We are anonymous, we are legion

Indien: Regierung will Nutzung von US-Mailprovidern in Verwaltungen verbieten

praskrishna — 2013-09-05T10:59:51Z

Die indische Regierung wird in Kürze all ihre Mitarbeiter auffordern, keine US-amerikanischen Mailprovider, allen voran Gmail, für ihre offizielle Kommunikation zu nutzen.

This was published in Netzpolitik (German Newspaper) on September 3, 2013. Sunil Abraham is quoted.

Ziel der Regierung ist es, die Sicherheit von vertraulichen Information der Regierung zu erhöhen. Die indische Regierung sieht sich zu diesem Schritt gezwungen, nachdem die flächendeckende Überwachung des Internets durch die USA bekannt wurde, an dem auch amerikanische Unternehmen gezwungenermaßen beteiligt sind.

Wie The Times of India berichtet, gab ein leitender Beamter der indischen Regierung an, dass die Regierung plane rund 500.000 Angestellte darüber zu informieren, dass die Nutzung amerikanischer Mailprovider zur offiziellen Kommunikation nicht mehr gestattet sei. Stattdessen sollen die Angestellten zum offiziellen Mailservice des indischen National Informatics Center wechseln.

“Gmail data of Indian users resides in other countries as the servers are located outside. Currently, we are looking to address this in the government domain, where there are large amounts of critical data,” said J Satyanarayana, secretary in the department of electronics and information technology.

Dass Angestellte der indischen Regierung und selbst Minister in Indien die Dienste von Gmail in Anspruch nehmen, statt auf Lösungen der eigenen Regierung zu setzen scheint nach Aussagen der Times of India keine Seltenheit zu sein.

Several senior government officials in India, including ministers of state for communications & IT Milind Deora and Kruparani Killi, have their Gmail IDs listed in government portals as their official email.

Ein Grund hierfür scheint die einfache und unbürokratische Anmeldung bei solchen Diensten zu sein. Wer eine offizielle Adresse der indischen Regierung haben wolle, müsse diese erst beantragen und in einem langwierigen Prozess seine tatsächliche Identität beweisen. Bei Gmail und anderen Mailprovidern hingegen sei eine Anmeldung oftmals mit wenigen Klicks durchführbar, wie ein leitender Angestellter im IT-Ministerium sagte.

Eine Pressesprecherin von Google Indien gab an, dass der Konzern bisher nicht von dem Verbot erfahren habe und es sich daher um reine Spekulation handele, auf die der Konzern nicht weiter eingehen wolle.

Erst in der letzten Woche gab der indische IT-Minister Kapil Sibal neue Richtlinien für im Ausland lebende Mitarbeiter der indischen Regierung bekannt. The Times of India berichtete:

[...] the new policy will make it mandatory for all government officials stationed in Indian missions abroad to use only static IP addresses, virtual private networks and one-time passwords for accessing Indian government email services.

Sibal ergänzte, dass alle Mails automatisch verschlüsselt würden und nur über indische Server des National Informatics Centers abgewickelt würden.

“All Indian missions will use NIC servers which are directly linked to a server in India and that will keep government information safe”

Sunil Abraham, Direktor des indischen Centre for Internet & Soceity in Bangalore nannte den Entschluss der Regierung “eine späte Reaktion”, begrüßte den Schritt aber dennoch:

“Use of official government email would also make it easier to achieve greater transparency and anti-corruption initiatives. Ministers, intelligence and law enforcement officials should not be allowed to use alternate email providers under any circumstance.”

For more details visit https://cis-india.org/news/netzpolitik-indien-regierung-will-nutzung-von-us-mailprovidern-in-verwaltungen-verbieten

Indians Rank Second For Online Snooping

praskrishna — 2012-11-30T06:10:24Z

Indians rank second globally when it comes to seeking details of private individuals online, as per Google transparency report.

The blog post was published in Indolink on November 23, 2012. Pranesh Prakash is quoted.

India recorded for 2,319 requests for the entire period of 2012, where various government agencies have been looking for individual user details contained in online records, as reported by Dailybhaskar.com. U.S. topped the list with 7,969 requests, while Brazil was on the third spot with 1,566 requests.

It was seen that in the first six months this year, India made 2,319 requests involving 3,467 users, while the U.S. made 7,969 requests in the same period. Globally, it was seen that there were 20,938 requests for user data in the period of January-June. The data includes an individual’s complete Gmail account, chat logs, Orkut profile and search terms among others. Google prepares this report every six months, and was started in July-December 2009.

The report also stated that the percentage of data requests fully or partially complied with by India stood at 64 percent.

The Director for policy at Centre for Internet and Society (CIS), Pranesh Prakash said "Though India is a large country with a significant number of internet users, this data is nonetheless an indicator of growing surveillance," as reported by Daily Bhaskar.com.Apart from snooping on user details, Indian authorities are also known to send requests for taking down certain web content, which is considered to be sensitive for national security or defamatory in general. A new trend also revealed that untrue court orders are being used as a key instrument for the same.

On one hand the nation is seeking to go net savvy, while on the other hand authorities are looking to stamp authority on freedom of a larger population.

If was also noted that there were 20 court orders and 64 requests from executive/police that resulted in 596 items being taken down from the web between January and June this year. Comparatively, there were only eight court orders and 22 executive/police requests in January-June 2010, resulting in 125 items being taken down.

Google said “In response to a court order, we removed 360 search results. The search results were linked to 360 web pages that had adult videos, which allegedly violated an individual’s personal privacy,” as reported by Business Standard.

For more details visit https://cis-india.org/news/indolink-november-2012-indians-rank-second-for-online-shopping

Indians Plead for #NetNeutrality as Airtel Raises Data Charges

subha — 2015-02-11T15:10:44Z

Click to read the article published in the Global Voices on December 30, 2014.

After Indian mobile data service provider Airtel announced plans to introduce data charges for VoIP usage, it received a rash of criticism from customers and open web advocates alike.

With 192.22 million users (as of August 2013), Airtel is India's largest mobile telephony provider and Asia-Pacific's second largest mobile operator. Although plans are now on hold due to regulatory restrictions, advocates worry that the company may yet find a way impose the fee increase.

On December 26, company proposed to raise costs for mobile phone users who rely on services like WhatsApp, Skype, and Viber to communicate with their contacts, requiring them to pay Rs.0.04/10KB (0.063 USD, based on current conversion rate) for 3G and Rs. 0.10/10KB (0.158 USD) for 2G service where a local or national call will cost one third of this amount or less.

If you pay a fixed amount for internet data pack, Airtel will charge you extra for internet calls on Skype, Viber or any free calling app. How much? 4 paise for every 10 Kilo Bytes on 3G and 10 paise for every 10 Kilo Bytes on 2G.

- Netneutrality.in

The new plan to charge Rs. 75 for 75 MB of data usage over VoIP calls was heavily criticized on social media:

So let me get this straight. Airtel is worried about people using a mere 75 MB out of their data allowance? WTF? #BoycottAirtel

— Madhu Menon (@madmanweb) December 26, 2014

Messages against Airtel on Twitter and Facebook included hashtags such as #BoycottAirtel and #NetNeutrality.

In protest of Airtel India's violation of net neutrality principles, I disabled all data packs in my mobile number .

I am not using skype or viber usually . My usual video requirements arechatb.org and Google hangout. But a carrier breaking net neutrality is a very serious development . Raise your voice against this .

Read More about Airtel Breaking Net Neutrality here http://netneutrality.in/

I would like to port to some other services without gate keeping after a few weeks If airtel continues same path.

‪#‎netneutrality‬ ‪#‎india‬ ‪#‎airtel‬ ‪#‎fail‬

- Anivar Joshina (on Facebook)

In an op-ed, Indian online news portal Niti Central's CEO Shashi Shekhar said the move could put Indian Prime Minister Narendra Modi's “Digital India” initiative in jeopardy.

Prime Minister Narendra Modi’s Vision of a Digital India will be in jeopardy unless the larger mess in Telecom is fixed urgently on priority and “Net Neutrality” does not make that priority list.

- Shashi Shekhar, CEO, Niti Central

Airtel has not released any further response on the issue of net neutrality since their initial announcement, which read as follows:

All Internet/data packs or plans (through which customer can avail discounted rate) shall only be valid for internet browsing and will exclude VoIP (Both incoming/ Outgoing). VoIP over data connectivity would be charged at standard data rates of 4p / 10 KB (3G service) and 10p / 10 KB (2G service).

- Published on Telecomtalk.info

Reacting to the public outcry against Airtel, India's Union Minister of Communications Ravi Shankar Prasad pledged to look into matter. According to news portal First Post, telecom operators voiced opposition to “over-the-top” VoIP services like WhatsApp, Skype, and Viber for some time, but the Telecom Regulatory Authority of India (TRAI) has thus far stood in the way of a price increase.

Airtel has started on plans to charge OTT users particularly using VOIP services like viber and skype. TRAI had earlier this year rejected such demands from Indian operators. Even after this Airtel has gone ahead and kickstarted this practice.

- Sandip Pillai (on Change.org)

Airtel has pushed for a policy level change to legitimize exceptional data charges and many other over-the-top services. But these were declined by TRAI who contended that Airtel's plans were “illegal and violation of net neutrality,” forcing Airtel to drop the plan — for now.

In view of the news reports that a consultation paper will be issued shortly by TRAI on issues relating to services offered by OTT players including VOIP, we have decided not to implement our proposed launch of VoIP packs.

We have no doubt that as a result of the consultation process a balanced outcome would emerge that would not only protect the interests of all stakeholders and viability of this important sector but would also encourage much needed investments in spectrum and roll out of data networks to fulfill the objective of digital India.

- Reported on MediaNama by Nikhil Pahwa

For more details visit https://cis-india.org/openness/blog-old/global-voices-december-30-2014-indians-plead-for-net-neutrality-as-aitel-raises-data-charges

Indians Join ‘Save the Internet’ Campaign

praskrishna — 2015-05-09T07:42:06Z

In India, hundreds of thousands have joined a public campaign to ensure equal access to the Internet as an impassioned debate engulfs the country on what is called “net neutrality.”

The article by Anjana Pasricha was published by Voice of America on April 15, 2015. Pranesh Prakash gave his inputs.

The controversy heated up after one of the country’s main telecom providers launched a new marketing platform, Airtel Zero, where Internet businesses could pay to have users browse their sites for free.

This triggered a nationwide backlash from those who fear that this could deny equal access to the Internet. They are demanding that the Internet remain a level playing field with all data getting equal treatment - whether it is a student’s blog or an online company with deep pockets.

Celebrities, professionals, entrepreneurs and students, are among the tens of thousands who have signed up for an online campaign “savetheinternet.”

Petitions are being sent at a furious pace to the telecom regulator, Telecom Regulatory Authority of India (TRAI), which invited public comments last month on various proposals such as allowing telecom companies to charge for services like Skype and YouTube.

One of the persons behind the campaign to ensure net neutrality, Kiran Jonnalagadda, in Bangalore, has been taken aback by the overwhelming response.

“400,000 users have on their own copy, pasted an email from our website and mailed it to TRAI from their own computers. It is not an automated script. There is nothing is going on from our servers. People are doing it by themselves on their own computers. That is incredible. We did not think they would do it,” said Jonnalagadda.

The strident public criticism on the issue has already had an impact. One of the country’s biggest online retailers, Flipkart, said on Tuesday that it had scrapped discussions with Airtel Zero on giving users free access to its app.

Flipkart announced its decision after some angry supporters of net neutrality denounced the company saying it would get an unfair advantage over its competitors. Some users even threatened to boycott the online retailer.

Supporters of allowing telecoms to give preferential, free access to Internet sites say providers need the funds to expand infrastructure and net coverage in countries like India, where broadband access is still limited. Opponents say such practices allow for preferential treatment for some websites over others, creating a disadvantage for upstart websites that would inhibit innovation.

Pranesh Prakash at the Bangalore-based Center for Internet and Society supports net neutrality. However he said that under certain conditions, companies could pay for customers using their data.

“They anyway have to pay money for using data. Right now what some companies are offering to do is not only to pay money for their data use, but also for customers data use. That can be anti-competitive, for instance if there is in exclusive deal, or if the terms of the deal are not transparent. But just the fact that a company is offering to pay for its customers data does not by itself make it anti-competitive. For instance toll free numbers are not considered anti-competitive by anyone,” said Prakash.

The government says it will wait for a report from a six-member committee due in May before it takes a position on the issue. But net users hope the government is leaning toward net neutrality.

Earlier this week, Minister for Communications and Information Technology, Ravi Shankar Prasad, called the Internet “one of the finest creations of the human mind.”

“It is the property of the entire human race, not of any country or of any society. Net to become truly global must have integral link with the local and when we talk of digital inclusion, it is equally important it must be available to those who are underprivileged and on the margins,” said Prasad.

India is one of the world’s biggest Internet markets after the United States and China with an estimated 180 million users. It is not the only country to debate net neutrality - it has also been a subject of intense discussion in the United States and Europe.

For more details visit https://cis-india.org/internet-governance/news/voice-of-america-april-15-2015-anjana-pasricha-indians-join-save-the-internet-campaign

Indians Get Particular about Online Marriage

praskrishna — 2011-04-04T06:48:58Z

The article quotes Nishant Shah's views on online behaviour of people seen elsewhere in the world.

From the overweight and transsexuals to people with HIV and those supposedly afflicted by negative planetary positions, the Internet dating game in India increasingly has a website for everyone.

And with Valentine's Day on Sunday, the specialist sites are seeing a rise in hits.

"There's always an increase in activity around this time of year," said Megha Singhal, who with her sister runs a portal for larger lonely hearts -- www.overweightshaadi.com.

"Valentine's Day is still a big deal here. Everyone wants a date," the 21-year-old economics student told AFP from New Delhi.

Marriage -- or "shaadi" in Hindi -- remains a cornerstone of society in conservative India, with hundreds of matchmaking sites concentrating on finding their members suitable life partners rather than casual dates.

Long-established portals like www.shaadi.com, www.bharatmatrimony.com and www.jeevansathi.com offer general searches. Would-be brides and grooms can be selected by age, caste, religion, language or where they live.

But Singhal and others say that niche matrimonial sites can often be more effective.

Yazdi Tantra, a computer consultant in Mumbai, runs www.theparsimatch.com, one of a number of websites for the dwindling community of followers of the ancient Zoroastrian faith.

"Essentially, Parsis like to marry within the community. It saves time rather than trawling through other multicultural sites to get a profile," he said.

Sanjeev Pahwa, head of the New Delhi-based firm Strikeone Advertising, said targeting niche groups made business sense as he realised smaller start-ups like his couldn't compete with the major players.

The result was www.bposhaadi.com, for call centre workers working unsociable hours, and www.govtshaadi.com, targeting state sector employees looking for love.

Another came about from the belief in Indian astrology that a Manglik -- a person born when Mars was in an inauspicious position in the skies -- is a bad match for marriage but that two Mangliks can cancel out its negative effects.

Now, www.manglikshaadi.com has more than 14,000 members, he said.

Since starting five years ago, Pahwa has introduced more sites, including for people with disabilities and the over 30s, who have preferred to further their careers before getting married.

Elsewhere, there are sites for hijras -- transsexuals and transvestites commonly known in India as eunuchs -- people with HIV and those who shun the officially banned, but still widely practised, dowry system.

Satya Naresh, who set up www.idontwantdowry.com, said the site is helping to break down traditional attitudes and a practice that can place an intolerable financial strain on families.

"We've been very successful in changing the mindset of people and hope it continues," he said from the southern city of Hyderabad.

For these Internet entrepreneurs, web access in India -- although still small at about 14 percent for broadband connections -- is good news for those looking for love.

"The Internet does make the access to a pool of suitable people much easier than matrimony in other times," said Singhal.

Nishant Shah, director of research at the Centre for Internet and Society, based in the IT hub of Bangalore, said the phenomenon reflected online behaviour already seen elsewhere in the world.

"As more and more people are going online they're going to replicate tight and personalised communities which are very local and bound by existing structures at the same time as trying to look more globally," he explained.

"The matrimonial sites are fairly indicative of that. We find people not going on to general websites but very narrow ones.

"It's not just matrimonial sites. Facebook, for example, looks like a very large community of users but when you look at friend networks you realise people connect in small and specialist networks.

"It reflects the old idea of 'birds of a feather stick together'."

For link to the original article

For more details visit https://cis-india.org/news/indians-online-marriage

Indians Call For More Stringent Data Protection Laws

praskrishna — 2017-07-18T13:36:49Z

The government is India is facing calls to establish better cybersecurity laws to protect consumers’ data after fears have crept up that Reliance Jio, the telecom startup in India, suffered a major data leak.

This report was published by PYMNTS on July 17, 2017. Pranesh Prakash was quoted.

According to a report in Reuters announcing the news, Jio denied the data leak took place, saying the names, telephone numbers and email addresses of Jio users that showed up on Magicpak, a website, were unauthentic. Its parent Reliance Industries said customers’ data was safe and protected.

But at the same time that it was issuing reassurances, Jio filed a complaint claiming unlawful access to its computer systems, reported Reuters. That discrepancy has led Indians to call for better laws for data protection for consumers.

“It raises questions of security and accountability,” said Pranesh Prakash, policy director at the Centre for Internet and Society (CIS), a research organization, in the report. “A rule to report breaches exists, but it is unenforceable. It says you’re not liable if you’re following reasonable security practices. What ‘reasonable’ means is not defined.”

Supporters of stronger data protection laws in India said that countries that have stronger cybersecurity laws on the books would have started an inquiry into what happened with Reliance Jio. They point to the data breach last week at Verizon. Verizon quickly responded with an explanation of what went down, how it occurred and how many customers’ data privacy it impacted.

“India is at a nascent stage. For good norms in Asia, look to Singapore. It’s been praised for not having cybersecurity issues by the UN,” Srinivas Kodali, an independent security researcher, said in the same Reuters report.

The report noted that in May there were two data privacy breaches of Indian companies with the records of 17 million Zomato customers being compromised. In another breach, as many as 135 million of India’s Aadhaar numbers had been stolen from government databases and placed online. Aadhaar numbers are similar to social security numbers.

For more details visit https://cis-india.org/internet-governance/news/pymnts-july-17-2017-indians-call-for-more-stringent-data-protection-laws

Indians Ask: Is Visiting a Torrent Site Really A Crime?

subha — 2016-09-06T14:09:26Z

India has banned various large-scale torrent sites for a long time — this is old news. But under a new federal policy in India, one can be jailed for three years and fined 300,000 Indian Rupees (~US $4464) for downloading content on any of these blocked websites.

The blog post was first published in Global Voices on September 5, 2016.

Netizens who regularly use these and similar services have become anxious about what the rule may mean for them. Last week, a new legal notice concerning copyright violations sparked widespread rumors that users could be penalized for simply viewing torrent sites.

The notice now appears when one visits any of the banned websites. It reads:

This URL has been blocked under the instructions of the Competent Government Authority or in compliance with the orders of a Court of competent jurisdiction. Viewing, downloading, exhibiting or duplicating an illicit copy of the contents under this URL is punishable as an offence under the laws of India, including but not limited to under Sections 63, 63-A, 65 and 65-A of the Copyright Act, 1957 which prescribe imprisonment for 3 years and also fine of upto Rs. 3,00,000/-. Any person aggrieved by any such blocking of this URL may contact at urlblock@tatacommunications.com who will, within 48 hours, provide you the details of relevant proceedings under which you can approach the relevant High Court or Authority for redressal of your grievance.

Soon after news of the notice began to circulate, the Chennai High Court – one of the oldest courts in India — issued a John Doe order to block as many as 830 websites, including several torrent websites such as thepiratebay.se, torrenthound.com, and kickasstorrents.come.in.

Indian tech news portal Medianama published a blog post arguing that it is the downloading of pirated content from certain banned websites and not accessing those website that should lead to the legal issues. The problem, it seems, lies in the poor wording of the notice. Medianama described this as “bizarre by any rational standard” and noted that, taken literally, it does not comply with the Indian Copyright Act. Digital piracy legislation in India has been modified quite a lot in the recent times in general and over last five years in particular (Sections 63, 63A and 65 of the Indian Copyright Act of 1957 in particular.) But it has not been implemented with such force in the past.	What is a torrent? A torrent is part of a system that enables peer-to-peer file sharing (“P2P”) that is used to distribute data and electronic files over the Internet. Known as BitTorrent, this file distribution system is one of the most common technical protocols for transferring large files, such as digital audio files containing TV shows or video clips or digital audio files containing songs. Within this system, files labeled with the .torrent extension contain meta data about files — e.g. file names, their sizes, folder structure and cryptographic hash value for integrity verification. They do not contain the content to be distributed, but without them, the system does not work. (via Wikipedia)

This is not the first time India has put a blanket ban on such sites. In December 2014, 32 websites — including including code repository Github, video streaming sites Vimeo and Dailymotion, online archive Internet Archive, free software hosting site Sourceforge — were banned in India. They were later unblocked after agreeing to remove some ISIS-related content.

As they have in the past, tech-savvy netizens began suggesting hacks to mask or fake one's IP address. Sumiteshwar Choudhary, a practicing criminal and matrimony lawyer, described on Quora how the law had existed for quite some time but the government had never fully enforced it:

[..] The only reason that India has not been able to successfully ban these services is because the servers rest outside India and we don’t have any law to extend our jurisdiction to that extent today. As an end user if you download a pirated version of things you are not entitled to, you can be booked criminally under this Act and can face prison for up to 2 years…

Twitter user Prisma Mama Thakur criticized the ban, arguing that it should be a low priority in a moment when India has many other important problems to solve:

For more details visit https://cis-india.org/internet-governance/blog/global-voices-september-5-2016-subhashish-panigrahi-indians-ask-is-visiting-a-torrent-site-really-a-crime

Indian Telegraph Act, 1885, 419A Rules and IT (Amendment) Act, 2008, 69 Rules

jdine — 2013-04-30T10:04:38Z

Jadine Lannon has performed a clause-by-clause comparison of the 419A Rules of the Indian Telegraph Act, 1885 and the 69 Rules under Section 69 of the Information Technology (Amendment) Act, 2008 in order to better understand how the two are similar and how they differ. Though they are from different Acts entirely, the Rules are very similar. Notes have been included on some changes we deemed to be important.

Though they are from different Acts entirely, the 419A Rules from the Indian Telegraph Act of 1885 and the 69 Rules from the Information Technology (Amended) Act, 2008 are very similar. In fact, much of the language that appears in the official 69 rules is very close, if not the same in many places, as the language found in the 419A rules. The majority of the change in language between the 419A Rules and the equivalent 69 Rules acts to clarify statements or wordings that may appear vague in the former. Aside from this, it appears that many of the 69 Rules have been cut-and-pasted from the 419A Rules.

Arguably the most important change between the two sets of rules takes place between Clause (3) of the 419A Rules and Clause (8) of the 69 Rules, where the phrase “while issuing directions [...] the officer shall consider possibility of acquiring the necessary information by other means” has been changed to “the competent authority shall, before issuing any direction under Rule (3), consider possibility of acquiring the necessary information by other means”. This is an important distinction, as the latter requires other options to be looked at before issuing the order for any interception or monitoring or decryption of any information, whereas the former could possibly allow the interception of messages while other options to gather the “necessary” information are being considered. It seems unreasonable that the state and various state-approved agencies could possibly be intercepting the personal messages of Indian citizens in order to gather “necessary” information without having first established that interception was a last resort.

Another potentially significant change between the rules can be found between Clause (15) of the 419A Rules, which states, in the context of punishment of a service provider, the action taken shall include “not only fine but also suspension or revocation of their licenses”, whereas Clause (21) of the 69 Rules states that the punishment of an intermediary or person in-charge of computer resources “shall be liable for any action under the relevant provisions of the time being in force”. This is an interesting distinction, possibly made to avoid issues with legal arbitrariness associated with assigning punishments that differ for those punishments for the same activities laid out under the Indian Penal Code. Either way, the punishments for a violation of the maintenance of secrecy and confidentiality as well as unauthorized interception (or monitoring or decryption) could potentially be much harsher under the 69 Rules.

In the same vein, the most significant clarification through a change in language takes place between Clause (10) of the 419A and Clause (14) of the 69 Rules: “the service providers shall designate two senior executives of the company” from the 419A Rules appears as “every intermediary or person in-charge of computer resource shall designate an officer to receive requisition, and another officer to handle such requisition” in the 69 Rules. This may be an actual difference between the two sets of Rules, but either way, it appears to be the most significant change between the equivalent Clauses.

The addition of certain clauses in the 69 Rules can also give us some interesting insights about what was of concern when the 419A rules were being written. To begin, the 419A rules provide no definitions for any of the specific terms used in the Rules, whereas the 69 Rules include a list of definitions in Clause (2). Clause (4) of 69 Rules, which deals which the authorisation of an agency of the Government to perform interception, monitoring and decryption, is sorely lacking in the 419A rules, which alludes to “authorised security [agencies]” without ever providing any framework as to how these agencies become authorised or who should be doing the authorising.

The 69 Rules also include Clause (5), which deals with how a state should go about obtaining authorisation to issue directions for interception, monitoring and/or decryption in territories outside of its jurisdiction, which is never mentioned in 419A rules, lamely sentencing states to carry out the interception of messages only within their own jurisdiction.

Lastly, Clause (24), which deals with the prohibition of interception, monitoring and/or decryption of information without authorisation, and Clause (25), which deals with the prohibition of the disclosure of intercepted, monitored and/or decrypted information, have fortunately been added to the 69 Rules.

For more details visit https://cis-india.org/internet-governance/blog/indian-telegraph-act-419-a-rules-and-it-amendment-act-69-rules

Indian surveillance laws & practices far worse than US

pranesh — 2013-07-12T11:09:39Z

Explosive would be just the word to describe the revelations by National Security Agency (NSA) whistleblower Edward Snowden.

Pranesh Prakash's column was published in the Economic Times on June 13, 2013. This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC.

Now, with the American Civil Liberties Union suing the Obama administration over the NSA surveillance programme, more fireworks could be in store. Snowden's expose provides proof of what many working in the field of privacy have long known. The leaks show the NSA (through the FBI) has got a secret court order requiring telecom provider Verizon to hand over "metadata", i.e., non-content data like phone numbers and call durations, relating to millions of US customers (known as dragnet or mass surveillance); that the NSA has a tool called Prism through which it queries at least nine American companies (including Google and Facebook); and that it also has a tool called Boundless Informant (a screenshot of which revealed that, in February 2013, the NSA collected 12.61 billion pieces of metadata from India).

Nothing Quite Private

The outrage in the US has to do with the fact that much of the data the NSA has been granted access to by the court relates to communications between US citizens, something the NSA is not authorised to gain access to. What should be of concern to Indians is that the US government refuses to acknowledge non-Americans as people who also have a fundamental right to privacy, if not under US law, then at least under international laws like the Universal Declaration of Human Rights and the ICCPR.

US companies such as Facebook and Google have had a deleterious effect on privacy. In 2004, there was a public outcry when Gmail announced it was using an algorithm to read through your emails to serve you advertisements. Facebook and Google collect massive amounts of data about you and websites you visit, and by doing so, they make themselves targets for governments wishing to snoop on you, legally or not.

Worse, Indian-Style

That said, Google and Twitter have at least challenged a few of the secretive National Security Letters requiring them to hand over data to the FBI, and have won. Yahoo India has challenged the authority of the Controller of Certifying Authorities, a technical functionary under the IT Act, to ask for user data, and the case is still going on.

To the best of my knowledge, no Indian web company has ever challenged the government in court over a privacy-related matter. Actually, Indian law is far worse than American law on these matters. In the US, the NSA needed a court order to get the Verizon data. In India, the licences under which telecom companies operate require them to provide this. No need for messy court processes.

The law we currently have â€” sections 69 and 69B of the Information Technology Act â€” is far worse than the surveillance law the British imposed on us. Even that lax law has not been followed by our intelligence agencies.

Keeping it Safe

Recent reports reveal India's secretive National Technical Research Organisation (NTRO) â€” created under an executive order and not accountable to Parliament â€” often goes beyond its mandate and, in 2006-07, tried to crack into Google and Skype servers, but failed. It succeeded in cracking Rediffmail and Sify servers, and more recently was accused by the Department of Electronics and IT in a report on unauthorised access to government officials' mails.

While the government argues systems like the Telephone Call Interception System (TCIS), the Central Monitoring System (CMS) and the National Intelligence Grid (Natgrid) will introduce restrictions on misuse of surveillance data, it is a flawed claim. Mass surveillance only increases the size of the haystack, which doesn't help in finding the needle. Targeted surveillance, when necessary and proportional, is required. And no such systems should be introduced without public debate and a legal regime in place for public and parliamentary accountability.

The government should also encourage the usage of end-to-end encryption, ensuring Indian citizens' data remains safe even if stored on foreign servers. Merely requiring those servers to be located in India will not help, since that information is still accessible to American agencies if it is not encrypted. Also, the currently lax Indian laws will also apply, degrading users' privacy even more.

Indians need to be aware they have virtually no privacy when communicating online unless they take proactive measures. Free or open-source software and technologies like Open-PGP can make emails secure, Off-The-Record can secure instant messages, TextSecure for SMSes, and Tor can anonymise internet traffic.

http://cis-india.org/internet-governance/blog/economic-times-june-13-2013-pranesh-prakash-indian-surveillance-laws-and-practices-far-worse-than-us

For more details visit https://cis-india.org/internet-governance/blog/economic-times-june-13-2013-pranesh-prakash-indian-surveillance-laws-and-practices-far-worse-than-us

Indian Supreme Court Overturns Law Barring ‘Offensive Messages’ Online

praskrishna — 2015-03-25T16:18:29Z

India’s Supreme Court on Tuesday struck down legislation barring “offensive messages” online, saying it violated constitutional guarantees of free expression.

The article by Niharika Mandhana published by Wall Street Journal on March 24, 2015 quotes Sunil Abraham.

A two-judge panel voided a part of India’s Information Technology Act that made it a crime to share information through computers or other communications devices that could cause “annoyance, inconvenience” and “enmity, hatred or ill will.”

Announcing the ruling in a crowded courtroom in the Indian capital, Justice Rohinton Nariman said the law’s provisions were too vague and didn’t provide “clearly defined lines” for law-enforcement officials. “What is offensive to one person may not be offensive to another,” he said.

The court also ruled that Internet companies, such as Facebook and Google, could be required to remove or block access to online content only if ordered to do so by a court or by a notification from the government. Previously, they were expected to act when they had “actual knowledge” of allegedly illegal materials.

Free-speech activists had long argued against the broad language in the law, which was enacted in part as an effort to prevent the incitement of violence among different religious and ethnic groups in the world’s second-most-populous nation.

On Tuesday they applauded the decision.

“This provision was hugely problematic for anyone using the Internet in India and that is gone,” said Sunil Abraham, head of the Bangalore-based Center for Internet and Society. “The court has removed the additional, unconstitutional limits to free speech.”

India’s Information Technology minister, Ravi Shankar Prasad, said in a televised interview after the ruling that the government “supports free social media.”

“If the security establishment needs a response in cases of terrorism, extremism, communal violence, the government will take a view after wider consultations,” Mr. Prasad said. “But only with adequate safeguards.”

Enforcement of the law has sparked controversy for years. In 2012, a 21-year-old was detained after complaining on Facebook about the effective shutdown of Mumbai for the funeral of a right-wing Hindu leader. Another person was also detained for “liking” her comment.

That year, political cartoonist Aseem Trivedi was also charged under this law for his work lampooning Parliament. Mr. Trivedi said Tuesday that the court’s decision would “put a stop to years of misuse of the law by the government and politicians.”

“It sends a strong message that Indian law is with free speech,” Mr. Trivedi said.

According to a recent report by Facebook, the U.S. social media company blocked 5,832 pieces of content in the second half of 2014 on requests from Indian law-enforcement agencies and the government.

That was up from 4,960 pieces blocked from January to June last year. Facebook said it restricted access in India to a lot of “anti-religious content” and “hate speech that Indian officials reported could cause unrest and disharmony.”

J. Sai Deepak, a New Delhi-based lawyer involved in the case, said Tuesday’s decision was a significant victory for Internet companies in India. He said the law’s implementation—which earlier was “subject to the vagaries of the political winds of the state,” he said—would now be guided only by the free-speech rules laid down in the Indian constitution.

The order, however, rejected an argument by free-speech advocates that information shared on the Internet must be treated the same way as other kinds of speech, such as a live address or printed material. The court said lawmakers could create a separate law to deal with online speech because such content, unlike others, “travels like lightning and can reach millions of persons all over the world.”

But the current law, the court said, was too vague and included terms which “take into the net a very large amount of protected and innocent speech.” The law “is cast so widely that virtually any opinion on any subject would be covered by it,” the order said.

—Newley Purnell contributed to this article.

For more details visit https://cis-india.org/internet-governance/news/wall-street-journal-niharika-mandhana-march-24-2015-indian-supreme-court-overturns-law-barring-hate-speech-online

Indian student in Cornell University hacks into ICSE, ISC database

praskrishna — 2013-07-02T07:39:45Z

A 20-year-old Indian student from Cornell University hacked into the database of ICSE (Class X) and ISC (Class XII) school exam results, exposed glaring anomalies in the marking system and went on to merrily write about his exploits in an online post.

The article by Kim Arora was published in the Times of India on June 6, 2013. Pranesh Prakash is quoted.

Kolkata-born Debarghya Das, majoring in computer science, says that all he had to do was run a simple program that entered all roll numbers after defining a range to get access to all the results. "It is shocking they haven't implemented a more secure system," Das told TOI on phone from New York.

After the result's data was crunched, analysed and plotted in graphs, Das discovered an interesting incongruity in the marking system: there are 33 different scores unattained between the passing mark of 35 and the maximum of 100 by the nearly 1,50,000 who appeared for the ICSE (Class X) exam. According to Das' findings, not a single student got the following marks: 36, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 56, 57, 59, 61, 63, 65, 67, 68, 70, 71, 73, 75, 77, 79, 81, 82, 84, 85, 87, 89, 91, 93. Similarly, in the case of ISC (Class XII exam) a set of 24 marks between 40 and 100 were found to be unattained.

When contacted, chairperson of the CI SCE (Council for the Indian School Certificate Examinations) Gerry Arathoon, refused to comment on both data security and the unattained marks. "I can't say anything until I have had a look at things myself," he said.

Das says that the missing marks indicate that perhaps they were tampered with. He offers mathematical and statistical arguments to defend his position in his online post. He says that the ISC anomaly appears to be a case of awarding "grace marks" and writes -- "Everything from 35 onwards, and most things from 23 onward seem blindly promoted to a pass mark."

	Pranesh Prakash, policy director at the Center for Internet and Society, says one needn't even be a techie to execute such a hack. "You don't need real technical skills to do this. You just need to figure out the ranges and feed them in. It is an interesting revelation that the website does nothing to obfuscate the javascript for security, but one can still retrieve data without that information. Once you have the data, it requires two minutes of programming to get it in a spreadsheet," says Prakash. In his post, titled "Hacking into the Indian Education System", Das wrote that he was doing this to "demonstrate how few measures our education board takes to hide such sensitive information".

Pranesh Prakash, policy director at the Center for Internet and Society, says one needn't even be a techie to execute such a hack. "You don't need real technical skills to do this. You just need to figure out the ranges and feed them in. It is an interesting revelation that the website does nothing to obfuscate the javascript for security, but one can still retrieve data without that information. Once you have the data, it requires two minutes of programming to get it in a spreadsheet," says Prakash. In his post, titled "Hacking into the Indian Education System", Das wrote that he was doing this to "demonstrate how few measures our education board takes to hide such sensitive information".

The student also told the TOI that it wasn't possible to change any values in marks and upload fudged data again, and that he made any significant progress in this direction only about 3-4 days after the results were announced. His online post says he also has the data for CBSE class XII. Though he hasn't yet made it public, he does admit it was harder to crack than CISCE, though not altogether difficult.

Schooled in Kolkata, Das is curren tly interning at Google, working on YouTube's captioning system. He is also working on a tongue-controlled game and has earlier been active in game and applet design. The idea to hack the results came to him fo llowing a desire to help two close friends who had recently taken the exams.

Das, nicknamed Deedy, told ToI that he worked on the ICSE and ISC results off and on for a week, but it essentially took about 4-5 hours to get all the data."It took me more time to write the blog post," says Das, referring to his 19-page post with all the graphs, data and explanations that is currently online.

For Das, there was only one other takeaway from the whole exercise. "Regardless of any tampering, it would be nice to see a transparent exam scheme. SAT (Scholastic Assessment Test) publishes everything related to the exam results every year. It is inconceivable that a national level exam board doesn't do that," he says.

For more details visit https://cis-india.org/news/the-times-of-india-kim-arora-june-6-2013-indian-student-in-cornell-university-hacks-icse-isc-databas

Indian public concerned about fingerprint payment scheme

praskrishna — 2017-02-12T15:10:23Z

The Guardian is reporting that a prominent think tank has found that the prospect of using fingerprint authentication for everyday payments is raising privacy concerns among the Indian public.

The blog post by Rawlson King was published by Biometric Update.com on February 9, 2017. Sumandro Chattapadhyay was quoted.

The Centre for Internet and Society says that many Indians are concerned about the “privacy implications” of using Aadhaar as a payment scheme.

Aadhaar is the 12-digit unique identification number issued by the Indian government to every individual resident of India. The Aadhaar project aims to provide a single, unique identifier which captures all the demographic and biometric details of every Indian resident. Currently, Aadhaar has issued over 900 million Aadhaar numbers. BiometricUpdate.com recently reported that over one billion people have now been enrolled.

The Indian government is intent on expanding the use of Aadhaar beyond the provision of social services to include financial transactions. The government’s “Digital India” initiative aims to create a “cradle-to-grave digital identity” that can enable a digital economy. Moving towards a digital economy will allow low income people to access the banking system. The use of Aadhaar for most transactions however would also allow the government to reduce the cash supply, which would work to eliminate untaxed cash transactions.

The government took a big step towards reducing the cash supply last November by removing 500 and 1,000 rupee notes, thereby eliminating 85 percent of the country’s circulating currency. Indian residents responded by setting up three million, enabled by fingerprint verification. BiometricUpdate.com has reported that banks, including DCB Bank, have introduced Aadhaar enhanced services, and that financial service firms including YES Bank and Spice Money are introducing Aadhaar-enabled payment systems.

The unveiling of this biometric-based payment ecosystem however is creating consternation among the general public. Sumandro Chattapadhyay, a director at the Centre for Internet and Society told the Guardian that Indian residents are concerned about the “data-sharing possibilities opened up by Aadhaar.”

He noted that Aadhaar “makes it easier for companies not only to share information on individuals’ consumption and mobility habits, but also to link this data up with public records like the electoral register. Both lead to significant threats to privacy of individuals.”

Chattapadhyay also told the Guardian that “the law governing use of the biometric database, fast-tracked through parliament last year, is flimsy when it comes to the private sector. Since India lacks a general privacy or data protection law, this leaves corporate use of Aadhaar services effectively unregulated.”

He told the UK newspaper that his greatest fear is that “private companies could eventually gain access to government-held personal data, such as income or medical records, while the government could use company data like phone records to target specific individuals in political campaigns.”

Despite these fears, the government continues to move ahead with link Aadhaar with more elements of the financial system. Recent reports have stated that the Indian government may allow citizens to use Aadhaar to file their income tax returns.

For more details visit https://cis-india.org/internet-governance/news/biometric-update-february-9-2017-rawlson-king-indian-public-concerned-about-fingerprint-payment-scheme

Indian Porn Ban is Partially Lifted But Sites Remain Blocked

pranesh — 2015-09-13T09:00:03Z

The Indian government made a quick about-face on its order to block hundreds of pornography websites on Tuesday, partially lifting the ban after political backlash against the moral policing.

The article was published in Wall Street Journal on August 5, 2015. Pranesh Prakash gave his inputs.

But the websites remained blocked because Internet service providers were afraid of legal trouble.

The new order from the Department of Telecommunications said that Internet service providers could unblock any of the 857 websites, so long as they don’t contain child pornography. However, the websites remain blocked because service providers say they have no way of knowing whether they contain child porn, and no control over whether they will in the future.

Ravi Shankar Prasad, the IT minister, said Tuesday night that the government would trim down the list of banned sites, to focus only on those that contain child porn.

“A new notification will be issued shortly. The ban will be partially withdrawn. Sites that do not promote child porn will be unbanned,” said Mr. Prasad on the TV news channel India Today.

The wording of the new order created confusion, because it appears to put the responsibility for policing the Internet for child pornography on service providers.

“How can we go ahead? What if something comes up tomorrow [on one of these sites], which has child porn, or something else?,” said an executive at an Indian service provider who asked not to be named.

“The onus cannot be put on the service providers. What the government is doing is inherently unfair, it is not what the law requires,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bangalore-based civil liberties advocacy group. It is the government’s job to determine what violates the law, not private companies, Mr. Prakash said.

For more details visit https://cis-india.org/internet-governance/news/the-wall-street-journal-august-5-2015-sean-mclain-indian-porn-ban-is-partially-lifted-but-sites-remain-blocked

Indian politicians yet to tap voters online: CIS’s Abraham

praskrishna — 2013-10-23T05:31:34Z

Sunil Abraham talks about the role online media will play in forthcoming elections and the behaviour of online readers of news.

The interview (taken by Venkatesh Upadhyay) was published in Livemint on October 22, 2013.

Sunil Abraham, 40, is executive director of the Centre for Internet and Society, a not-for-profit research organization that works on issues related to freedom of expression and privacy. Abraham was in New Delhi to speak on the impact of media, social media and technology on governance and democracy, organized by the Observer Research Foundation together with the Rosa Luxemburg Stiftung. On the sidelines of the conference, he talked about the role that online media will play in forthcoming elections as well the behaviour of online readers of news.

Edited excerpts from the interview:

How important will digital media be for the forthcoming elections?

I think the Internet in India is very different from, say, the one found in the US. So, our capacity to read from similar experience in their elections is limited. If you take the extensive exposure that the (Barack) Obama campaign had on the online space and the manner in which it supposedly helped the campaign, I don’t see that happening here.

Politicians and political parties very active on social media. You don’t think that will have an effect on elections?

I think the missing part of the equation till now is that there has not been any devising—to my knowledge—of targeting of voters through Facebook or Twitter. Our digital footprint leads to immense big-data opportunities, which I do not see politicians in India being able to exploit. Again, to give an example from the United States, there were certain instances there from where if you were member of a particular community, you could be targeted by political campaigns. Here, I don’t see that happening that easily.


Above: Sunil Abraham on the role of digital media in elections

So our politicians are wasting their time on social media?

Not entirely. In my view, one of the good things that the Internet does is that it has the capacity to democratize public opinion. One must also keep in mind that networks such as the ones available through social media are not homogenous. So nodes such as users who are opinion-makers and journalists are active on these networks, and so politicians can use these methods to reach out to more people.

Does the traditional media still have a role?
Of course. Traditional media is more likely to determine political outcomes in comparison to social media because most of the links that we see in social media are related to content that is created on traditional media. Now, of course, we can be sceptical of the role that traditional media plays in influencing the general mood of the country, but that is a different question.

Is there something peculiar about the manner in which readers interact with newspaper reports online?
I think one can usually see the comments section of some news sites littered with hurtful and hateful comments. So, some readers such as myself basically go through these comments to look at trolling and also sometimes for comic relief. But again, every news organization seems to be dealing with this differently. The Times of India, doesn’t, in my view, regulate its comments section. But one can see, say, in The Hindu, that readers’ comments are regulated and are usually very thoughtful.

Is there any particular reason why certain news readers respond the way they do?

Well, a part of the reason why people consuming news online comment and interact the way they do is that anonymity produces a level of freedom that allows people to be more brutal in their behaviour online.

At the same time, you can also see, in some instances, the chilling effects of surveillance, where people end up censuring their thoughts on issues. Of course, surveillance is not the answer. Societies need to deal with hateful threats on their own terms.

What will it take for politicians and public figures to get their message across, given the idiosyncrasies of the Indian digital media?
I think two components are crucial: trust and authenticity. For example, in the case of Wikipedia, there is an assumed amount of trust that the user has. The trust relationship between public figures who are active online and the public also is a two-way street. Politicians must also trust their common party members to use their social media presence as and when they want to. For example, why don’t they allow each and every member of the political party to man their Twitter handle for a day?

As for authenticity, the human mind can say whether an act by someone online is authentic or not.

Finally, what is your view on the role that larger Internet monopolies such as Facebook and Google are playing across the digital plane?

The Internet has also changed over the past 15 years. It used to be a decentralized network. Everybody was hopeful that it would have democratizing potential and, therefore, techno-utopianism was born. Now, it is increasingly clear that a small proportion of websites have 90% of the traffic and large corporations such as Google and Facebook play a significant role in configuring the attention economy. They are now also beginning to take this role very seriously themselves. In the case of Google, increasingly Google is using its power over the attention economy to play a role in the electoral process in India. They have been holding Google Hangouts and what they have been able to do is bring the public to the politicians.

Other concerns such as Facebook and Twitter through their walled-garden arrangements with telecom companies also play a similar role in configuring the attention economy. One is more innocuous—like the manner in which their algorithms are structured determining who shows up in their feeds.

For more details visit https://cis-india.org/news/livemint-venkatesh-upadhyay-october-22-2013-indian-politicians-yet-to-tap-voters-online

Indian police set up lab to monitor social media

praskrishna — 2013-03-19T09:23:12Z

Mumbai police have set up India's first "social media lab" to monitor Facebook, Twitter and other networking sites, sparking concerns about freedom of speech online.

This was published by AFP on March 18, 2013. This was also carried in Global Post on the same day. Sunil Abraham is quoted.

A specially-trained team of 20 police officers will staff the lab, which was launched over the week end and will work around the clock to keep an eye on issues being publicly discussed and track matters relating to public order.

"They will work under Special Branch. They will monitor and find out which topics are trending among the youth so we can plan law and order in a good way," police spokesman Satyanarayan Choudhary told AFP on Monday.

In November police sparked outrage and fierce debate about India's Internet laws by arresting two young women over a Facebook post criticising the shutdown of Mumbai after the death of a local hardline politician.

The pair were arrested under laws including section 66a of the Information Technology Act, which forbids "sending false and offensive messages through communication services" and can lead to three years in jail.

The case followed several arrests across the country for political cartoons or comments made online.

Sunil Abraham, executive director of the Bangalore-based Centre for Internet and Society research group, said the "natural reaction" was to worry about the new police lab given the way the law has been used.

"Police in the last four years have acted in an arbitrary and random fashion, often using the IT Act to settle political scores," he told AFP.

"When there's no crisis for the police, proactively keeping an eye on what people are saying or doing is overkill," he said.

Choudhary said the lab was not set to censor comments, echoing a statement made by police commissioner Satyapal Singh at the launch.

"By reading the mindset of what people are writing on various modes of communication, we will try to provide better and improved safety and security to the Mumbai citizens," Singh said.

For more details visit https://cis-india.org/news/afp-march-18-2013-indian-police-set-up-lab-to-monitor-social-media