We are anonymous, we are legion

Indian Feminist Judgment Project Workshop

Admin — 2018-10-16T13:34:06Z

Swaraj Paul Barooah was a discussant at the Indian Feminist Judgment Project 'righting together' workshop organised in Delhi by Jindal from October 6 - 7, 2018.

Swaraj provided commentary on the re-writing of a patent application from a feminist perspective. Click here to view the agenda.

For more details visit https://cis-india.org/internet-governance/news/indian-feminist-judgment-project-workshop

Indian experts doubt government ban on porn sites will be effective

praskrishna — 2016-07-01T15:00:32Z

The Indian government directed service providers to block 240 websites but doubts have surfaced over the legality of such an order.

This was published in ZDNet on June 20, 2016.

Last year, the Indian government identified more than 850 websites that provided escort services but action has been initiated only with respect to 240 such websites after a Mumbai court issued an order to ban them last week.

These sites were banned under the provision of Section 79(3)(b) of the Information Technology Act, 2000 -- as their content relate to morality and decency as given in Article 19(2) of the Constitution of India -- on June 13 after a committee of experts in the Indian Home Ministry recommended action against them.

But experts doubt whether the government can proscribe them in view of a lack of adequate legislation. Jaspreet Grewal, programme officer with the Centre for Internet and Society, said that though the websites offering escort services may potentially be in violation of the law, they cannot be banned under the existing provisions of the IT Act.

Even the government appears to be in a dilemma, as although it notified internet service providers to disable 857 websites on July 31, 2015, it modified the orders four days later, saying that the service providers were free "not to disable" any of the 857 sites if they did not have child pornographic content.

Following an uproar, with netizens lashing out at the government on the social media platforms such as Reddit and Twitter saying that it was trying to impose censorship and also curb freedom of expression, the government decided to rescind its July 31 directives.

According to a report in Delhi-based English daily Hindustan Times, Indian Minister for Communication and Information Technology Ravi Shankar Prasad rejected that the present government was a Talibani government, as being said by some of the critics. "Our government supports free media, respects communication on social media, and has respected freedom of communication always," he said.

The minister, while making a statement in Parliament last month, admitted that it was a significant challenge to filter the sites with pornographic content as most of the pornographic sites were hosted outside the country, where viewing pornography is legal.

"These websites keep on changing the names, domain addresses, and hosting platforms from time to time, making it difficult to filter or block such websites using technical tools available in the market," he added.

The minister also said that the government was asking the service providers regularly to upgrade their infrastructure and technology to effectively address the shortcomings with regard to identifying and blocking encrypted websites. "The government is also in regular touch with social networking sites, having their offices in India, to disable objectionable contents at the source from their websites," he added.

However, the government seems to be treading cautiously and an indication to this effect was given by a senior official in the Department of Electronics and Information Technology (DeitY). "Though a debate is taking place for a long time, the government is now taking a calibrated approach," DeitY Joint Secretary Rajiv Bansal said at an ICANN event held in Delhi on Thursday.

He also felt that banning the websites was not a solution as new sites were sprouting to replace the blocked ones.

For more details visit https://cis-india.org/internet-governance/news/zdnet-vl-srinivasan-june-20-2016-indian-experts-doubt-government-ban-on-porn-sites-will-be-effective

Indian Cricket Board Exposes Personal Data of Thousands of Players

Admin — 2018-05-18T05:01:50Z

The IT security researchers at Kromtech Security Center discovered a trove of personal and sensitive data belonging to around 15,000 to 20,000 Indian applicants participating in cricket seasons 2015-2018.

The blog post was published on Hack Read on May 15, 2018.

The authority responsible for protecting this data was The Board of Control for Cricket in India (BCCI) but it was left exposed to the public in two misconfigured AWS (Amazon Web Service) S3 cloud storage buckets.

According to the analysis from Kromtech researchers, the data was divided into different categories of players including those under 19 years old. The data was accessible to anyone with an Internet connection and basic knowledge of using AWS cloud storage.

The data was discovered earlier this month and included names, date of birth, place of birth, permanent addresses, email IDs, proficiency details, medical records, birth certificate number, passport number, SSC certificate number, PAN card number, mobile number, landline and phone number of the person who can be contacted in case of emergency.

Screenshot of one of the files that were exposed (Image credit: Kromtech)

At the time of publishing this article, the BCCI was informed by Kromtech researchers and both misconfigured buckets were secured. However, this is not the first time when such sensitive information was leaked online. In 2017, Bangalore-based Centre for Internet and Society (CIS) found that names, addresses, date of birth, PAN card details, Aadhaar card numbers and other relevant details of millions of Indian citizen could be found with just a simple Google search.

On the other hand, lately, AWS buckets have been making headlines for the wrong reasons. Until now, there have been tons of cases in which misconfigured AWS buckets have been found carrying highly sensitive and confidential data such as classified NSA documents or details about US Military’s social media spying campaign.

In two such cases, malicious hackers were able to compromise AWS buckets belonging to Tesla Motors and LA Times to secretly mine cryptocurrency. Therefore, if you are an AWS user make sure your cloud server is properly secured.

For more details visit https://cis-india.org/internet-governance/news/hack-read-waqas-may-15-2018-indian-cricket-board-exposes-personal-data-of-thousands-of-players

Indian Court Strikes Down Section of Law Punishing Offensive Posts

praskrishna — 2015-03-26T15:40:06Z

The Indian Supreme Court on Tuesday struck down a section of a law that allowed the authorities to jail people for offensive online posts, in a judgment that was regarded as a landmark ruling on free speech in India.

The blog post by Nida Najar and Suhasini Raj was published on the website of NDTV on March 25, 2015. Sunil Abraham gave his inputs.

The law stipulated that a person could be jailed for up to three years for any communication online that was, among other things, "grossly offensive," "menacing" or "false," and for the purpose of causing "annoyance," "inconvenience" or "injury." The provisions, which led to highly publicized arrests in recent years, had been roundly criticised by legal experts who called them vague and argued that they had been used in some cases to stifle dissent.

Calling the wording so vague that "virtually any opinion on any subject would be covered by it," the court said "if it is to withstand the test of constitutionality, the chilling effect on free speech would be total."

Sunil Abraham, the executive director of the Center for Internet & Society, which is based in Bangalore, called the decision "amazing."
"It is in continuation of a great tradition in India: that of apex courts consistently, over the years, protecting the citizens of India from violations of human rights," he said.

India is considered by some to be one of the world's most freewheeling democracies, but the law reflected the ambivalence with which Indian officials have sometimes treated freedom of expression, occasionally citing the Constitution's allowance of "reasonable restrictions" on free speech in order to ban books, movies and other material about subjects like sex, politics and religion.

The government recently blocked the screening in India of the BBC documentary "India's Daughter," about the Delhi gang rape in 2012 that made international news.

The law, the Information Technology (Amendment) Act, was passed by parliament shortly after the three-day terrorist attacks on Mumbai in 2008. It granted the authorities more expansive powers to monitor electronic communications for reasons of national security. That section was not a part of the court case.

In the past, critics have been particularly worried that the section of the law that was struck down was ripe for misuse at the hands of police officials often beholden to political parties.

Last week, a young man in the northern Indian state of Uttar Pradesh became one of the latest people to be arrested under the law when the police said he incorrectly attributed a polarizing statement to the lawmaker Azam Khan on Facebook.

Other highly publicized cases include the arrest in 2012 of a professor accused of sharing cartoons mocking the chief minister of West Bengal state on Facebook and the arrest of two young women after one shared a Facebook post criticizing the virtual shutdown of Mumbai following the death of a revered right-wing political leader there. The professor is still contesting his case in court, while the case against the two young women was dropped in 2013, according to the Press Trust of India.

In a separate part of the Supreme Court judgment, the justices made it harder to force websites to take down content, although a legal expert said it remained to be seen how much of an impediment the ruling would be to blocking content.

For more details visit https://cis-india.org/internet-governance/news/ndtv-nida-najar-and-suhasini-raj-march-25-2015-indian-court-strikes-down-section-of-law-punishing-offensive-posts

Indian companies need to boost encrpytion adoption rate: experts

praskrishna — 2016-08-10T14:36:05Z

Most banks do not follow Reserve bank of India’s standard 64/128-bit encryption policy due to laxity and unavailability of funds.

The article by Koustav Das was published in the Deccan Chronicle on August 9, 2016. Sunil Abraham was quoted.

A recent report by security software firm Sophos highlighted the increasing number of online attacks on Indian businesses, suggesting strong encryption policies can change the existing scenario.

As per a SophosLab research, India’s threat exposure rate has been pegged at 16.7 per cent, ranking fifth in terms of highest percentage of endpoints exposed to malware attack.

The research said cyber-criminals have developed a keen sense of luring organisations on the basis of location, language and disguise, leading to an acute increase in the number of targeted attacks.

Global Experts have explained that digital attackers have taken the aid of advanced malware including deadly ransomwares, which involve locking or capturing an organisation’s valued data and demanding money to unlock it.

In future, ransomware have been predicted to become deadlier, allowing hackers to take control of an organisation’s entire network security.

Not only financial and IT companies but Government websites also face similar obstructions due to lack of updated security tools.

Mohit Puri, Head of Pre-sales, Sophos India and SAARC, said, "India faces increased risk from cyber-criminals due to its high economic growth, which has left several companies to re-think their security strategy."

Reactive to attacks, not proactive

Though Puri mentioned that Indian enterprises have been trying to prevent such attacks, large fissures in network security have made the task easier for online criminals.

One of the major reasons for companies failing to prevent advanced cyber-attacks can be attributed to the lack of pragmatic solutions, albeit their awareness about the situation.

Puri said, “While companies are aware about security threats to our systems, we are still not there in terms of how we are trying to mitigate these threats.”

According to Sunil Abraham, Director of The Centre For Internet and Society (CIS), there are manifold issues that have led to the scenario of India’s poor online security.

He said that Indian businesses and financial organisations recognize the situation but do not want to allocate budget for updating their security infrastructure.

“The problem with cyber-security is just like smoking; people are aware of it but they do not care about the warnings. Companies know about the looming threats but need an episode to make a move towards updating their network infrastructure,” Abraham added.

Enterprises also struggle due to the absence of sufficient cyber-security professionals in the country. Abraham said, “There are uncountable software professionals in India but the story is totally opposite when it boils down to cyber-security professionals.”

Weak encryption adoption

According to technology enthusiast Blaise Crowly, Co-Founder & Head Of Security Design Gladius & Schild, "Cryptography—a broader form of encryption—can be defined as a branch of mathematical algorithms that can be used to securely protect data."

Crowly added, “It is the one of the strongest form of all defence mechanisms against cyber attacks.”

However, a Sophos assessment—State of Encryption Today—where 1,700 Indian IT managers were surveyed, showed the ignorance of companies towards integrating strong encryption tools.

Out of the total number of participants, 61 per cent felt encryption holds significant importance in protecting a company’s proprietary data.

Others had peculiar reasons—18 per cent felt that encryption would help avoid incurring additional costs after a breach and 23 per cent just wanted to avoid negative publicity of the company.

Even in case of banks, reports suggested that most banks do not follow Reserve bank of India’s (RBI) standard 64/128 bit encryption policy due to laxity and unavailability of funds.

“Indian organisations need to take a second look at their security posture and deploy up-to-date synchronized security solutions that are able to combat today’s threats as well as tomorrows,” said Puri.

Government’s role

A 2015 CIS study, titled “How India Regulates Encryption” mentioned that under section 84A of the IT Act, the government has the sole authority to prescribe modes and methods of encryption.

Though the government has not yet issued any rules in exercise of these powers, it had released earlier released a draft encryption policy on September 21, 2015. However, it failed to pass it due to wide-spread criticism regarding certain mandates in the draft.

In addition, the Internet Service Providers (ISP) License Agreement, between the Department of Telecommunication (DoT) and Internet Service Providers (ISP), limit the use of encryption up to 40-bit key length in symmetric algorithms—an extremely weak standard.

Although it cannot be enforced if organisations employ third-party encryption systems, it becomes extremely expensive for them. In such a scenario, companies hesitate in using better encryption standards.

CIS Director Sunil Abraham said, “To solve the issue, the government should work towards incentivising and enforcing strong security infrastructure which will help companies get these features at a lower price.”

Adding to the aforementioned statement, Crowly highlighted that current security standards set by the government cannot adeptly counter advanced threats.

“OpenSSL, LibNaCl and similar protocols provide free implementation of encryption schemes that companies can use. The only issue is that companies and government agencies should show proper diligence in hiring experts in this field,” Crowly concluded.

For more details visit https://cis-india.org/internet-governance/news/deccan-chronicle-koustav-das-august-9-2016-indian-companies-need-to-boost-encryption-adoption-rate

Indian biometric ID plan faces court hurdle

praskrishna — 2013-10-03T10:58:31Z

Supreme Court in India rules -- for now -- against plan to make biometric ID mandatory for receiving services.

This article by John Ribeiro was published in Computer World on September 25, 2013. Pranesh Prakash is quoted.

A controversial biometric project in India, which could require people to produce their biometric IDs to collect government subsidies, has received a significant setback from the country's Supreme Court.

The court ruled this week in an interim order that people cannot be required to have the controversial Aadhaar identification to collect state subsidies, even as the Unique Identification Authority of India (UIDAI), the government agency that manages the project, has been trying to promote the Aadhaar number as proof of identity for a variety of services including banking.

The UIDAI has said that the scheme is voluntary, but some states and agencies have attempted to link the identification to the implementation of programs such as cash subsidies for cooking gas that benefit even the middle and richer classes.

"I signed up for Aadhaar only to ensure that I continue to get a gas cylinder at reasonable rates," said an executive in Bangalore who had queued up a few months ago for an Aadhaar number. The state of Maharashtra, for example, aims to be the first state in the country to roll out Aadhaar-linked subsidy transfers to LPG (liquified petroleum gas) consumers across all the districts in the state.

Pending a final order, the court ruled that "....no person should suffer for not getting the Adhaar card inspite of the fact that some authority had issued a circular making it mandatory...."

UIDAI Chairman Nandan Nilekani did not immediately agree to discuss the court order.

The Aadhaar project is the result of an executive order, and is not backed by a law passed by India's Parliament, so its legality can be in question, said Pavan Duggal, a cyberlaw expert who practices before India's Supreme Court. The project could be in violation of the country's Information Technology Act and rules which cover collection, handling and processing of sensitive personal data, he added.

Aadhaar, though said to be voluntary, could also be in violation of fundamental rights of the Indian constitution relating to right to life and privacy, as a perception is being created that the ID will be required for subsidies and benefits, Duggal added.

The government should have considered getting an enabling law passed by Parliament for the data collection as also a strong privacy law to prevent misuse of Aadhaar related data and collation of multiple databases using Aadhaar, because of the privacy issues involved and its implications on fundamental rights, said Pranesh Prakash, Policy Director at the Centre for Internet and Society in Bangalore.

The biometric project, which collects 10 fingerprints, iris scan and other information such as name, date of birth and address, has been criticized by a number of privacy groups who worry that the data could at some point be misused by the government. There is also a risk that such large databases could be hacked, putting at risk information of people. It is not clear what are the measures taken by UIDAI to protect the authenticity and correctness of the biometric information, and prevent access by foreign powers, Duggal said.

The Aadhaar number now allows different agencies including private organizations to collect and exchange data between them, which may be useful to marketers, for example, Prakash said. Previously, it wasn't practical as the agencies would have difficulty ensuring that the information was about the same person, he added.

The Supreme Court has also ruled that illegal immigrants should not be enrolled under the Aadhaar program, which is meant to facilitate subsidized services to Indian citizens. The Aadhaar, which does not collect citizenship information, is likely to be misused by illegal migrants, activists have said.

One of the many challenges facing the Aadhaar program is that village-level politicians and influence peddlers cook up data to enroll under subsidy schemes people who are not eligible for benefits, or people who are nonexistent. The traditional paper ration card scheme and voter rolls are usually stuffed with nonexistent people or people who do not typically qualify for benefits.

Aadhaar was expected to remove these discrepancies by more accurate collection of data on people who enrolled under the scheme. But a number of users have complained that the Aadhaar cards they have received have errors in their names, addresses and other details. One newspaper reported that an Aadhaar applicant received a card that had the face of a dog in place of his photograph.

UIDAI aims to provide 600 million Aadhaar numbers to residents by 2014.

For more details visit https://cis-india.org/news/computerworld-september-25-2013-john-ribeiro-indian-biometric-id-plan-faces-court-hurdle

Indian activists slam FCC decision to ditch net neutrality

Admin — 2017-12-18T15:27:04Z

Indian net neutrality activists are assured the ongoing net neutrality tussle in the US will have no impact on India.

The article by Kul Bhushan was published in the Hindustan Times on November 23, 2017.

Net neutrality is in the news again. This time it is because the US’ Federal Communications Commission (FCC) has decided to formally scrap existing protections that are meant to keep access to internet equitable.

India had its own tryst with the idea of net neutrality after it blocked the zero-rating programmes by social networking giant Facebook — which proposed to rollout the Internet.org or Free Basics project in February last year.

A powerful social media campaign made Facebook back down and the Telecom Regulatory Authority of India (TRAI) to announce that ‘differential pricing’ — a practice where some services or sites are priced in a special manner — will no longer be allowed.

Some people who were at the forefront of the net neutrality campaign in here almost three years ago have expressed their displeasure over the FCC’s move.

“I think the approach the FCC is taking is flawed. Spectrum is a public resource and it needs to be spent on maximisation of public good. That public good, and the utility of the Internet is based on the freedom that people have to create new apps and services, without needing permission from ISPs, or the fear that ISPs might discriminate against them or favour their competitors. This is what net neutrality enables,” said Nikhil Pahwa, founder of publication Medianama and one of the activists.

“By going against Net Neutrality, FCC chairman Ajit Pai is attacking the core of what makes the Internet tick. We didn’t let that happen in India, and instead, focused on increasing competition between ISPs and telecom operators, because of which we’ve see broadband prices drop, quality of service improve, a tremendous growth in Internet users in India. For this, we owe a great debt to all those who supported Net Neutrality, especially the TRAI,” he added.

Apar Gupta, who is closely associated with the ‘Save the Internet’ initiative and is the co-founder of Internet Freedom Foundation, said, “FCC’s move to take back the internet order is a huge setback to the global campaign to ensure open internet because it undermines the net neutrality.”

“I don’t think the development should impact the regulatory process in India considering TRAI’s strong support for net neutrality. I hope that TRAI comes out with a comprehensive network neutrality regulation in the future,” he responded when asked about the possible impact on India of the FCC move.

Sunil Abraham, executive director of Bangalore-based research organisation Centre for Internet and Society, said there should be no impact on India from the FCC move.

He also slammed FCC chief Pai’s attempt to change the existing net neutrality rules. “What Ajit Pai is trying to do he’s not saying he will not regulate. He is saying when companies violate net neutrality principles they should be transparent about it. He hopes the magic of market competition will help resolve the problem,” he said

“Pai’s approach to the net neutrality might work in a market where there is a lot of competition. In the US, there is no competition and that in case damage will be immediate,” he added.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-kul-bhushan-november-23-2017-indian-activists-slam-fcc-decision-to-ditch-net-neutrality

India:Privacy in Peril

bhairav — 2013-09-25T09:56:22Z

The danger of mass surveillance in India is for real. The absence of a regulating law is damning for Indians who want to protect their privacy against the juggernaut of state and private surveillance.

The article was originally published in the Frontline on July 12, 2013.

At the concluding scene of his latest movie, Superman disdainfully flings a surveillance drone down to earth in front of a horrified general. “You can’t control me,” he tells his military minder. “You can’t find out where I hang up my cape.” This exchange goes to the crux of surveillance: control. Surveillance is the means by which nation-states exercise control over people. If the logical basis of the nation-state is the establishment and maintenance of homogeneity, it is necessary to detect and interdict dissent before it threatens the boundedness and continuity of the national imagination. This imagination often cannot encompass diversity, so it constructs categories of others that include dissenters and outsiders. Admittedly, this happens less in India because the foundation of the Indian nation-state imagined a diverse society expressing a plurality of ideas in a variety of languages secured by a syncretic and democratic government that protected individual freedoms. Unfortunately, this vision is still to be realised, and the foundational idea of India continues to be challenged by poor governance, poverty, insurgencies and rebellion. Consequently, surveillance is, for the modern nation-state, a condicio sine qua non—an essential element without which it will eventually cease to exist. The challenge for democratic nation-states is to find the optimal balance between surveillance and the duty to protect the freedoms of its citizens.

History of wiretaps

Some countries, such as the United States, have assembled a vast apparatus of surveillance to monitor the activities of their citizens and foreigners. Let us review the recent controversy revealed by the whistle-blower Edward Snowden. In 1967, the U.S. Supreme Court ruled in Katz vs United States that wiretaps had to be warranted, judicially sanctioned and supported by probable cause. This resulted in the passage of the Wiretap Act of 1968 that regulated domestic surveillance. Following revelations that Washington was engaging in unrestricted foreign surveillance in the context of the Vietnam war and anti-war protests, the U.S. Congress enacted the Foreign Intelligence Surveillance Act (FISA) in 1978. FISA gave the U.S. government the power to conduct, without judicial sanction, surveillance for foreign intelligence information; and, with judicial sanction from a secret FISA court, surveillance of anybody if the ultimate target was a foreign power. Paradoxically, even a U.S. citizen could be a foreign power in certain circumstances. Domestically, FISA enabled secret warrants for specific items of information such as library book borrowers and car rentals.

Following the 9/11 World Trade Centre attacks, Congress enacted the Patriot Act of 2001, Section 215 of which dramatically expanded the scope of FISA to allow secret warrants to conduct surveillance in respect of “any tangible thing” that was relevant to a national security investigation. In exercise of this power, a secret FISA court issued secret warrants ordering a number of U.S. companies to share, in real time, voice and data traffic with the National Security Agency (NSA). We may never know the full scope of the NSA’s surveillance, but we know this: (a) Verizon Communications, a telecommunications major, was ordered to provide metadata for all telephone calls within and without the U.S.; (b) the NSA runs a clandestine programme called PRISM that accesses Internet traffic, such as e-mails, web searches, forum comments and blogs, in real time; and (c) the NSA manages a comprehensive data analysis system called Boundless Informant that intercepts and analyses voice and data traffic around the world and subjects them to automated pattern recognition. The documents leaked by Snowden allege that Google, Facebook, Apple, Dropbox, Microsoft and Yahoo! participate in PRISM, but these companies have denied their involvement.

India fifth-most monitored

How does this affect India? The Snowden documents reveal that India is the NSA’s fifth-most monitored country after Iran, Pakistan, Jordan and Egypt. Interestingly, China is monitored less than India. Several billion pieces of data from India, such as e-mails and telephone metadata, were intercepted and monitored by the NSA. For Indians, it is not inconceivable that our e-mails, should they be sent using Gmail, Yahoo! Mail or Hotmail, or our documents, should we be subscribing to Dropbox, or our Facebook posts, are being accessed and read by the NSA. Incredibly, most Indian governmental communication, including that of Ministers and senior civil servants, use private U.S. e-mail services. We no longer enjoy privacy online. The question of suspicious activity, irrespective of the rubric under which suspicion is measured, is moot. Any use of U.S. service providers is potentially compromised since U.S. law permits intrusive dragnet surveillance against foreigners. This clearly reveals a dichotomy in U.S. constitutional law: the Fourth Amendment’s guarantees of privacy, repeatedly upheld by U.S. courts, protect U.S. citizens to a far greater extent than they do foreigners. It is natural for a nation-state to privilege the rights of its citizens over others. As Indians, therefore, we must clearly look out for ourselves.

Privacy and personal liberty

Unfortunately, India does not have a persuasive jurisprudence of privacy protection. In the Kharak Singh (1964) and Gobind (1975) cases, the Supreme Court of India considered the question of privacy from physical surveillance by the police in and around homes of suspects. In the latter case, the court found that some of the Fundamental Rights “could be described as contributing to the right to privacy”, which was subject to a compelling public interest. This insipid inference held the field until 1994 when, in the Rajagopal (“Auto Shankar”, 1994) case, the Supreme Court, for the first time, directly located privacy within the ambit of the right to personal liberty recognised by Article 21 of the Constitution. However, Rajagopal dealt specifically with the publication of an autobiography, it did not consider the privacy of communications. In 1997, the Supreme Court considered the question of wiretaps in the People’s Union for Civil Liberties (PUCL) case. While finding that wiretaps invaded the privacy of communications, it continued to permit them subject to some procedural safeguards which continue to be routinely ignored. A more robust statement of the right to privacy was made by the Delhi High Court in the Naz Foundation case (2011) that decriminalised consensual homosexual acts; however, there is an appeal against the judgment in the Supreme Court.

Legislative silence

Judicial vagueness has been compounded by legislative silence. India does not have a law to operationalise a right to privacy. Consequently, a multitude of laws permit daily infractions of privacy. These infractions have survived because they are diverse, dissipated and quite disorganised. However, the technocratic impulse to centralise and consolidate surveillance and data collection has, in recent years, alarmed many citizens. The state hopes to, through enterprises such as the Central Monitoring System (CMS), the Crime and Criminals Tracking Network and System (CCTNS), the National Intelligence Grid (NATGRID), the Telephone Call Interception System (TCIS) and the Unique Identification Number (UID), replicate the U.S. successes in surveillance and monitoring and profiling all its citizens. However, unlike the U.S., India proposes to achieve this without an enabling law. Let us consider the CMS. No documents have been made available that indicate the scope and size of the CMS.

From a variety of police tenders for private equipment, it appears that the Central government hopes to put in place a system that will intercept, in real time, all voice and data traffic originating or terminating in India or being carried by Indian service providers. This data will be subject to pattern recognition and other automated tests to detect emotional markers, such as hate, compassion or intent. The sheer scale of this enterprise is intimidating; all communications in India’s many languages will be subject to interception and testing designed to detect different forms of dissent. This mammoth exercise in monitoring is taking place—it is understood that some components of the CMS are already operational—without statutory sanction. No credible authorities exist to supervise this exercise, no avenues for redress have been identified and no consequences have been laid down for abuse.

Statutory Surveillance

In a recent interview, Milind Deora, Minister of State for Communications and Information Technology, dismissed public scepticism of the CMS saying that direct state access to private communications was better for privacy since it reduced dependence on the interception abilities of private service providers. This circular argument is both disingenuous and incorrect. No doubt, trusting private persons with the power to intercept and store the private data of citizens is flawed. The leaking of the Niira Radia tapes, which contain the private communications of Niira Radia taped on the orders of the Income Tax Department, testifies to this flaw. However, bypassing private players to enable direct state access to private communications will preclude leaks and, thereby, remove from public knowledge the fact of surveillance. This messy situation may be obviated by a regime of statutory regulation of warranted surveillance by an independent and impartial authority. This system is favoured by liberal democracies around the world but conspicuously resisted by the Indian government.

The question of privacy legislation was recently considered by a committee chaired by Justice Ajit Prakash Shah, a former judge of the Delhi High Court who sat on the Bench that delivered the Naz Foundation judgment. The Shah Committee was constituted by the Planning Commission for a different reason: the need to protect personal data that are outsourced to India for processing. The lack of credible privacy law, it is foreseen, will result in European and other foreign personal data being sent to other attractive processing destinations, such as Vietnam, Israel or the Philippines, resulting in the decline of India’s outsourcing industry. However, the Shah Committee also noted the absence of law sufficient to protect against surveillance abuses. Most importantly, the Shah Committee formulated nine national privacy principles to inform any future privacy legislation (see story on page 26). In 2011, the Department of Personnel and Training (DoPT) of the Ministry of Human Resource Development, the same Ministry entrusted with implementing the Right to Information Act, 2005, leaked a draft privacy Bill, marked ‘Secret’, on the Internet. The DoPT Bill received substantive criticism from the Attorney General and some government Secretaries for the clumsy drafting. A new version of the DoPT Bill is reported to have been drafted and sent to the Ministry of Law for consideration. This revised Bill, which presumably contains chapters to regulate surveillance, including the interception of communications, has not been made public.

The need for privacy legislation cannot be overstated. The Snowden affair reveals the extent of possible state surveillance of private communications. For Indians who must now explore ways to protect their privacy against the juggernaut of state and private surveillance, the absence of regulatory law is damning. Permitting, through public inaction, unwarranted and non-targetted dragnet surveillance by the Indian state without reasonable cause would be an act of surrender of far-reaching implications.

Information, they say, is power. Allowing governments to exercise this power over us without thought for the rule of law constitutes the ultimate submission possible in a democratic nation-state. And, since superheroes are escapist fantasies, without the prospect of good laws we will all be subordinate to a new national imagination of control and monitoring, surveillance and profiling. If allowed to come to pass, this will be a betrayal of the foundational idea of India as a free and democratic republic tolerant of dissent.

Bhairav Acharya is a constitutional lawyer practising in the Supreme Court of India. He advises the Centre for Internet & Society, Bangalore, on privacy law and other constitutional issues.

For more details visit https://cis-india.org/internet-governance/blog/frontline-cover-story-july-12-2013-bhairav-acharya-privacy-in-peril

India: The New Front Line in the Global Struggle for Internet Freedom

praskrishna — 2012-06-18T07:10:21Z

The government tussles with Internet freedom activists in the world's largest democracy.

This article was published in the Atlantic on June 7, 2012

This Saturday, Indian Internet freedom advocates are planning to stage a nation-wide protest against what they see as their government's increasingly restrictive regulation of the Internet. An amorphous alliance of concerned citizens and activist hackers intend to use the streets and the Internet itself to make their opposition felt.

Over the last year, as Americans were focused on the domestic debates surrounding the Stop Online Piracy Act (SOPA) and the Protect Intellectual Property Act (PIPA), or on the more brazen displays of online censorship by mainstays of Internet restriction like China, Iran and Pakistan, India was rapidly emerging as a key battleground in the worldwide struggle for Internet freedom.

The confrontation escalated in April 2011, when the Ministry of Communications and Information Technology introduced sweeping new rules regulating the nature of material that Internet companies could host online. In response, civil liberties groups, Internet freedom supporters, and a growing assembly of online activist hackers have been fighting back, initiating street protests, organizing online petitions, and launching -- under the banner of the "Anonymous" hacker group -- a torrent of distributed denial of service (DDoS) attacks against Indian government and industry web sites.

The April 2011 rules, an update to India's Information Technology Act (IT Act) of 2000 (amended in 2008), popularly known as the "intermediary guidelines," instruct online "intermediaries" -- companies that provide Internet access, host online content, websites, or search services -- to remove, within 36 hours, any material deemed to be "grossly harmful, harassing, blasphemous," "ethnically objectionable," or "disparaging" by any Internet user who submits a formal objection letter to that intermediary. Under the guidelines, any resident of India can compel Google, at the risk of criminal and/or civil liability, to remove content from its site that the resident finds politically, religiously, or otherwise "objectionable."

Information Technology Minister Kapil Sibal -- the intermediary guidelines' most important government evangelist, and the head of the agency responsible for administering the guidelines -- even instructed Internet companies to go one step further and start pre-screening content for removal before it was flagged by concerned users. This requires companies like Facebook, in effect, to determine what material might offend its users and thus violate Indian law, and then remove it from the website. With over 100 million Internet users in India, no company could possibly monitor all its content through human intervention alone; web companies would have to set up filters and other mechanisms to take down potentially objectionable content more or less automatically.

India's constitution, in large part crafted in response to the modern country's harrowing history of religious and communal violence, allows for "reasonable restrictions" on free speech. Indian officials have at times banned certain books, movies, or other materials touching on such sensitive subjects as religion and caste.

Left with little choice but to comply or risk legal action, Google, Yahoo!, and other Internet companies acquiesced and began pulling down webpages after receiving requests to do so. Yet many companies refused to remove all the content requested, prompting Mufti Aijaz Arshad Qasm, an Islamic scholar, and journalist Vinay Rai, respectively, to file civil and criminal suits against 22 of the largest Internet companies operating in India. The targets, including Google, Yahoo!, Facebook, and Microsoft, were accused of failing to remove material deemed to be offensive to the Prophet Mohammed, Jesus, several Hindu gods and goddesses, and various political leaders.

The companies have had some success in the litigation: Google India, Yahoo!, and Microsoft have all been dropped from the civil case after the court heard preliminary arguments; the Delhi High Court recently dismissed Microsoft from the criminal case. Otherwise, both cases are still ongoing.

India has taken its Internet regulation internationally, asking the United States government to ensure that India-specific objectionable content is removed from sites such as Facebook, Google, and YouTube, and suggesting that these companies should be asked to relocate their servers to India in to order better to regulate the content locally.

The Indian government's state-centric view of Internet regulation and governance is also clear in their approach to international governance. Citing the need for more governmental input in the Internet's development and what happens online, India formally proposed the creation of the Committee for Internet Related Policies (CIRP) at the 2011 United Nations General Assembly. The CIRP would be an entirely new multilateral UN body responsible for coordinating virtually all Internet governance functions, including multilateral treaties.

To be fair, some Indians see these as efforts not to impose censorship but to allow a greater degree of Indian and international control over a system considered by many in India and elsewhere to be under the thumb of the U.S. government.

Yet some Internet experts in both India and the West are criticizing the CIRP proposal as part of "thinly masked efforts to control or shape the Internet," as one Indian official put it. They warn that a state-centric system of Internet governance could lead to serious restrictions on the type of information available online, and damage the Internet's potential for innovation.

India's Internet freedom advocates are straining to keep up with the rapid pace of the last year. But, now, they're gathering some steam. Online petitions against the intermediary guidelines, the IT Act, and censorship in India in general have appeared on Change.org and Facebook; protest videos are popping up on Youtube. The Centre for Internet and Society, a web-focused think tank, released an extensive report highlighting the intermediary guidelines' effects on freedom online. The Internet Democracy Project organized a day-long training program on freedom of expression and censorship for bloggers entitled "Make Blog not War." FreeSoftware Movement Karnataka organized a protest of hundreds of students in Bangalore, India's IT hub. And Save Your Voice activists held a sit in outside Delhi's Jantar Mantar monument to pressure lawmakers.

Yet, not all the opposition has been so civil. Hackers, operating under the umbrella of the techno-libertarian hacker community, "Anonymous," are waging their own, less lawful fight against the government as well as the Internet companies that have, in their view, too readily complied with the government's censorship demands.

On May 17, Anonymous hackers attacked a number of Indian government websites, including the Indian Supreme Court, the Reserve Bank of India, the ruling Congress Party and its coalition partners, as well as the opposition Bhartiya Janata Party (BJP), making them all inaccessible for several hours.

Moreover, just this past week, Anonymous broke into the websites and servers of a number of Internet Service Providers, including Reliance Communications, seemingly to punish them for complying with government orders to block file-sharing hosts such as Pirate Bay and Vimeo. Once in the ISPs' servers, the hackers accessed their lists of blocked sites -- which they then distributed to media outlets. They also redirected people who tried to reach Reliance's site to an Anonymous protest page.

Building on the momentum of these attacks, and on the anti-censorship outrage growing across India, Anonymous has called for a national day of protest in 11 Indian cities this Saturday, and an additional series online attacks against government and industry websites. The occupy-style protests -- which Anonymous insists will be non-violent -- are to include awareness campaigns on Facebook and other social networking sites. Protesters are being asked to don the Guy Fawkes mask, a symbol now associated with Anonymous, among other protest movements, both in the streets and on their Facebook profiles.

It's unclear how much support the June 9 protest will receive, or how serious the planned Anonymous attacks with be, but given the attention that the announcement has attracted in the Indian media, it seems likely that people will at least be paying attention. And even if this weekend the protest fails to attract the type of large and vocal response protest organizers are hoping it will, that it's come so far is an indication that neither side looks ready to back down.

Still, the government has given some small signs recently that it is reconsidering its position on the "intermediary guidelines," if not on Internet regulation more generally. Information Technology Minister Sibal, under pressure from the political opposition and after Parliament Member P. Rajeeve tabled a motion to seek rescission of the new rules, indicated that he would reconsider his previous positions, and the government has agreed to reexamine the rules.

This is an encouraging sign, although it's unlikely that any government action will come in time to forestall this weekend's protests. But even if the intermediary guidelines are ultimately rescinded, India will likely continue its soul-searching on how it deals with the Internet.

As the world's largest democracy and a model for much of the developing world, and with an Internet population anticipated to surpass that of the United States in the next few years, India is an important, maybe the most important, test case for the future of Internet freedom globally. Should India continue down a course of restriction, other nations eager to restrict online speech could see precedent to impose their own technical and political barriers to free expression online. It would be a tragic irony if India, as one of the developing world's greatest beneficiaries of the information revolution, ended up curbing those same free flows of information and ideas.

For more details visit https://cis-india.org/news/india-the-new-front-line-in-the-global-struggle-for-internet-freedom

India: Social Media Censorship to Contain ‘Cyber-Terrorism'?

praskrishna — 2012-08-27T03:36:37Z

This is the second post in the 2-part series about the perceived role of social media in the wake of the Assam clashes that spilled across the country and threatened to upset the nation's peace.

Written by Aparna Ray. This post was published in GlobalVoices on August 24, 2012. Pranesh Prakash's analysis is quoted in this. The first post can be found here.

As the Indian government sought to block bulk SMS, MMS, webpages and specific social media urls, justifying its step as an attempt to control viral rumor-mongering and “cyber-terrorism”, there was a lot of discussion on the mainstream media (MSM) about how social media was fast becoming a “double-edged sword” and how the recent events brought out the “mischief potential of social media in full play“. These MSM opinions, some of which offered tacit support the idea of reigning in social media, did not go unnoticed by netizens. For example, Media Crooks asked:

So what’s with the rant against the Twitterati and social media by these media celebs?

Blogger Amrit Hallan at Writing Cave wondered if the MSM had an underlying motive for creating a hype around the ‘dangers' of social media. He wrote:

People in the mainstream media have always been at loggerheads with the free spirit of social networking websites that empowers everybody to express opinions and spread ideas…(they) have been gleefully recommending the curtailment (of social media). Social networking and blogging continuously make their job hard. The moment they try to spread some misinformation, it is countered by Twitter or blogs with factually correct information, often posted by people close to the ground.

Tweets too expressed similar concerns and sentiments:

Priya James (@james_priya): I think by now, MSM coverage volumes of 'social media terrorism' has now surpassed even their basic coverage of Assam situation!

Gaurav Sabnis (@gauravsabnis): Politician-MSM nexus in India so blatantly clear with blame for NE rumors laid squarely at social media's doors.

Rajeev Nagpal (@rajeevnagpal): In #India the #MSM can't tolerate any one challenging their hold. No wonder they support censoring social media #HandsOffTwitter

Things have been moving very quickly. The ISPs have been sent official communication to block webpages and twitter handles, including those ofsome journalists plus fake profiles created with the purpose of lampooning the Indian Prime Minister. Curiously, the Pakistani blogger Faraz Ahmed Siddiqui, who was the first to break the news about the morphed photos being used to incite communal tensions, also came under the ambit of censorship and his post was inaccessible on some ISPs.

AEIdeas, a blog from the American Enterprise Institute commented on the issue:

The Indian government ought to have given Mr. Siddiqui a medal for his investigative work. Instead it has blocked his post.

Social media users in India have been following the government actions closely and there is muchdebate and discussion about whether the crack down on social media is censorship of free speech in the guise of rumor control.

Some have termed the government's action as Orwellian/dystopian. Others have seen merit in the government's ‘intent' to curb inflammatory content but have been disappointed with the ineffective way the government went about the task - acting as “Net nannies” and “blocking communications, curbing speech, and banning websites”.

At CIS India, Pranesh Prakash did an analysis of the social media content blocked in India since August 18, 2012. Here are the results:

Strong reactions are pouring in on Twitter via trending hashtags such as #GOIBlocks, #IndiaBlocks,#Emergency2012 etc. [There is some debate over the use of the word ‘Emergency' and the attempt to draw parallels between the present block and the state of emergency of 1975, which saw suspension of civil liberties and persecution of journalists in the name of battling threat to national security].

Indian Rebellion (@reBel1857): today they r blocking ur twitter account, tomorrow ur bank account and then will lock u in ur home … #GOIBlocks #Emergency2012

Pranesh Prakash (@pranesh_prakash): If you oppose #censorship, more power to you! I do too. But calling this #Emergency2012 is ridiculous! #IndiaBlocks #netfreedom

Madhavan Narayanan @madversity): Social media is a modern challenge and a modern opportunity. Government attempts to police it smacks of outdated feudal style #GOIblocks

Raheel Khursheed(@Raheelk): Everything ██ is █████ ████ ████ fine ███ █ ████ love. ████ █████ the ███ UPA ███ ████ Government ██ #GOIBlocks #Twitter

Sunanda Vashisht (@sunandavashisht): First they ignored us, then they argued with us, then they blocked us #emergency2012

Babar (@6a6ar): The only thing left for us to do is block all media and Govt. handles in protest. Let's start a #VirtualRevolution #IndiaBlocks

Abhijit Majumdar (@abhijitmajumder): Govt of #India is just testing #socialmedia waters by blocking spoof PMO accounts. Prepare for greater censorship on #Twitter and #Facebook

Amit Agarwal (@labnol): The Indian govt can force ISPs to block individual Twitter profiles but everything will still be available through web apps like Tweetdeck

Humour and sarcasm too weren't in short supply. For example:

Mahesh Murthy (@maheshmurthy): Now that Govt has solved North East crisis by limiting SMS, it will fight malnutrition by banning food pics on Instagram

Kalyan Varadarajan (@itzkallyhere): My nose blocked. But I didn't poke my nose in Govt matters! My nose isnt a handle. Damn! #GOI

Ramesh Srivats (@rameshsrivats): I've a few SMSs to spare from today's quota. If you mail me recipient's number, message & a cheque, I can send an SMS for you.#BusinessIdea

However, not everyone is amused. Amrit Hallan asks:

Are we going to follow the footsteps of Pakistan and China and turn into a Blockistan? No matter how much it makes some of the English-speaking mainstream journalists happy, blocking isn’t possible, at least sustained blocking. The Internet has empowered the silent majority and there is going to be a big backlash if the government, or another agency tries to take this power back. In what form this backlash is going to manifest? It remains to be seen.

In a guest post on Trak.In, blogger Prasant Naidu suggests how the government could use social media positively. He says:

instead of banning social media, the government can use it in its favor controlling the crisis of NE. The virality feature that our politicians are scared of can be used for killing rumors. Can’t the government get in touch with Facebook and Google India to find out ways to use social media in a better way? Can’t the Government start a social media campaign to “Save NE and Save India”?

Twitter is one of the tools that the government can use. A brilliant example is how Nirupama Rao, India’s Foreign Secretary used Twitter during the evacuation of Indians at the time of the Libyan crisis.

Social Media is not rocket science; it is about communicating with humans and for that you need to have the will to evolve and change. Banning social networks is not a solution to combat rumors but it is a half backed measure to cover the lid on the growing tensions.

The government, on it's part, issued social media guidelines to be followed by government agencies. It remains to be seen how the situation develops on the ground and what impact the current stand-off between government and social media has on cyber-control policies in the days to come.

For more details visit https://cis-india.org/news/global-voices-online-org-aparna-ray-aug-24-2012india-social-media-censorship-to-contain-cyber-terrorism

India: Privacy Bill will likely reflect EU Directive

praskrishna — 2014-03-05T11:45:37Z

The Indian Centre for Internet and Society (CIS) called for comments - on 25 February 2014 - on a draft Privacy Protection Bill ('the Bill'). The draft Bill comes after a series of roundtable discussions in 2013. The last CIS roundtable on the Bill, on 19 October 2013, included Jacob Kohnstamm, Chairman of the EU Article 29 Working Party and the Dutch data protection authority, and Christopher Graham, the UK Information Commissioner.

The article was published in DataGuidance on March 3, 2014.

"In its eventual form, I expect [the Bill] will be modelled to a great extent on the European Data Protection Directive (95/46/EC)," Rodney Ryder, Partner at Scriboard, told DataGuidance. "The European Directive is an important model as India moves forward." Data protection in India is currently regulated by the Information Technology Act 2011, however, if enacted, the Bill would introduce the country's first comprehensive privacy regime. In 2013, the European Commission assessed India's data protection regime and decided not to award adequacy recognition at that time.

"If the Bill is introduced in the Winter Session, […] it is likely to […] come into effect either at the end of the year or early in the next year"

The draft Bill regulates collection, storage and processing of personal data, with both monetary and penal penalties yet to be determined for anyone who 'collects, receives, stores, processes or otherwise handles any personal data [except in conformity with the provisions of the Act].' It also establishes an Indian Data Protection Authority (DPA), with the power to investigate data processing and to 'give such directions or pass such orders as are necessary.'

"[Moving forward,] we expect more clarity on the role and functioning of the DPA," Ryder stated. "In the past, the Government of India has not been clear on the role of the DPA. Will this 'authority' have the independent powers and stature of the European Privacy Commissioners? [Additionally,] the complaint mechanism under the Bill requires greater clarity, precision and structure."

Divya Sharma, Legal Director at Bird and Bird LLP, commented, "Considering that India has parliamentary elections scheduled to take place in April 2014, this bill is unlikely to progress further until a new Government takes office in May 2014. […] Any legislation of this nature is unlikely to progress during this Government's tenure."

"If the Bill is introduced in the Winter Session, after due consideration, it is likely to be passed by the end of the Year and come into effect either at the end of the year or early in the next year," said Ryder.

For more details visit https://cis-india.org/news/data-guidance-march-3-2014-india-privacy-bill-will-likely-reflect-eu-directive

India: obscene pics of gods require massive human censorship of Google, Facebook

praskrishna — 2012-01-17T09:46:25Z

It's hardly the sort of Internet policy statement one hopes to hear from judges in major democracies. "Like China, we can block all such websites [who don't comply]," Justice Suresh Cait told Facebook and Google lawyers in India yesterday. "But let us not go to that situation."

No, let's not. But it's what the government wants if Internet companies won't start screening and censoring all user-generated material on social network and user-generated content sites. And they'd better do their screening by hand, not with machines.

The New York Times reported last December that India's Telecommunications and Human Resources Development Minister, Kapil Sibal, has been battling hard with Internet companies on pre-emptive screening and censorship.

About six weeks ago, Mr. Sibal called legal representatives from the top Internet service providers and Facebook into his New Delhi office, said one of the executives who was briefed on the meeting.

At the meeting, Mr. Sibal showed attendees a Facebook page that maligned the Congress Party’s president, Sonia Gandhi. “This is unacceptable,” he told attendees, the executive said, and he asked them to find a way to monitor what is posted on their sites.

In the second meeting with the same executives in late November, Mr. Sibal told them that he expected them to use human beings to screen content, not technology, the executive said.

The Internet companies insist that they can't possibly pre-screen everything that goes up. If something truly is illegal under local laws, they are generally willing to take it down when a court rules.

The main concern is obscenity (though criticism of government officials appears to touch a sore spot, too); in the current case against Facebook, Google, and others, the obscenity involves pictures of gods, goddesses, and Mohammed.

"At present it's obscene images of Gods and Goddesses, tomorrow it can be an image of someone in your family posted online. There has to be some control," Justice Cait said at yesterday's hearing. He allowed the case against the Internet companies to proceed.

Who's pressing for the court case? A journalist. NDTV has a new interview with him, in which the man presses for quick action. (Note: the actual interview portion is not in English.)

Can we censor dissent while we're at it?

Between January and June 2011, India requested that Google remove 358 bits of content by filing 68 different complaints. One was from Google Maps (for "national security"); almost every other was from YouTube, social network Orkut, and Google's Blogger platform. Almost none came with a court order.

"We received requests from state and local law enforcement agencies to remove YouTube videos that displayed protests against social leaders or used offensive language in reference to religious leaders," Google explained.

"We declined the majority of these requests and only locally restricted videos that appeared to violate local laws prohibiting speech that could incite enmity between communities. In addition, we received a request from a local law enforcement agency to remove 236 communities and profiles from Orkut that were critical of a local politician. We did not comply with this request."

This is hardly an inspiring track record. While in public the companies are criticized for obscenity, Google's most recent records show only 3 requests to remove pornographic material. Government criticism and defamation were actually the two largest categories of requested material.

As the Financial Times "beyondbrics" blog notes, the Internet companies are coming under increasing attack for content they host, despite the vagueness of the demands for censorship. For instance, "Last month, a lower court had ordered the sites to remove all 'anti-social' or 'anti-religious' content by February 6. As Sunil Abraham, executive director of the Bangalore-based Centre for Internet & Society, told beyondbrics last month, it’s difficult to establish exactly what is anti-religious: for example, the Hindu profession of belief in multiple gods is blasphemous to Muslims, Christians and Jews."

Photograph by Diganta Talukdar

The blog post by Nate Anderson was published in ars technica on 14 January 2012

For more details visit https://cis-india.org/news/obsecene-pics-of-gods-require-massive-human-censorship

India’s vanishing fingerprints put UID in question

praskrishna — 2011-10-26T10:05:13Z

A curious situation has come to light at the UID (unique identity) enrolment centres. Call it the phenomenon of vanishing fingerprints. You see, our unique fingerprints don’t necessarily last a lifetime and they can be damaged or destroyed and, in some cases, even non-existent. And that is not the best scenario for the first-of-its-kind project that endeavours to create a unique identity for India’s billion-plus population based on fingerprints and iris scans (or biometric data).

To find out more, Firstpost visited five UID centres in the North West district, which incidentally has the highest enrolments (619,571 and counting) among Delhi’s nine districts since the show hit the road in February 2011, and one centre in North Delhi.

The officials at the Unique Identification Authority of India (UIDAI) will tell you that there is no overemphasising the importance of the quality of biometric data to the success of the super ambitious UID, now known as Aadhar project. If the quality of a person’s biometric data is poor, it automatically compromises the authentication of that data by him when he wants to access a service based on his UID.

So what happens when the data – fingerprints, for instance – are inherently unreliable on account of various biological and socio-economic reasons, some of which are especially relevant to the Indian context.

The UIDAI’s Committee on Biometrics in a December 2009 was rather forthright about its reservations on the fingerprint reliability. Titled Biometrics Design Standards For UID Applications (page 4, para 4), it stated, "….two factors however, raise uncertainty about the accuracy that can be achieved through fingerprints. First, retaining efficacy while scaling the database size from fifty million to a billion has not been adequately analysed. Second, fingerprint quality, the most important variable for determining de-duplication accuracy, has not been studied in depth in the Indian context." (Emphasis added).

The findings on the ground were revelatory. Operators and technical experts at the UID enrolment centres confirmed to Firstpost that they routinely came across cases where fingerprints had been damaged/destroyed/underdeveloped. And such cases, they said, were more common among senior citizens, those involved in manual labour (who handle rough objects, for instance) and children (mostly below 10 years of age).

Here is an example that Firstpost observed.

Batuli, 72, arrived at around noon at the Basti Vikas Kendra, now also a UID centre, in Mangol Puri to get herself a ‘smart card’ everyone has been talking about. (The 'Aadhar' brand name hasn’t caught on in these parts of Delhi, with everyone insisting on calling it the 'smart card'.)

The helpful operator with the fancy gadgets helps Batuli to her seat. After her photo is taken, Batuli is asked to place four fingers — one hand at a time — on a green-lit device. Right hand, then left hand.

She is, however, asked to repeat the exercise a second time for the left hand. The operator explains. "In some case, we have to scan the fingerprints and Iris multiple times. If it doesn’t pass the required quality percentage of 70 per cent (the quality is indicated in percentage terms on the computer screen that is connected to the fingerprint machine, see pic), we repeat the exercise up to four times."

Batuli’s hands are then wiped using a cloth and placed back on the device. The exercise is repeated a fourth and final time. But still the same result. 'Fail', declares the reading on the operator’s computer.

An operator at the next station, says, "In the case of senior citizens, Iris scans also sometime fail. It registers weakly when the retina is damaged."

(Enrolment centres are run by private companies on contracts given by registrars chosen by the UIDAI. Strategic Outsourcing is one such company and it runs many of centres in the North West and South West districts of Delhi.)

The project coordinator of the UID enrolment centre working out of the Destitute Welfare Trust, an NGO in Sultanpuri, too, confirmed that he was aware of the problem of damaged fingerprints and the challenge it posed in getting good quality fingerprint data.

"The hands of children are very soft and in some cases fingerprints are not yet fully developed. Also, children tend to have sweaty hands and this can interfere with the quality of fingerprints. Extremely dry hands also pose problems. We have to often, wipe the hands or provide lotion to improve the quality of fingerprints," said a technical expert working with Strategic Outsourcing.

While the number of attempts, as prescribed by the UIDAI, to get a stronger finger print when the result reads 'fail' is four, operators report that sometimes attempts go up to 10 to 15. (The machine picks up the strongest impression of the attempts made). They say they didn’t anticipate such a problem and it was only when they started enrolments in January that they were confronted with such a scenario. “Now, of course, everybody knows about it."

'Everybody' implies those who are directly involved in collecting biometric data. An operator from another private company Smartchip working in a JJ (slum) colony in the North Delhi district of Model town, revealed similar problems on being probed. "A fingerprint strength of 70 percent or more is pass. About 10 per cent of the cases we get every day register the 'fail' reading. What can we do? In the case of stone cutters, for instance, the fingers are completely smooth, the fingerprints are completely wiped out."

So what are the implications of poor quality fingerprints for the UID project? The UIDAI admitted that it could provide challenges to authentication.

In an email response to Firstpost, Sujata Chaturvedi, UIDAI’s Deputy Director General for the Delhi region said, "It could provide some challenges in de-duplication although that has been mitigated to a large extent by the decision of the UIDAI to go in for iris an additional de-duplication factor… Also to be noted is the fact that normally not all fingers are equally de-graded. So UIDAI is evolving a protocol to inform the residents about their good quality fingerprints as part of the Aadhaar letter so that they are aware of the finger to use for authentication."

But not everyone is convinced. Sunil Abraham is the executive director of Centre for Internet and Society (CIS), which has written seven open letters to the Standing Committee on the Finance Branch (before which is the National Identification Authority of India Bill, 2010) asking the committee to consider their research on the UID project and change aspects of the Bill and the project.

The seventh letter sent last week, says Abraham, provides statistical analysis that demonstrates how the UID will never be able to create a unique database.

"In CIS’s seventh open letter to the finance committee, statistical analysis reveals that UIDAI tender specification is 1,000 times less accurate than it should be to have a reasonable chance of building a truly unique database. This analysis depends on high quality biometrics. With poor biometric quality the problem of de-duplication is compounded."

When UIDAI was asked what the percentage of the population enrolled (all India and Delhi) had recorded below-standard fingerprint quality, no specific data was forthcoming.

Chaturvedi wrote, "Currently the population with very poor quality fingerprints is a very small percentage. It must also be remembered that this population is scattered all over the country."

In India, even a small percentage translates to millions of people. "Small percentage could mean absolutely anything. Why can’t they be more specific? One percent in the Indian context is 12 million people," said Abraham.

On how the UIDAI was dealing with challenge of poor fingerprint quality, Chaturvedi said, "Even amongst the populace that has damaged/destroyed/underdeveloped fingerprints, chances are very high that they would have at least one good fingerprint that could be used for authentication. Second, UIDAI is also starting to actively develop iris authentication ecosystem. Fingerprint authentication and iris authentication could supplement each other to ensure a universal coverage."

She added that Aadhaar authentication will supplement and work in conjunction with existing authentication systems to strengthen the overall authentication rather than replace completely the existing authentication systems.

That begs the question, as Abraham puts it, "If the UIDAI is not going to replace existing forms of authentication it is not clear why the government is spending all this money on unproven biometric technology."

Chaturvedi, however, maintained that the initial PoC (proof of concept) study that was taken up in Andhra Pradesh, Karnataka and Jharkhand collected about 60,000 enrolments indicated that the biometric accuracy levels necessary for de-duplication of all residents of India are achievable.

"The PoC results also indicated the time needed for capture of biometrics in typical rural conditions is small enough to support large scale enrolment. Over and above the initial PoC, the UIDAI has currently completed over 5 crore enrolments for which Aadhaars have been generated. This experience reinforces the initial PoC results that the de-duplication accuracy is sufficient and sustainable to enrol the rest of the population."

The original article is written by Pallavi Polanki. It was published in Firstpost on October 24, 2011 and can be read here.

For more details visit https://cis-india.org/news/vanishing-fingerprints-put-uid-in-question

India’s Supreme Court strikes down law that led to Facebook arrests

praskrishna — 2015-03-27T00:29:08Z

India’s Supreme Court on Tuesday struck down a provision of a law that made it illegal to spread “offensive messages” on electronic devices and resulted in arrests over posts on Facebook and other social media.

The article by Annie Gowen was published in Washington Post on March 24, 2015. Sunil Abraham is quoted.

In a decision hailed as a victory for free speech, Judge Rohinton Fali Nariman ruled that Section 66A of the Information Technology Act was unconstitutional, writing that the vaguely worded legislation had wrongly swept up innocent people and had a “chilling” effect on free speech in the world’s most populous democracy.

“Section 66A is cast so widely that virtually any opinion on any subject would be covered by it,” the judge wrote. “If it is to withstand the test of constitutionality, the chilling effect on free speech would be total.”

India passed the Information Technology Act in 2000, and an amendment that went into effect in 2009 gave authorities broad powers to arrest those who post content deemed “grossly offensive” or false. The offense was punishable by up to three years in jail and a fine.

Sunil Abraham, the executive director of the Centre for Internet and Society in Bangalore, said that the provision was originally intended to protect citizens from electronic spam but that it was used much more broadly.

“Politicians who didn’t like what people were saying about them used it to crack down on online criticism,” he said.

The section has resulted in more than 20 high-profile arrests, including that of a professor who posted an unflattering cartoon of a state political leader and an artist who drew cartoons lampooning the government and Parliament.

The most well-known was the case of two young women arrested in the western town of Palghar after one of them posted a comment on Facebook that said Mumbai should not have been shut down for the funeral of a famous conservative leader. A friend who merely “liked” the post also was arrested. After much outcry, the two were released on bail and the charges eventually dropped.

The case of the “Palghar Girls” inspired a young law student, Shreya Singhal, to take on the law. Singhal became the chief petitioner for the case, joined by other free speech advocates and an Indian information technology firm.

[When — and where — posting the wrong thing to Facebook can get you arrested]

“It’s a big victory,” Singhal said after the ruling. “The Internet is so far-reaching and so many people use it now, it’s very important for us to protect this right.”

In addition, Singhal and other petitioners had argued that a section of the Information Technology Act that allowed the government to block Web sites containing questionable material also was unconstitutional. The court disagreed, however, saying there was a sufficient review process in place to avoid misuse.

Free speech is enshrined in the Indian constitution but has its limits. Books and movies are often banned or censored out of consideration for the sentiments of religious and minority groups.

Last year, a conservative Hindu group persuaded Penguin India to withdraw a book on Hinduism by Wendy Doniger, a professor of religion at the University of Chicago, from the Indian market. And, more recently, the government halted the planned television debut of a documentary on a 2012 gang rape called “India’s Daughter.”

[India blocks film about 2012 New Delhi rape case]

The government, whose attorney had argued in court that the legislature was in the best position to understand the needs of the people, also welcomed the decision.

“The government is committed to free speech. India is a democratic country, and free flow of ideas should be respected. We do not seek to curtail any rights,” said Ravi Shankar Prasad, the minister of communications and information technology. He cautioned, however, that social media users and platforms should show self-restraint.

In recent years, other nations also have sharply increased monitoring of and crackdowns on Web posts perceived as insulting.

Across the Persian Gulf Arab states, dozens of activists have been arrested for social media posts considered insulting to the countries’ rulers or damaging to the national image. In January 2014, an American national was allowed to leave the United Arab Emirates after serving more than eight months in prison for posting a YouTube video spoofing the UAE’s youth culture.

Brian Murphy in Washington contributed to this report. Picture: (Indranil Mukherjee/AFP/Getty Images)

For more details visit https://cis-india.org/internet-governance/news/washington-post-annie-gowen-march-24-2015-indias-sc-strikes-down-law-that-led-to-fb-arrests

India’s Supreme Court strikes down law that led to arrests over Facebook posts

praskrishna — 2015-03-26T01:49:54Z

Judge rules that section of the information technology law was unconstitutional, had wrongly swept up innocent people and had a ‘chilling’ effect on free speech.

The article by Annie Gowen was published in 'The Star.com' on March 25, 2015. Sunil Abraham is quoted.

The Supreme Court in India struck down a section of its country’s information technology act Tuesday that had made it illegal to spread “offensive messages” on electronic devices and resulted in arrests over posts on Facebook and other social media.

Supreme Court Judge Rohinton Fali Nariman wrote in the ruling that the section of the law, known as 66A, was unconstitutional, saying the vaguely worded legislation had wrongly swept up innocent people and had a “chilling” effect on free speech in the world’s most populous democracy.

India had first passed its Information Technology Act in 2000, but stricter provisions were added in 2008 and ratified in 2009 that gave police sweeping authority to arrest citizens for their personal posts on social media, a crime punishable for up to three years in jail and a fine.

Sunil Abraham, the executive director of the Centre for Internet and Society in Bangalore, said the section was originally intended to protect citizens from electronic spam, but it did not turn out that way.

“Politicians who didn’t like what people were saying about them used it to crack down on online criticism,” he said.

In the end, there were more than 20 high-profile arrests, including a professor who posted an unflattering cartoon of a state political leader and another artist who drew a set of cartoons lampooning the government and Parliament.

The most well-known was the case of two young women arrested in the western town of Palghar after one of them posted a comment on Facebook that argued the city of Mumbai should not have been shut down for the funeral of a famous conservative leader. A friend, who merely “liked” the post, was also arrested. After much outcry, the two were released on bail and the charges eventually dropped.

The case of the “Palghar Girls” inspired a young law student, Shreya Singhal, to take on the government’s law. Singhal became the chief petitioner for the case, along with other free speech advocates and an Indian information technology firm.

“It’s a big victory,” Singhal said after the ruling. “The Internet is so far-reaching and so many people use it now, it’s very important for us to protect this right.”

Singhal and other petitioners had also argued that another section of India’s technology act that allowed the government to block websites containing questionable material were also unconstitutional, but the court disagreed, saying there was a sufficient review process in place to avoid misuse.

Free speech in India is enshrined in the country’s constitution but has its limits. Books and movies are often banned or censored out of consideration for religious and minority groups.

In 2014, a conservative Hindu group persuaded Penguin India to withdraw a book about Hinduism by Wendy Doniger, a professor of religion at the University of Chicago, from the Indian market. And more recently, the government of India blocked a planned television debut of a documentary film on a 2012 gang rape case, India’s Daughter.

For more details visit https://cis-india.org/internet-governance/news/the-star-march-25-2015-annie-gowen-indias-supreme-court-strikes-down-law-that-led-to-arrests-over-facebook-posts