We are anonymous, we are legion

Big Data and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011

elonnai — 2015-08-11T07:01:12Z

Experts and regulators across jurisdictions are examining the impact of Big Data practices on traditional data protection standards and principles. This will be a useful and pertinent exercise for India to undertake as the government and the private and public sectors begin to incorporate and rely on the use of Big Data in decision making processes and organizational operations.This blog provides an initial evaluation of how Big Data could impact India's current data protection standards.

Experts and regulators across the globe are examining the impact of Big Data practices on traditional data protection standards and principles. This will be a useful and pertinent exercise for India to undertake as the government and the private and public sectors begin to incorporate and rely on the use of Big Data in decision making processes and organizational operations.

Below is an initial evaluation of how Big Data could impact India's current data protection standards.

India currently does not have comprehensive privacy legislation - but the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules 2011 formed under section 43A of the Information Technology Act 2000[1] define a data protection framework for the processing of digital data by Body Corporate. Big Data practices will impact a number of the provisions found in the Rules:

Scope of Rules: Currently the Rules apply to Body Corporate and digital data. As per the IT Act, Body Corporate is defined as "Any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities."

The present scope of the Rules excludes from its purview a number of actors that do or could have access to Big Data or use Big Data practices. The Rules would not apply to government bodies or individuals collecting and using Big Data. Yet, with technologies such as IoT and the rise of Smart Cities across India – a range of government, public, and private organizations and actors could have access to Big Data.

Definition of personal and sensitive personal data: Rule 2(i) defines personal information as "information that relates to a natural person which either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person."

Rule 3 defines sensitive personal information as:

Password,
Financial information,
Physical/physiological/mental health condition,
Sexual orientation,
Medical records and history,
Biometric information

The present definition of personal data hinges on the factor of identification (data that is capable of identifying a person). Yet this definition does not encompass information that is associated to an already identified individual - such as habits, location, or activity.

The definition of personal data also addresses only the identification of 'such person' and does not address data that is related to a particular person but that also reveals identifying information about another person - either directly - or when combined with other data points.

By listing specific categories of sensitive personal information, the Rules do not account for additional types of sensitive personal information that might be generated or correlated through the use of Big Data analytics.

Importantly, the definitions of sensitive personal information or personal information do not address how personal or sensitive personal information - when anonymized or aggregated – should be treated.

Consent: Rule 5(1) requires that Body Corporate must, prior to collection, obtain consent in writing through letter or fax or email from the provider of sensitive personal data regarding the use of that data.

In a context where services are delivered with little or no human interaction, data is collected through sensors, data is collected on a real time and regular basis, and data is used and re-used for multiple and differing purposes - it is not practical, and often not possible, for consent to be obtained through writing, letter, fax, or email for each instance of data collection and for each use.

Notice of Collection: Rule 5(3) requires Body Corporate to provide the individual with a notice during collection of information that details the fact that information is being collected, the purpose for which the information is being collected, the intended recipients of the information, the name and address of the agency that is collecting the information and the agency that will retain the information. Furthermore body corporate should not retain information for longer than is required to meet lawful purposes.

Though this provision acts as an important element of transparency, in the context of Big Data, communicating the purpose for which data is collected, the intended recipients of the information, the name and address of the agency that is collecting the information and the agency that will retain the information could prove to be difficult to communicate as they are likely to encompass numerous agencies and change depending upon the analysis being done.

Access and correction: Rule 5(6) provides individuals with the ability to access sensitive personal information held by the body corporate and correct any inaccurate information.

This provision would be difficult to implement effectively in the context of Big Data as vast amounts of data are being generated and collected on an ongoing and real time basis and often without the knowledge of the individual.

Purpose Limitation: Rule 5(5) requires that body corporate should use information only of the purpose which it has been collected.

In the context of Big Data this provision would overlook the re-use of data that is inherent in such practices.

Security: Rule 8 states that any Body Corporate or person on its behalf will be understood to have complied with reasonable security practices and procedures if they have implemented such practices and have in place codes that address managerial, technical, operational and physical security control measures. These codes could follow the IS/ISO/IEC 27001 standard or another government approved and audited standard.

This provision importantly requires that data controllers collecting and processing data have in place strong security practices. In the context of Big Data – the security of devices that might be generating or collecting data and algorithms processing and analysing data is critical. Once generated, it might be challenging to ensure the data is being transferred to or being analysed by organisations that comply with such security practices as listed.

Data Breach : Rule 8 requires that if a data breach occurs, Body Corporate would have to be able to demonstrate that they have implemented their documented information security codes.

Though this provision holds a company accountable for the implementation of security practices, it does not address how a company should be held accountable for a large scale data breach as in the context of Big Data the scope and impact of a data breach is on a much larger scale.

Opt in and out and ability to withdraw consent : Rule 5(7) requires Body Corporate or any person on its behalf, prior to the collection of information - including sensitive personal information - must give the individual the option of not providing information and must give the individual the option of withdrawing consent. Such withdrawal must be sent in writing to the body corporate.

The feasibility of such a provision in the context of Big Data is unclear, especially in light of the fact that Big Data practices draw upon large amounts of data, generated often in real time, and from a variety of sources.

Disclosure of Information: Rule 6 maintains that disclosure of sensitive personal data can only take place with permission from the provider of such information or as agreed to through a lawful contract.

This provision addresses disclosure and does not take into account the “sharing” of information that is enabled through networked devices, as well as the increasing practice of companies to share anonymized or aggregated data.

Privacy Policy : Rule 4 requires that body corporate have in place a privacy policy on their website that provides clear and accessible statements of its practices and policies, type of personal or sensitive personal information that is being collected, purpose of the collection, usage of the information, disclosure of the information, and the reasonable security practices and procedures that have been put in place to secure the information.

In the context of Big Data where data from a variety of sources is being collected, used, and re-used it is important for policies to 'follow data' and appear in a contextualized manner. The current requirement of having Body Corporate post a single overarching privacy policy on its website could prove to be inadequate.

Remedy : Section 43A of the Act holds that if a body corporate is negligent in implementing and maintain reasonable security practices and procedures which results in wrongful loss or wrongful gain to any person, the body corporate can be held liable to pay compensation to the affected person.

This provision will provide limited remedy for an affected individual in the context of Big Data. Though important to help prevent data breaches resulting from negligent data practices, implementation of reasonable security practices and procedures cannot be the only hinging point for determining liability of a Body Corporate for violations and many of the harms possible through Big Data are not in the form of wrongful loss or wrongful gain to another person. Indeed many harms possible through Big Data are non-economic in nature – including physical invasion of privacy, and discriminatory practices that can arise from decisions based on Big Data analytics. Nor does the provision address the potential for future damage that can result from a 'Big Data data breach'.

The safeguards noted in the above section are not the only legal provisions that speak to privacy in India. There are over fifty sectoral legislation that have provisions addressing privacy - for example provisions addressing confidentiality of health and banking information. The government of India is also in the process of drafting a privacy legislation. In 2012 the Report of the Group of Experts on Privacy provided recommendations for a privacy framework in India. The Report envisioned a framework of co-regulation - with sector level self regulatory organization developing privacy codes (that are not lower than the defined national privacy principles) and that are enforced by a privacy commissioner.[2] Perhaps this method would be optimal for the regulation of Big Data- allowing for the needed flexibility and specificity in standards and device development. Though the Report notes that individuals can seek remedy from the court and the Privacy Commissioner can issue fines for a violation, the development of privacy legislation in India has yet to clearly integrate the importance of due process and remedy. With the onset of Big Data - this will become more important than ever.

Conclusion

The use and generation of Big Data in India is growing. Plans such as free wifi zones in cities[3], city wide CCTV networks with facial recognition capabilities[4], and the implementation of an identity/authentication platform for public and private services[5], are indicators towards a move of data generation that is networked and centralized, and where the line between public and private is blurred through the vast amount of data that is collected.

In such developments and innovations what is privacy and what role does privacy play? Is it the archaic inhibitor - limiting the sharing and use of data for new and innovative purposes? Will it be defined purely by legislative norms or through device/platform design as well? Is it a notion that makes consumers think twice about using a product or service or is it a practice that enables consumer and citizen uptake and trust and allows for the growth and adoption of these services?

How privacy will be regulated and how it will be perceived is still evolving across jurisdictions, technologies, and cultures - but it is clear that privacy is not being and cannot be overlooked. Governments across the world are reforming and considering current and future privacy regulation targeted towards life in a quantified society. As the Indian government begins to roll out initiatives that create a "Digital India" indeed a "quantified India", taking privacy into consideration could facilitate the uptake, expansion, and success of these practices and services. As the Indian government pursues the opportunities possible through Big Data it will be useful to review existing privacy protections and deliberate on if, and in what form, future protections for privacy and other rights will be needed.

[1]Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules 2011). Available at: http://deity.gov.in/sites/upload_files/dit/files/GSR313E_10511(1).pdf

[2]Group of Experts on Privacy. (2012). Report of the Group of Experts on Privacy. New Delhi: Planning Commission, Government of India. Retrieved May 20, 2015, from http://planningcommission.nic.in/reports/genrep/rep_privacy.pdf

[3] NDTV. “Free Public Wi-Fi Facility in Delhi to Have Daily Data Limit. NDTV, May 25^th 2015, Available at: http://gadgets.ndtv.com/internet/news/free-public-wi-fi-facility-in-delhi-to-have-daily-data-limit-695857. Accessed: July 2^nd 2015.

[4]FindBiometrics Global Identity Management. “Surat Police Get NEC Facial Recognition CCTV System”. July 21^st 2015. Available at: http://findbiometrics.com/surat-police-nec-facial-recognition-27214/

[5]UIDAI Official Website. Available at: https://uidai.gov.in/

For more details visit https://cis-india.org/internet-governance/blog/big-data-and-information-technology-rules-2011

Net Neutrality: India is a Keybattle Ground

praskrishna — 2015-09-20T07:08:42Z

Hardnews talks to Sunil Abraham, the executive director of the Centre for Internet and Society (CIS), about the future of the Internet in India.

The article by Abeer Kapoor was published in Hardnews on August 10, 2015.

There are competing definitions of net neutrality. What do you think an Indian definition of net neutrality should be?
It should be driven by an empirical understanding of the harms and benefits for Indian consumers. Any regulation should be based on evidence of harm. Forbearance should be the first option for any regulator. The second option is mandating transparency. The third option, as (Managing Director of the World Dialogue on Regulation for Network Economies Programme) William Melody says, should be raising competition before we consider other more intrusive regulatory measures such as price regulation, mandatory registration and licensing, etc. Telling network administrators how to run their networks should be the very last option we consider. Ideally, the Competition Commission of India should have started an investigation into the competition harms emerging from network neutrality violations. There are other harms emerging from network neutrality violations, such as free speech harms, diversity harms, innovation harms and privacy harms. These residual elements should have been the focus of the TRAI (Telecom Regulatory Authority of India) consultation paper process, the DoT (Department of Telecommunications) panel process and the consultations of the parliamentary standing committee.

There are certain rights that are essential, like privacy. How do you think the right to privacy will play into the definition of Indian net neutrality?
Deep packet inspection – which is a method that is used to manage Internet traffic and walled garden access via mobile applications – causes significant privacy harms and gives rise to a range of security vulnerabilities. These cannot be directly addressed in network neutrality policy. On privacy and security, it is not clear that the Indian situation is different from the global trend, so it is unlikely that we will have an India-specific privacy language in our network neutrality policy.

Privacy harms caused by network neutrality violations have to be addressed by enacting the privacy bill into law. The Department of Personnel and Training (DoPT) has been working on this Bill for the last five or six years. The latest draft has implemented the recommendations of the Justice AP Shah Committee. The last leak of the privacy Bill revealed that the DoPT has included the nine principles identified by the Shah Committee Report on Privacy. We hope that the government will introduce this Bill at the earliest. Section 43A of the IT Act may also need to be amended to address all the nine privacy principles.

The report drafted by DoT on net neutrality is ambiguous and almost reluctant to take a stand. What are the key points of this report?
The DoT panel report does take a stand. It clearly identifies network neutrality as a policy goal. Unfortunately, the panel did not provide its own definition of network neutrality, but instead quoted a definition submitted by civil society activists who testified before it without explicitly adopting it. The panel report examines zero rating and legitimate traffic management in quite a bit of detail and does prescribe some regulatory decision trees to the policymakers. When it comes to specialised services and walled gardens there could have been more detailed and specific recommendations. The biggest disappointment in the report is the call for licensing of those OTT (Over the Top) service providers that provide equivalent services to those provided by telcos. While the need to address regulatory arbitrage from the perspective of privacy and surveillance law may be virtuous, it may not be technically feasible to do so, especially if there is end-to-end encryption. Also, regulatory arbitrage could be addressed by reducing regulations for telcos rather than increasing them for OTT providers.

Do you think licensing and regulation of OTT services such as Google and WhatsApp are a necessity?
It is a myth that they exist in a regulatory vacuum. Many regulations do apply to them and a few of them do comply with Indian authorities on issues like speech regulation, legal interception and also data access. With competition law and taxation there is very little compliance. The trouble is not that there are regulatory vacuums, but rather that these services operate from foreign jurisdictions. Without offices, servers and human resources within the Indian jurisdiction it is very difficult for the courts to implement their orders, and for law enforcement to ensure compliance with Indian laws. This jurisdictional challenge affects most developing countries and not just India, and can only be solved by harmonising procedural and substantive law across jurisdictions, through the spread of soft norms, development of self-regulatory mechanisms using the multi-stakeholder models and through the creation of international law through various multilateral and pluri-lateral bodies.

The report reduces the neutrality debate to ‘access.’ Do you think this approach is reductive?
Access is very important in the Indian context so I don’t see how that is reductive. Many observers believe that the next round in the war for network neutrality will happen in the global South. India is a key battleground – what happens here will have global impact and implications. Network neutrality policies need to consider free speech, privacy, competition, diversity and innovation goals of the markets they seek to regulate. If we are not being doctrinaire about network neutrality we could adopt what (Professor of Internet & Media Law at the University of Sussex) Chris Marsden calls forward-looking “positive net neutrality” wherein “higher QoS (Quality of Service) for higher prices should be offered on fair, reasonable and non-discriminatory [FRAND] terms to all comers”. FRAND, according to Prof. Marsden, is well understood by the telcos and ISPs (Internet Service Providers) as it is the basis of common carriage. This understanding of network neutrality allows for technical and business model innovation by ISPs and telcos without the associated harms. There are zero-rating services being launched by Mozilla, Jaana, Mavin and others that are attempting to do this. I do not believe that they violate network neutrality principles, unlike Airtel Zero or Internet.org.

While this report attempts to arrive at a middle ground between the TSPs and the OTTs, how is this going to reflect in the government’s ‘Digital India’ programme?
We know we have a policy solution when all stakeholders are equally unhappy. But we also need an elegant solution that is easy to implement. Scholars like (Associate Professor of Computer Science at Columbia University) Vishal Mishra have a theoretical solution based on the Shapley Value, that assumes a multi-sided market model, but this may not work in real life. Professor V. Sridhar of the International Institute of Information Technology, Bengaluru (IIITB) has a very elegant idea of setting a ceiling and floor for price and speed and also for insisting on a minimum QoS of the whole of the Internet. These ideas I have not heard in the American and European debate around network neutrality. I remain hopeful that the Indian middle ground will be qualitatively different, given that the structure and constraints of the Indian telecom sector are very different from that in developed countries. Ensuring network neutrality is essential to the success of Digital India. Unfortunately, the Digital India plans that we have heard so far don’t make this explicitly clear.

The Internet was never meant to be monetised. Do you think that private players are eating into a public good that is absolutely necessary for development?
I have never heard that statement before. The Internet, after its early history, has been completely built using private capital. The public Internet has always been monetised. Collectively, the individual entrepreneurs and enterprises that build and run the components of the Internet have created a common public good – which is the globally interconnected network. But the motivation for private capital behind maintaining and building their corner or component of this network has also been profit maximisation.

What has contributed to the growing need to regulate and administer the Internet?
Technical advancements and business model innovations have resulted in both benefits and harms and therefore there could be a rationale for regulation. But more regulation per se is not a virtue and does not serve the interest of citizens and consumers. Expanding the regulatory scope of government infinitely will only result in failure, given the limited capacity and resources of the State. Therefore, whenever the State enters a new area of regulation it should ideally stop regulating in another area. In other words, there is no clear case that the regulation of the Internet is needed to keep growing exponentially – as evolving technologies may require specific regulation – if the resultant harms cannot be addressed using existing law. In most cases, traditional law is sufficient to deal with crimes and offences online.

This story is from the print issue of Hardnews: August 2015

For more details visit https://cis-india.org/internet-governance/news/hardnewsmedia-august-10-2015-abeer-kapoor-net-neutrality-india-is-a-keybattle-ground

CIS submission to the UNGA WSIS+10 Review

jyoti — 2015-08-09T16:24:04Z

The Centre for Internet & Society (CIS) submitted its comments to the non-paper on the UNGA Overall Review of the Implementation of the WSIS outcomes, evaluating the progress made and challenges ahead.

To what extent has progress been made on the vision of the peoplecentred, inclusive and development oriented Information Society in the ten years since the WSIS?
The World Summit on the Information Society (WSIS) in 2003 and 2005 played an important role in encapsulating the potential of knowledge and information and communication technologies (ICT) to contribute to economic and social development. Over the past ten years, most countries have sought to foster the use of information and knowledge by creating enabling environment for innovation and through efforts to increase access. There have been interventions to develop ICT for development both at an international and national level through private sector investment, bilateral treaties and national strategies.

However, much of the progress made in the past ten years in terms of getting people connected and reaping the benefits of ICT has not been sufficiently peoplecentred, nor have they been sufficiently inclusive.

These developments have not been sufficiently peoplecentred, since governments across the world have been using the Internet as a monumental surveillance tool, invading people’s privacy without legitimate justifications, in an arbitrary manner without due care for reasonableness, proportionality, or democratic accountability. These developments have not been sufficiently peoplecentred, since the largest and most profitable Internet businesses — businesses that have more users than most nationstates have citizens, yet have one-sided terms of service — have eschewed core principles like open standards and interoperability that helped create the Internet and the World Wide Web, and instead promote silos.

We still reside in a world where development has been very lopsided, and ICTs have contributed to reducing some of these gulfs, while exacerbating others. For instance, persons with visual impairment are largely yet to reap the benefits of the Information Society due to a lack of attention paid to universal, while sighted persons have benefited far more; the ability of persons who don’t speak a language like English to contribute to global Internet governance discussions is severely limited; the spread of academic knowledge largely remains behind prohibitive paywalls.

As ICTs have grown both in sophistication and reach, much work remains to achieve the peoplecentred, inclusive and developmentoriented information society envisaged in WSIS. While the diffusion of ICTs has created new opportunities for development, even today less than half the world has access to broadband (with only eleven per cent of the world’s population having access to fixed broadband). See International Telecommunication Union, ICT Facts and Figures: The World in 2015.

Ninety per cent of people connected come from the industrialized countries — North America (thirty per cent), Europe (thirty per cent) and the AsiaPacific (thirty per cent). Four billion people from developing countries remain offline, representing two-thirds of the population residing in developing countries. Of the nine hundred and forty million people residing in Least Developed Countries (LDCs), only eighty-nine million use the Internet and only seven per cent of households have Internet access, compared with the world average of forty-six per cent. See International Telecommunication Union, ICT Facts and Figures: The World in 2015. This digital divide is first and foremost a question of access to basic infrastructure (like electricity).

Furthermore, there is a problem of affordability, all the more acute since in the South in comparison with countries of the North due to the high costs related to access to the connection. Further, linguistic, educational, cultural and content related barriers are also contributing to this digital divide. Growth of restrictive regimes around intellectual property, vision of the equal and connected society. Security of critical infrastructure with in light of ever growing vulnerabilities, the loss of trust following revelations around mass surveillance and a lack of consensus on how to tackle these concerns are proving to be a challenge to the vision of a connected information society. The WSIS+10 overall review is timely and a much needed intervention in assessing the progress made and planning for the challenges ahead.

There were two bodies as major outcomes of the WSIS process: the Internet Governance Forum and the Digital Solidarity Fund, with both of these largely failing to achieve their intended goals. The Internet Governance Forum, which is meant to be a leading example of “multi-stakeholder governance” is also a leading example of what the Multi-stakeholder Advisory Group (MAG) noted in 2010 as “‘black box’ approach”, with the entire process around the nomination and selection of the MAG being opaque. Indeed, when CIS requested the IGF Secretariat to share information on the nominators, we were told that this information will not be made private. Five years since the MAG lamented its own blackbox nature, things have scarcely improved. Further, analysis of MAG membership since 2006 shows that 26 persons have served for 6 years or more, with the majority of them being from government, industry, or the technical community. Unsurprisingly, 36 per cent of the MAG membership has come from the WEOG group, highlighting both deficiencies in the nomination/selection
process as well as the need for capacity building in this most important area. The Digital Solidarity Fund failed for a variety of reason, which we have analysed in a separate document annexed to this response.

What are the challenges to the implementation of WSIS outcomes?

Some of the key areas that need attention going forward and need to be addressed include:

Access to Infrastructure

Developing policies aimed at promoting innovation and increasing affordable access to hardware and software, and curbing the ill effects of the currentlyexcessive patent and copyright regimes.

Focussing global energies on solutions to lastmile access to the Internet in a manner that is not decoupled from developmental ground realities.
This would include policies on spectrum sharing, freeing up underutilized spectrum, and increasing unlicensed spectrum.
This would also include governmental policies on increasing competition among Internet providers at the last mile as well as at the backbone (both nationally and internationally), as well as commitments for investments in basic infrastructure such as an openaccess national fibreoptic backbone where the private sector investment is not sufficient.
Developing policies that encourage local Internet and communications infrastructure in the form of Internet exchange points, data centres, community broadcasting.

Access to Knowledges

As the Washington Declaration on IP and the Public Interest5 points out, the enclosure of the public domain and knowledge commons through expansive “intellectual property” laws and policies has only gotten worse with digital technologies, leading to an unjust allocation of information goods, and continuing royalty outflows from the global South to a handful of developing countries. This is not sustainable, and urgent action is needed to achieve more democratic IP laws, and prevent developments such as extra judicial enforcement mechanisms such as digital restrictions management systems from being incorporated within Web standards.
Aggressive development of policies and adoption of best practices to ensure that persons with disabilities are not treated as secondgrade citizens, but are able to fully and equally participate in and benefit from the Information Society.
Despite the rise of video content on the Internet, much of that has been in parts of the world with already high literacy, and language and illiteracy continue to pose barriers to full usage of the Internet.
While the Tunis Agenda highlighted the need to address communities marginalized in Information Society discourse, including youth, older persons, women, indigenous peoples, people with disabilities, and remote and rural communities, but not much progress has been seen on this front.

Rights, Trust, and Governance

Ensuring effective and sustainable participation especially from developing countries and marginalised communities. Developing governance mechanisms that are accountable, transparent and provide checks against both unaccountable commercial interests as well as governments.
Building citizen trust through legitimate, accountable and transparent governance mechanisms.
Ensuring cooperation between states as security is influenced by global foreign policy, and is of principal importance to citizens and consumers, and an enabler of other rights.
As the Manila Principles on Intermediary Liability show, uninformed intermediary liability policies, blunt and heavy handed regulatory measures, failing to meet the principles of necessity and proportionality, and a lack of consistency across these policies has resulted in censorship and other human rights abuses by governments and private parties, limiting individuals’ rights to free expression and creating an environment of uncertainty that also impedes innovation online. In developing, adopting, and reviewing legislation, policies and practices that govern the liability of intermediaries, interoperable and harmonized regimes that can promote innovation while respecting users’ rights in line with the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights and the United Nations Guiding Principles on Business and Human Rights are needed and should be encouraged.
An important challenge before the Information Society is that of the rise of “quantified society”, where enormous amounts of data are generated constantly, leading to great possibilities and grave concerns regarding privacy and data protection.
Reducing tensions arising from the differences between cultural and digital nationalism including on issues such as data sovereignty, data localisation, unfair trade and the need to have open markets.
Currently, there is a lack of internationally recognized venues accessible to all stakeholders for not only discussing but also acting upon many of these issues.

What should be the priorities in seeking to achieve WSIS outcomes and progress towards the Information Society, taking into account emerging trends?
All the challenges mentioned above should be a priority in achieving WSIS outcomes and ensuring innovation to lead social and economic progress in society. Digital literacy, multilingualism and addressing privacy and user data related issues need urgent attention in the global agenda. Enabling increased citizen participation thus accounting for the diverse voices that make the Internet a unique medium should also be treated as priority. Renewing the IGF mandate and giving it teeth by adopting indicators for development and progress, periodic review and working towards tangible outcomes would be beneficial to achieving the goal of a connected information society.

What are general expectations from the WSIS + 10 High Level Meeting of the United Nations General Assembly?
We would expect the WSIS+10 High Level Meeting to endorse an outcome document that seeks to d evelop a comprehensive policy framework addressing the challenges highlighted above . It would also be beneficial, if the outcome document could identify further steps to assess development made so far, and actions for overcoming the identified challenges. Importantly, this should not only be aimed at governments, but at all stakeholders. This would be useful as a future road map for regulation and would also allow us to understand the impact of Internet on society.

What shape should the outcome document take?
The outcome document should be a resolution of the UN General Assembly, with high level policy statements and adopted agreements to work towards identified indicators. It should stress the urgency of reforms needed for ICT governance that is democratic, respectful of human rights and social justice and promotes participatory policymaking. The language should promote the use of technologies and institutional architectures of governance that ensure users’ rights over data and information and recognize the need to restrict abusive use of technologies including those used for mass surveillance. Further, the outcome document should underscore the relevance of the Universal Declaration of Human Rights, including civil, political, social, economic, and cultural rights, in the Information Society.

The outcome document should also acknowledge that certain issues such as security, ensuring transnational rights, taxation, and other such cross jurisdictional issues may need greater international cooperation and should include concrete steps on how to proceed on these issues. The outcome document should acknowledge the limited progress made through outcome-less multi-stakeholder governance processes such as the Internet Governance Forum, which favour status quoism, and seek to enable the IGF to be more bold in achieving its original goals, which are still relevant. It should be frank in its acknowledgement of the lack of consensus on issues such as “enhanced cooperation” and the “respective roles” of stakeholders in multi-stakeholder processes, as brushing these difficulties under the carpet won’t help in magically building consensus. Further, the outcome document should recognize that there are varied approaches to multi-stakeholder governance.

For more details visit https://cis-india.org/internet-governance/blog/cis-submission-to-unga-wsis-review

India partially lifts Porn Ban?

praskrishna — 2015-09-20T06:30:34Z

India is said to have partially removed the porn ban. But many internet service providers have refused to restore access, due to a 'vague' government order.

The blog post by Nazhat Khan was published in DESI blitz on August 7, 2015.

India has partially lifted the ban of online pornography, just days after blocking user access to 857 adult websites.

The Indian government enforced the ban on July 30, 2015, only to reverse its decision on August 4, 2015. Ravi Shankar Prasad, the Communications and IT Minister, clarifies the ban only targets websites promoting child pornography.

He says: “A new notification will be issued shortly. The ban will be partially withdrawn. Sites that do not promote child porn will be unbanned.” Under the new order, internet service providers (ISPs) in India are allowed to unblock these 857 websites – except for those that contain child pornography.

This has caused another outrage. ISPs complain it is not within their capability and responsibility to do so. Internet Service Providers Association of India (ISPAI) explains: “ISPs have no way or mechanism to filter out child pornography from URLs, and the further unlimited sub-links.

“Hence, we request your good self to advise us immediately on the future course of action in this regard.

“Till your further directive, the ISPs are keeping the said 857 URLs disabled.”

An executive at an Indian ISP tells the Wall Street Journal: “How can we go ahead? What if something comes up tomorrow [on one of these sites], which has child porn, or something else?”

Pranesh Prakash, policy director at the Centre for Internet and Society, points out it is not right for the government to pass the ball over to private companies.

He says: “The onus cannot be put on the service providers. What the government is doing is inherently unfair, it is not what the law requires.” In effect, porn sites in India are still blocked. The Supreme Court and senior officials are yet to provide clearer directives for ISPs.

For more details visit https://cis-india.org/internet-governance/news/desi-blitz-august-7-2015-nazhat-khan-india-partially-lifts-porn-ban

Genetic Profiling: Is it all in the DNA?

praskrishna — 2015-09-13T09:47:17Z

A Bill seeks to make genetic profiling mandatory for the fight against crime—and generates a debate about the clash of ethics, freedom, science and data.

The article by Ullekh NP was published in Open Magazine on August 7, 2015. Sunil Abraham gave his inputs.

When British geneticist Sir Alec Jeffreys first developed the DNA profiling test 31 years ago in his laboratory at Leicester University, he didn’t help the police prove a man guilty. His test—back then it took weeks to complete DNA profiling procedures as opposed to a few hours now—proved that a rape suspect in police custody was innocent. Details from the whole exercise also subsequently helped the local police nab the real criminal, who had killed his teenaged rape victim. Later, the police found that he was the one who had committed a similar crime three years earlier in a village nearby. Britain was destined to make great gains in solving crimes thanks to DNA identification, while the rest of the developed world, including the US, caught up later, but only after lagging initially thanks to the relentless—and sometimes ill-founded—opposition from civil liberties activists. In India, the Human DNA Profiling Bill, 2015, a proposed law that envisages collecting DNA finger prints—which are unique to an individual—especially of criminals, has been in the making for the past 12 years. The draft bill, which will shortly be placed before the Union Cabinet for its nod, has been prepared by the Department of Biotechnology and the Centre for DNA Fingerprinting & Diagnostics (CDFD), a Hyderabad-based Central Government-run agency, after examining and reviewing submissions by a panel of experts, holding consultations with various stakeholders and getting responses from the public. Notwithstanding the claims of safeguards against any misuse of the intended DNA data base, activists, lawyers, internet freedom fighters, civil liberty activists and columnists have been up in arms against the Government, arguing that the DNA profiling bill is ill- conceived and naïve—to the extent that it would destroy an individual’s right to privacy as it lacks provisions to check data tampering.

The international experience has proved otherwise. Ever since Sir Jeffreys extracted DNA from human muscle tissue, identified and processed genetic markers (which are unique to individuals except in the case of identical twins) from what was until then considered ‘seemingly purposeless segments of the human DNA’ in the words of writers Peter Reinharz and Howard Safir, more than 500,000 ‘otherwise unsolvable’ cases have been solved in the developed world thanks to the DNA identification, note CDFD scientists. DNA is the hereditary material in the human body. It is found in blood, saliva, urine, strands of hair, semen, tears, skin, etcetera.

Dr Madhusudan Reddy Nandineni, staff scientist and group leader, laboratory of DNA fingerprinting services and laboratory of genomics and profiling applications, CDFD, is worried that opposition to the Bill is gaining momentum in India due to a raft of reasons. Of course, the West, too, has witnessed sharp protests against DNA profiling laws. One of the key reasons anti-profiling activists have an edge, says a senior Home Ministry official who asks not to be named, is that there is a “general public anxiety” over “anything to do with disclosing personal details”. He agrees that the tests are going to be intrusive, because muscle tissue may have to be collected from private parts. The procedure of DNA sample collection—as explained in the draft Bill submitted in January by a committee headed by TS Rao, senior adviser to the department of biotechnology—talks about obtaining intimate body samples of living persons (on page 6-7 of the 48- page document) from ‘the genital or anal area, the buttocks and also breasts in the case of a female’. According to the draft Bill, it also involves external examination of private parts, taking samples from pubic hair or by swabs or washing or by vacuum suction, by scraping or by lifting by tape and taking of a photograph or video recording of, or an impression or cast of a wound in those areas. “But then, it is par for the course,” says the Home Ministry official by way of justification.

American military historian and author Edward Luttwak agrees that DNA profiling is a significant intrusion into the “very body of a citizen”. That is the price one has to pay in the choice between liberty and equality before investigation, he posits. Luttwak is glad that in the US, as well as in other countries that have such profiling laws, DNA identification has yielded results. “It protects suspicious/ low status but innocent people from false accusations and helps to catch clever/high-status law-breakers,” he says.

+++

For his part, Dr Nandineni says that every aspect of the Human DNA Profiling Bill for India is based on similar legislation that has already been implemented in the US, Canada, UK, Australia and Continental Europe for more than 20 years. He also contends that the benefits that have accrued there are enormous, which India has missed out on for all these years. “In all these countries, the concerns of the general public on privacy matters have been allayed in their legislation,” he adds. He points out that the retention of DNA profiles in a ‘DNA Data Bank’ is meant to apprehend repeat offenders and thus serve a larger societal good. As regards privacy concerns, Dr Nandineni says that consultations on the preparations of the Bill lasted for 2-3 years and took into account the views of an expert committee whose members included representatives of NGOs.

Dr Nandineni is of the view that the opponents of the Bill have managed to get an upper hand in a national debate thanks to their media-savvy backgrounds. Agrees the Home Ministry official: “Perhaps the drafters of the Bill have not been communicative enough in getting their points across to the public and the media. Which might explain why the Bill has come under tremendous attack in the media. Even otherwise, global trends also show that civil liberty rights activists have had great initial advantage in their campaign against DNA profiling.” After all, the potential for misuse of DNA samples is not restricted to biological material collected under the provisions of the DNA Bill alone, Nandineni offers. “Any and every blood sample collected by a clinical laboratory has the same potential for misuse,” he says.

While Dr J Gowrishankar, director, CDFD, has been vocal about the positives of the Bill, its opponents have been louder. Many of those who oppose the Bill say the question is not one of being loud or feeble, but about being naïve or not.

The likes of Sunil Abraham, executive director of Bangalore-based internet research organisation Centre for Internet and Society (CIS), have no argument against DNA profiling being the gold standard for all forensic investigations. “There is nothing wrong with using DNA evidence for forensic purposes,” says Abraham, “However, the draft Bill is filled with techno-utopianism; it assumes that the people and machines that leverage DNA technologies are infallible.” He goes on, “This is not true. It is easier to tamper with DNA evidence than it is to tamper with a video recording. Therefore, all we are asking for are process checks that prevent compromised persons and machines from using DNA evidence to convict or exonerate the wrong person.” His contention is that if the DNA sample is sent to two different labs and both labs come back with exactly the same result, then the courts can be convinced of the veracity of the result. “Also the Bill says that DNA labs will give courts ‘yes’ or ‘no’ answers to questions related to DNA matching. But ideally, the lab must give the exact match percentage along with all the detailed information that emerges from the match process so that the court can fully appreciate the significance of the DNA evidence,” he suggests.

Abraham and legal scholar Usha Ramanathan—both members of the expert panel who filed notes of dissent and disagreed with various aspects of the Bill—have a problem with the claim that the proposed DNA data bank will cover only criminals and not the general public. Points out Ramanathan: “The Bill does not restrict the data base to criminals alone, not by a long shot. The provision in the proposed Bill reads: ‘(Clause 31(4)) Every DNA Data Bank shall maintain following indices for various categories of data, namely: (a) a crime scene index; (b) a suspects’ index; (c) an offenders’ index; (d) a missing persons’ index; (e) unknown deceased persons’ index; (f) a volunteers’ index; and (g) such other DNA indices as may be specified by regulations.’ That is an elaborate set of indices. There is certainly a lot of the ‘general public’ in it.”

Supporters of the DNA Profiling Bill have maintained that a DNA data bank is not for the public but only for a limited category of individuals. The proposed law also provides for storing profiles with the consent of relatives of missing children and grownups so that relationship identities can be established.

Ramanathan is also worried that apart from purposes of criminal justice, DNA profiling may be extended to parental disputes (maternity or paternity), issues related to pedigree, those related to assisted reproductive technologies (surrogacy, in vitro fertilisation or IVF, intrauterine implantation or IUI, and so on), to transplantation of human organs (donor and recipient) under the Transplantation of Human Organs Act, 1994, and also related to immigration or emigration. She had objected to the requirement of revealing a person’s caste in the application form for offering blood samples. “This Bill is certainly not a convict data base. The ambitions are much much vaster, and little to do with crime control,” she alleges.

Abraham agrees that some safeguards have been built in the proposed law to prevent any misuse of DNA data under pressure from expert panel members such as him. However, he says, cyber security and privacy-related issues are not addressed in a comprehensive manner. “The Bill basically hopes that the Privacy Bill will address all of this when it becomes law. But unfortunately, a bill could take 7-10 years before it becomes law,” he says.

Dr Gowrishankar of CDFD and others have conceded that it was the decision of the expert panel to include an enabling provision for the privacy issues of DNA profiling to comply with the proposed Privacy Bill.

Abraham says that various measures to prevent ‘privacy harms’ to volunteers are missing in the latest draft of the Bill. “Given that biometric technology works on probabilistic matching, the larger the size of the database, the larger the incidence of mistaken identification. Therefore it is important that the database remain as small as necessary,” he asserts.

+++

The estimated cost of the Bill is Rs 20 crore—to create the infrastructure for the DNA Profiling Board and the data bank, which includes buildings, furniture, computer servers and so on. Among other things, the DNA Profiling Board is tasked with the responsibility of laying down and implementing standards for laboratories and proper protocols for ‘Data Bank’ operations.

CDFD scientists and government officials are keen to highlight the ‘under- hyped’ benefits of DNA profiling –similar to the Innocence Project in the US, which was aimed at securing the release of people who were erroneously convicted on the basis of other lines of evidence. Abraham has no patience for such comparisons. “DNA profiling for forensic purposes is very advanced and sophisticated, but technologies do not exist in a vacuum,” he says, “These advanced technologies have to work within traditional institutions with vulnerabilities and flaws. We need to, therefore, have non-technological procedural fixes that ensure that these technologies are not compromised by money and power. The choice is between the right to privacy and the rights and requirements of the criminal justice process.”

Ramanathan agrees with that view. “In the Indian context, the state of investigation is so poor that we have been looking for ways of circumventing our problems, not addressing them. That is how narco-analysis began to be used, till the court struck it down. DNA may be more reliable than most other scientific tools available to us today, but it is not all about the science. We also have to worry about contamination, what happens in the chain of custody, its potential for being planted or otherwise abused, and the errors even in the laboratory. You may remember the avowed mix-up of results in the Aarushi [Talwar murder] case, something the lab said they noticed over two years after they had given it to the investigators. The danger of treating DNA as conclusive and not needing corroboration is exacerbated in this kind of a vulnerable system. Which is why bringing this into a DNA data base law and not putting any checks on criminal procedure is less than wise,” she elaborates. She is least impressed with the ‘idea’ of ‘pedigree’ and of ‘population genetics’ in the Bill. “Institutions like the CDFD have been collecting DNA from suspects and asking for the caste of the person on the form. How does this seem innocent and safeguarded?” she asks.

Meanwhile, columnist and author Salil Tripathi says that it is sheer hubris to think that technology will provide all the answers to crime-fighting. “Tech- nology is enormously useful and powerful, but it is value-neutral; it can be used for good or bad ends… There have to be sufficient safeguards, overseen not only by technologists, law enforcement officers and bureaucrats, but also by lawyers and civil liberties experts, who can point out potential flaws and misuse and prevent those.”

Tripathi, too, is piqued that one of the markers sought is of caste. “Why?” he asks, emphatic that the country’s people should be concerned about allowing the state so much power over their lives. “And it may not be only the state; given that the scope of its future expansion is undefined, what guarantees are there that private actors won’t have access to the data, and if so, what security protocols would apply?”

Dr Gowrishankar and Dr Nandineni are right in saying that without DNA fingerprinting, many international criminals would still be at liberty, and the opponents of the Bill do not disagree with the efficacy of the technique developed by Sir Jeffreys. Instead, they are placing the spotlight on various objectionable aspects in the proposed law. In a country which first needs—according to former RAW chief Vikram Sood—to ensure access to Photofit (a technique to create an accurate image of a person that gels with a witness’ description) for its ground-level police operatives to combat crime, critics of the Bill seem to have won the war of words.

For more details visit https://cis-india.org/internet-governance/news/open-magazine-august-7-2015-ullekh-np-genetic-profiling

Ban on pornography temporary, says government

pranesh — 2015-09-13T08:46:24Z

The government has taken a dramatic U-turn from its stated position on internet pornography.

The article was published in Business Standard on August 4, 2015. Pranesh Prakash has been quoted.

A year after conveying to the Supreme Court that a blanket ban on internet pornography was not possible, through the department of electronics and information technology, it has asked internet providers to disable 857 websites that carry adult content. A senior official from the department of telecommunications (DoT) said the ban was a temporary measure, till the final order is announced by the apex court on August 10.

The government is looking at setting up an ombudsman to oversee cyber content, which will have representatives from NGOs, child activists and the government. The DoT official said, “There has to be some kind of regulatory oversight away from the government intervention… An ombudsman might be set up for overseeing cyber related content issues.”

The genesis of the current notification lies in the public interest litigation (PIL) filed by advocate Vijay Panjwani in April 2013. The PIL has sought curbs on these websites on the internet, especially the ones showing child pornography. The senior DoT official conveyed that the blocking of 857 websites was in compliance with the SC directive asking for measures to block porn sites, particularly those dealing with child pornography.

The July 31 notification from DoT has advised internet service licensees to disable content on 857 websites, as the content "hosted on these websites relates to morality and decency as given in Article 19(2) of the Constitution of India". The government had stated last year that it was not technologically feasible to monitor such contents as it would require physical intervention, which would impact data speeds.

In December 2014, the government had approached telecom providers and internet service providers to help identify such sites, but the service providers did not cooperate. Consequently, the government has gone ahead and identified 857 websites. However, the government has not given any detail as what was the criterion to identify such websites.

Pranesh Prakash, policy director at the Centre for Internet and Society, says DoT has used the provision of 79 (3) (b) of the IT Act, which is a convoluted Section that the intermediatory (ISPs) may lose protection from liability. This section is very convulated, the provisions for website blocking does not allow blocking porn. In section 69 (a), the entire procedure is that it allows an opportunity for the blocked website to be heard. “I can't comment on the reasons that the government for doing this. I know the order says the ban relates to morality, decency," adds Prakash.

Last year, the government took a position that said blocking these websites was not feasible, given that these sites are hosted outside India. In case of any ban, these sites can be relocated within hours to bypass it. Pavan Duggal, an advocate who specialises in cyber laws, has called the disablement 'cosmetic,' as it will not have the requisite deterrent effect. Duggal says: "This is a lost battle from the word go, as it is impossible to disable access permanently."

Watching such content in India is currently not an offence and, thus, the government is invoking “morality and decency” while seeking a curb on a fundamental right — Freedom of Speech & Expression. Under Article 19 (2) of the Constitution, the state can curb a fundamental right in order to maintain public order, decency or morality.

TO BAN OR NOT TO BAN

2013

Advocate Vijay Panjwani & Kamlesh Vaswani file PIL seeking curbs on internet pornography

Aug 2014

Supreme Court bench under Chief Justice R M Lodha agreed with the PIL and sought strict laws to curb online content

8 Jul 2015

Chief Justice of India H L Dattu upholds personal liberty and refuses to pass an interim order. Asks government to take a stand on the issue
CJI, heading a three-judge Bench, asks government to a detailed affidavit within four weeks

Jul 31

DoT sends notification seeking ban on 857 websites
Currently, there are no laws banning internet pornography in India, other than those related to children
Government’s stated position has been that it is difficult to curb online content

For more details visit https://cis-india.org/internet-governance/news/business-standard-august-4-2015-ban-on-pornography-temporary-says-government

Indian Porn Ban is Partially Lifted But Sites Remain Blocked

pranesh — 2015-09-13T09:00:03Z

The Indian government made a quick about-face on its order to block hundreds of pornography websites on Tuesday, partially lifting the ban after political backlash against the moral policing.

The article was published in Wall Street Journal on August 5, 2015. Pranesh Prakash gave his inputs.

But the websites remained blocked because Internet service providers were afraid of legal trouble.

The new order from the Department of Telecommunications said that Internet service providers could unblock any of the 857 websites, so long as they don’t contain child pornography. However, the websites remain blocked because service providers say they have no way of knowing whether they contain child porn, and no control over whether they will in the future.

Ravi Shankar Prasad, the IT minister, said Tuesday night that the government would trim down the list of banned sites, to focus only on those that contain child porn.

“A new notification will be issued shortly. The ban will be partially withdrawn. Sites that do not promote child porn will be unbanned,” said Mr. Prasad on the TV news channel India Today.

The wording of the new order created confusion, because it appears to put the responsibility for policing the Internet for child pornography on service providers.

“How can we go ahead? What if something comes up tomorrow [on one of these sites], which has child porn, or something else?,” said an executive at an Indian service provider who asked not to be named.

“The onus cannot be put on the service providers. What the government is doing is inherently unfair, it is not what the law requires,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bangalore-based civil liberties advocacy group. It is the government’s job to determine what violates the law, not private companies, Mr. Prakash said.

For more details visit https://cis-india.org/internet-governance/news/the-wall-street-journal-august-5-2015-sean-mclain-indian-porn-ban-is-partially-lifted-but-sites-remain-blocked

Porn block in India sparks outrage

pranesh — 2015-08-05T02:10:46Z

India’s government has triggered a storm of protest after blocking 857 alleged pornography websites, with privacy and internet freedom campaigners, as well as consumers, condemning the move as arbitrary and unlawful.

The article by Amanda Hodge was published in the Australian on August 5, 2015. Pranesh Prakash gave his inputs.

The order, enforced since Sunday by the country’s main internet service providers, comes amid debate about the influence of pornography on sex crime in India, and as the Supreme Court considers a petition by lawyer Kamlesh Vaswani to ban pornographic websites that harm children.

The government has been forced to defend the move, saying it was taken in response to Supreme Court criticism at inaction against child pornography websites, although the Supreme Court itself has refused to impose any interim ban while it considers the petition. The websites — a fraction of the world’s millions of internet pornography sites — will remain blocked until the government figures out how to restrict access, a spokesman said.

Critics have slammed the measure as unconstitutional and pointed out the list includes adult humour sites that contain no pornographic content. Others have suggested it is another intrusion into the private lives of ordinary Indians by an administration intent on pushing a puritanical Hindu agenda, citing the recent ban on beef in several states and an alleged “Hindu-isation” of school textbooks.

That prompted outrage from Telecom Minister Ravi Shankar Prasad. “I reject with contempt the charge that it is a Talibani government. Our government supports free media, respects communication on social media and has respected freedom of communication always,” he said.

While India has no law preventing citizens accessing internet pornography, regulations do restrict the publishing of “obscene information in electronic form”. Centre for Internet and Society policy director Pranesh Prakash told The Australian yesterday that some elements of that act were welcome — such as prohibition of child pornography and the uploading of a person’s private parts without consent — but “the provisions relating to ‘sexually explicit materials’ are far too broad, with no exceptions made for art, architecture, education or literature”.

Mr Prakash said the pornography ban amounted to an “abdication of the government’s duty”, given the list of sites blocked was provided on request to the government by one of the Vaswani petitioners. “The additional solicitor-general essentially asked one of the petitioners to provide a list of websites, which she passed on to the Department of Information Technology, which in turn passed to Department of Telecommunications asking for them to be blocked or disabled.

“That is not acceptable in a democracy where it is not the government which has actually found any of these websites to be unlawful.” Mr Prakash also criticised the secrecy surrounding the order, which he said contravened Indian law requiring a public declaration of any intended ban so that it might be challenged. The bans were made under “Rule 12” of India’s IT Act, which empowers the government to force ISPs to block sites when it is “necessary or expedient”.

For more details visit https://cis-india.org/internet-governance/news/the-australian-news-august-5-2015-amanda-hodge-porn-block-in-india-sparks-outrage

Porn ban: People will soon learn to circumvent ISPs and govt orders, expert says

pranesh — 2015-08-05T01:47:52Z

The article by Karthikeyan Hemalatha was published in the Times of India on August 2. Pranesh Prakash gave inputs.

The government used other sections of the Act to circumvent this provision. Sources in the Department of Telecommunication, which comes under the ministry of communications and information technology, said a notification had been issued under Section 79 (b) of IT Act under which internet service providers could be penalized for not following government orders. "Though the section protects an internet service provider (ISP) from legal action for the content it may allow, it can be penalized for not following government orders to ban them," said Prakash.

Last month, the Supreme Court declined to pass an interim order to block websites which have pornographic content. "Such interim orders cannot be passed by this court. Somebody may come to the court and say 'look I am above 18 and how can you stop me from watching it within the four walls of my room?' It is a violation of Article 21 [right to personal liberty]," said Chief Justice H L Dattu.

The judge was reacting to a public interest litigation filed by advocate Kamlesh Vashwani who was seeking to block porn websites in the country. "The issue is definitely serious and some steps need to be taken. The Centre is expected to take a stand. Let us see what stand the Centre will take," the Chief Justice said and directed the Centre to reply within four weeks. Over the weekend, the stance became clear.

Sources also say that Section 19 (2) of the Constitution was used for the ban. The section allows the government to impose "reasonable restrictions in the interest of sovereignty and integrity of India, security of the state, decency or morality or in relation to contempt of court."

For netizens, the government could actually be providing crash courses on proxy sites. "This is the best way to teach people on how to circumvent ISPs and government orders," said Prakash, adding that real abusive porn sites might still be available.

"There is no dynamic mechanism to block all sites with pornographic content. The government has to individually pick URLs (uniform resource locator) to ban websites. Right now, only popular websites have been banned and the little known abusive sites like those that propagate revenge porn or child porn," said Prakash. "No ban can be comprehensive," he added.

For more details visit https://cis-india.org/internet-governance/news/the-times-of-india-august-2-2015-karthikeyan-hemalatha-porn-ban

Nanny state rules porn bad for you

praskrishna — 2015-08-05T01:39:28Z

The article by Anahita Mukherji was published in the Times of India on August 4, 2015. Pranesh Prakash gave his inputs.

Half a century ago, India banned the DH Lawrence classic, Lady Chatterley's Lover. The ban, though lambasted for its Victorian view of modesty and obscenity, was fair and square; the matter was debated in the Supreme Court, which upheld the ban. Over 50 years later, a diverse spectrum of civil society has slammed a much more insidious and far less transparent ban on internet pornography.

For starters, the 857 sites that vanished from India's internet sphere haven't been officially banned, they just don't show up when you type the url. The order blocking them isn't public. For a list of the 857 sites, one must rely on leaked documents put out on Twitter by Pranesh Prakash, policy director, Centre for Internet and Society. "The ban on Lady Chatterley's Lover was public. As for the blocked websites, the government has gone out of its way to hide the list of sites pulled down. A secret order banning material violates all principles of transparency in a democracy," says Prakash.

The document, with 'Restricted' written on it, is a letter from the department of telecom asking ISPs to disable 857 sites as they bear content related to "morality" and "decency," violating Article 19 (2).

Strangely, the order's been issued under Sec 79 (3)(b) of the IT Act dealing with intermediaries having to remove material used to commit unlawful acts. "Watching porn isn't illegal in India. Disseminating 'obscene' content can be illegal, but for that, the government must file a case against the sites, and they must be allowed a representation," says Prakash.

"Sec 79 (3)(b) of the IT act isn't the section under which governments can block sites. It should use Sec 69 that has a review process," says Nikhil Pahwa, a champion of internet freedom.

The government drew up its list of 857 sites even as SC is in the process of hearing a petition to ban porn and is yet to pass an order. It includes playboy.com that, says Prakash, is a legitimate adult site. Pahwa points to the ban's "bizarrely moralistic undertones".

"As society evolves, government and regulatory regime are stuck in medieval ages," he says, adding a ban on websites will be rendered ineffective, pushing users to VPNs, a black hole for government monitoring mechanisms.

"A government that hasn't succeeded with Make in India is trying to prevent Make out in India," says venture capitalist Mahesh Murthy, who earlier backed net neutrality.

"The government is blocking websites to keep Rightwing lunatic fringes happy after its unsuccessful bid to pass the land bill," says Murthy.

"It isn't merely looking at blocking porn, but is trying to bring back Sec 66A (IT Act), ruled unconstitutional by the SC," he adds. "It's part of the bid to restrict individual freedom, create an artificial separation between Indian culture and anything erotic, driven by a diktat from Hindutva forces. It's ironic as Modi came to power as someone looking to activate individual agency. Now he's wary about where that leads to," says Subir Sinha, professor at the School of Oriental and African Studies (London). Murthy and Sinha believe the issue stems from a refusal to accept Indian culture in totality. "Victorian morality is considered Hindu, Khajuraho isn't," says Murthy.

"The government seems to be acting in a more high-handed manner than previous ones. The press and public opinion should wake up to this," says sociologist Andre Beteille.

For more details visit https://cis-india.org/internet-governance/news/the-times-of-india-august-4-2015-anahita-mukherji-nanny-state-rules-porn-bad-for-you

India blocks access to 857 porn sites

pranesh — 2015-08-05T01:31:32Z

India has blocked free access to 857 porn sites in what it says is a move to prevent children from accessing them.

The story was published by BBC on August 3, 2015. Pranesh Prakash gave his inputs.

Adults will still be able to access the sites using virtual private networks (VPNs) or proxy servers. In July, the Supreme Court expressed its unhappiness over the government's inability to block sites, especially those featuring child pornography.

Telecom companies have said they will not be able to enforce the "ban" immediately.

"We have to block each site one by one and it will take a few days for all service providers to block all the sites," an unnamed telecom company executive told The Times of India newspaper.

A senior official, who preferred to remained unnamed, told the BBC Hindi that India's department of telecommunications had "advised" telecom operators and Internet service providers to "control free and open access" to 857 porn sites.

"There is no total ban. This was done in the backdrop of Supreme Court's observation on children having free access to porn sites. The idea is also to protect India's cultural fabric. This will not prevent adults from visiting porn sites," the official said.

In July, the top court had observed that it was not for the court to order a ban on porn sites.

"It is an issue for the government to deal with. Can we pass an interim order directing blocking of all adult websites? And let us keep in mind the possible contention of a person who could ask what crime have I committed by browsing adult websites in private within the four walls of my house. Could he not argue about his right to freedom to do something within the four walls of his house without violating any law?," the court said.

According to statistics released by adult site Pornhub, India was its fourth largest source of traffic in 2014, behind the US, UK and Canada. Pranesh Prakash of the Bangalore based Centre for Internet and Society said the directive to block the 857 sites was "the largest single order of its kind" in India.

"The government's reasoning that it is not a ban because adults can still access the porn sites is ridiculous," he told the BBC. The move has caused a great deal of comment on Indian social media networks, with many prominent personalities coming forward to condemn it.

Popular author Chetan Bhagat, writer and commentator Nilanjana Roy, politician Milind Deora and director Ram Gopal Varma have all added their voices to the debate.

For more details visit https://cis-india.org/internet-governance/news/bbc-news-august-3-2015-india-blocks-access-to-857-porn-sites

India launches crackdown on online porn

pranesh — 2015-08-05T01:21:12Z

India has launched a crackdown on internet pornography, banning access to more than 800 adult websites, including Playboy and Pornhub.

The article by James Crabtree published in Financial Times on August 3, 2015 quotes Pranesh Prakash.

The restrictions followed a ruling from India’s telecoms ministry ordering internet service providers, including international telecoms groups operating in the country such as the UK’s Vodafone, to block 857 such sites.

Prime Minister Narendra Modi’s government provided no public justification for the unexpected ban when it came into effect at the weekend. However, on Monday India’s telecoms ministry said that the order, issued under India’s Information Technology Act, had been prompted by comments made by a supreme court judge during a hearing in July.

The ministry said that the restrictions were temporary and did not amount to a “blanket” ban, arguing that internet users running virtual private networks, which can be used to access blocked sites, could still view the material. “It isn’t that they are being banned lock, stock and barrel,” the ministry said. “The justice noted that free and open access to these websites.... should be controlled, but these sites will continue to be available through the mechanism of a VPN.”

The crackdown is set to raise fresh concerns about sudden and sweeping legal restrictions in India, after the introduction of a ban on the sale of beef earlier this year in the western state of Maharashtra, a move that was supported by Mr Modi’s government. The ruling also drew criticism from legal experts following broader concerns about a recent rise in poorly-targeted internet rules, including some restrictions on global social media sites such as Facebook and Twitter.

Pranesh Prakash of the Bangalore-based Centre for Internet and Society think-tank questioned the basis of the ruling, describing it as a further example of a “clumsy” approach to online regulation.

“There is no proper justification that they have given for banning all porn, rather than child porn or revenge porn or something like that,” he said. “The reaction is heavy handed, and has been done under the cloak of secrecy.” The remarks by a judge cited by India’s government as a rationale for the ban were a comment made in court rather than a legal ruling, Mr Prakash added, casting further doubt on the basis for the restrictions.

India’s mix of strict regulation and conservative public morals mean explicit sexual content is almost unheard of in mainstream media, where Bollywood films seldom featuring more than a chaste on-screen embrace.However India’s fast-growing internet population of about 300m is now both the world’s second largest after China, and an increasingly important sources for traffic for global pornographic websites.

Pornhub, which is the world’s 66th most visited website according to ranking service Alexa, said Indians were the fourth largest national users of its content during 2014.

For more details visit https://cis-india.org/internet-governance/news/financial-times-james-crabtree-august-3-2015-india-launches-crackdown-on-online-porn

Proxies and VPNs: Why govt can't ban porn websites?

pranesh — 2015-09-13T08:26:17Z

The government's move to block more than 800 pornographic websites has led experts to question whether this latest attempt to police the internet is even feasible.

The article by Siladitya Ray was published in the Hindustan Times on August 3, 2015. Pranesh Prakash was quoted.

Internet service providers (ISPs) have confirmed they received letters from the Department of Telecommunications (DoT) on Saturday that directed them to block certain websites. But can the government stop users from visiting porn sites?

The answer seems to be no.

"It is extremely easy to circumvent these blocks, using virtual private networks (VPNs) and proxies that anonymise your traffic," said Pranesh Prakash, policy director at the Centre for Internet and Society in Bengaluru.

A cursory Google search on how to unblock porn websites throws up millions of how-tos and guides on using proxies and VPNs to get around restrictions set by authorities. All these services anonymise users’ web traffic by routing them through foreign servers.

According to data from Pornhub, one of the world's biggest porn sites, India ranks fifth for the most daily visitors to the website. Pornhub saw a total of 78.9 billion video views globally in 2014.

The government can try to keep up with proxies and block them too. But as proxies change on a daily basis and there are always dozens of functioning proxies to choose from across, blocking all of them will be a near impossible task.

Tor, an anonymity network, is also a popular way to surf blocked sites.

But is it legal to circumvent blocks put in place by authorities by using VPNs and proxies?

There is no law in India that prohibits viewing pornography, experts say. Section 67 of the Information Technology Act only deals with "publishing obscene information in electronic form".

This provision has been interpreted as a measure to criminalise the posting of pornographic content online. However, accessing "obscene" content privately – such as within the four walls of a person’s home – is not illegal, say experts.

In July, while hearing a petition seeking the blocking of pornographic websites, Supreme Court Chief Justice HL Dattu wondered whether the court could restrain an adult from watching pornography within his home and described such a ban as a violation of Article 21 of the Constitution, which grants the right to personal liberty to its citizens.

But what about the legality of using VPNs and proxies? “There are no laws preventing the use of VPNs and proxies in India," said Prakash.

Are proxies and VPNs safe?

While the use of proxies and VPNs is very simple, they do come with their own set of problems. These services have access to all your browsing data and may push adware and other forms of malware.

Prakash advised that users should only choose services that are well known and have a good reputation.

"Sites like TorrentFreak put out annual lists of the top VPNs available," he said. These can be used as a guide to determine what services are safe.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-august-3-2015-siladitya-ray-proxies-and-vpns

Indian government orders ISPs to block 857 porn websites

pranesh — 2015-09-13T08:18:33Z

The Indian government has ordered a large number of porn websites to be blocked, creating an uproar among users and civil rights groups in the country.

The blog post by John Ribeiro was originally published by IDG News Service and mirrored on PC World website on August 2, 2015.

The Department of Telecommunications has issued orders for the blocking of 857 websites serving pornography, said two persons familiar with the matter, who declined to be named.

Section 69 (A) of India’s Information Technology Act allows the government to order blocking of public access to websites and other information through computer resources, though this section appears to be designed to be invoked when a threat is perceived to the sovereignty and integrity of India, security of the state, friendly relations with foreign states or public order.

“The government cannot on its own block private access to pornography under current statutes,” said Pranesh Prakash, policy director of the Centre for Internet and Society in Bangalore. “Parliament has not authorized the government to ban porn on its own.”

“However, courts have in the past ordered specific websites to be blocked for specific offences such as defamation, though as far as I know not for obscenity,” Prakash added.

Viewing pornography privately is not a crime in the country, though its sale and distribution is an offense.

Some porn websites were still accessible through certain Internet service providers on Monday, as some ISPs took some time to implement the order. “All the 857 websites will be blocked by all ISPs today,” said a source in the ISP industry, who requested anonymity. “As licensees we have to follow the orders.”

The government could not be immediately reached for comment.

Reports of the blocks created a furore among Internet users in the country, who criticized the move on Reddit, Twitter and other social media.

India’s Supreme Court struck down in March as unconstitutional an Internet law that provided for the arrest of people sending online messages considered offensive or menacing. But it upheld Section 69 (A) in that same ruling, which it described as a “narrowly drawn provision” limited to a few subjects.

In a public interest lawsuit on the blocking of pornography, the Supreme Court last month declined to issue an interim order that would block porn websites at the request of the private litigant, according to a report.

For more details visit https://cis-india.org/internet-governance/news/idg-news-service-august-2-2015-indian-govt-orders-isps-to-block-857-porn-websites

Why the DNA Bill is open to misuse: Sunil Abraham

sunil — 2015-09-13T08:37:44Z

The Human DNA Profiling Bill, the law that regulates the collection, storage and use of the human genetic code, has attracted some strong criticism from civil liberties groups including the Bengaluru-based Centre for Internet and Society (CIS) which had participated in the expert committee for DNA profiling constituted by the Department of Biotechnology in 2012.

CIS circulated a detailed dissent note earlier this year on the draft of the Bill. As the government gets ready to table the Bill in Parliament, CIS Executive Director Sunil Abraham tells Kanika Datta why the provisions of the Bill are open to misuse and invasion of privacy. Edited excerpts:

Why does Centre for Internet and Society reject using DNA analysis for non-forensic use as set out in the Human DNA Profiling Bill in its current form? What are the possible risks involved here?

The problem here is that the introduction to the Bill talks of DNA matches "without a doubt". But the way we understand it, biometric technology depends on approximate matching and not discrete matching. Unlike, say, the technology used for matching digital signatures, machines for matching DNA, fingerprints or the iris specify a false positive ratio when they leave the factory - that's what created the controversy in the O J Simpson trial, for example. This means you have to be very conservative in populating the database. For a given false positive ratio - the larger the database the greater the incidence of mistaken identification. That is why we think that for purposes other than forensic use, it would be better to create other databases.

Let me clear: we are not Luddites but neither are we naïve techno-enthusiasts. After all, the Innocence Project in the US has managed to overturn the convictions of many people who were held guilty through DNA evidence. But it is a myth that the more sophisticated the technology the more secure and accurate it is. In fact, the reverse is often true. For instance, the voter machines we use in India are primitive technology but they are much harder to compromise compared to the voting machines used in the US. Given all this, we believe that there should be "process fixes", such as sending DNA collected from a crime scene to two laboratories as a check and balance against the fallibility of human beings and machines.

CIS made the point that the powers of the DNA Board are too wide. In what possible way could these powers be misused since the Board is to be an independent authority?

When this exercise was started, the DNA Board had 26 functions. We proposed that this be cut this down to ten, which was accepted by a sub-committee. But when the final Bill came back it rejected the consensus view and restored the 26 functions, including things like "raising the general awareness". All this detracts from the Board's primary role and efficiency and expands its discretionary powers. It is true that a good regulator needs some amount of discretion but this should be a limited discretion within a tightly defined scope -- this is true for any regulator, not just the DNA Board.

The provision that no civil suit can be entertained on any matter on which the DNA Board is empowered under the Act looks excessive. Is there any precedent that explains why this provision was introduced? What kind of oversight and checks and balances are there in other jurisdictions that could be incorporated in the Indian law?

I can understand the logic here; the government is trying to ensure that the regulator has final say. After all, if you look at telecom, the decisions of the TDSAT (Telecom Dispute Settlement & Appellate Tribunal) can be appealed in the High Court and the Supreme Court. But eliminating judicial appeal as this Bill has state amounts to a violation of classic regulatory design by circumventing the appellate process. Ideally, we need a tripartite separation of law in which the executive frames policies, the DNA board implements them and the courts adjudicate upon them.

You have said the term "DNA Analysis" has not been defined. Could you explain the possible risks of the absence of a definition?

DNA analysis is of many types and some of them allow you to get to know a person quite intimately in terms of their medical history, genetic traits and so on. But forensic analysis looks at a limited set of markers which are essentially privacy-protecting and from which no genetic traits can be determined. You can't, for instance, do a study on the genetic make-up of criminals from this analysis. Now, if this Bill is around law enforcement - which we know is the policy intention - then the DNA analysis should be limited to those markers. That would reduce the chances of abuse.

You have also criticised the low standards of information disclosure and suggest the issue should be vested in an independent third party rather than the DNA Bank Manager. Could you explain how this would help?

In information and technology and telecom there is an executive authorisation mechanism in place for information sharing that requires the home secretary's permission for non-emergency situations and the head of the police station in the case of an emergency. We want a similar authorisation process - say, a judge and an established paper trail so that there are proper checks and balances. When personal information is involved, even the DNA Board is not well placed because its members are scientists whereas disclosure of personal information is a question of the law.

You have said the Bill has not been brought in line with the nine national privacy principles set out by an expert committee in 2012. Shouldn't a privacy law precede the passing of the DNA Bill in any case?

It's not a chicken-and-egg situation, but the point to consider is that the world is moving towards European data protection principles, and something like 100 countries have adopted it. If we in India want to trade in European personal information (via our BPO and outsourcing businesses) we must have a law that is adequate from the data protection perspective. This means, among other things, mandating that anyone whose DNA profile is accessed receives a notice to this effect, for instance. We know that the Department of Personnel and Training has incorporated the principles set out in the Justice Shah report in the privacy Bill two years ago but we haven't heard anything about it since. If and when this Bill is enacted, it will have overriding powers over a host of laws. But where the DNA Bill is concerned, there is no reason for it not to take cognisance of a later law.

What has been the government's reaction to this dissent note?

No reaction!

For more details visit https://cis-india.org/internet-governance/news/business-standard-kanika-datta-august-1-2015-why-the-dna-bill-is-open-to-misuse-sunil-abraham