We are anonymous, we are legion

Indian student in Cornell University hacks into ICSE, ISC database

praskrishna — 2013-07-02T07:39:45Z

A 20-year-old Indian student from Cornell University hacked into the database of ICSE (Class X) and ISC (Class XII) school exam results, exposed glaring anomalies in the marking system and went on to merrily write about his exploits in an online post.

The article by Kim Arora was published in the Times of India on June 6, 2013. Pranesh Prakash is quoted.

Kolkata-born Debarghya Das, majoring in computer science, says that all he had to do was run a simple program that entered all roll numbers after defining a range to get access to all the results. "It is shocking they haven't implemented a more secure system," Das told TOI on phone from New York.

After the result's data was crunched, analysed and plotted in graphs, Das discovered an interesting incongruity in the marking system: there are 33 different scores unattained between the passing mark of 35 and the maximum of 100 by the nearly 1,50,000 who appeared for the ICSE (Class X) exam. According to Das' findings, not a single student got the following marks: 36, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 56, 57, 59, 61, 63, 65, 67, 68, 70, 71, 73, 75, 77, 79, 81, 82, 84, 85, 87, 89, 91, 93. Similarly, in the case of ISC (Class XII exam) a set of 24 marks between 40 and 100 were found to be unattained.

When contacted, chairperson of the CI SCE (Council for the Indian School Certificate Examinations) Gerry Arathoon, refused to comment on both data security and the unattained marks. "I can't say anything until I have had a look at things myself," he said.

Das says that the missing marks indicate that perhaps they were tampered with. He offers mathematical and statistical arguments to defend his position in his online post. He says that the ISC anomaly appears to be a case of awarding "grace marks" and writes -- "Everything from 35 onwards, and most things from 23 onward seem blindly promoted to a pass mark."

	Pranesh Prakash, policy director at the Center for Internet and Society, says one needn't even be a techie to execute such a hack. "You don't need real technical skills to do this. You just need to figure out the ranges and feed them in. It is an interesting revelation that the website does nothing to obfuscate the javascript for security, but one can still retrieve data without that information. Once you have the data, it requires two minutes of programming to get it in a spreadsheet," says Prakash. In his post, titled "Hacking into the Indian Education System", Das wrote that he was doing this to "demonstrate how few measures our education board takes to hide such sensitive information".

Pranesh Prakash, policy director at the Center for Internet and Society, says one needn't even be a techie to execute such a hack. "You don't need real technical skills to do this. You just need to figure out the ranges and feed them in. It is an interesting revelation that the website does nothing to obfuscate the javascript for security, but one can still retrieve data without that information. Once you have the data, it requires two minutes of programming to get it in a spreadsheet," says Prakash. In his post, titled "Hacking into the Indian Education System", Das wrote that he was doing this to "demonstrate how few measures our education board takes to hide such sensitive information".

The student also told the TOI that it wasn't possible to change any values in marks and upload fudged data again, and that he made any significant progress in this direction only about 3-4 days after the results were announced. His online post says he also has the data for CBSE class XII. Though he hasn't yet made it public, he does admit it was harder to crack than CISCE, though not altogether difficult.

Schooled in Kolkata, Das is curren tly interning at Google, working on YouTube's captioning system. He is also working on a tongue-controlled game and has earlier been active in game and applet design. The idea to hack the results came to him fo llowing a desire to help two close friends who had recently taken the exams.

Das, nicknamed Deedy, told ToI that he worked on the ICSE and ISC results off and on for a week, but it essentially took about 4-5 hours to get all the data."It took me more time to write the blog post," says Das, referring to his 19-page post with all the graphs, data and explanations that is currently online.

For Das, there was only one other takeaway from the whole exercise. "Regardless of any tampering, it would be nice to see a transparent exam scheme. SAT (Scholastic Assessment Test) publishes everything related to the exam results every year. It is inconceivable that a national level exam board doesn't do that," he says.

For more details visit https://cis-india.org/news/the-times-of-india-kim-arora-june-6-2013-indian-student-in-cornell-university-hacks-icse-isc-databas

Indian public concerned about fingerprint payment scheme

praskrishna — 2017-02-12T15:10:23Z

The Guardian is reporting that a prominent think tank has found that the prospect of using fingerprint authentication for everyday payments is raising privacy concerns among the Indian public.

The blog post by Rawlson King was published by Biometric Update.com on February 9, 2017. Sumandro Chattapadhyay was quoted.

The Centre for Internet and Society says that many Indians are concerned about the “privacy implications” of using Aadhaar as a payment scheme.

Aadhaar is the 12-digit unique identification number issued by the Indian government to every individual resident of India. The Aadhaar project aims to provide a single, unique identifier which captures all the demographic and biometric details of every Indian resident. Currently, Aadhaar has issued over 900 million Aadhaar numbers. BiometricUpdate.com recently reported that over one billion people have now been enrolled.

The Indian government is intent on expanding the use of Aadhaar beyond the provision of social services to include financial transactions. The government’s “Digital India” initiative aims to create a “cradle-to-grave digital identity” that can enable a digital economy. Moving towards a digital economy will allow low income people to access the banking system. The use of Aadhaar for most transactions however would also allow the government to reduce the cash supply, which would work to eliminate untaxed cash transactions.

The government took a big step towards reducing the cash supply last November by removing 500 and 1,000 rupee notes, thereby eliminating 85 percent of the country’s circulating currency. Indian residents responded by setting up three million, enabled by fingerprint verification. BiometricUpdate.com has reported that banks, including DCB Bank, have introduced Aadhaar enhanced services, and that financial service firms including YES Bank and Spice Money are introducing Aadhaar-enabled payment systems.

The unveiling of this biometric-based payment ecosystem however is creating consternation among the general public. Sumandro Chattapadhyay, a director at the Centre for Internet and Society told the Guardian that Indian residents are concerned about the “data-sharing possibilities opened up by Aadhaar.”

He noted that Aadhaar “makes it easier for companies not only to share information on individuals’ consumption and mobility habits, but also to link this data up with public records like the electoral register. Both lead to significant threats to privacy of individuals.”

Chattapadhyay also told the Guardian that “the law governing use of the biometric database, fast-tracked through parliament last year, is flimsy when it comes to the private sector. Since India lacks a general privacy or data protection law, this leaves corporate use of Aadhaar services effectively unregulated.”

He told the UK newspaper that his greatest fear is that “private companies could eventually gain access to government-held personal data, such as income or medical records, while the government could use company data like phone records to target specific individuals in political campaigns.”

Despite these fears, the government continues to move ahead with link Aadhaar with more elements of the financial system. Recent reports have stated that the Indian government may allow citizens to use Aadhaar to file their income tax returns.

For more details visit https://cis-india.org/internet-governance/news/biometric-update-february-9-2017-rawlson-king-indian-public-concerned-about-fingerprint-payment-scheme

Indian Porn Ban is Partially Lifted But Sites Remain Blocked

pranesh — 2015-09-13T09:00:03Z

The Indian government made a quick about-face on its order to block hundreds of pornography websites on Tuesday, partially lifting the ban after political backlash against the moral policing.

The article was published in Wall Street Journal on August 5, 2015. Pranesh Prakash gave his inputs.

But the websites remained blocked because Internet service providers were afraid of legal trouble.

The new order from the Department of Telecommunications said that Internet service providers could unblock any of the 857 websites, so long as they don’t contain child pornography. However, the websites remain blocked because service providers say they have no way of knowing whether they contain child porn, and no control over whether they will in the future.

Ravi Shankar Prasad, the IT minister, said Tuesday night that the government would trim down the list of banned sites, to focus only on those that contain child porn.

“A new notification will be issued shortly. The ban will be partially withdrawn. Sites that do not promote child porn will be unbanned,” said Mr. Prasad on the TV news channel India Today.

The wording of the new order created confusion, because it appears to put the responsibility for policing the Internet for child pornography on service providers.

“How can we go ahead? What if something comes up tomorrow [on one of these sites], which has child porn, or something else?,” said an executive at an Indian service provider who asked not to be named.

“The onus cannot be put on the service providers. What the government is doing is inherently unfair, it is not what the law requires,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bangalore-based civil liberties advocacy group. It is the government’s job to determine what violates the law, not private companies, Mr. Prakash said.

For more details visit https://cis-india.org/internet-governance/news/the-wall-street-journal-august-5-2015-sean-mclain-indian-porn-ban-is-partially-lifted-but-sites-remain-blocked

Indian politicians yet to tap voters online: CIS’s Abraham

praskrishna — 2013-10-23T05:31:34Z

Sunil Abraham talks about the role online media will play in forthcoming elections and the behaviour of online readers of news.

The interview (taken by Venkatesh Upadhyay) was published in Livemint on October 22, 2013.

Sunil Abraham, 40, is executive director of the Centre for Internet and Society, a not-for-profit research organization that works on issues related to freedom of expression and privacy. Abraham was in New Delhi to speak on the impact of media, social media and technology on governance and democracy, organized by the Observer Research Foundation together with the Rosa Luxemburg Stiftung. On the sidelines of the conference, he talked about the role that online media will play in forthcoming elections as well the behaviour of online readers of news.

Edited excerpts from the interview:

How important will digital media be for the forthcoming elections?

I think the Internet in India is very different from, say, the one found in the US. So, our capacity to read from similar experience in their elections is limited. If you take the extensive exposure that the (Barack) Obama campaign had on the online space and the manner in which it supposedly helped the campaign, I don’t see that happening here.

Politicians and political parties very active on social media. You don’t think that will have an effect on elections?

I think the missing part of the equation till now is that there has not been any devising—to my knowledge—of targeting of voters through Facebook or Twitter. Our digital footprint leads to immense big-data opportunities, which I do not see politicians in India being able to exploit. Again, to give an example from the United States, there were certain instances there from where if you were member of a particular community, you could be targeted by political campaigns. Here, I don’t see that happening that easily.


Above: Sunil Abraham on the role of digital media in elections

So our politicians are wasting their time on social media?

Not entirely. In my view, one of the good things that the Internet does is that it has the capacity to democratize public opinion. One must also keep in mind that networks such as the ones available through social media are not homogenous. So nodes such as users who are opinion-makers and journalists are active on these networks, and so politicians can use these methods to reach out to more people.

Does the traditional media still have a role?
Of course. Traditional media is more likely to determine political outcomes in comparison to social media because most of the links that we see in social media are related to content that is created on traditional media. Now, of course, we can be sceptical of the role that traditional media plays in influencing the general mood of the country, but that is a different question.

Is there something peculiar about the manner in which readers interact with newspaper reports online?
I think one can usually see the comments section of some news sites littered with hurtful and hateful comments. So, some readers such as myself basically go through these comments to look at trolling and also sometimes for comic relief. But again, every news organization seems to be dealing with this differently. The Times of India, doesn’t, in my view, regulate its comments section. But one can see, say, in The Hindu, that readers’ comments are regulated and are usually very thoughtful.

Is there any particular reason why certain news readers respond the way they do?

Well, a part of the reason why people consuming news online comment and interact the way they do is that anonymity produces a level of freedom that allows people to be more brutal in their behaviour online.

At the same time, you can also see, in some instances, the chilling effects of surveillance, where people end up censuring their thoughts on issues. Of course, surveillance is not the answer. Societies need to deal with hateful threats on their own terms.

What will it take for politicians and public figures to get their message across, given the idiosyncrasies of the Indian digital media?
I think two components are crucial: trust and authenticity. For example, in the case of Wikipedia, there is an assumed amount of trust that the user has. The trust relationship between public figures who are active online and the public also is a two-way street. Politicians must also trust their common party members to use their social media presence as and when they want to. For example, why don’t they allow each and every member of the political party to man their Twitter handle for a day?

As for authenticity, the human mind can say whether an act by someone online is authentic or not.

Finally, what is your view on the role that larger Internet monopolies such as Facebook and Google are playing across the digital plane?

The Internet has also changed over the past 15 years. It used to be a decentralized network. Everybody was hopeful that it would have democratizing potential and, therefore, techno-utopianism was born. Now, it is increasingly clear that a small proportion of websites have 90% of the traffic and large corporations such as Google and Facebook play a significant role in configuring the attention economy. They are now also beginning to take this role very seriously themselves. In the case of Google, increasingly Google is using its power over the attention economy to play a role in the electoral process in India. They have been holding Google Hangouts and what they have been able to do is bring the public to the politicians.

Other concerns such as Facebook and Twitter through their walled-garden arrangements with telecom companies also play a similar role in configuring the attention economy. One is more innocuous—like the manner in which their algorithms are structured determining who shows up in their feeds.

For more details visit https://cis-india.org/news/livemint-venkatesh-upadhyay-october-22-2013-indian-politicians-yet-to-tap-voters-online

Indian police set up lab to monitor social media

praskrishna — 2013-03-19T09:23:12Z

Mumbai police have set up India's first "social media lab" to monitor Facebook, Twitter and other networking sites, sparking concerns about freedom of speech online.

This was published by AFP on March 18, 2013. This was also carried in Global Post on the same day. Sunil Abraham is quoted.

A specially-trained team of 20 police officers will staff the lab, which was launched over the week end and will work around the clock to keep an eye on issues being publicly discussed and track matters relating to public order.

"They will work under Special Branch. They will monitor and find out which topics are trending among the youth so we can plan law and order in a good way," police spokesman Satyanarayan Choudhary told AFP on Monday.

In November police sparked outrage and fierce debate about India's Internet laws by arresting two young women over a Facebook post criticising the shutdown of Mumbai after the death of a local hardline politician.

The pair were arrested under laws including section 66a of the Information Technology Act, which forbids "sending false and offensive messages through communication services" and can lead to three years in jail.

The case followed several arrests across the country for political cartoons or comments made online.

Sunil Abraham, executive director of the Bangalore-based Centre for Internet and Society research group, said the "natural reaction" was to worry about the new police lab given the way the law has been used.

"Police in the last four years have acted in an arbitrary and random fashion, often using the IT Act to settle political scores," he told AFP.

"When there's no crisis for the police, proactively keeping an eye on what people are saying or doing is overkill," he said.

Choudhary said the lab was not set to censor comments, echoing a statement made by police commissioner Satyapal Singh at the launch.

"By reading the mindset of what people are writing on various modes of communication, we will try to provide better and improved safety and security to the Mumbai citizens," Singh said.

For more details visit https://cis-india.org/news/afp-march-18-2013-indian-police-set-up-lab-to-monitor-social-media

Indian PM Narendra Modi’s digital dream gets bad reception

praskrishna — 2015-09-29T15:23:04Z

As Indian Prime Minister Narendra Modi told Silicon Valley’s most powerful chief executives this week how his government “attacked poverty by using the power of networks and mobile phones’’, the entire population of the state of Kashmir remained offline — by order of the state.

The article by Amanda Hodge was published in the Australian on September 29, 2015. Sunil Abraham gave inputs.

“I see technology as a means to empower and as a tool that bridges the distance between hope and opportunity,” Mr Modi said yesterday on a trip in which he will also discuss development at the UN.

Earlier, in a “town hall” meeting with Facebook chief Mark Zuckerberg Mr Modi hailed the power of social media networks that gave governments the opportunity to correct themselves “every five minutes”, rather than every five years.

His remarks during his Digital India tour of the US west coast sparked a storm of Twitter protest.

The northern state’s former chief minister Omar Abdullah, who noted the “irony of listening to Prime Minister Modi lecturing about connected digital India, while we are totally disconnected”.

The ban on mobile and broadband internet in Jammu and Kashmir was imposed last Friday, the beginning of the Muslim holiday of Eid-ul-Zuha during which animals are slaughtered and the meat fed to the poor, for fear social media could inflame tensions over the state government’s decision to enforce a beef ban.

It was to have lasted 24 hours but — notwithstanding Twitter feedback — was extended twice as a “precautionary” measure.

As Mr Modi outlined his dreams of a broadband network connecting the country’s most remote communities, millions of New Delhi mobile phone users continued their daily wrestle with line dropouts.

“We are bringing technology, transparency, efficiency, ease and effectiveness in governance,” he said, as in New Delhi the government talked of pulling down more mobile towers.

Centre for Internet and Society director Sunil Abraham said yesterday: “Schizophrenia between rhetoric and reality (on digital policy) is the global standard for all world leaders.

“Politicians in opposition are invariably opposed to surveillance and in favour of free speech but the very day that politician assumes office even if it is someone as splendid as Barack Obama, they change their opinions on these topics and become pro-surveillance and pro-censorship.”

Certainly successive Indian governments have had a patchy record on such issues. Last March India’s activist Supreme Court struck down a controversial section of the Information Technology Act which made posting information of a “grossly offensive or menacing character” punishable by up to three years’ jail.

That month police in northern Uttar Pradesh arrested a teenager for a Facebook post, which they said “carried derogatory language against a community”.

Previous cases under the former Congress-led government include that of a university professor detained for posting a cartoon about the chief minister of West Bengal and the arrest of two young women over a Facebook post criticising the shutdown of Mumbai following the death of a Hindu right politician.

While Mr Modi’s government welcomed the Supreme Court ruling as a “landmark day for freedom of speech and expression”, last month it attempted to block 857 random porn sites.

Notwithstanding the gulf between Mr Modi’s digital dream rhetoric and the reality at home, his second US visit in 17 months has reaped dividends. Google has committed to a joint initiative to roll out free Wi-Fi to 500 railway stations across the country, and Qualcomm has pledged a $US150 million ($213m) tech startup fund.

But Mr Abraham warned of the potential for such investments to compromise net neutrality — the principle of allowing internet users access to all content and applications.

For more details visit https://cis-india.org/internet-governance/news/the-australian-amanda-hodge-september-29-2015-indian-pm-narendra-modi-digital-dream-gets-bad-reception

Indian Netizens Criticize Online Censorship of ‘Jihadi’ Content

subha — 2015-02-10T02:43:17Z

The article on online censorship by Subhashish Panigrahi was published in Global Voices on January 6, 2015.

Click to view the article on Global Voices here.

Indian Netizens Criticize Online Censorship of ‘Jihadi’ Content · Global Voices


Mock-up of a blocked URL (Image: Subhashish Panigrahi, CC-by-SA 3.0)

The Government of India in the last week of 2014 asked Internet service providers (ISPs) to block 32 websites including code repository Github, video streaming sites Vimeo and Dailymotion, online archive Internet Archive, free software hosting site Sourceforge and many other websites on the basis of hosting anti-India content from the violent extremist group known as ISIS.

The blanket block on many resourceful sites has been heavily criticized on social media and blogs by reviving the hashtag #GoIblocks that evolved in the past against internet censorship by the government.

Nikhil Pahwa at MediaNama notes that this time many ISPs published the list of the blocked sites:

Typically, users are not informed about which websites are blocked, so this was a welcome move from the ISP.

“Say No to Censorship. #GOIBlocks” (taken from Facebook page of Free Software Foundation, Tamil Nadu)

In 2012, opposition party leader Narendra Modi (who is now India's Prime Minister) tweeted against the URL blocks by the earlier ruling of India's National Congress when then-Minister of Communications and Information Technology Kapil Sibal ordered to block 300 websites. Many eyebrows were raised when Modi repeated the move this time around.

Internet censorship in India has been increasingly prominent since 1999 when Pakistani newspaper Dawn was blocked by the Videsh Sanchar Nigam Limited for post-Kargil War views against India. These caught heavy criticism from netizens, often under the hashtag #IdiotKapilSibal. Since then there have been many instances of government-mediated censorship, particularly with the enactment of India's Information Technology Act of 2000.

Arvind Gupta, head of Information Technology for India's ruling Bharatiya Janata Party, tweeted to clarify that the sites were blocked as advised by the Anti-Terrorism Squad.

Arvind Gupta ✔ @buzzindelhi
Follow

The websites that have been blocked were based on an advisory by Anti Terrorism Squad, and were carrying Anti India content from ISIS. 1/2

3:11 PM - 31 Dec 2014

362 Retweets 82 favorites

After agreeing to remove anti-India content posted by accounts that appeared to have some association with ISIS, weebly.com, vimeo.com, Pastebin, dailymotion.com and gist.github.com were unblocked.

These websites have undertaken not to allow pasting of such propaganda information on their website and also work with the government to remove such material as per the compliance with the laws of land.

- Ministry of Communications and Information Technology, Government of India (posted in Business Standard)

Arvind Gupta ✔ @buzzindelhi
Follow

Action has been initiated to unblock -- http://weebly.com , http://vimeo.com , http://dailymotion.com and (1/2)

12:36 AM - 1 Jan 2015

63 Retweets 25 favorites

Arvind Gupta ✔ @buzzindelhi

gist.github.com :: http://wap.business-standard.com/article/news-ians/government-decides-to-unblock-four-websites-out-of-32-114123101162_1.html … (2/2)

12:36 AM - 1 Jan 2015

39 Retweets 12 favorites

For more details visit https://cis-india.org/internet-governance/blog/global-voices-january-6-2015-subhashish-panigrahi-indian-netizens-criticize-online-censorship-of-jihadi-content

Indian net service providers too play censorship tricks

praskrishna — 2013-02-13T04:20:53Z

The study by a Canadian university has found that some major Indian ISPs have deployed web-censorship and filtering technology.

The article by T Ramachandran was published in the Hindu on February 9, 2013. Sunil Abraham is quoted.

Your internet service provider (ISP) could be blocking some content. A study conducted by a Canadian university has found that some major Indian ISPs have deployed web-censorship and filtering technology widely used in China and some West Asian countries.

The findings, published on January 15, were the result of a search for censorship software and hardware on public networks like those operated by ISPs.

A research team at Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs, University of Toronto, found a software-hardware combo package called PacketShaper being used in many parts of the world, including India.

The study identified the presence of four PacketShaper installations on the networks of three major ISPs in India during the period of study in late 2012. These ISPs had been earlier “implicated in filtering to some degree,” the report said.

The deployment of such traffic management technologies by ISPs could threaten privacy, freedom of expression and competition, said Sunil Abraham, Executive Director of the Bangalore-based NGO, Centre for Internet and Society.

He said tools like PacketShaper could be used by ISPs for two types of censorship —“to block entire websites or choke traffic on certain services or destinations in a highly granular fashion.”

The U.S.-based producers of the technology, Blue Coat Systems, are quite open about the product features on the company’s website. They say it could be used to control and weed out undesirable content. It could also be used to slow down or speed up the operation of programmes and content flow to achieve the goals set by the operators of the networks.

Transparency is the key

Technology experts said such products could be used to exercise legitimate control over the internet traffic and prioritise the use of bandwidth and resources, if used ethically.

“If done in a transparent manner that does not discriminate against different actors within a class it does benefit the collective interest of the ISP’s clients. However, it could also be used to engage in hidden censorship against legitimate speech and also for anti-competitive behaviour,” said Mr. Abraham.

The study focussed on countries where concerns exist over “compliance with international human rights law, legal due process, freedom of speech, surveillance, and censorship.”

For more details visit https://cis-india.org/news/the-hindu-feb-9-2013-t-ramachandran-indian-net-service-providers-too-play-censorship-tricks

Indian music streaming service Gaana hacked, millions of users’ details exposed

praskrishna — 2015-08-22T16:44:25Z

Indian music streaming service Gaana, which has over 7.5 million monthly visitors, has been compromised by a hacker and its user information database is now exposed.

The hacker, who goes by the moniker Mak Man and appears to be based in Lahore, Pakistan, posted a link to a searchable database of Gaana user details on his Facebook page. Enter a user’s email address and it spits out their full name, email address, MD5-hashed password, date of birth Facebook and Twitter profiles and more.

The hack appears to be a SQL injection-based exploit of Gaana’s systems, but the intention behind it is unknown. The database shows more than 12.5 million users are currently registered on Gaana.

Mak Man also posted images of the service’s admin panel.

It’s worrying that an online service from one of India’s biggest internet companies (Times Internet) is vulnerable to attacks like this.

With user details exposed, it may not do much good to simply change your Gaana password, as it will reflect in the hacker’s database. You’re better off deactivating your account until the issue is resolved, and changing your email, Facebook and Twitter passwords if they’re the same as on Gaana right away.

Update: Since our story broke, Gaana has taken its site offline and the exposed database isn’t returning search results when we queried it with test data.

The hacker has updated his database page with the following message: “The vulnerable parameter I was using here, has been patched by the Admin
Now the question is, Was this the only vulnerable parameter I had .. ? ;)”

Update 2: Times Internet CEO Satyan Gajwani tweeted that only login credentials were accessed and no financial or sensitive personal data was leaked.

Gajwani attempted to contact the hacker on Facebook and acknowledged the issue. He added that the attack was the hacker’s way of highlighting Gaana’s vulnerability.

The exposed database has since been removed on Gajwani’s request. All Gaana users’ passwords have been reset.

Gajwani also sought to reassure his followers that no user data was stored and that the passwords were hashed. Hacker

Mak Man also confirmed this in a Facebook post. However, that can’t be confirmed and you’d best change your passwords for any social accounts and email addresses associated with your Gaana profile.

According to Pranesh Prakash, Policy Director at Center for Internet and Society in Bangalore, India, the MD5 hashing algorithm which appears to have been used for securing passwords isn’t very strong and could easily be unscrambled using a rainbow table to get the plain-text version of the data.

Prakash also says that for added security, Gaana should:

Stop using MD5 as its password hashing function and instead look at stronger password derivation functions like scrypt, bcrypt, or PBKDF2.
Sanitize its SQL inputs to prevent against malicious SQL injections.
Enable two-factor authentication for users to log in securely.
Urge its users to use long passphrases instead of short complicated passwords and to never to reuse a password.

➤ Gaana [via The Geek Byte]

For more details visit https://cis-india.org/internet-governance/news/tnwnews-may-28-2015-abhimanyu-ghoshal-indian-music-streaming-service-gaana-hacked-millions-of-users-details-exposed

Indian mobiles go quiet amid SMS curbs

praskrishna — 2012-08-27T07:15:01Z

India’s 900m-plus mobile telephones have fallen unusually quiet since Saturday, when the government curbed text and multimedia messages for 15 days in an attempt to dispel panic among north-easterners fearing attacks from angry Muslims.

This article written by Victor Mallet in New Delhi and James Crabtree in Mumbai was published in Financial Times on August 21, 2012. Additional reporting by Jyotsna Singh in New Delhi. Pranesh Prakash is quoted.

The order limiting the number of SMS and MMS messages to five a day from each pre-paid account – which comprise 97 per cent of the market – has disrupted personal communications and threatens to squeeze the revenues of the mobile operating companies.

The government has also urged social media websites including Facebook and Twitter to remove “inflammatory” content it said had helped spread rumours that caused an exodus of migrants from some cities last week. Access to 245 web pages containing doctored videos and images had been blocked, the government claimed, and the relevant sites told to take the pages down.

Indians send more than a billion text messages a day, although it is not clear how many people have been affected by the restrictions or how many of the messages are mass mailings.

Akshat Dwivedi, 20, an undergraduate student at Delhi University, said the restrictions were “a stupid idea”.

“How can the government take away something that has become a basic, fundamental need today?” he said. “The ban has affected mostly students who use pre-paid connections because pre-paid connections are cheaper and more affordable for students like us. The ban has hugely disrupted our life. There are many people who rely on text messages because you can’t always call everybody.”

Civil rights activists wary of censorship accept that the ban may have been necessary to ease ethnic and religious tensions.

“There is the fear that the state will exercise inordinate powers,” said Akila Shivdas, a civil and consumer rights activist. “But regulation and state control are two different things … This is an opportunity to look at regulation seriously.”

India’s mobile industry earned about $20bn in revenue last year, of which 15-18 per cent was from data services, according to the Cellular Operators Association of India, a trade body. This suggests operators are set to suffer a loss of about $133m for the 15-day period, according to COAI figures.

“When we are going through the trauma of increased costs, being challenged on revenues does not help,” said Rajan Matthew, COAI director-general. “The government’s heart is in the right place in trying to address this issue ... But when we are fighting for every nickel and dime, this loss is not a small amount.”

Other analysts cautioned that the likely revenue impact would be much smaller, noting that most customers bought pre-paid SMS packages. “I’m not saying there will be no loss, but it will not be dramatic”, said Rohit Chordia, a telecoms analyst at Kotak, a Mumbai-based brokerage.

Industry sources and analysts also questioned the government’s decision to impose an extended nationwide ban, rather than experimenting with more limited short-term restrictions targeted to particular trouble spots.

“Some kind of limitation on communication was a reasonable step, but restricting everyone to just five per day I don’t think is reasonable at all,” said Pranesh Prakash, programme manager at the Centre for Internet and Society, a Bangalore-based think tank.

Thousands of north-easterners – physically similar to the Bodo people who have been fighting Muslim migrants over land and political power in Assam – fled from cities such as Bangalore and Hyderabad last week after threats of violence sent by SMS.

Muslims in Mumbai had previously been inflamed by media messages purportedly showing brutality towards their fellow followers of Islam, though the Indian government said some pictures were doctored and had been uploaded from Pakistan.

Events in Bangalore, said Pavan Duggan, a lawyer specialising in IT issues, were “a classic case of mobile cyberterrorism”. He backed the government’s measures despite concerns about censorship. “Obviously there are some rumblings, but these are still small murmurs because everyone is very clear that the national interest will come over [mobile] revenues.”

For more details visit https://cis-india.org/news/www-ft-com-aug-21-2012-victor-mallet-james-crabtree-indian-mobiles-go-quiet-amid-sms-curb

Indian IT firms not ready for European Union's proposed privacy laws, only a few compliant with GDPR

Admin — 2018-04-18T00:56:20Z

Only a third of Indian IT firms are compliant with the European Union's General Data Protection Regulation (GDPR), which will come into force on 25 May, according to a media report.

The article was published in First Post on March 26, 2018.

The GDPR, the EU's new online privacy rules, is designed to protect users' online privacy. The European Parliament has adopted the regulation but European governments have yet to approve the text.

“Only 30-35 percent of all IT/ITeS companies have started their journey to work towards GDPR compliance,” Jaspreet Singh, Cyber Security Partner at EY, was quoted as saying by The Economic Times.

The GDPR is applicable to companies globally, and has significant potential financial penalties. Damages of any breach of privacy of user data from Europe could cost companies as much as four percent of their revenue, according to The Economic Times. For the Indian IT sector, Europe ranks number two in terms of the amount of business it drives, with US still taking the lead.

Indian firms, according to Business Standard, are struggling to understand the GDPR policies. A survey by EY had shown that 60 percent of Indian respondents were unfamiliar with the new regulation.

"When asked to describe their company’s current status with respect to complying with the GDPR, only 33 percent of respondents said that they have a plan, while 39 percent said that they are not familiar with the GDPR at all and 17 percent said that they have heard of the GDPR but have not yet taken any action," EY’s Global Forensic Data Analytics Survey 2018 had said.

What the GDPR is all about?

The GDPR attempts to unify data protection laws across the EU. It applies to all companies, regardless of location, that process the personal data of people living in the European Union. It aims to strengthen the protection of EU citizens' personal details. It will apply to all companies, including those outside of the EU.

The GDPR is considered the biggest shake-up of personal data privacy rules since the birth of the internet. It is intended to give European citizens more control over their online information.

Under the new regulation, users will be asked once and for all whether to accept cookies, rather than every time they visit a new website. Users will have the option of going invisible online, while the rules enshrine the so-called "right to be forgotten" legislation. The industries most deeply affected will be those that collect large amounts of customer data and include technology companies, retailers, healthcare providers, insurers and banks.

Companies must be able to provide European customers with a copy of their personal data and under some circumstances delete it at their behest. They will also be required to report data breaches within 72 hours.

How Indian firms will be affected?

According to a study published by The Centre for Internet and Society, as a result of GDPR, data protection procedures like breach notification; excessive documentation and appointment of data protection officer may have to be incorporated in the Indian laws as well.

"As non – compliance involves high fines, inability of India or the organizations situated in India to qualify as data secure destinations is likely to divert business opportunities to safer locations," the study said.

(With inputs from agencies)

For more details visit https://cis-india.org/internet-governance/news/first-post-march-26-2018-indian-it-firms-not-ready-for-european-unions-proposed-privacy-laws-only-a-few-compliant-with-gdpr

Indian Internet Lawsuit Puts Spotlight on Freedom of Expression

praskrishna — 2012-01-19T08:59:15Z

In India, Internet giants such as Google and Facebook are fighting a lawsuit after the government authorized their prosecution for online content on their sites deemed to be offensive. The case has put the spotlight on free speech in the world’s largest democracy.

The criminal lawsuit filed by the editor of New Delhi-based Urdu weekly Akbari accuses 21 Internet companies of violating Indian law. Vinay Rai alleged that online material on their websites has the potential to incite religious conflict.

Rai said his colleagues brought to his attention images of Prophet Muhammad which could offend Muslims. He cited other images and text which could hurt sentiments of Hindus and Christians. Rai wants Internet companies to screen content before it is posted.

Google and Facebook have asked the Delhi High Court to dismiss the case against them. In an appeal, they said it is impossible to filter all content or stop individuals from posting material online.

Editor Rai filed the case after the government indicated its approval for the prosecution. The official go-ahead came weeks after the government also raised a similar demand.

Voluntary framework

Telecommunications Minister Kapil Sibal told Internet company representatives to come up with a voluntary framework to keep offensive material off the net. After confronting them with photos and material derogatory of Indian Prime Minister Manmohan Singh and Congress Party leader Sonia Gandhi, he said the companies had not cooperated.

Both the court case and the government’s demands have stoked fears of net censorship in the world’s largest democracy.

Advocacy groups say the dispute between authorities and websites began simmering last year when India tightened laws to block content which could be deemed offensive. Citizens and officials can ask sites to block objectionable material and failure to comply within 36 hours can attract penalties or imprisonment of up to seven years.

Sunil Abraham, with the Center for Internet and Society in India, said these rules have the potential to curtail debate and discussion on the net.

“These limits are vague. They allow for all sorts of subjective tests by private parties and we predicted they would have a chilling effect on freedom of expression online," Abraham said. "Policy in India has been headed in a very worrisome direction."

Abraham pointed out that one of his organization’s recent studies indicates that, faced with the threat of stiff penalties, most service providers removed content when asked to do so, even when it was not offensive or controversial.

Free media?

The government insists its objective is not to encroach on the fundamental right of free speech guaranteed by India’s democratic constitution. The clarification came from Minister Kapil Sibal after his meetings with Internet companies last month.

"This government does not believe in censorship," noted Sibal. "This government does not believe in either directly or indirectly interfering in the freedom of the press, and we have demonstrated that time and again."

India does have a vibrant free media and Internet access is largely free, unlike in China. But in a country with a history of religious violence, authorities have long tussled with the dilemma of balancing free speech with the need to not inflame sentiments among religious groups. India was one of the first countries to ban Salman Rushdie’s “The Satanic Verses.”

Other books and articles have also faced bans. Many are challenged in courts and several have been overturned. Now the focus is on the Internet and questions are being raised about whether the web should or can be policed.

Online freedom

In a remark widely quoted in the domestic media, a judge hearing the case had warned websites that like China, India might be compelled to block some of them if they did not create means to curb material seen as offensive.

However, Abraham from the Center of Internet and Society hopes that, as the latest case navigates its way through Indian courts, online freedom will come up the winner.

"I think the executive in India has always been very conservative in freedom of expression. It is usually the courts in India that protect freedom of expression, the precedent," Abraham said. "So we are every hopeful that the current case is in the appropriate venue, and we are confident that, as in the past, the judiciary in India will stand on the side of freedom of expression."

With 100 million people surfing the web, India has the world’s third largest number of Internet users after China and the United States.

Published in the Voice of America on 19 January 2012. Sunil Abraham is quoted in this.

For more details visit https://cis-india.org/news/indian-internet-lawsuit-puts-spotlight-on-freedom-of-expression

Indian Intermediary Liability Regime: Compliance with the Manila Principles on Intermediary Liability

divij — 2018-05-20T15:14:21Z

This report assesses the compliance of the Indian intermediary liability framework with the Manila Principles on Intermediary Liability, and recommends substantive legislative changes to bring the legal framework in line with the Manila Principles.

The report was edited by Elonnai Hickok and Swaraj Barooah

The report is an examination of Indian laws based upon the background paper to the Manila Principles as the explanatory text on which these recommendations have been based, and not an assessment of the principles themselves. To do this, the report considers the Indian regime in the context of each of the principles defined in the Manila Principles. As such, the explanatory text to the Manila Principles recognizes that diverse national and political scenario may require different intermediary liability legal regimes, however, this paper relies only on the best practices prescribed under the Manila Principles.

The report is divided into the following sections

Principle I: Intermediaries should be shielded by law from liability for third-party content
Principle II: Content must not be required to be restricted without an order by a judicial authority
Principle III: Requests for restrictions of content must be clear, be unambiguous, and follow due process
Principle IV: Laws and content restriction orders and practices must comply with the tests of necessity and proportionality
Principle V: Laws and content restriction policies and practices must respect due process
Principle VI: Transparency and accountability must be built into laws and content restriction policies and practices
Conclusion

Download the Full report here

For more details visit https://cis-india.org/internet-governance/blog/indian-intermediary-liability-regime

Indian ID crisis unveils Aadhaar doubts

praskrishna — 2013-03-15T04:52:49Z

Two separate organizations are capturing biometric data of over 1 billion Indians, creating fresh doubts in the government's justification to catalogue citizens.

The blog post by Mahesh Sharma was published in ZD Net on March 14, 2013. Sunil Abraham is quoted.

A new US$1 billion national identity card project has undermined the Indian government's ambitious "Aadhaar" project to catalogue the biometric details of over 1 billion citizens.

Indians' biometric details are being captured by two separate organizations: the National Population Register, to develop the resident identity card (RIC); and the Unique Identification Authority of India (UIDAI), to create a unique identifier (UID), commonly referred to as "Aadhaar" number.

Both projects are designed to streamline the distribution of welfare and social services to citizens--a process that is currently mired in corruption.

In an interview with ZDNet, Centre for Internet and Society's India executive director, Sunil Abraham, said the ID smartcard and ID number are fundamentally different, not complementary, as the government has previously said.

"Those are two very separate visions. You cannot mix them up and make some kind of salad and have a little bit of this and a little bit of that. You have to go the whole hog in one direction," Abraham said.

He said it was easier for the government to proceed with both projects, rather than cancel Aadhaar, which has been criticized over reports there were duplicate biometric information and data abuse.

"The government is afraid it made a mistake," Abraham said. "It could just continue to create a hodgepodge of both ideas, both visions, and continue making big mistakes and have ghosts [in the UID system] and large scale corruption."

On March 12, India's house of representatives, the Lok Sabha, Member of Parliament, P. Karunakaran asked the Minister of State, R.P.N. Singh, to clarify the overlap between the proposed biometric identity card and UID. Singh confirmed the government would spend over US$1 billion (55.52 billion rupees) to issue a resident identity card (RIC) that featured the Aadhaar number.

"The RIC would enable both online and offline authentication of identity in a secure manner and will complement the efforts of Aadhaar," Singh said in a written response. To avoid duplication, he explained that if citizen biometric data was already captured by the UIDAI, then the Aadhaar number would be recorded on the RIC smart card.

Independent lawyer Usha Ramanathan told ZDNet the government had overstepped its legal bounds. She said the UIDAI has demonstrated biometrics are imperfect but the government has persisited with the project.

"The UID is lawless. Now we will have an RIC which will be lawless," Ramanathan said. "All we are offered is the UIDAI 'confidence' that the project will work."

"Privacy and personal security continue to be unprotected. And there seems to be an inexhaustible amount of money to experiment on the whole population," she noted.

For more details visit https://cis-india.org/news/zdnet-mahesh-sharma-march-14-2013-indian-id-crisis-unveils-aadhar-doubts

Indian govt blocks 40 smut sites, forgets to give reason

praskrishna — 2013-07-01T09:04:26Z

Don't mind us, we're just censoring your content for you...

The article by Phil Muncaster was published in "The Register" on June 27, 2013. Sunil Abraham is quoted.

The Indian government has ordered ISPs to block 39 smut flick web sites hosted outside the country without giving any explanation, stoking further fears of online censorship by the back door.

Most of the sites are web forums and so allow for the uploading of naughty images and URLs where smut-seekers can download their grumble flicks, according to Times of India.

However, the sites claim to operate under the 18 USC 2257 rule, meaning actors are (supposedly) over 18 years of age, and there is apparently no indication from the Department of Telecom's order why ISPs are being asked to comply.

The message greeting web users who try to visit a blocked site now reads as follows:

This website has been blocked until further notice either pursuant to court orders or on the directions issued by the Department of Telecommunications.

While the law, updated in 2011, does forbid production, transmission and sharing of smutty content in India - therefore requiring internet cafes, for example, to block such content - there is no ban on consumption, especially from sites hosted outside India.

Sunil Abraham, director of Indian not-for-profit the Centre for Internet and Society, told ToI that the government is probably interpreting the law to serve its own ends, and that its ISP order “is a clear overreach”.

The Union government has certainly been quick in the past to order blocks on any content deemed inappropriate.

Facebook and Google were forced to remove “objectionable content” from their Indian sites last year after complaints it was offensive to Muslims, Hindus and Christians.

The government was also one of many across the globe to force Google to block notorious YouTube video Innocence of Muslims.

A controversial anti-piracy ruling last June, meanwhile, led to a clumsy, large-scale block on a number of legitimate sites in the country – drawing the ire of hacktivist group Anonymous.

The government also closed hundreds of sites and social media accounts in August last year in a bid to prevent the escalation of sectarian violence across the country.

In fact, the number of content removal requests received by Google increased by 90 per cent from July-December 2012 compared with the previous six months.

For these reasons, India only enjoys “Partly Free” status, according to the Freedom on the Net 2012 report from not-for-profit Freedom House.

For more details visit https://cis-india.org/news/the-register-phil-muncaster-june-27-2013-indian-govt-blocks-40-smut-sites-forgets-to-give-reason