location of the material – such as a specific URL – in order to be valid. This is perhaps the most important requirement, in that it allows hosts to take targeted action against identified illegal material without having to engage in burdensome search or monitoring. Notices that demand the removal of particular content wherever it appears on a site without specifying any location(s) are not sufficiently precise to enable targeted action.
Description of alleged illegal content. Notices should be required to include a detailed description of the specific content alleged to be illegal and to make specific reference to the law allegedly being violated. In the case of copyright, the notice should identify the specific work or works claimed to be infringed.
Contact details. Notices should be required to contain contact information for the sender. This facilitates assessment of notices’ validity, feedback to senders regarding invalid notices, sanctions for abusive notices, and communication or legal action between the sending party and the poster of the material in question.
Standing: Notices should be issued only by or on behalf of the party harmed by the content. For copyright, this would be the rightsholder or an agent acting on the rightsholderʼs behalf. For child sexual abuse images, a suitable issuer of notice would be a law enforcement agency or a child abuse hotline with expertise in assessing such content. For terrorism content, only government agencies would have standing to submit notice.
Certification: A sender of a notice should be required to attest under legal penalty to a good-faith belief that the content being complained of is in fact illegal; that the information contained in the notice is accurate; and, if applicable, that the sender either is the harmed party or is authorized to act on behalf of the harmed party. This kind of formal certification requirement signals to notice-senders that they should view misrepresentation or inaccuracies on notices as akin to making false or inaccurate statements to a court or administrative body.
Consideration of limitations, exceptions, and defenses: Senders should be required to certify that they have considered in good faith whether any limitations, exceptions, or defenses apply to the material in question. This is particularly relevant for copyright and other areas of law in which exceptions are specifically described in law.
An effective appeal and counter-notice mechanism. A notice-and-action regime should include counter-notice procedures so that content providers can contest mistaken and abusive notices and have their content reinstated if its removal was wrongful.
Penalties for unjustified notices. Senders of erroneous or abusive notices should face possible sanctions. In the US, senders may face penalties for knowingly misrepresenting that content is infringing, but the standard for “knowingly misrepresenting” is quite high and the provision has rarely been invoked. A better approach might be to use a negligence standard, whereby a sender could be held liable for damages or attorneys’ fees for making negligent misrepresentations (or for repeatedly making negligent misrepresentations). In addition, the notice-and-action system should allow content hosts to ignore notices from senders with an established record of sending erroneous or abusive notices or allow them to demand more information or assurances in notices from those who have in the past submitted erroneous notices. (For example, hosts might be deemed within the safe harbor if they require repeat abusers to specifically certify that they have actually examined the alleged infringing content before sending a notice).”^[9]

All ISPs should publish their content removal policies online and keep them current as they evolve
The UNESCO report states, by way of background, that “[c]ontent restriction practices based on Terms of Service are opaque. How companies remove content based on Terms of Service violations is more opaque than their handling of content removals based on requests from authorized authorities. When content is removed from a platform based on company policy, [our] research found that all companies provide a generic notice of this restriction to the user, but do not provide the reason for the restriction. Furthermore, most companies do not provide notice to the public that the content has been removed. In addition, companies are inconsistently open about removal of accounts and their reasons for doing so.”^[10]

There are legitimate reasons why an ISP may want to have policies that permit less content, and a narrower range of content, than is technically permitted under the law, such as maintaining a product that appeals to families. However, if a company is going to go beyond the minimal legal requirements in terms of content that it must restrict, the company should have clear policies that are published online and kept up-to-date to provide its users notice of what content is and is not permitted on the company’s platform. Notice to the user about the types of content that are permitted encourages her to speak freely and helps her to understand why content that she posted was taken down if it must be taken down for violating a company policy.

When content is removed, a clear notice should be provided in the product that explains in simple terms that content has been removed and why
This subsection works in conjunction with “ii,” above. If content is removed for any reason, either pursuant to a legal request or because of a violation of company policy, a user should be able to learn that content was removed if they try to access it. Requiring an on-screen message that explains that content has been removed and why is the post-takedown accompaniment to the pre-takedown published online policy of the online intermediary: both work together to show the user what types of content are and are not permitted on each online platform. Explaining to users why content has been removed in sufficient detail may also spark their curiosity as to the laws or policies that caused the content to be removed, resulting in increased civic engagement in the internet law and policy space, and a community of citizens that demands that the companies and governments it interacts with are more responsive to how it thinks content regulation should work in the online context.

The UNESCO report provides the following example of how Google provides notice to its users when a search result is removed, which includes a link to a page hosted by Chilling Effects:^[11]

“When search results are removed in response to government or copyright holder demands, a notice describing the number of results removed and the reasons for their removal is displayed to users (see screenshot below) and a copy of the request to the independent non-proft organization ChillingEffects.org, which archives and publishes the request. When possible the company also contacts the website’s owners.”^[12]

This is an example of the message that is displayed when Google removes a search result pursuant to a copyright complaint.^[13]

Requirements that governments impose on intermediaries should be as clear and unambiguous as possible
Imposing liability on internet intermediaries without providing clear guidance as to the precise type of content that is not lawful and the precise requirements of a legally sufficient notice encourages intermediaries to over-remove content. As Article 19 noted in its 2013 report on intermediary liability:

“International bodies have also criticized ‘notice and takedown’ procedures as they lack a clear legal basis. For example, the 2011 OSCE report on Freedom of Expression on the internet highlighted that: Liability provisions for service providers are not always clear and complex notice and takedown provisions exist for content removal from the Internet within a number of participating States. Approximately 30 participating States have laws based on the EU E-Commerce Directive. However, the EU Directive provisions rather than aligning state level policies, created differences in interpretation during the national implementation process. These differences emerged once the national courts applied the provisions.

These procedures have also been criticized for being unfair. Rather than obtaining a court order requiring the host to remove unlawful material (which, in principle at least, would involve an independent judicial determination that the material is indeed unlawful), hosts are required to act merely on the say-so of a private party or public body. This is problematic because hosts tend to err on the side of caution and therefore take down material that may be perfectly legitimate and lawful. For example, in his report, the UN Special Rapporteur on freedom of expression noted:

[W]hile a notice-and-takedown system is one way to prevent intermediaries from actively engaging in or encouraging unlawful behavior on their services, it is subject to abuse by both State and private actors. Users who are notiﬁed by the service provider that their content has been ﬂagged as unlawful often has little recourse or few resources to challenge the takedown. Moreover, given that intermediaries may still be held ﬁnancially or in some cases criminally liable if they do not remove content upon receipt of notiﬁcation by users regarding unlawful content, they are inclined to err on the side of safety by overcensoring potentially illegal content. Lack of transparency in the intermediaries’ decision-making process also often obscures discriminatory practices or political pressure affecting the companies’ decisions. Furthermore, intermediaries, as private entities, are not best placed to make the determination of whether a particular content is illegal, which requires careful balancing of competing interests and consideration of defenses.”^[14]

Considering the above, if liability is to be imposed on intermediaries for certain types of unlawful content, the legal requirements that outline what is unlawful content and how to report it must be clear. Lack of clarity in this area will result in over-removal of content by rational intermediaries that want to minimize their legal exposure and compliance costs. Over-removal of content is at odds with the goals of freedom of expression.

The UNESCO Report made a similar recommendation, stating that; “Governments need to ensure that legal frameworks and company policies are in place to address issues arising out of intermediary liability. These legal frameworks and policies should be contextually adapted and be consistent with a human rights framework and a commitment to due process and fair dealing. Legal and regulatory frameworks should also be precise and grounded in a clear understanding of the technology they are meant to address, removing legal uncertainty that would provide opportunity for abuse.”^[15]

Similarly, the 2011 Joint Declaration on Freedom of Expression and the Internet states:

“Consideration should be given to insulating fully other intermediaries, including those mentioned in the preamble, from liability for content generated by others under the same conditions as in paragraph 2(a). At a minimum, intermediaries should not be required to monitor user-generated content and should not be subject to extrajudicial content takedown rules which fail to provide sufficient protection for freedom of expression (which is the case with many of the ‘notice and takedown’ rules currently being applied).”^[16]

Principle IV: Mindful Community Policy Making

“Laws and regulations as well as corporate policies are more likely to be compatible with freedom of expression if they are developed in consultation with all affected stakeholders – particularly those whose free expression rights are known to be at risk.”^[17] To be effective, policies should be created through a multi-stakeholder consultation process that gives voice to the communities most at risk of being targeted for the information they share online. Further, both companies and governments should embed an ‘outreach to at-risk communities’ step into both legislative and policymaking processes to be especially sure that their voices are heard. Finally, civil society should work to ensure that all relevant stakeholders have a voice in both the creation and revision of policies that affect online intermediaries. In the context of corporate policymaking, civil society can use strategies from activist investing to encourage investors to make the human rights and freedom of expression policies of Internet companies’ part of the calculus that investors use to decide where to place their money. Considering the above;

Human rights impact assessments, considering the impact of the proposed law or policy on various communities from the perspectives of gender, sexuality, sexual preference, ethnicity, religion, and freedom of expression, should be required before:
New laws are written that govern content issues affecting ISPs or conduct that occurs primarily online
“Protection of online freedom of expression will be strengthened if governments carry out human rights impact assessments to determine how proposed laws or regulations will affect Internet users’ freedom of expression domestically and globally.”^[18]

Intermediaries enact new policies
“Protection of online freedom of expression will be strengthened if companies carry out human rights impact assessments to determine how their policies, practices, and business operations affect Internet users’ freedom of expression. This assessment process should be anchored in robust engagement with stakeholders whose freedom of expression rights are at greatest risk online, as well as stakeholders who harbor concerns about other human rights affected by online speech.”^[19]

Multi-stakeholder consultation processes should precede any new legislation that will apply to content issues affecting online intermediaries or online conduct
“Laws and regulations as well as corporate policies are more likely to be compatible with freedom of expression if they are developed in consultation with all affected stakeholders – particularly those whose free expression rights are known to be at risk.”^[20]

Civil society and public interest groups should encourage responsible investment in companies who implement policies that reflect best practices for internet intermediaries
“Over the past thirty years, responsible investors have played a powerful role in incentivizing companies to improve environmental sustainability, supply chain labor practices, and respect for human rights of communities where companies physically operate. Responsible investors can also play a powerful role in incentivizing companies to improve their policies and practices affecting freedom of expression and privacy by developing metrics and criteria for evaluating companies on these issues in the same way that they evaluate companies on other “environmental, social, and governance” criteria.”^[21]

Principle V: Necessity and Proportionality in Content Restriction

Content should only be restricted when there is a legal basis for doing so, or the removal is performed in accordance with a clear, published policy of the ISP
As CDT outlined in its 2012 intermediary liability report, “[a]ctions required of intermediaries must be narrowly tailored and proportionate, to protect the fundamental rights of Internet users. Any actions that a safe-harbor regime requires intermediaries to take must be evaluated in terms of the principle of proportionality and their impact on Internet users’ fundamental rights, including rights to freedom of expression, access to information, and protection of personal data. Laws that encourage intermediaries to take down or block certain content have the potential to impair online expression or access to information. Such laws must therefore ensure that the actions they call for are proportional to a legitimate aim, no more restrictive than is required for achievement of the aim, and effective for achieving the aim. In particular, intermediary action requirements should be narrowly drawn, targeting specific unlawful content rather than entire websites or other Internet resources that may support both lawful and unlawful uses.”^[22]

When content must be restricted, it should be restricted in the most minimal way possible (i.e., prefer domain removals to IP-blocking)
There are a number of different ways that access to content can be restricted. Examples include hard deletion of the content from all of a company’s servers, blocking the download of an app or other software program in a particular country, blocking the content on all IP addresses affiliated with a particular country (“IP-Blocking”), removing the content from a particular domain of a product (i.e., removing from a link from the .fr version of a search engine that remains accessible on the .com version), blocking content from a ‘version’ of an online product that is accessible through a ‘country’ or ‘language’ setting on that product, or some combination of the last three options (i.e., an online product that directs the user to a version of the product based on the country that their IP address is coming from, but where the user can alter a URL or manipulate a drop-down menu to show her a different ‘country version’ of the product, providing access to content that may otherwise be inaccessible).

While almost all of the different types of content restrictions described above can be circumvented by technical means such as the use of proxies, IP-cloaking, or Tor, the average internet user does not know that these techniques exist, much less how to use them. Of the different types of content restrictions described above, a domain removal, for example, is easier for an individual user to circumvent than IP-Blocked content because you only have to change the URL of the product you are using to, i.e. “.com” to see content that has been locally restricted. To get around an IP-block, you would have to be sufficiently savvy to employ a proxy or cloak your true IP address.

Therefore, the technical means used to restrict access to controversial content has a direct impact on the magnitude of the actual restriction on speech. The more restrictive the technical removal method, the fewer people that will have access to that content. To preserve access to lawful content, online intermediaries should choose the least restrictive means of complying with removal requests, especially when the removal request is based on the law of a particular country that makes certain content unlawful that is not unlawful in other countries. Further, when building new products and services, intermediaries should built in removal capability that minimally restricts access to controversial content.

If content is restricted due to its illegality in a particular country, the geographical scope of the content restriction should be as minimal as possible
Building on the discussion in “ii,” supra, a user should be able to access content that is lawful in her country even if it is not lawful in another country. Different countries have different laws and it is often difficult for intermediaries to determine how to effectively respond to requests and reconcile the inherent conflicts that result. For example, content that denies the holocaust is illegal in certain countries, but not in others. If an intermediary receives a request to remove content based on the laws of a particular country and determines that it will comply because the content is not lawful in that country, it should not restrict access to the content such that it cannot be accessed by users in other countries where the content is lawful. To respond to a request based on the law of a particular country by blocking access to that content for users around the world, or even users of more than one country, essentially allows for extraterritorial application of the laws of the country that the request came from. While it is preferable to standardize and limit the legal requirements imposed on online intermediaries throughout the world, to the extent that this is not possible, the next-best option is to limit the application of laws that are interpreted to declare certain content unlawful to the users that live in that country. Therefore, intermediaries should choose the technical means of content restriction that is most narrowly tailored to limit the geographical scope and impact of the removal.

The ability of conduits (telecommunications/internet service providers) to filter content should be minimized to the extent technically and legally possible

The 2011 Joint Declaration on Freedom of Expression and the Internet made the following points about the dangers of allowing filtering technology:

“Mandatory blocking of entire websites, IP addresses, ports, network protocols or types of uses (such as social networking) is an extreme measure – analogous to banning a newspaper or broadcaster – which can only be justified in accordance with international standards, for example where necessary to protect children against sexual abuse.

Content filtering systems which are imposed by a government or commercial service provider and which are not end-user controlled are a form of prior censorship and are not justifiable as a restriction on freedom of expression.

Products designed to facilitate end-user filtering should be required to be accompanied by clear information to end-users about how they work and their potential pitfalls in terms of over-inclusive filtering.”^[23]

In short, filtering at the conduit level is a blunt instrument that should be avoided whenever possible. Similar to how conduits should not be legally responsible for content that they neither host nor modify (the ‘mere conduit’ rule discussed supra), conduits should technically restrict their ability to filter content such that it would be inefficient for government agencies to contact them to have content filtered. Mere conduits are not able to assess the context surrounding the controversial content that they are asked to remove and are therefore not the appropriate party to receive takedown requests. Further, when mere conduits have the technical ability to filter content, they open themselves to pressure from government to exercise that capability. Therefore, mere conduits should limit or not build in the capability to filter content.

Notice and notice, or notice and judicial takedown, should be preferred to notice and takedown, which should be preferred to unilateral removal
Mechanisms for content removal that involve intermediaries acting without any oversight or accountability, or those which only respond to the interests of the party requesting removal, are unlikely to do a very good job at balancing public and private interests. A much better balance is likely to be struck through a mechanism where power is distributed between the parties, and/or where an independent and accountable oversight mechanism exists.

Considered in this way, there is a continuum of content removal mechanisms that ranges from those are the least balanced and accountable, and those that are more so. The least accountable is the unilateral removal of content by the intermediary without legal compulsion in response to a request received, without affording the uploader of the content the right to be heard or access to remedy.

Notice and takedown mechanisms fit next along the continuum, provided that they incorporate, as the DMCA attempts to do, an effective appeal and counter-notice mechanism. However where notice and takedown falls down is that the cost and incentive structure is weighted towards removal of content in the case of doubt or dispute, resulting in more content being taken down and staying down than would be socially optimal.

A better balance is likely to be struck by a “notice and notice” regime, which provides strong social incentives for those whose content is reported to be unlawful to remove the content, but does not legally compel them to do so. If legal compulsion is required, a court order must be separately obtained.

Canada is an example of a jurisdiction with a notice and notice regime, though limited to copyright content disputes. Although this regime is now established in legislation, it formalizes a previous voluntary regime, whereby major ISPs would forward copyright infringement notifications received from rightsholders to subscribers, but without removing any content and without releasing subscriber data to the rightsholders absent a court order. Under the new legislation additional record-keeping requirements are imposed on ISPs, but otherwise the essential features of the regime remain unchanged.

Analysis of data collected during this voluntary regime indicates that it has been effective in changing the behavior of allegedly infringing subscribers. A 2010 study by the Entertainment Software Association of Canada (ESAC) found that 71% of notice recipients did not infringe again, whereas a similar 2011 study by Canadian ISP Rogers found 68% only received one notice, and 89% received no more than two notices, with only 1 subscriber in 800,000 receiving numerous notices.^[24] However, in cases where a subscriber has a strong good faith belief that the notice they received was wrong, there is no risk to them in disregarding the erroneous notice – a feature that does not apply to notice and takedown.

Another similar way in which public and private interests can be balanced is through a notice and judicial takedown regime, whereby the rightsholder who issues a notice about offending content must have it assessed by an independent judicial (or perhaps administrative) authority before the intermediary will respond by taking the content down.

An example of this is found in Chile, again limited to the case of copyright.^[25] In response to its Free Trade Agreement with the United States, the system introduced in 2010 is broadly similar to the DMCA, with the critical difference that intermediaries are not required to take material down in order to benefit from a liability safe harbor, until such time as a court order for removal of the material is made. Responsibility for evaluating the copyright claims made is therefore shifted from intermediaries onto the courts.

Although this requirement does impose a burden on the rightsholder, this serves a purpose by disincentivizing the issue of automated or otherwise unjustified notices that are more likely to restrict or chill freedom of expression. In cases where there is no serious dispute about the legality of the content, it is unlikely that the lawsuit would be defended. In any case, the legislation authorizes the court to issue a preliminary injunction on an ex parte basis, on condition of payment of a bond.

Intermediaries should be allowed to charge for the time and expense associated with processing legal requests
As an intermediary, it is time consuming and relatively expensive to understand the obligations that each country’s legal regime imposes on you, and to accurately how each legal request should be handled. Especially for intermediaries without many resources, such as forum operators or owners of home Wifi networks, the costs associated with being an intermediary can be prohibitive. Therefore, it should be within their rights to charge for their compliance costs if they are either below a certain user threshold or can show financial necessity in some way.

Legal requirements imposed on intermediaries should be a floor, not a ceiling- ISPs can adopt more restrictive policies to more effectively serve their users as long as they have published policies that explain what they are doing
The Internet has space for a wide range of platforms and applications directed to different communities, with different needs and desires. A social networking site directed at children, for example, may reasonably want to have policies that are much more restrictive than a political discussion board. Therefore, legal requirements that compel intermediaries to take down content should be seen as a ‘floor,’ but not a ‘ceiling’ on the range and quantity that of content those intermediaries may remove. Intermediaries should retain control over their own policies as long as they are transparent about what those policies are, what type of content the intermediary removes, and why they removed certain pieces of content.

Principle VI: Privacy

It is important to protect the ability of Internet users to speak by narrowing and making less ambiguous the range of content that intermediaries can be held liable for, but it is also very important to make users feel comfortable sharing their view by ensuring that their privacy is protected. Protecting the user’s ability to share her views, especially when those views are controversial or have a direct bearing on important political issues, requires that the user can trust the intermediaries that she uses. This concept can be further broken down into three sub-principles:

The user’s personal information should be protected to the greatest extent possible given the state of the art in encryption, security, and policy
Users will be less willing to speak on important topics if they have legitimate concerns that their data may be taken from them. As stated in the UNESCO Report, “[b]ecause of the amount of personal information held by companies and ability to access the same, a company’s practices around collection, access, disclosure, and retention are key. To a large extent a service provider’s privacy practices are influenced by applicable law and operating licenses required by the host government. These can include requirements for service providers to verify subscribers, collect and retain subscriber location data, and cooperate with law enforcement when requested. Outcome: The implications of companies trying to balance a user’s expectation for privacy with a government’s expectation for cooperation can be serious and are inadequately managed in all jurisdictions studied.”^[26]

Where possible, ISPs should help to preserve the user’s right to speak anonymously
An important aspect of an Internet user’s ability to exercise her right to free expression online is ability to speak anonymously. Anonymous speech is one of the great advances of the Internet as a communications medium and should be preserved to the extent possible. As noted by special rapporteur Frank LaRue, “[i]n order for individuals to exercise their right to privacy in communications, they must be able to ensure that these remain private, secure and, if they choose, anonymous. Privacy of communications infers that individuals are able to exchange information and ideas in a space that is beyond the reach of other members of society, the private sector, and ultimately the State itself. Security of communications means that individuals should be able to verify that only their intended recipients, without interference or alteration, receive their communications and that the communications they receive are equally free from intrusion. Anonymity of communications is one of the most important advances enabled by the Internet, and allows individuals to express themselves freely without fear of retribution or condemnation.”^[27]

The user’s PII should never be sold or used without her consent, and she should always know what is being done with it via an easily comprehensible dashboard
The user’s trust in the online platform that she uses and relies upon is influenced not only by the relationships the intermediary maintains with the government, but also with other commercial entities. A user, who feels that her data will be constantly shared with third parties, perhaps without her consent and/or for marketing purposes, will never feel like she is able to freely express her opinion. Therefore, it is the intermediary’s responsibility to ensure that its users know exactly what information it retains about them, who it shares that information with and under what circumstances, and how to change the way that her data is shared. All of this information should be available on a dashboard that is comprehensible to the average user, and which gives her the ability to easily modify or withdraw her consent to the way her data is being shared, or the amount of data, or specific data, that the intermediary is retaining about her.

Principle VII: Access to Remedy

As noted in the UNESCO Report, “Remedy is the third central pillar of the UN Guiding Principles on Business and Human Rights, placing an obligation both on governments and on companies to provide individuals access to effective remedy. This area is where both governments and companies are almost consistently lacking. Across intermediary types, across jurisdictions and across the types of restriction, individuals whose content is restricted and individuals who wish to access such content are offered little or no effective recourse to appeal restriction decisions, whether in response to government orders, third party requests or in accordance with company policy. There are no private grievance or due process mechanisms that are clearly communicated and readily available to all users, or consistently applied.”^[28]

Any notice and takedown system is subject to abuse, and any company policy that results in the removal of content is subject to mistaken or inaccurate takedowns, both of which are substantial problems that can only be remedied by the ability for users to let the intermediary know when the intermediary improperly removed a specific piece of content and the technical and procedural ability of the intermediary to put the content back. However, the technical ability to reinstate content that was improperly removed may conflict with data retention laws. This conflict should be explored in more detail. In general, however, every time content is removed, there should be:

A clear mechanism through which users can request reinstatement of content
When an intermediary decides to remove content, it should be immediately clear to the user that content has been removed and why it was removed (see discussion of in-product notice, supra). If the user disagrees with the content removal decision, there should be an obvious, online method for her to request reinstatement of the content.

Reinstatement of content should be technically possible
When intermediaries (who are subject to intermediary liability) are building new products, they should build the capability to remove content into the product with a high degree of specificity so as to allow for narrowly tailored content removals when a removal is legally required. Relatedly, all online intermediaries should build the capability to reinstate content into their products while maintaining compliance with data retention laws.

Intermediaries should have policies and procedures in place to handle reinstatement requests
Between the front end (online mechanism to request reinstatement of content) and the backend (technical ability to reinstate content) is the necessary middle layer, which consists of the intermediary’s internal policies and processes that allow for valid reinstatement requests to be assessed and acted upon. In line with the corporate ‘responsibility to respect’ human rights, and considered along with the human rights principle of ‘access to remedy,’ intermediaries should have a system in place from the time that an online product launches to ensure that reinstatement requests can be made and will be processed quickly and appropriately.

Principle VIII: Accountability

Governments must ensure that independent, transparent, and impartial accountability mechanisms exist to verify the practices of government and companies with regards to managing content created online
“While it is important that companies make commitments to core principles on freedom of expression and privacy, make efforts to implement those principles through transparency, policy advocacy, and human rights impact assessments, it is also important that companies take these steps in a manner that is accountable to stakeholders. One way of doing this is by committing to external third party assurance to verify that their policies and practices are being implemented to a meaningful standard, with acceptable consistency wherever their service is offered. Such assurance gains further public credibility when carried out with the supervision and affirmation of multiple stakeholders including civil society groups, academics, and responsible investors. The Global Network Initiative provides one such mechanism for public accountability. Companies not currently participating in GNI, or a process of similar rigor and multi-stakeholder involvement, should be urged by users, investors, and regulators to do so.”^[29]

Civil society should encourage comparative studies between countries and between ISPs with regards to their content removal practices to identify best practices
Civil society has the unique ability to look longitudinally across this issue to determine and compare how different intermediaries and governments are responding to content removal requests. Without information about how other governments and intermediaries are handling these issues, it will be difficult for each government or intermediary to learn how to improve its laws or policies. Therefore, civil society has an important role to play in the process of creating increasingly better human rights outcomes for online platforms by performing and sharing ongoing, comparative research.

Civil society should establish best practices and benchmarks against which ISPs and government can be measured, and should track governments and ISPs over time in public reports
“A number of projects that seek, define and implement indicators and benchmarks for governments or companies are either in development (examples include: UNESCO’s Indicators of Internet Development project examining country performance, Ranking Digital Rights focusing on companies) or already in operation (examples include the Web Foundation’s Web Index, Freedom House’s Internet Freedom Index, etc.). The emergence of credible, widely-used benchmarks and indicators that enable measurement of country and company performance on freedom of expression will help to inform policy, practice, stakeholder engagement processes, and advocacy.”^[30]

Principle IX: Due Process - In Both Legal and Private Enforcement

ISPs should always consider context before removing content and Governments and courts should always consider context before ordering that certain content be removed
“Governments need to ensure that legal frameworks and company policies are in place to address issues arising out of intermediary liability. These legal frameworks and policies should be contextually adapted and be consistent with a human rights framework and a commitment to due process and fair dealing. Legal and regulatory frameworks should also be precise and grounded in a clear understanding of the technology they are meant to address, removing legal uncertainty that would provide opportunity for abuse.”^[31]

Principles for Courts

An independent and impartial judiciary exists, at least in part, to preserve the citizen’s due process rights. Many have called for an increased reliance on courts to make determinations about the legality of content posted online in order to both shift the censorship function from unaccountable private actors and to ensure that courts only order the removal of content that is actually unlawful. However, when courts do not have an adequate technical understanding of how content is created and shared on the internet, the rights of the intermediaries that facilitate the posting of the content, and who should be ordered to remove unlawful content, they do not add value to the online ecosystem. Therefore, courts should keep certain principles in mind to preserve the due process rights of the users that post content and the intermediaries that host the content.

Preserve due process for intermediaries- do not order them to do something before giving them notice and the opportunity to appear before the court

In a dispute between two private parties over a specific piece of content posted online, it may appear to the court that the easy solution is to order the intermediary who hosts the content to remove it. However, this approach does not extend any due process protections to the intermediary and does not adequately reflect the intermediary's status as something other than the creator of the content. If a court feels that it is necessary for an intermediary to intervene in a legal proceeding between two private parties, the court should provide the intermediary with proper notice and give them the opportunity to appear before the court before issuing any orders.

Necessity and proportionality of judicial determinations- judicial orders determining the illegality of specific content should be narrowly tailored to avoid over-removal of content

With regards to government removal requests, the UNESCO Report notes that “[o]ver-broad law and heavy liability regimes cause intermediaries to over-comply with government requests in ways that compromise users’ right to freedom of expression, or broadly restrict content in anticipation of government demands even if demands are never received and if the content could potentially be found legitimate even in a domestic court of law.”^[32] Courts should follow the same principle: only order the removal of the bare minimum of content that is necessary to remedy the harm identified and nothing more.

Courts should clarify whether ISPs have to remove content in response to court orders directed to third parties, or only have to remove content when directly ordered to do so (first party court orders) after an adversarial proceeding to which the ISP was a party

See discussion of the difference between first party and third party court orders (supra, section a., “Transparency”). Ideally, any decision that courts reach on this issue would be consistent across different countries.

Questions- related unresolved issues that should be kicked to the larger group

How should the conflict between access to remedy and data retention laws that say content must be hard deleted after a certain period of time be resolved? I think the access to remedy has to be subordinated to the data protection laws. Let's make that our draft position, but continue to flag it for discussion.

Should ISPs have to remove content in response to court orders directed to third parties, or only have to remove content when directly ordered to do so (first party court orders) after an adversarial proceeding to which the ISP was a party? I think first party orders. Let's make that our draft position, but continue to flag it for discussion.

[1] Center for Democracy and Technology, Shielding the Messengers: Protecting Platforms for Expression and Innovation at 4-15 (Version 2, 2012), available at https://www.cdt.org/files/pdfs/CDT-Intermediary-Liability-2012.pdf (see pp.4-15 for an explanation of these different models and the pros and cons of each).

[2] UNESCO, “Fostering Freedom Online: The Roles, Challenges, and Obstacles of Internet Intermediaries” at 6-7 (Draft Version, June 16th, 2014) (Hereinafter “UNESCO Report”).

[3] UNESCO Report at 56.

[4] UNESCO Report at 37.

[5] Center for Democracy and Technology, Additional Responses Regarding Notice and Action, Available at https://www.cdt.org/files/file/CDT%20N&A%20supplement.pdf.

[6] The United Nations (UN) Special Rapporteur on Freedom of Opinion and Expression, the Organization for Security and Co-operation in Europe (OSCE) Representative on Freedom of the Media, the Organization of American States (OAS) Special Rapporteur on Freedom of Expression and the African Commission on Human and Peoples’ Rights (ACHPR) Special Rapporteur on Freedom of Expression and Access to Information, Article 19, Global Campaign for Free Expression, and the Centre for Law and Democracy, JOINT DECLARATION ON FREEDOM OF EXPRESSION AND THE INTERNET at 2 (2011), available at http://www.osce.org/fom/78309 (Hereinafter “Joint Declaration on Freedom of Expression).

[7] Center for Democracy and Technology, Additional Responses Regarding Notice and Action, Available at https://www.cdt.org/files/file/CDT%20N&A%20supplement.pdf.

[8] Id.

[9] Id.

[10] UNESCO Report at 113-14.

[11] ‘Chilling Effects’ is a website that allows recipients of ‘cease and desist’ notices to submit the notice to the site and receive information about their legal rights. For more information about ‘Chilling Effects’ see: http://www.chillingeffects.org.

[12] Id. at 73. You can see an example of a complaint published on Chilling Effects at the following location. “DtecNet DMCA (Copyright) Complaint to Google,” Chilling Effects Clearinghouse, March 12, 2013, www.chillingeffects.org/notice.cgi?sID=841442.

[13] UNESCO Report at 73.

[14] Article 19, Internet Intermediaries: Dilemma of Liability (2013), available at http://www.article19.org/data/files/Intermediaries_ENGLISH.pdf.

[15] UNESCO Report at 120.

[16] Joint Declaration on Freedom of Expression and the Internet at 2.

[17] Id.

[18] Id.

[19] Id. at 121.

[20] Id. at 104.

[21] Id. at 122.

[22] Center for Democracy and Technology, Shielding the Messengers: Protecting Platforms for Expression and Innovation at 12 (Version 2, 2012), available at https://www.cdt.org/files/pdfs/CDT-Intermediary-Liability-2012.pdf.

[23] Joint Declaration on Freedom of Expression at 2-3.

[24] Geist, Michael, Rogers Provides New Evidence on Effectiveness of Notice-and-Notice System (2011), available at http://www.michaelgeist.ca/2011/03/effectiveness-of-notice-and-notice/

[25] Center for Democracy and Technology, Chile’s Notice-and-Takedown System for Copyright Protection: An Alternative Approach (2012), available at https://www.cdt.org/files/pdfs/Chile-notice-takedown.pdf

[26] UNESCO Report at 54.

[27] “Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue (A/HRC/23/40),” United Nations Human Rights, 17 April 2013, http://www.ohchr.org/Documents/HRBodies/HRCouncil/RegularSession/Session23/A.HRC.23.40_EN.pdf, § 24, p. 7.

[28] UNESCO Report at 118.

[29] UNESCO Report at 122.

[30] Id.

[31] UNESCO Report at 120.

[32] Id. at 119.

For more details visit https://cis-india.org/internet-governance/blog/zero-draft-of-content-removal-best-practices-white-paper

YouTube is the answer to what has changed in India

praskrishna — 2013-11-20T07:00:48Z

Alternative Law Forum’s Lawrence Liang on relaunching Creative Commons, and how it changes the legal landscape of copyright issues.

The article by Moulishree Srivastava was published in Livemint on November 20, 2013. Lawrence Liang was quoted.

Creative Commons (CC), a non-profit organization headquartered in Mountain View, California, US, which enables Internet users to share and use the creativity and knowledge of others, on Tuesday relaunched its India chapter after six years. CC provides free copyright licences that give creators a way to share their creative work, on conditions of their choice.

In India, for instance, Pratham Books, a not-for-profit publisher, licenses its content under a CC licence that allows others to use the content (on certain conditions). And the National Council of Educational Research and Training has created a portal where digital versions of its course material have been uploaded under a CC licence.

In an interview, Lawrence Liang , co-founder of Alternative Law Forum and chairman of the board at the Bangalore-based Centre for Internet and Society, which is one of the CC affiliates in India, spoke about the re-launch, what went wrong the last time, what it means for the country and how it changes the legal landscape of copyright issues. Edited excerpts:

People all over the world are already using CC licences. What does this relaunch mean for India?

There are two things. One is the legal component. The licences have been tailor-made for Indian law. Tomorrow, if someone were to use CC licence and there were violations and it came up in court, this (the CC licence) would be in compliance with the Indian Copyright Act. The other is, we have a very large number of young people who are entering the space of making creative works. The CC means for them to be aware that there are options they have apart from traditional copyright licensing.

How does it impact the legal landscape of copyright issues?

In the US, you have something called derivative rights, which is conversion of one medium into another medium. In India, you don’t have that idea; you have the right of adaptation, which is a much more narrowly defined idea. It has the specific definition of what the adaptation is. There is the right to adaptation of a work from, say, literary into dramatic, but it doesn’t mean conversion of a work into any form.

The second is in terms of presumption of how you gain ownership over copyright, which is slightly different in India than it is in the US.

In India—section 17 (of the Constitution) lays out different classes of work—there are different presumptions of who the owner of copyright is, which becomes very important. For example, if a film-maker wants to license his work, now it has to be clear that he is the owner of the copyright in the first place, because the presumption in India would be that the producer is the owner of the work, whereas in Europe the producer is the first owner of the work. These are some of the small differences that CC attempts to clarify.

What went wrong the last time?

When it was first launched (in India) in 2007, perhaps there wasn’t the momentum. Last time CC was launched as a licence in India, but not as a community, which was the key issue. Second, it was institutionally housed in IIT (Indian Institute of Technology) Bombay and it needed being pluralized. You can’t depend on CC being housed in one single institution. It should be in as many institutions as possible, which is what has happened this time. The crucial thing here is that we will be developing a community. A lot more people know about CC now than they did back in 2007.

Why do you think it will succeed?

One is the overall awareness about open source and alternatives. The other one, which is more crucial, is, when CC was launched in the US, it was in response to a very clear crisis. The crisis was that a large number of users were being prevented from using existing works. Lawrence Lessig (one of the co-founders of CC) felt that there was a need to create a legal alternative. There was already, in a way, a certain kind of environment which allowed CC to automatically speak to a number of people’s concerns. In India, we didn’t have that. Copyright was anyway not being enforced. That’s happening now. So once people could use YouTube, could create remixes, then they suddenly realized that they have used a film song and other copyrighted content. Then they suddenly realize a need of legal content as alternative. YouTube is the answer to what has changed.

What does it mean for the media?

It depends on whether you are looking at it from the perspective of a media producer or a user. From the perspective of a media producer, one of the big things that people assume is that everything is copyrighted until stated otherwise and that you can’t use it. There are a number of people who will be very happy to use it, but they may not want to use it commercially. With a CC licence, the boundaries are clear. What you are allowed to do and what you are not allowed to do is extremely clear. One of the biggest problems in the digital landscape at the moment is opacity. You are not sure. There is an image on a website, which seems to be used in many places. Am I allowed to reproduce it? What is the extent to which I can use the content? A lot of these will be rendered clear for media practitioners.

For more details visit https://cis-india.org/news/livemint-november-12-2013-moulishree-srivastava-you-tube-is-answer-to-what-changed-in-india

Youths brainstorm at social summit

praskrishna — 2013-09-25T11:08:03Z

This group of youngsters is in the process of developing a smartphone app that will help traffic police and civic agencies strengthen emergency services like ambulances and fire engines.

The event was hosted in CIS on September 21. The Times of India covered this and published the story on September 22, 2013.

"Digital signboards and phone alerts can sensitize road users and traffic cops about emergency vehicles ," says the team, which is working on creating prototypes to build emergency response systems for citizens in case of road accidents.

Trupti Chengalath, head of communications for Mahiti.org, Dipankar Nayak, a young architect and Gauri Prasad, a Class 12 student of Canadian International School are part of the team which came together at the Bangalore Social Good Jam on Saturday.

The event, organized at the Centre for Internet and Society, Domlur, saw the participation of schoolchildren, college goers, young professionals and social entrepreneurs , who focused on devising technological solutions to some of the most pressing problems faced by Indian cities . Members of Ashoka India , a global association of leading social entrepreneurs , IDEX, a six-month fellowship programme on social enterprise, and the Green Lungi Movement, were part of the session.

Meera Vijayan, consultant , Framework Change, Ashoka, told STOI, "NGOs run by fellows of Ashoka and IDEX will implement these tech-based solutions in different cities and will involve government stakeholders too. These summits have become a global conversation on how to leverage technology for social change. Bangalore was chosen for the first-of-its-kind event in India because IT runs in the blood of the city."

For more details visit https://cis-india.org/news/the-times-of-india-september-22-2013-youths-brainstorm-at-social-summit

Your telco could help spy on you

praskrishna — 2013-07-30T06:13:07Z

Telecom minister gives approval to changes in rules for mobile licences to enable such mass surveillance.

The article by Joji Thomas Philip, Leslie D'Monte and Shauvik Ghosh was originally published in Livemint on July 30, 2013. Sunil Abraham is quoted.

Telecom companies and Internet service providers will soon help the government monitor every call made, every email sent and every website visited, with the Centre deciding to connect their networks to its automated surveillance platform known as the Centralised Monitoring System (CMS).

Communications minister Kapil Sibal has approved changes in existing rules and new clauses to be inserted in mobile licences for enabling such mass surveillance, copies of documents reviewed by Mint reveal.

	The department of telecommunications (DoT) will shortly send a letter to all telcos asking them to connect their “lawful interception system (LIS)” to the CMS “at a regional monitoring centre through an interception, store and forward (ISF) server placed in the licensee’s premises”, according to the documents. Telcos including Bharat Sanchar Nigam Ltd (BSNL), Mahanagar Telephone Nigam Ltd (MTNL), Reliance Communications Ltd, Bharti Airtel Ltd, Vodafone India Ltd and Tata TeleServices Ltd declined to comment on questions emailed in this regard.

The department of telecommunications (DoT) will shortly send a letter to all telcos asking them to connect their “lawful interception system (LIS)” to the CMS “at a regional monitoring centre through an interception, store and forward (ISF) server placed in the licensee’s premises”, according to the documents.

Telcos including Bharat Sanchar Nigam Ltd (BSNL), Mahanagar Telephone Nigam Ltd (MTNL), Reliance Communications Ltd, Bharti Airtel Ltd, Vodafone India Ltd and Tata TeleServices Ltd declined to comment on questions emailed in this regard.

“The automated process of the CMS will be subjected to the same regulatory scrutiny as is available in the present manual system under Section 5(2) of Indian Telegraph Act and Rules 419-A thereunder, with the added advantage of having a safeguard against any illegal provisioning by the telecom service providers in the present system, however, remote it may be,” DoT said in an email reply to a questionnaire with a brief on CMS.

“Safeguard has also been built against any unauthorized provisioning by having a different interception provisioning agency than the interception requisitioning and monitoring agencies thus having an inbuilt system of checks and balances. Further, a non-erasable command log will be maintained by the system, which can be examined anytime for misuse, thus having an additional safeguard,” DoT said.

The CMS was approved by the cabinet committee on security (CCS) on 16 June 2011, with government funding of Rs.400 crore. It is expected to enable the government to monitor all forms of communication, from emails to online activity to phone calls, text messages and faxes by automating the existing process of interception and monitoring. The government completed a pilot project in September 2011 under which the Centre for Development of Telematics (C-DoT) installed two ISF servers, one of them for MTNL.

“The interception services have been integrated and tested successfully for these two telecom services providers (TSPs),” the note said, referring to MTNL and Tata Communications Ltd. MTNL officials declined to comment. There was no response to queries by Tata Communications.

It added that training had been imparted to six law enforcement agencies—the Intelligence Bureau, the Central Bureau of Investigation, the Directorate of Revenue Intelligence, the Research and Analysis Wing, the Delhi Police and the National Investigation Agency.

However, the documents also reveal that the CMS project is getting delayed over technical issues such as lawful interception systems sending the intercept-related information (IRI) in “their own proprietary format”; difficulty in tracing the movement of “the target from the home network to the roaming network”; and how to independently provision voice and data interception of mobile users.

The government is simultaneously devising a strategy to counter criticism from the media and privacy lobby groups that this surveillance platform has no privacy safeguards. Mint reported on 13 July that fresh questions were raised on the CMS infringing on the rights of individuals, especially in the wake of the US government’s PRISM surveillance project.

In an internal note on 16 July to help Sibal brief the media, DoT said even as the CMS will automate the existing process of interception and monitoring “... all safeguards that are currently in place in the manual mode of interception will continue”.

The note argued that implementation of the CMS “will rather enhance the privacy of the citizens” since it will not be necessary to take the authorization (for tapping) to the nodal officer of the telecom service providers “who comes to know whose or which phone is being intercepted”. The note added that after the CMS is implemented, provisioning of interception will be done by a CMS authority, who would be different from the law enforcement agency authorities.

“The law enforcement agency (LEA) cannot provision for interception and monitoring and the CMS authority cannot see the content but would be able to provision the request from the LEA.Hence, complete check and balance will be ensured. Further, a non-erasable command log will be maintained by the system, which can be examined anytime for misuse, thus having an additional safeguard,” added the department’s note briefing the minister.

Also, acknowledging that “questions were being asked about the practices of Indian agencies and the privacy and rights of its citizens”, national security adviser Shivshankar Menon in a 23 June note to the ministries of home, external affairs and telecom, the department of electronics and information technology, and the cabinet secretary said: “Only home secretaries of the Centre and states can authorize such monitoring; orders are valid for two months, are not extendable beyond six months; records are to be maintained, use of storage is limited and a review committee of cabinet secretary, law secretary and secretary of the telecom department regularly screens all cases.”

Menon also admitted that when it came to individual privacy rights, there were “larger issues that needed serious consideration and wider consultation with industry, advocacy groups and NGOs (non-governmental organizations) as has been the case so far in the draft privacy Bill... For data protection and retention in India, however, there may be a need to consider legislation or strengthening existing legislation, as the march of technology has made most present laws irrelevant.”

Privacy experts are convinced that safeguards are needed, especially since India does not have a privacy law.

“To safeguard public interest, the government should also draft a law that will make it a criminal offence if a CMS authority is found in possession of any personal information culled through the CMS. That will prove to be a deterrent,” said Sunil Abraham, executive director of the Centre for Internet and Society, a privacy lobby body. “Also, the government must build an audit trail using PKI (public key encryption) and people as an additional safeguard.”

“As I understand it, there is also no clear statutory backing for the CMS,” said Apar Gupta, a partner at law firm Advani and Co. that specializes in information technology (IT) law. “What is important is that every tapping order should be backed by a reason. This was the case with the manual process. Will this be possible in an automated surveillance system such as the CMS?”

“What is disturbing is that there is no transparency with regard to the CMS. Everything is happening under the radar with media reports periodically giving us glimpses into the project,” he said. “A state should protect its interests but should do so in a manner that safeguards privacy and limits abuse.”

According to the Freedom on the Net 2012 report by Freedom House, an independent privacy watchdog body, of the 47 countries analysed, 19 had introduced new laws or other directives since January 2011 that could affect free speech online, violate users’ privacy, or punish individuals who post certain types of content. India, which scored 39 points out of 100 (score achieved out of 100 for censoring the Internet), was termed partly free by the report, which was released on 24 September.

Globally, 79% of the respondents in another study said they were concerned about their privacy online, with India (94%), Brazil (90%) and Spain (90%) showing the highest level of concern, according to a June survey undertaken by research firm ComRes, and commissioned by Big Brother Watch, an online privacy campaign.

For more details visit https://cis-india.org/news/livemint-july-30-2013-joji-thomas-philip-leslie-d-monte-shauvik-ghosh-your-telco-could-help-spy-on-you

Your private data may be online, courtesy govt

praskrishna — 2013-10-29T05:50:59Z

Some depts have posted bank account & income details on net for transparency; experts cry privacy breach.

The article by Somesh Jha and Surabhi Agarwal was published in the Business Standard on October 29, 2013. Sunil Abraham is quoted.

To push the government's agenda of greater transparency and accountability, several states and central departments might be, unwittingly, following a bare-it-all approach in posting citizen data online. And, even sensitive and personal information, such as bank account numbers and income status, is not being spared. A Business Standard investigation reveals, with so much citizen data already in the public domain and more getting added every day, the government could be jeopardising the privacy of its 1.2 billion citizens, who stand exposed to a variety of risks, including those of 360-degree profiling and financial frauds.

For instance, the Centre's National Rural Employment Guarantee Scheme puts out full bank account numbers of its beneficiaries, along with details like the amount they received. So, one can easily know the bank in which most residents of, say, Punjab's Machhiwara district have their accounts. Also, their account numbers are complete, with photographs. In the case of Haryana's 25-year-old Ram (surname withheld), the photograph is not available but one can get his financial details on the portal, along with the first eight digits of his Aadhaar number (the last four have been muted).

Sample this: The occupation and yearly income of one Amrita of Uttar Pradesh are just a matter of a few clicks and so are her ration card number, full address, age, father's/husband's name, category and poverty status. A farmer from Amethi district, she doesn't have a gas or an electricity connection, but Lucknow-based Manu, who earns Rs 4 lakh a year, does have. Amrita's yearly income is Rs 1.2 lakh a year. These details are all there on their respective ration cards, out in the open on the government website of Uttar Pradesh, a state that might have gone overboard in revealing citizen data under the ongoing computerisation of the public distribution system.

"If people start publishing information like these and the government doesn't regulate it through a data protection law, criminal minds can harvest and combine all databases accurately," says Sunil Abraham, executive director of Centre for Internet and Society, a Bangalore based think-tank. People often create passwords and pins based on dates and numbers very important to them. "A little bit of intelligence and some amount of social engineering could lead to guesses... and financial fraud." Even by sifting through just three databases, it is quite easy to get a random person's details like voter identity card number, address, name, age, date of birth, ration card number, information on family members, along with income status and photograph.

One can argue the electoral roll is a public document and there is nothing wrong with a person's voter identity card number, full address, name, age, father's name and even date of birth being easily searcheable online. But a few states like Uttarakhand have even published photographs, an element barred from online posting under the law. Experts argue a massive digitisation exercise is underway in the country and, with the lack of standards and clear advisories from the Centre, the situation could worsen in the future.

A Cabinet minister, who did not wish to be named, said there was a continuous tug-of-war between the imperative of privacy, which doesn't allow you to share information; and transparency, which says you should share it. "Also, the Right to Information Act says if somebody is receiving government subsidy, it is public information." However, the Indian laws might not be consistent on this issue as "under Section 43a of the Information Technology Act, any kind of financial information is classified as 'sensitive personal information' and can't be put online," says an official of the communications and information technology ministry who has closely worked on drafting of the IT Act.

But, the IT Act provides an exception for matters covered under the RTI Act. This could infer that when the recently-approved Food Security Act comes into being, the income status of two-thirds of the population (that the Act covers) could be posted online. Also, the law would permit bank account numbers of beneficiaries of various welfare schemes like cooking gas subsidy under the ongoing direct benefit transfer scheme to be made public, as subsidies are transferred directly to accounts under the project.

A statement from the office of Rural Development Minister Jairam Ramesh explained the National Rural Employment Guarantee Act provided for "making available for public scrutiny" all accounts and records related to the scheme. It added "there appears to be no evident risk of misappropriation or financial fraud". Sudhir Kumar, secretary in the Department of Food and Public Distribution, says the whole system needs to be transparent, especially when huge government subsidy is going out in the case of PDS. However, "if states are putting unnecessary details online, it can be looked into". Deputy Election Commissioner Alok Shukla says, according to an EC order, states are not allowed to put photographs of voters online to ensure their privacy is safeguarded. These will be removed if such cases are found. He adds a standard protocol is also being worked out for states.

For more details visit https://cis-india.org/news/business-standard-october-29-2013-somesh-jha-surabhi-agarwal-your-private-data-may-be-online-courtesy-govt

Your phone is a surveillance device, your ISP a surveillance provider…: Pranesh Prakash

praskrishna — 2015-06-17T14:53:40Z

“In India there is no special privilege for journalists over ordinary citizens,” Pranesh Prakash, Policy Director at the Centre for Internet and Society began at the workshop entitled ‘Digital Security for Journalists’ organised by the Mumbai Press Club and the Centre for Internet and Society.

The blog post was published by mxmindia.com on May 27, 2015. Pranesh Prakash gave his inputs.

“Even if you don’t care about your own security/privacy, think about you sources. Your sources want privacy,” Prakash said as he began the workshop on how to assess security threats, how to protect sources and how to prevent your ISP from leaking out information. With the growth of the internet since the 1980s, we know we can’t trust everyone; police stations, governments, all engage in surveillance of some sort, he pointed out. Prakash went on to explain the ‘Threat Model’, wherein journalists ought to ask questions like what are you protecting, who are you protecting yourself against, what do you hope to achieve and to what lengths are you willing to go? All of the measures you are going to take to protect your source are going to be inconvenient. Security is always at the cost of convenience he reiterated.

Data threat can be intercepted at two levels, Prakash explained; data in transit and data at rest. The important question to ask is which you wish to secure, because the means to secure both are very different.Emails being sent to someone can be intercepted by an outside source in transit. It is easier to secure you own data on your computer, but an email is so much more difficult to secure because there are multiple points where the information is stored. Targeted surveillance is much more difficult to protect yourself against than mass surveillance.

For WiFi, password protected networks form an encryption, one more barrier to protect you. However, a WEP encrypted network is easy to break through. You need at least a WPAII to be secure enough. Airport networks usually ask for a password after connecting to the WiFi. That too is easy to see through. Avoid using these networks for sensitive work.

One must keep in mind who they want to secure the data from; whether from a casual threat or an Intelligence Agency like the National Security Agency (NSA), National Technical Research Organisation (NTRO) or Intelligence Bureau (IB).Mass surveillance or non-targeted surveillance is not legal in India. However. the NTRO engages in mass surveillance, for which it was criticised in a Mint article, following which they shifted only to the national borders for surveillance. It is also possible for the NSA to tamper with your laptop before delivery.The NSA’s ANT catalogue has been working on a technology that has a device that can fit within the connector that connects to your keyboards and it can last there years and years without detection. Hence Prakash suggests that if a journalist is working on a sensitive story that if leaked could cause a ruckus, he/she would be safer buying a new computer and paying for it in hard cash.

The more important a source is, the less you must use your phone, Prakash pointed out. Phones leak information time and again, information of time and location. The NSA uses it, the police use it. If you are meeting with someone and you both have your phone, then information that you have met is transmitted. Even without GPS it can track your location, when you receive/send a call/message, as your mobile network needs to access the cell tower you are around in order to reach you.

Encrypted emails still leak identities. If the police look into an encrypted email, they will still know who you are communicating with. Background information you are doing on a story can also give away a lot you don’t want to be given away. Even with an encrypted email, they have access to your location, IP address, the sender and the receiver of the email, time stamp, Mac id and IMEI.

End-to-end encryption is the way out here.This means that no one in the middle, including the company can read the emails you send from your company server. End-to-end encryption is the most inconvenient. End-to-end encryption means that you and the party concerned need to come up with a code that the other party needs to be able to decrypt. The software both parties use also needs to be compatible.

“I recommend using WhatsApp over Viber and Line, Skype over other alternatives and Twitter is also safe, but never use Facebook for sensitive conversations that you don’t want to get out,” Prakash said. WhatsApp is safer than normal text messaging he points out. Prakash recommended an app called Conversations to use for messaging on your phone. It is safer than both normal SMSing and WhatsApp. An SMS leaks metadata, he explains, that’s why it is preferable to use data or apps that use the internet.

In the 2G network space, only Airtel and Docomo use at least a weak encryption.All the rest use no encryption. Anyone can snoop in on your conversations. Instead one must use data-enabled apps for calling like RedPhone, he suggested. This is a great way to protect your source.

Most people are known to repeat passwords for various accounts. Never repeat a password, Prakash advised. Maintain different passwords for all your accounts. It is the safest. And if you are unable to remember them all, then use password managementsoftware like LastPass or KeyPass. These enable you to key in and store all your passwords in one place and you only have to remember the password to your LastPass/KeyPass account. But if you forget your master password, then there is no way to recover all your other passwords.

The session concluded with Prakash working hands-on with the journalists, helping them to download the required software on their laptops and mobile phones. This knowledge is vital for all journalists in order to protect themselves and their sources when doing a high profile, sensitive story, Prakash said.

For more details visit https://cis-india.org/internet-governance/news/mxmindia-may-27-2015-dyanne-coelho-your-phone-is-a-surveillance-device-your-isp-a-surveillance-provider

Your mobile apps have the permission to spy on you

Admin — 2018-04-03T15:48:47Z

The top applications on the Android Play store in India seek permission like access to your camera, microphone, modify contacts and download files without notifications depending on the use of the app.

The article was published in the Economic Times on March 30, 2018. Pranesh Prakash was quoted.

“What we need is, not just knowing what permissions are being sought, but why they need such permissions,” said Pranesh Prakash, policy director of the Centre for Internet and Society.

Companies such as TrueCaller say that app developers should only be permitted to collect data that they can demonstrate as proportionate and “necessary for the stated purpose of their service”.

An Uber spokesperson said they provide users with an option to turn off certain permissions like location and phone contacts within the privacy settings on app along with explanations on what data they collect and the reason behind it. Others declined comment.

For more details visit https://cis-india.org/internet-governance/news/economic-times-march-30-2018-your-mobile-apps-have-the-permission-to-spy-on-you

Your life's an open Facebook

praskrishna — 2013-07-26T04:53:11Z

The jury's out on Facebook's newly introduced Graph Search. While some argue that it's a stalker's dream come true, others say it's a great tool for social research. Shikha Kumar jumps right into the debate.

Shikha Kumar's article was published in DNA on July 21, 2013. Sunil Abraham is quoted.

Do this little exercise. Log on to Facebook and type ‘friends of friends who are single’ or ‘friends of friends who like dancing’ in the search bar on the top left hand of the screen. A long list of names with photographs of people you may have never seen in your life will pop up in front of you. Better still (or worse, depending on perspective), you can refine this search further with the drop down menu on the right hand side of the screen; you can filter the results on the basis of gender, employer, current city, hometown and so on.

Now, depending on whether you are paranoid about your privacy, or don’t give a damn (since the government is snooping on us anyway), you will either view this feature as a stalker’s dream come true or just another irritant to rant about for a day and then forget.

Whatever your reaction, Graph Search, an upgrade on Facebook’s rudimentary ‘search’, is here to stay and it holds the potential to forever change the ‘search’ behaviour of its members.

HOW DOES IT WORK?
Put simply, Graph Search is the Google search of Facebook. It indexes every little detail you have shared on Facebook — every drunken ‘like’, every status update, every unflattering photograph you are tagged in, every joke you’ve shared — so that a simple search can throw up pretty specific answers. A beta version was unveiled to a select audience in January but it went live for all English (US) users early last week.

A look at a Tumblr blog called ‘Actual Facebook Graph Searches’ gives an indication of how specific the results can get. Ranging from humorous to downright outrageous, some queries posted included ‘Single women who live nearby and who are interested in men and like Getting Drunk’ and ‘Married people who like Prostitutes.’

This is exactly why people like Adarsh Matham, a 29-year-old tech writer, cite as reason for never having been on Facebook. While he does admit the new feature can be very useful in finding jobs, dates, new friends and local businesses, he says the downsides trump the benefits. “Imagine if some pervert searches for ‘girls who like Fifty Shades of Grey in Mumbai’… It will make it easier for him to stalk them,” says Matham.

If you use your imagination, the list won’t end. Imagine what perverts at your workplace and in your apartment complex who are not ‘friends’ with you on Facebook can do with information they glean about you thanks to Graph Search.

Matham is particularly concerned with Graph Search’s misuse in India because of our social attitudes and tendency to slot people into types and judge them immediately. “One of the first things that people do when they go for a job or on a date is a Google search. Soon they will do a Graph Search too. This is a complete intrusion of one’s privacy.”

Sunil Abraham, director at the Bangalore-based Centre for Internet and Society, thinks the privacy implications are worrying because the average Indian user is not a ‘power’ user who fully exploits the site’s advanced features and is thus unclear about what personal information is public or private. “People need to be very cautious as they’re leaving behind a digital trail that is always searchable unlike on other platforms like Twitter. It’s like tattooing yourself, it’s permanent but you may not be comfortable with it in the future,” he says.

A brilliant format
Privacy concerns aside, many have warmed up to the benefits of Graph Search. Raghu Mohan, a Bangalore-based writer with YourStory.in, has used it for over six months and has only good things to say about it. “I think it’s a remarkable engineering feat. Any platform with a user data of over a billion people needs to come up with such a search facility,” says Mohan, adding that the tool has been very useful in finding work-related data.

Chetan Asher, founder and CEO of Tonic Media, a social media agency, agrees with him, saying the new feature is “very exciting” purely because of its ability to index information that was always there, but was buried somewhere. “The simple phrase-like format is brilliant… It completely changes the way you network and mine for information.”

Mohan adds that start-ups can benefit with what the feature offers. “Though not a complete marketing tool, Graph Search patterns can also provide more targeted behaviour for advertisers.” Mohan also looks at the feature as a social influencer. “If I’m looking to buy a new car, I’d rather use Graph Search to find out opinions based on my friends’ recommendations than a web search involving strangers,” he says.

From his experience, Asher says that the site doesn’t compromise the privacy settings that the user has set. But Ankit Tuteja, a 23-year-old technology expert in Delhi, would beg to differ with this. Tuteja has experimented with random searches to gauge how the feature worked with different privacy settings and found that Facebook tends to override certain security settings. “The security of your photographs are a major cause for concern,” he cautions.

For those concerned about privacy, it’s best to think carefully before ‘liking’ or uploading anything as it will remain in the digital realm forever, says Abraham. Mohan shrugs off privacy concerns as overrated. “You lost your personal life when you went online. Stalking can happen otherwise too.”

This innovation is clearly important to the company. While Asher says it is part of Facebook’s long-term plans to move beyond networking, Abraham says that faced with slow overall growth globally (except in markets like India), such innovations are just an attempt to keep its user base intact.

The more things change...
Whatever the reaction, Facebook is probably banking on the fact that after initial protests and social media debates, people will come around to accepting this intrusion into their private lives.

The American news satire website The Onion pretty much nailed this when, in a satirical piece, it ‘quoted’ Zuckerberg as saying: “Facebook will introduce a bunch of new features that everyone will hate, that will make your experience worse, you will complain about it, and then you will realize you are utterly powerless to do anything about these new features, at which point you will move on and continue to use our product every single day. Any users who strongly disagree with their policy should feel free to deactivate their accounts and reactivate them two days later.”

Admit it, you’ll probably be one of them.

For more details visit https://cis-india.org/news/dna-july-21-2013-shikha-kumar-your-life-is-an-open-facebook

Your digital wallet can be a ‘pickpocket’

praskrishna — 2016-12-05T01:44:29Z

If you have installed a wallet app on your smartphone, be careful. Many such apps can access data, even sensitive personal information, and have features that do more than just make payments. All that, with your due “permission”.

The article by Samarth Bansal was published in the Hindu on December 5, 2016. Pranesh Prakash was quoted.

When installing them, the apps display a list of permissions. The user is prompted to either grant permission to access to SMSs, call records and so on or decline, but the latter means rejecting the download. Barring a small fraction of tech-savvy users, most go with the flow, ignoring the permissions section.

The Hindu reviewed permissions sought by five wallet applications: MobiKwik, Freecharge, PayTM, Jio Money and Airtel Money.

Freecharge and Jio Money seek permission to “directly call phone numbers”. The app can call up numbers without notifying you. In fact, Freecharge asks to “read call log”. All five require permission to “read contacts”, which, as PayTM mentions, “gives you the ability to pick a number from contacts for a quick recharge or bill payment” or “helps you send and request money from friends”. FreeCharge and PayTM ask permission to “modify contacts” and “record audio”.

PayTM is the only one that requests to “read your web bookmarks and history”. According to AndroidPit, an Android-centred news portal, this permission is needed for alternative browsers, back-up tools and possibly some social networking apps. For the rest, it is possibly a way to “spy on user’s browsing behaviour”, the portal says.
Wealth of data

Pranesh Prakash, policy director at the Centre for Internet and Society, told The Hindu that access to a wealth of data about the user enables various other business models.

“A mobile wallet application, using location tracking data, can tell a user about the discounts available on a nearby store if the payment is conducted using that platform. If the user is not explicitly made aware of such usage of data, I would call it a misuse of information,” he said. Note that “precise” location tracking feature, via GPS or mobile network, is a feature requested by all.

For PayTM, there is a mismatch between the complete set of permissions it asks for — as stated in the app store — and the ones it mentions on a dedicated page on its website explaining “PayTM app permissions”. Apart from the six basic features, there is no mention about functions like location tracking or reading web history — which it requires — on the web page.

“In this regard, PhonePe [another wallet app] is the model to follow: it clearly states the permissions it is seeking and explains why it needs each one of those at the time of set-up.

For more details visit https://cis-india.org/internet-governance/news/hindu-samarth-bansal-december-5-2016-your-digital-wallet-can-be-a-pickpocket

Young Scholars' Programme, CPRSouth 2016

praskrishna — 2016-09-23T01:03:13Z

Rohini Lakshané took part in the Young Scholars' Programme organized by Communication Policy Research South from September 6 to 7, 2016 in Zanzibar.

CPRsouth 2016 Young Scholar Awards

Following highly successful joint Afro-Asian CPR conferences in Mauritius in 2012, and India in 2013, CPRafrica and CPRsouth formally merged under the banner of CPRsouth in 2014. Since then, CPRsouth has hosted conferences in the Cradle of Humankind in South Africa (2014), and at the Innovation Center for Big Data and Digital Convergence at Yuan Ze University, Taiwan (2015).

This year’s conference is co-hosted by COSTECH and TCRA in Zanzibar from 8-10 September. It will include sessions on cutting-edge developments in ICT policy and regulation in the South and discussion of the research-policy interface.

As part of the capacity building initiative, 30 Young Scholars from Africa and the Asia-Pacific region have been selected to participate in a tutorial programme. They will be taught by recognised scholars and practitioners from Africa and Asia, and will be attending the main conference thereafter. Congratulations to the Young Scholars of 2016. See the list here.

For more details visit https://cis-india.org/internet-governance/news/young-scholars-programme-cpr-south-2016