We are anonymous, we are legion

India's Shame: World Reacts to FB Post Arrest

praskrishna — 2012-11-30T05:51:10Z

The arrest of 21 year old Shaheen Dhada for posting anti-Bal Thackeray comments has not only outraged Indians. The story has been picked up and reported across international media as well. Though they may not be aware of the complexities of Indian politics, the fact that young girls were arrested for an FB post has got them questioning the dwindling tolerance for the freedom of speech in India.

This was posted by Sonal Bhadoria in IndiaTimes on November 21, 2012. Pranesh Prakash is quoted.

The Wall Street Journal warns ,'You better think twice before 'Liking' your friends' comments on Facebook. It may land you in jail.' The article quotes Pranesh Prakash, policy director at the Centre for Internet and Society saying “Bal Thackeray had violated the same provisions in his lifetime,” with reference to Mr. Thackeray’s inflammatory speeches against the South Indians and Muslims.

The BBC put a question mark on India's commitment to freedom of speech by citing recent examples of the arrest of a cartoonist like Ravi Srinivasan, a 46-year-old businessman in the southern Indian city of Pondicherry, who was arrested for a tweet criticising Karti Chidambaram, son of Indian Finance Minister P Chidambaram.

UK's Daily Mail, says 'So much for freedom of speech' and questions the IT act which led to the arrest.

In a New York Times article, Pranesh Prakash questioned the arbitrariness in the application of the law saying 'There were thousands of people on Facebook, Twitter and in person who were saying the exact same kinds of things that this girl is alleged to have said'. The article also stated that Shiv Sena has a history of banning books, movies and other popular culture that are critical of the political party.

Mashable noted that several dissenters had taken to Twitter to speak out about the arrest including Milind Deora, the government minister of state, communications and information technology, who showed support for Dhadha and Renu with this tweet:

Milind Deora
@milinddeora

To learn who rules over you, simply find out who you are not allowed to criticize ~ Voltaire
It also asked 'Do you think Facebook is a good place to voice political opinions?'

The Christian Science Monitor calls the incident 'the latest in a string of crackdowns on Internet speech in the world's largest democracy'. It says, 'The other cases have included arrest of a resident of Chandigarh who complained on the Facebook page of Chandigarh police that they were not doing enough to find her stolen car; a cartoonist who posted work online protesting corruption scandals by the central government; and a professor in Kolkata who merely forwarded an email with a cartoon that was critical of West Bengal chief minister Mamata Banerjee.' The article also mentions Shaheen Dhada’s uncle, Dr. Abdullah Ghaffar Dhada stating that he had incurred losses of two million Rupees due to the ransacking of his clinic by angry Shiv Sainiks.

For more details visit https://cis-india.org/news/indiatimes-sonal-bhadoria-nov-21-2012-indias-shame-world-reacts-to-fb-post-arrest

India's section 66A scrapped: Win for free speech

praskrishna — 2015-03-26T16:19:42Z

India's Supreme Court court has struck down a law that made posting "offensive" comments on the internet a crime punishable by a jail term of up to three years. But, for the free speech campaigners, there is more work to do, writes technology writer Prasanto K Roy.

The blog post by Prasanto K. Roy was published by BBC on March 24, 2015. Pranesh Prakash was quoted.

Section 66A, inserted in 2009 into India's Information Technology [IT] Act of 2000, was sweeping and draconian, and was repeatedly abused across the country, say free speech campaigners.

It was challenged in 2012 by a law student, Shreya Singhal, then 21.

She filed a public-interest litigation in the Supreme Court, shortly after the arrest of two girls in Mumbai for a Facebook post criticising the shutdown of the city after a political leader's death.

One of the two girls had merely "liked" the post.

Earlier in the same year, a businessman in south India was arrested for tweeting that a politician had amassed much wealth.

A professor at Jadavpur University in Kolkata (formerly Calcutta) was arrested for forwarding a cartoon about West Bengal Chief Minister Mamata Banerjee. Both were charged under Section 66A, among others.

In May 2013, the Supreme Court made arrests under Section 66A tougher - it said an arrest would require the permission of senior law-enforcement officials.

'A victory'

The judgement on Tuesday was read out by Justice RF Nariman, who said Section 66A was unconstitutional and directly affected the public's right to know.

"We have no hesitation in striking it down in its entirety," he said.

The order notes that Section 66A violates an article of the Indian constitution that guarantees freedom of speech and expression.

"This judgement is a victory for anyone and everyone who uses the internet.

"I am ecstatic. It's a complete victory for us, because the Supreme Court struck it down and held it unconstitutional," Ms Singhal told BBC Hindi moments after the court scrapped the law.

Section 66A provided for up to three years in jail for anyone who sent an electronic message that was considered "grossly offensive" or caused "annoyance or inconvenience".

Justice Nariman said such terms were vague, and created a sweeping law that was open to abuse.

The apex court judgement notes that 66A was based substantially on section 66 of the UK Post Office Act of 1953, which made sending offensive or annoying messages by telephone or telegram an offence punishable by up to a month in jail.

That law, last updated in 2003, still retains the terms "annoyance" and "inconvenience".

Section 66A's creation, and much of its implementation, happened on the watch of the Congress party-led political regime that lost to Prime Minister Narendra Modi's BJP government in last year's general election.

Arun Jaitley of the BJP - the current finance minister and former opposition leader - had criticised the law in the upper house of parliament, after it was reported that the government had blocked nearly 300 websites.

Once in power, however, the BJP swung around to defending 66A in the Supreme Court, the government represented by additional solicitor general Tushar Mehta.

Arrests under Section 66A continued into 2015 - last week, a 19-year-old student in Uttar Pradesh was arrested for a Facebook post on a political leader, and spent two days in jail.

Next target

The petitioners and their many supporters, including multiple virtual support groups, are celebrating the order striking down 66A.

But there are concerns about another section - 69A - introduced in the same amendment of 2009, which has been retained.

Section 69A, which was also challenged in Ms Singhal's and others' petitions, allows the government to block online content that "threatens the security of the state" or fulfils other conditions.

Hundreds of websites and web pages have been blocked under 69A, including a government website in 2013.

The apex court's order notes that 69A is a "narrowly drawn provision with several safeguards", and has allowed the section to remain.

Pranesh Prakash of the Centre for Internet and Society says: "The Supreme Court judgement is at its best on 66A, but weaker on 69A."

The free speech campaigners say their work is not yet finished.

For more details visit https://cis-india.org/internet-governance/news/bbc-march-24-2015-indias-section-66-a-scrapped

India's Rs 400-crore Central Monitoring System to snoop on all communication

praskrishna — 2013-06-05T10:39:19Z

Latest reports confirm that the government's longstanding aim of initiating the Central Monitoring System in the country is materialising now.

This was published in Tech 2 on May 9, 2013. Pranesh Prakash is quoted.

The Times of India reports that the government began rolling out the project last month, and it lets them access all communication in the country – comprising online activities, phone calls, SMSes, social media conversations and even the geographical location of individuals. Using the Central Monitoring System, officials with the National Investigation Agency or tax officials will have access to "every byte of communication".

Pavan Duggal, an advocate with the Supreme Court, believes that the new system "is capable of tremendous abuse". He went on to say that the government hasn't revealed much on what it intends to monitor with this new system, and under what criteria.

The Centre for Development of Telematics has been given the task of putting this system in place to give government officials this crucial access to communication in the country. In his statement to the Parliament in December last year, IT minister Milind Deora had said that the Central Monitoring System will "lawfully intercept Internet and telephone services".

This system was initiated in the wake of the horrying bomb blast in Mumbai in November 2008. Post that incident, the government reportedly took on the task of making itself technologically adept to "eavesdrop on digital communications".

It would be important to quote here that the IT law – enacted in 2000, amended in 2008 and in 2011 – confers upon government officials the authority to intercept phone calls, SMSes, emails and even monitor websites. That, however, can only be done for "reasonable security practices and procedures".

For more details visit https://cis-india.org/news/tech-2-may-9-2013-indias-rs-400-crore-central-monitoring-system-to-snoop-on-all-communication

India's Proposed Map Law Prompts Outcry

praskrishna — 2016-05-29T09:30:31Z

In India, proposed legislation to ban use of maps or satellite images of the country without approval from the government has led to an outcry and triggered an online campaign called “Save The Map.”

The article by Anjana Pasricha was published in Voice of America on May 17, 2016. Pranesh Prakash was quoted.

The controversy is not just over stiff penalties of up to $15 million for a wrong depiction of India’s borders, but that in a digital era, the law would potentially disrupt a host of businesses and start-ups such as taxi-hailing services.

Reasons

The draft Geospatial Information Regulation Bill seeks to regulate the use of mapping and satellite data for two reasons: secure the country’s strategic installations from enemies and terrorists and ensure that its political boundaries are correctly depicted. The government says it will not create barriers to business.

But Internet experts say the sweeping proposed law will affect ordinary people using mobiles and laptops, all new-age companies such as food-delivery and e-commerce, apps, as well as Apple and Google map products.

Nikhil Pahwa, founder of the website MediaNama, calls location data the core fabric of all digital services.

“What the government has ended up doing is making pretty much every single app illegal because they all use geospatial data and they wont have a license. If you take a photograph, it has location data. If you use Uber to hail a cab, it uses maps and it shows taxi cabs on the map. If I WhatsApp my location to a friend to pick me from a particular location, I am generating geospatial information,” he said.

Nikhil Pahwa, founder of the website MediaNama, calls location data the core fabric of all digital services.

Complications for ordinary citizens

The draft law requires anyone wanting to use, publish or own maps or geospatial data to apply for a license, which will be considered by a security vetting committee.

The Bangalore-based Center for Internet and Society (CIS) has also slammed the new bill, saying it takes India back more than three decades when businesses were governed by a maze of bureaucratic licenses and permits.

“What it does, it puts in place a license raj for all use of mapping technologies. That just does not make sense. No other country in the world has this regressive mapping law,” said Pranesh Prakash at CIS.

Internet opposition

A volunteer-led internet campaign called “Save The Map” led by Bangalore-based tech experts, is steadily gathering momentum. It is calling on people to petition the government against the bill in its present form. It seeks to replicate an extremely successful campaign called “SavetheInternet” which built public opinion and put pressure on the government to ensure equal access to the internet.

The government has sought to calm the growing concerns, saying the bill is only in a preliminary stage and it has invited feedback and suggestions from the public until June 4.

Officials point to India’s growing security concerns, specially since an armed attack at a strategic air base in Pathankot in northern India earlier this year, allegedly mounted by Pakistan-based terrorists. Speaking to an Indian newspaper, Junior Home Minister Kiren Rijiju said the bill is necessary because “India as a responsible country must have provisions to secure its boundary and territory.

However Prakash of CIS points out that the new bill will not necessarily prevent terror groups from getting hold of geospatial data to target Indian installations because they don’t need maps generated inside India to access such information.

“They need satellite imagery and they need maps, period. Now this law does not actually prevent such maps from being created, it does not prevent satellite images of India being captured. What it does is prevent Indians from doing so. So it won't prevent foreign-based terrorists, especially state-backed terrorists, from attacking India,” he said.

Internet and public policy experts agree that the government could impose restrictions on mapping and satellite images of strategic and sensitive locations in the country.

Huge fines

The eye-popping fines of up to $15 million and jail terms of up to seven years proposed for incorrect depiction of India’s borders have also caused surprise.

India has always insisted maps should show Kashmir in the north, which is claimed by both India and Pakistan and the state of Arunachal Pradesh in the northeast, which China claims, within Indian political boundaries.

Foreign magazines and newspapers which failed to do so were only allowed to circulate in the country after the words “Boundaries of India shown in this map are not correct” were stamped over maps that did not conform to India’s interpretations of its borders.

Google already offers slightly altered versions of its maps inside India, showing the disputed regions of Kashmir and Arunachal Pradesh as part of India.

Independent political analyst Ajoy Bose said New Delhi has long been very sensitive over how these two territories are depicted. “It has always been a source of annoyance to successive governments, but this government being ultranationalist in nature is very particular about India’s geographical boundaries being correctly shown, and therefore it is taking much more drastic action,” he said.

For more details visit https://cis-india.org/internet-governance/news/voice-of-america-may-17-2016-anjana-pasricha-india-proposed-map-law-prompts-outcry

India's plan to offer citizens digital lockers poses a privacy threat, say experts

praskrishna — 2015-04-03T06:32:20Z

The Indian government launched a test version of a service called the digital locker last month that allows citizens to store scanned versions of important documents online, something that experts say poses a serious threat to people’s privacy.

The blog post was published in Scroll.in on March 19, 2015. Sunil Abraham was quoted.

Based on a similar project being tried out in Maharashtra, the service allows people with Aadhar cards to store scanned copies of their passports, birth certificates, ration cards and other important documents on remote servers. This way, people can digitally back-up important documents and also send them over the internet to others, such as potential employers or banks, for availing themselves of other services.

The service, whose test version was launched on February 12, will be optional. But it could find takers from among the about 90% of India’s households who do not own a laptop or computer and the 95% that do not have an internet connection, according to the 2011 census. Experts are concerned that sensitive data stored in a central place could be stolen or misused.

Serious threat

“Any large linked database with personal information is a serious threat to citizen's data,” said G Nagarjuna, a researcher at the Homi Bhabha Centre for Science Education in Mumbai and a member of the Free Software Movement. “There exists no agency that could secure their data till date without any possibilities of data theft.”

Digitisation is not inherently a problem, experts say. It is the kind of information stored that is. There are two kinds of information people need to be concerned about, said Sunil Abraham, executive director of the Bangalore-based Centre for Internet and Society, in an email to Scroll.in. Public domain information such as land records, pan cards and ration cards should be available to the public anyway. However, private information such as biometrics and passports are of concern.

“Unless the cryptography and architecture is organised in such a manner that only the citizen will have access there can be very serious consequences for the individual’s right to privacy,” he said.

The scheme raises the same concerns about privacy that came up during the creation of Aadhar cards, for which the government has collected biometric and identification data for 773 million citizens.

Information is power

Experts pointed to the dangers of the state having access to crucial data about citizens. The dangers are perhaps greater when the data passes into the hands of private corporations, they said.

The Indian government has not said who will run the central servers on which all the data is to be stored, but Maharashtra said in January that it would upload the data it was collecting to a private cloud service run by Microsoft.

“This is a terrible idea because it is centralising storage of personal information across silos controlled by different data controllers and also giving the citizen no control over who has access to his or her data," said Abraham.

“A blunder of the highest order is to pass this information to a cloud, and that too to a foreign company,” said Nagarjuna. “India is a sovereign republic, and hence we should assert this in the country’s digital assets as well. How secure can India be if our security is passed on to another agency that owes its allegiance to another country?”

Surykant Jadhav, joint secretary of the Directorate of Information Technology in Maharashtra, defended the scheme, comparing it to other optional services that the state provides such as online ticketing and filing of income tax returns. “The lockers are there only if people want to use it,” he said.

Cart before the horse

But the government ought to be trying to improve the basics, such as increasing computer and internet penetration, before launching value-added digital services, said Nagarjuna.

“What is the basic social or economic problem that the government is trying to solve by creating the digital lockers?” “Just as each citizen learns how to protect their assets, the digital natives of a digital society will eventually learn how to protect their digital assets. Digital India cannot be created without providing digital literacy to all the citizens. Did we do that? Once we do that, citizens will learn what is good for them, particularly for their own assets over which the government has no ownership.”

For more details visit https://cis-india.org/internet-governance/news/scroll-mridula-chari-march-19-2015-indias-plan-to-offer-citizens-digital-lockers-poses-a-privacy-threat-say-experts

India's Online Freedom Advocates Hail Court Ruling on Free Speech

praskrishna — 2015-03-27T01:43:22Z

Online freedom advocates in India are hailing a court ruling that struck down a controversial law seen as infringing free speech on the Internet. But in a country expected to have the world’s largest number of web users by 2018, some concerns about net censorship remain.

The blog post by Anjana Pasricha was published by Voice of America on March 24, 2015. Sunil Abraham is quoted.

The 24-year old law student, Shreya Singhal, who spearheaded the legal battle for overturning the harsh law, said it was the arrest of two young women in 2012 for a seemingly innocuous Facebook post that prompted her to petition the Supreme Court. One woman had criticized a shutdown in Mumbai after the death of a Hindu nationalist leader Bal Thackeray, the other “liked” her post.

Like millions of others, Singhal was alarmed at their detention because she says she could have been the one to post the innocuous comment.

“It [the law] was punishing people for expressing their views on the Internet, whereas if they did it or they did it on TV or they did nit in newspapers, they would not get arrested for the same views,” she said.

Scrapping the law on Tuesday, India's Supreme Court said the Information Technology Act was vaguely worded, and did not explain what could be “inconvenient" or “grossly offensive.” The judgment said the law was liable to have a chilling effect on free speech as it strikes at the root of liberty and freedom of expression.

The law had raised alarm bells after several people were arrested in recent years for posting “objectionable content.” In the latest instance, a 16-year-old boy in Uttar Pradesh state was arrested and released on bail for posting an “insulting” remark about regional party leader, Azam Khan. Among others who were picked up under the law were a professor in Kolkata and a cartoonist in Mumbai.

The previous government, which passed the law, said it was necessary to combat abuse and defamation on the Internet, but critics said it was used by political parties to suppress dissent and criticism.

The Supreme Court ruling also made it tougher for the government to order Internet companies to remove online content.

Sunil Abraham of Bangalore-based Center for Internet and Society says local and foreign Internet companies have faced growing pressure for putting up content deemed offensive in India.

“According to Facebook's latest transparency report, takedown requests and information requests from the Indian government continue to grow, and that is worrying. But that part of the law has been read down. Now when the government sends the takedown notice, it has to be accompany the takedown notice with a court order,” said Abraham.

But free speech campaigners say concerns about online censorship have not completely gone away. The Supreme Court has upheld a law that allows the government to block websites, saying there are sufficient safeguards.

Campaigners like Sunil Abraham think otherwise. “Lack of transparency makes it impossible for anybody to tell whether the government is censoring the Internet in a proportionate manner, whether it is working to truly address the real harms that emerge from bad content online. When the court in India bans books or movies, the judgments of these courts are made available to the public."

"But if when it comes to website blocking, this transparency requirement is missing. In fact, the law has secrecy provisions, which prevents ISP’s that receive these block orders from making them available in the public domain,” said Abraham.

The young student, Singhal, who led the legal battle, said she was “overwhelmed” at the victory for online freedom.

“We are such a diverse society in India with so many diverse and different opinions. It is inherent in us, it is part of us, this democracy, this debate we have,” she said.

Her views were echoed on Twitter and Facebook by people in India, a country of 1.2 billion people where Internet access is growing rapidly.

For more details visit https://cis-india.org/internet-governance/news/voice-of-america-march-24-2015-anjana-pascricha-indias-online-freedom-advocates-hail-court-ruling-on-free-speech

India's National ID Project Brings Pain to Those it Aims to Help

Admin — 2018-05-12T00:53:39Z

Poor management, corruption and fraud are threatening to derail the world’s largest national identity project.

The blog post by Aayush Soni was published in Ozy.com on May 11, 2018.

For Phoolmati, a resident of the Kusumpur Pahari slum in south Delhi, standing every month in a queue at the neighborhood fair-price shop was a trusted routine. When her turn came up, she would place her thumb on a scanning machine that confirmed her identity. But on a biting-cold morning this past January, she had to return home empty-handed because, the shopkeeper told her, the “server was down.”

The next day, it happened again. On her third try, Phoolmati thought she had gotten lucky when the machine scanned her thumb successfully. But she was in for a shock. “The shopkeeper told me that, according to the computer records, I’ve already taken my quota of wheat flour for the month,” she says. When she protested and showed her ration card, another form of identification, the shopkeeper wouldn’t accept it.

Left with no choice, Phoolmati had to buy wheat flour from the open market at 25 rupees per kilogram — more than 12 times the amount she usually paid at fair-price shops. She wasn’t alone. At a weekly meeting of slum residents in a temple courtyard in April, many women complained about the difficulty of buying subsidized food grains to the Satark Nagrik Sangathan (Alert Citizens Organization), a nonprofit that seeks accountability from government agencies. Nanno Devi, a 67-year-old homemaker whose fingers are wrinkled with age, said that she didn’t receive her quota of wheat flour for January because a fingerprint-scanning machine couldn’t detect her thumb impression.

Nor are the urban poor, like Phoolmati, the only ones with such complaints. Students with government scholarships, senior citizens with pensions, farmers entitled to subsidies, religious minorities and backward castes eligible for benefits, patients at public hospitals, young couples trying to get married and professionals updating their bank details are all on the front line of an unparalleled experiment that was meant to help them but is hurting them instead.

Theirs is the lived experience of Aadhaar, a unique 12-digit identity system that includes an individual’s biometrics and demographic data — and that must verify an individual’s identity for the government, increasingly, to even recognize their existence. First rolled out in 2010, it is modeled on America’s Social Security number system, with the aim that government subsidies and welfare programs reach the intended beneficiaries and aren’t siphoned off by middlemen.

But over the past three years, India’s Narendra Modi government has cajoled, pressured and often effectively forced people into enrolling for this ID, even though it isn’t required by law. Today, a person’s bank account risks being frozen if it isn’t linked to her Aadhaar number. Her PAN (permanent account number) card, used to file income tax, could be declared invalid. Mobile phone companies can disconnect her number if it isn’t authenticated through biometrics. An Aadhaar number (or an enrollment number, in case someone has already applied for it) is mandatory to open a new bank account, get a new passport, invest in mutual funds or register a marriage. A joke making the rounds on Twitter is that very soon, Aadhaar will be mandatory for a person to swipe right on Tinder.

In the absence of any privacy law, much of the concern within sections of India’s educated middle class has focused on questions about personal freedom, data security and mass surveillance. But a parallel tide of complaints is rising from those the program was meant to help, rooted in complications it has instead imposed upon them. This growing frustration is threatening to derail the initiative in a manner privacy can’t, in a nation where millions live in cramped city apartments with strangers, and the distinction between personal and public is often blurred.

Cases of fraud, mismanagement and corruption hurting Aadhaar beneficiaries are tumbling out into the public domain almost every week. In late March, hackers used weaknesses in the Aadhaar database to steal data from a government organization that manages more than $120 billion in the pensions and savings of millions of Indians. In January, a 10-year-old girl from the Dalit community — historically at the bottom of India’s caste ladder — was denied a school scholarship because officials had misnamed her on her Aadhaar card. Last October, a farm loan waiver program in Maharashtra state ran into trouble after officials discovered that 100 farmers had the same Aadhaar identity number.

The Modi government maintains that it takes both the security of personal data and the concerns of Aadhaar beneficiaries seriously. But it is reluctant to answer any questions about identity theft, corruption, privacy or misappropriated benefits. Neither Ajay Bhushan Pandey, the current CEO of the Unique Identification Authority of India (UIDAI), which runs Aadhaar, nor Vikas Shukla, its spokesperson, responded to multiple requests for comment.

At a public rally in early May, Modi — who had himself opposed the program before he came to power in 2014 — called critics of Aadhaar “opponents of technology” unwilling to evolve with the times. Increasingly, though, many are questioning whether it’s Aadhaar’s own identity that has changed the most from when the idea first came up. “From a project of inclusion, it has become a project of exclusion,” says Usha Ramanathan, a lawyer who focuses on issues of development and poverty. Just ask Phoolmati.

Aadhaar was the brainchild of Nandan Nilekani, a former CEO of tech giant Infosys, who in a 2009 book argued that multiple forms of identification made it “difficult” to establish a “definitive identity” for India’s citizens.

A single identity linked to passports, PAN cards and other national databases, Nilekani argued, would not only solve this problem but also help eliminate the exasperating processes that India’s bureaucracy is notorious for — mountains of paper, proof of identity in triplicate and a glacial pace of work. It would help citizens avail government benefits that are rightfully theirs. Such a system would reduce a citizen’s dependence on distribution mechanisms susceptible to leakages and make “the moral scruples of our bureaucrats redundant,” Nilekani wrote. “An IT-enabled, accessible national ID system would be nothing less than revolutionary in how we distribute state benefits and welfare handouts.”

That same year, the Congress Party–led United Progressive Alliance government offered Nilekani a chance to translate his idea into reality, appointing him UIDAI chairman. Under Nilekani the UIDAI hired people from within the Indian bureaucracy as well as those outside it. The initial team of 50 included software engineers, designers and entrepreneurs from Silicon Valley as well as lawyers and policy wonks who worked at the head office in New Delhi. Each of the eight regional offices had a staff of 20.

In its early-stage avatar, the team had thought out solutions to problems such as the ones the residents of Kusumpur Pahari faced, says a policy consultant who worked with the UIDAI in 2010 and spoke on condition of anonymity. “You can use old methods and physically verify a person’s name and address [by going to their house] if biometrics aren’t working,” the consultant says. “It’s built into the architecture [of Aadhaar].” In his view, the current government under Modi — whose Bharatiya Janata Party defeated the Congress Party and came to power in 2014 — and the UIDAI setup have made a “mess” of the program. He also believes that the goal has shifted from inclusion to mass enrollment. Nilekani did not respond to a request for comment.

For sure, Aadhaar has staunch supporters too, who argue that it has helped reduce the misuse of government subsidies. In July 2017, India’s junior minister for consumer affairs, food and public distribution, C.R. Chaudhary, told the country’s Parliament that Aadhaar had helped the government delete nearly 25 million fake ration cards that the poor use to access subsidized food ingredients.

“This unnecessary fearmongering around Aadhaar is uncalled for,” says Sanjay Anandaram of iSpirit, a software industry think tank. In his view, it’s “last-mile deployment challenges” like fingerprint authentication, one-time-password systems and server glitches that need to be fixed, not Aadhaar. He juxtaposes anecdotal examples of people struggling to gain benefits with the “larger purpose” he believes Aadhaar serves. “It is a revolutionary system to ensure governance improves — especially for centrally administered programs,” he says.

The UIDAI has made some efforts too, if not to improve security of personal data then at least to allow citizens to check whether their Aadhaar identity has been misused. They can go online and view any occasions when their Aadhaar identity was used to access benefits.

But for millions of Indians dependent on subsidies, pensions, scholarships and other benefits, the concerns go well beyond privacy. Getting an Aadhaar identity can be a struggle. Earlier this year, the Punjab government conceded that it can’t process nearly 200,000 farm loan waiver claims either because intended beneficiaries don’t have Aadhaar cards or because the UIDAI is still processing their applications. At the same time, not signing on to Aadhaar is increasingly not an option. In February 2017, Chaudhary’s ministry made it mandatory for individuals to have an Aadhaar card to access subsidized food grains. Then, in October, an 11-year-old girl died of starvation in the central state of Jharkhand because the local ration dealer refused to give her family food grains for six months, as they had not linked their ration cards to Aadhaar. Facing criticism, the government asked states not to deny the poor the food grains they are entitled to, but the incident underscored how the Aadhaar initiative is cutting the needy off from subsidy access, rather than helping them, suggests Ramanathan, the lawyer. “People are dying because of Aadhaar,” she says.

But the Modi government has shown no signs of rethinking either the ways in which Aadhaar appears to hurt the poorest in Indian society or its data security protocols. Instead, it has appeared keener to target whistle-blowers pointing out weaknesses in the initiative.

It cost Rachna Khaira, a reporter, only 500 rupees ($7.50) to access the entire Aadhaar database — the names, addresses, fingerprint scans, iris scans, mobile phone numbers, email addresses, postal index numbers (PINs) and Aadhaar numbers of 830 million Indians. She “purchased” the service offered by anonymous sellers on WhatsApp and transferred the money via Paytm, a popular digital wallet company, to an “agent,” who created a “gateway” for Khaira. He then gave her a log-in ID and a password to that gateway, which allowed Khaira unrestricted access to the Aadhaar database. Her report, published in January in The Tribune, one of India’s oldest English dailies, created a national stir. Instead of trying to plug the holes the report had revealed, the UIDAI filed criminal cases against Khaira and the newspaper, accusing them of breaching privacy.

Khaira’s wasn’t the first piece of evidence to expose the vulnerability of the Aadhaar database. In May 2017, a report by the Centre for Internet and Society, a nonprofit organization, claimed that 130 million to 135 million Aadhaar numbers were published on four websites: the National Social Assistance Programme, the National Rural Employment Guarantee Scheme and two projects run by Andhra Pradesh state. “This is the largest exercise in the world of the conversion of public information into an asset and then its privatization,” says Nikhil Pahwa, editor of MediaNama and a critic of Aadhaar.

These breaches of security highlight corruption and mismanagement that belie claims the government continues to peddle. In April 2017, Ravi Shankar Prasad, India’s minister of information and technology, told Parliament that “Aadhaar is robust. Aadhaar is safe. Aadhaar is secure, and totally accountable.” The government hasn’t appeared too perturbed by privacy concerns. On July 22, 2015, Mukul Rohatgi, the then attorney general, argued before the country’s Supreme Court that “the right of privacy is not a guaranteed right under our constitution.” That set off a two-year-long hearing before a nine-judge bench of the court, which unanimously ruled in 2017 that the right to privacy was indeed a fundamental right.

The criticism from social groups Aadhaar was meant to benefit, though, has left the Modi administration on the defensive. Since the passage of the 2016 Aadhaar law, civil society activists have filed 12 petitions in the Supreme Court challenging its legality. In January, the All India Kisan Sabha, one of India’s largest farmer organizations with millions of members, petitioned the top court against government moves to link subsidies to Aadhaar identities. Some leaders from Modi’s party, the BJP, have also started questioning their own government in Parliament about cases of beneficiaries denied their due because of the Aadhaar program. The Supreme Court, which is holding regular hearings on the case, has extended indefinitely the date by which citizens must link all identity documents to their Aadhaar number, until it rules on the validity of the legislation. At stake is the trust the Indian people can place in their government.

Back in Kusumpur Pahari, much of that trust has already eroded. In his 2014 election campaign, Modi had promised to stand guard as a chaukidaar (watchman) over the country’s resources, to prevent corruption. But when someone illegally withdrew Phoolmati’s grains by using her Aadhaar identity, the watchman wasn’t able to stop the theft.

For Phoolmati and other residents of Kusumpur Pahari, their ration cards guaranteed them food, and were a rare pillar of certainty in an unstable life. The Aadhaar-linked fingerprint authentication system is a source of frustration, and they don’t want it, they make clear at their weekly meeting. They now get their ration some months, and other months they don’t. Life on the fringes of society was already tough. Aadhaar, they say, has made it harder still.

For more details visit https://cis-india.org/internet-governance/news/ozy-aayush-soni-may-11-2018-indias-national-id-project-brings-pain-to-those-it-aims-to-help

India's National Cyber Security Policy in Review

jon — 2013-07-31T10:40:22Z

Earlier this month, the Department of Electronics and Information Technology released India’s first National Cyber Security Policy. Years in the making, the Policy sets high goals for cyber security in India and covers a wide range of topics, from institutional frameworks for emergency response to indigenous capacity building.

What the Policy achieves in breadth, however, it often lacks in depth. Vague, cursory language ultimately prevents the Policy from being anything more than an aspirational document. In order to translate the Policy’s goals into an effective strategy, a great deal more specificity and precision will be required.

The Scope of National Cyber Security

Where such precision is most required is in definitions. Having no legal force itself, the Policy arguably does not require the sort of legal precision one would expect of an act of Parliament, for example. Yet the Policy deals in terms plagued with ambiguity, cyber security not the least among them. In forgoing basic definitions, the Policy fails to define its own scope, and as a result it proves remarkably broad and arguably unfocused.

The Policy’s preamble comes close to defining cyber security in paragraph 5 when it refers to "cyber related incident[s] of national significance" involving "extensive damage to the information infrastructure or key assets…[threatening] lives, economy and national security." Here at least is a picture of cyber security on a national scale, a picture which would be quite familiar to Western policymakers: computer security practices "fundamental to both protecting government secrets and enabling national defence, in addition to protecting the critical infrastructures that permeate and drive the 21st century global economy."[*] The paragraph 5 definition of sorts becomes much broader, however, when individuals and businesses are introduced, and threats like identity theft are brought into the mix.

Here the Policy runs afoul of a common pitfall: conflating threats to the state or society writ large (e.g. cyber warfare, cyber espionage, cyber terrorism) with threats to businesses and individuals (e.g. fraud, identity theft). Although both sets of threats may be fairly described as cyber security threats, only the former is worthy of the term national cyber security. The latter would be better characterized as cyber crime. The distinction is an important one, lest cyber crime be “securitized,” or elevated to an issue of national security. National cyber security has already provided the justification for the much decried Central Monitoring System (CMS). Expanding the range of threats subsumed under this rubric may provide a pretext for further surveillance efforts on a national scale.

Apart from mission creep, this vague and overly broad conception of national cyber security risks overwhelming an as yet underdeveloped system with more responsibilities than it may be able to handle. Where cyber crime might be left up to the police, its inclusion alongside true national-level cyber security threats in the Policy suggests it may be handled by the new "nodal agency" mentioned in section IV. Thus clearer definitions would not only provide the Policy with a more focused scope, but they would also make for a more efficient distribution of already scarce resources.

What It Get Right

Definitions aside, the Policy actually gets a lot of things right — at least as an aspirational document. It certainly covers plenty of ground, mentioning everything from information sharing to procedures for risk assessment / risk management to supply chain security to capacity building. It is a sketch of what could be a very comprehensive national cyber security strategy, but without more specifics, it is unlikely to reach its full potential. Overall, the Policy is much of what one might expect from a first draft, but certain elements stand out as worthy of special consideration.

First and foremost, the Policy should be commended for its commitment to “[safeguarding] privacy of citizen’s data” (sic). Privacy is an integral component of cyber security, and in fact other states’ cyber security strategies have entire segments devoted specifically to privacy. India’s Policy stands to be more specific as to the scope of these safeguards, however. Does the Policy aim primarily to safeguard data from criminals? Foreign agents? Could it go so far as to protect user data even from its own agents? Indeed this commitment to privacy would appear at odds with the recently unveiled CMS. Rather than merely paying lip service to the concept of online privacy, the government would be well advised to pass legislation protecting citizens’ privacy and to use such legislation as the foundation for a more robust cyber security strategy.

The Policy also does well to advocate “fiscal schemes and incentives to encourage entities to install, strengthen and upgrade information infrastructure with respect to cyber security.” Though some have argued that such regulation would impose inordinate costs on private businesses, anyone with a cursory understanding of computer networks and microeconomics could tell you that “externalities in cybersecurity are so great that even the freest free market would fail”—to quote expert Bruce Schneier. In less academic terms, a network is only as strong as its weakest link. While it is true that many larger enterprises take cyber security quite seriously, small and medium-sized businesses either lack immediate incentives to invest in security (e.g. no shareholders to answer to) or more often lack the basic resources to do so. Some form of government transfer for cyber security related investments could thus go a long way toward shoring up the country’s overall security.

The Policy also “[encourages] wider usage of Public Key Infrastructure (PKI) within Government for trusted communication and transactions.” It is surprising, however, that the Policy does not mandate the usage of PKI. In general, the document provides relatively few details on what specific security practices operators of Critical Information Infrastructure (CII) can or should implement.

Where It Goes Wrong

One troubling aspect of the Policy is its ambiguous language with respect to acquisition policies and supply chain security in general. The Policy, for example, aims to “[mandate] security practices related to the design, acquisition, development, use and operation of information resources” (emphasis added). Indeed, section VI, subsection A, paragraph 8 makes reference to the “procurement of indigenously manufactured ICT products,” presumably to the exclusion of imported goods. Although supply chain security must inevitably factor into overall cyber security concerns, such restrictive acquisition policies could not only deprive critical systems of potentially higher-quality alternatives but—depending on the implementation of these policies—could also sharpen the vulnerabilities of these systems.

Not only do these preferential acquisition policies risk mandating lower quality products, but it is unlikely they will be able to keep pace with the rapid pace of innovation in information technology. The United States provides a cautionary tale. The U.S. National Institute of Standards and Technology (NIST), tasked with producing cyber security standards for operators of critical infrastructure, made its first update to a 2005 set of standards earlier this year. Other regulatory agencies, such as the Federal Energy Regulatory Commission (FERC) move at a marginally faster pace yet nevertheless are delayed by bureaucratic processes. FERC has already moved to implement Version 5 of its Critical Infrastructure Protection (CIP) standards, nearly a year before the deadline for Version 4 compliance. The need for new standards thus outpaces the ability of industry to effectively implement them.

Fortunately, U.S. cyber security regulation has so-far been technology-neutral. Operators of Critical Information Infrastructure are required only to ensure certain functionalities and not to procure their hardware and software from any particular supplier. This principle ensures competition and thus security, allowing CII operators to take advantage of the most cutting-edge technologies regardless of name, model, etc. Technology neutrality does of course raise risks, such as those emphasized by the Government of India regarding Huawei and ZTE in 2010. Risk assessment must, however, remain focused on the technology in question and avoid politicization. India’s cyber security policy can be technology neutral as long as it follows one additional principle: trust but verify.

Verification may be facilitated by the use of free and open-source software (FOSS). FOSS provides security through transparency as opposed to security through obscurity and thus enables more agile responses to security responses. Users can identify and patch bugs themselves, or otherwise take advantage of the broader user community for such fixes. Thus open-source software promotes security in much the same way that competitive markets do: by accepting a wide range of inputs.

Despite the virtues of FOSS, there are plenty of good reasons to run proprietary software, e.g. fitness for purpose, cost, and track record. Proprietary software makes verification somewhat more complicated but not impossible. Source code escrow agreements have recently gained some traction as a verification measure for proprietary software, even with companies like Huawei and ZTE. In 2010, the infamous Chinese telecommunications giants persuaded the Indian government to lift its earlier ban on their products by concluding just such an agreement. Clearly trust but verify is imminently practicable, and thus technology neutrality.

What’s Missing

Level of detail aside, what is most conspicuously absent from the new Policy is any framework for institutional cooperation beyond 1) the designation of CERT-In “as a Nodal Agency for coordination of all efforts for cyber security emergency response and crisis management” and 2) the designation of the “National Critical Information Infrastructure Protection Centre (NCIIPC) to function as the nodal agency for critical information infrastructure protection in the country.” The Policy mentions additionally “a National nodal agency to coordinate all matters related to cyber security in the country, with clearly defined roles & responsibilities.” Some clarity with regard to roles and responsibilities would certainly be in order. Even among these three agencies—assuming they are all distinct—it is unclear who is to be responsible for what.

More confusing still is the number of other pre-existing entities with cyber security responsibilities, in particular the National Technical Research Organization (NTRO), which in an earlier draft of the Policy was to have authority over the NCIIPC. The Ministry of Defense likewise has bolstered its cyber security and cyber warfare capabilities in recent years. Is it appropriate for these to play a role in securing civilian CII? Finally, the already infamous Central Monitoring System, justified predominantly on the very basis of cyber security, receives no mention at all. For a government that is only now releasing its first cyber security policy, India has developed a fairly robust set of institutions around this issue. It is disappointing that the Policy does not more fully address questions of roles and responsibilities among government entities.

Not only is there a lack of coordination among government cyber security entities, but there is no mention of how the public and private sectors are to cooperate on cyber security information—other than oblique references to “public-private partnerships.” Certainly there is a need for information sharing, which is currently facilitated in part by the sector-level CERTS. More interesting, however, is the question of liability for high-impact cyber attacks. To whom are private CII operators accountable in the event of disruptive cyber attacks on their systems? This legal ambiguity must necessarily be resolved in conjunction with the “fiscal schemes and incentives” also alluded to in the Policy in order to motivate strong cyber security practices among all CII operators and the public more broadly.

Next Steps

India’s inaugural National Cyber Security Policy is by and large a step in the right direction. It covers many of the most pressing issues in national cyber security and lays out a number of ambitious goals, ranging from capacity building to robust public-private partnerships. To realize these goals, the government will need a much more detailed roadmap.

Firstly, the extent of the government’s proposed privacy safeguards must be clarified and ideally backed by a separate piece of privacy legislation. As Benjamin Franklin once said, “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.” When it comes to cyberspace, the Indian people must demand both liberty and safety.

Secondly, the government should avoid overly preferential acquisition policies and allow risk assessments to be technologically rather than politically driven. Procurement should moreover be technology-neutral. Open source software and source code escrow agreements can facilitate the verification measures that make technology neutrality work.

Finally, to translate this policy into a sound strategy will necessarily require that India’s various means be directed toward specific ends. The Policy hints at organizational mapping with references to CERT-In and the NCIIPC, but the roles and responsibilities of other government agencies as well as the private sector remain underdetermined. Greater clarity on these points would improve inter-agency and public-private cooperation—and thus, one hopes, security—significantly.

[*]. Melissa E. Hathaway and Alexander Klimburg, “Preliminary Considerations: On National Cyber Security” in National Cyber Security Framework Manual, ed. Alexander Klimburg, (Tallinn, Estonia: Nato Cooperative Cyber Defence Centre of Excellence, 2012), 13

For more details visit https://cis-india.org/internet-governance/blog/indias-national-cyber-security-policy-in-review

India's Latest Data Leak: People's Aadhaar Number And Bank Account Are Just One Google Search Away

Admin — 2018-07-13T15:18:46Z

Even Truecaller doesn't reveal this much.

The article by Gopal Sathe was published in Huffington Post on July 12, 2018.

Imagine being able to hack someone's personal data simply by entering their mobile phone number into a Google search. There is a website of the Andhra Pradesh government that's leaking people's phone numbers, Aadhaar numbers, father's names, passbook and bank account numbers, and the district and mandal where they live - all the link to all this information is the first result you get when you search for the phone numbers of people in the database.

The Andhra government has been leaking the personal data of more than 23,000 farmers who have received subsidies from the Andhra Pradesh Medicinal and Aromatic Plants Board, and organisation that encourages the growth of Ayurvedic medicines in the state. The subsidies are offered to farmers and tribals in the state, and all their personal data is available on an open database on an Andhra Government website.

The information is not behind any access control, and you can see all the records, click on them to get the details of anyone, or download everything as an Excel sheet. But what's perhaps worse is that simply by searching for the phone numbers of many of these farmers, we were able to find the detailed information about them. HuffPost India randomly chose a dozen farmers, and in each case, this database was the first result for their phone number on Google.

That's the most concerning part - in most cases, even when the information has leaked, it isn't readily apparent to people. You have to know the website address, or at the very least spend some time poring through dashboards. In the case of this latest leak, all you need is the person's phone number, and all their information is made visible. HuffPost India has reported this issue to the AP government, much like earlier leaks, although at the time of writing the data is still available online.

Who's held responsible?

This is just the latest in a long line of leaks from AP - in just the last few months, we've reported on a website that let you geo-locate homes on the basis of caste and religion; while another tracked all the medicines people buy, such as generic viagra, along with their phone numbers; and one that tracked pregnant women in ambulances in real time.

A government official we spoke to in AP Secretariat said that while all the departments have been digitised, an understanding of security - and privacy - is yet to come. "Even if you tell them, 'this data is not something you can publish', they disagree and say that it is needed for the beneficiaries to be able to access their own information," he explained.

Karan Saini, a security analyst and consultant who writes on issues of web security and privacy, told HuffPost that the various government departments are generally unresponsive when breaches like this are brought up.

"Lack of outreach is an issue with all of these organisations," said Saini. "NCIIPC is the only one that can even be found by someone looking at the surface. [These organisations] are hard to get a response from."

One reason for this, said Srinivas Kodali, a security researcher who has revealed a tremendous amount of leaks in the AP system, is that there is no official system of accountability in the government when it comes to data leaks.

In May 2017, the AP government passed the Andhra Pradesh Core Digital Data Authority Act, under which in section 37 it states that no legal proceeding shall lie against any officer or employee for anything which is in good faith done. What this means is that leaks and breaches are not something any official in the government can be held responsible for.

This act came out less than a month after the Centre for Internet and Society in Bengaluru published a report stating that 13 crore Aadhaar numbers were leaked - of which 2 crore were from Andhra Pradesh.

A lack of (human) resources

AP officials do acknowledge the problem. "There is a major shortage of cybersecurity professionals, and hiring them is a challenge," said V Premchand, head of the Andhra Pradesh Technology Service, who is in charge of the ongoing security work in the state. AP has seen a major security audit in May this year, and a privacy audit was announced last month.

"The work is ongoing but it is not something that can happen overnight," Premchand explained. However, others argue that the government isn't doing enough to make use of existing manpower. Unlike other countries, the Indian government does not have any real bug bounty program, where security researchers are incentivised to report weaknesses to organisations for cash rewards and recognition.

Sai Krishna Kothapalli, a student at IIT Guwahati and a security researcher, told HuffPost that the government actively discourages security experts from providing their support, rather than encouraging them.

"The US Department of Defense and others have a responsible disclosure program and a lot of people from India take part in that," he said. "Our talent is being used by them instead because the government here does not reply at all."

"India's top hackers are being employed by people outside the country, even though we have the talent here, because will you spend the time and effort to be ignored here, or report issues to a US company and make thousands of dollars instead?"

However, security audits in India are only being carried out by agencies that have been empaneled, and most of the hackers active here don't have the certification, he added. "They're too busy actually doing the work, while these big companies do audits, and leave all kinds of security issues behind."

For more details visit https://cis-india.org/internet-governance/news/huffington-post-gopal-sathe-july-12-2018-indias-latest-data-leak-is-so-basic-that-peoples-aadhaar-number-bank-account-and-fathers-name-are-just-one-google-search-away

India's landmark online speech ruling is step toward greater press freedom

praskrishna — 2015-03-29T00:55:35Z

In an historic decision, India's Supreme Court on Tuesday struck down part of a law used to silence criticism and free expression. While this marks a pivotal victory that has been welcomed in many quarters, many challenges remain for press freedom in the country.

The blog post by Sumit Galhotra was published by CPJ (Committee to Protect Journalists) on March 28, 2015. Pranesh Prakash is quoted.

Section 66A of the Information Technology Act--the vaguely worded provision struck down by the court--criminalized online speech deemed "grossly offensive" or "menacing," along with information for the purpose of causing "annoyance" or "inconvenience." Individuals convicted under the provision could face up to three years in prison. This law, along with others that remain on the books, has allowed India to become a paradise for the offended.

The law was challenged by a public interest litigation mounted by Shreya Singhal, in 2012. Singhal, who had just returned to Delhi from her studies in the U.K., was infuriated at how the law was being used to stifle debate and criticism in her home country, according to reports.

The September 2012 arrest of cartoonist Aseem Trivedi, on a range of charges including one under Section 66A, over his cartoons on politics and corruption, caught Singhal's attention. A few weeks later, she learned of the arrest of 21-year-old Shaheen Dhada, who questioned on Facebook the shutdown of Mumbai following the death of a politician, Singhal said. Dhada's friend, Renu Srinivasan, who had merely "liked" the comment, was arrested under the law. According to news reports, both were charged. These cases sparked a national debate on the space for free expression in the world's largest democracy, and led Singhal to challenge the law, she told reporters.

"It's a big victory," Singhal, who is currently studying law in Delhi, told the media following Tuesday's decision. "The Internet is so far-reaching and so many people use it now, it's very important for us to protect this right."

India is expected to overtake the U.S. as the second largest population of Internet users in the world, behind only China, according to the Internet and Mobile Association of India, a nonprofit group representing the Web and mobile industry. As Internet usage accelerates in India, thanks in large part to the widespread use of mobile devices, there has been an ongoing debate on how best to policeit in a country that has to contend with frequent episodes of violence, civil unrest, and terrorist attacks.


Karuna Nundy, an advocate at the Supreme Court of India who helped the legal challenge, says the country has several laws that are a threat to press freedom. (Geoffrey King)

Lawrence Liang, a lawyer and researcher at the Bangalore-based Alternative Law Forum, an Indian legal research organization, shared in Singhal's welcoming of the decision. "It is important to note that this is the first judgment in decades in which the Supreme Court has struck down a legal provision for violating freedom of speech, and in doing so, it simultaneously builds upon a rich body of free speech cases in India and paves the way for a jurisprudence of free speech in the 21st century, the era of the Internet and social media," he told CPJ.

Pranesh Prakash, policy director at Bangalore-based Centre for Internet and Society, an organization that focuses on issues of digital pluralism, called the judgment "a moral victory." He said the decision "furthers free speech jurisprudence in India, but also in all those other countries where an Indian precedent would be important," including many countries in Asia, and places such as South Africa.

As part of the judgment, the court narrowed its reading of Section 79 of the IT Act, under which private parties could submit notice-and-takedown orders directly to Internet intermediaries. The court held that intermediary liability can be pursued only through a court order or other government order, reports said.

Liang told CPJ the judgment falls short in some areas. The Supreme Court's 123-page judgment kept in place Section 69A of the IT Act and Information Technology Rules 2009 that allows the government to block websites if the content in question has the potential to create communal discord, social disorder, or impact India's relations with other countries, according to news reports.

"I would say that if there is missed opportunity in the judgment, it is the clarification of the process of blocking websites. If Section 66A was found to be arbitrary in that its scope covered protected and unprotected speech, then the procedure for blocking websites as laid out in Section 69A is also beset with similar problems," Liang said.

According to Chinmayi Arun, research director at the Centre for Communications Governance at the National Law University in Delhi, the 2009 rules require blocking requests and implementation to be kept confidential. "This means that speakers will have no way of finding out that the government has ordered intermediaries to block their content. Speakers will therefore not be able to question unconstitutional blocking orders before the judiciary--this is a clear interference with their constitutional rights," she told CPJ via email, referring to online users who could fall foul of the law.

Academic in me: As a matter of legal & constitutional analysis, the SC judgment is at its best on #66A, but weaker on 69A & weakest on 79.
-- Pranesh Prakash (@pranesh_prakash) March 24, 2015

For some journalists, the decision highlights how virtually no national party in India, including the ruling Bharatiya Janata Party (BJP), is a champion of these rights. In a piece for independent news website Scroll, journalist Shivam Vij criticizes the current Narendra Modi-led government for missing an opportunity by not acting decisively to address the problematic law. "It has become routine for India's politicians to avoid taking tough political decisions if they can be left to the courts," he said. "When in power, the BJP is as happy as the Congress to have at its disposal laws that can muzzle voices of dissent."

Trivedi told CPJ he agreed that the previous and current government did little to address abuses of the law. Trivedi, who up until the court decision, faced charges under Section 66A, and had joined Singhal as a petitioner in the case, added: "This decision marks a strong first step." The cartoonist's lawyer, Vijay Hiremath, told CPJ that the Section 66A charge has now been removed, but Trivedi still faces charges under the National Emblem Act.

While the striking down of Section 66A is a step in the right direction, many challenges remain for press freedom in India. Karuna Nundy, an advocate at the Supreme Court of India, who was at the forefront of the legal challenge, told CPJ numerous colonial-era laws, particularly in India's penal code, continue to pose threats to free speech and press freedom in India. CPJ has long documented cases of Indian journalists being threatened with sedition, defamation, and laws that criminalize "outraging religious sentiment."

Actually, next step(s): a review of the constitutionality of sedition, challenge criminal defamation, constitutionalise civil defamation.
-- Gautam Bhatia (@gautambhatia88) March 24, 2015

But Nundy expressed optimism for the challenges ahead for press freedom in India and elsewhere. She said the judgment shows, "If you do the work, you take the trouble, you make the challenge, you can achieve the kinds of values that you stand for. That is the work that is the duty of all us as national citizens and citizens of the world."

[Geoffrey King, CPJ Internet Advocacy Coordinator, contributed to this report from Manila]

For more details visit https://cis-india.org/internet-governance/news/cpj-march-28-2015-sumit-galhotra-indias-landmark-online-speech-ruling-is-step-toward-greater-press-freedom

India's Internet Privacy Woes

praskrishna — 2013-09-05T11:09:30Z

“For the sake of national security and to protect the privacy of its citizens, India should develop its own social media platforms,” says Dr Kamlesh Bajaj, CEO of Data Security Council of India (DSCI), a Nasscom-promoted ‘self-regulatory’ organisation on data protection and privacy in India, in a blog post dated August 13.

This article by Rohin Dharmakumar was published in Forbes India on August 26, 2013. Pranesh Prakash is quoted.

Citing a litany of woes, including American control over internet infrastructure, Bajaj makes the case for India to take a leaf out of China’s playbook (“even though its reasons were different”) and encourages the creation of “Indian” social media sites and search engines.

“Unfortunately, Dr Bajaj provides a wrong solution to a correct diagnosis,” says Pranesh Prakash, a policy director with the Centre for Internet and Society. “First, I can’t think of any governmental intervention—short of a ban on existing foreign services—that can make a new Indian service successful. Second, India’s privacy laws are worse than those in the US. Nothing will stop the US and Indian governments from coming after this company too.”

The problem arises because services like Facebook and Google store all your data unencrypted on their servers, making it easy for them, or governments and hackers, to monitor everything you do. The correct solution, says Prakash, would be to encourage the creation and use of de-centralised and end-to-end encrypted services that do not store all your data in one place.

For more details visit https://cis-india.org/news/forbesindia-august-26-2013-india-internet-privacy-woes

India's Internet Jam

pranesh — 2014-03-20T12:41:58Z

As authorities continue to clamp down on digital freedom, politicians and corporations are getting a taste for censorship too. Pranesh Prakash reports.

The article was published in Index on Censorship in August 2012. This is an unedited version of the article.

In a matter of three days, in August 2012, India’s central government ordered internet service providers to block around 309 pieces of online content – mostly individual web pages, YouTube videos and Facebook groups. The blocking orders came days after people originally from north-eastern India living in Bangalore began fleeing the city in fear of attack. Rumours that some Muslims in the city were planning violence in retaliation for recent clashes between the indigenous Bodo tribe and Muslim settlers in Assam spread quickly via text messages and through the media. The Nepali migrant community in Bangalore also received text messages from their families, warning them that they might be mistaken for north-eastern Indians and also be targeted. Indian Railway, catering to the huge demand, organised special trains to Assam for the crowds of people.

Freedom of speech is enshrined in the Constitution of India, which came into force in 1952, and specifically in Article 19(1)(a), which guarantees that ‘all citizens shall have the right to freedom of speech and expression’. While in the United States, it wasn’t until the 1920s that the Supreme Court struck down a law or governmental action on freedom of speech grounds, in India, just one year after the constitution was adopted, government actions against both left- and right-wing political speech were struck down for violating Article 19(1)(a). Enraged, the Congress government then amended Article 19, expanding the list of restrictions to the right to free expression. These included speech pertaining to ‘friendly relations with foreign states’, ‘public order’ and ‘incitement to an offence’. In 1963, in response to the 1962 war with China, the ‘sovereignty and integrity of India’ was also added, taking the number of categories of permissible restrictions up to eight. While the constitution categorically stipulates that no further restrictions should be imposed, courts have on occasion added to the list (privacy, for instance) through judicial interpretation without explicitly stating that they are doing so. Comparisons are often drawn between the constitution’s ‘reasonable restrictions’ and the categorical prohibition enshrined in the US Constitution’s First Amendment: ‘Congress shall make no law … abridging the freedom of speech, or of the press’ – a meaningless comparison as there are indeed many categories of speech that are seen as being protected under the US constitution and even speech that is protected may be restrained in a number of ways.

Today, there are a number of laws that regulate freedom of speech in India, from the Indian Penal Code (IPC), the Victorian legislation meant to codify crimes, to the Information Technology Act, which was amended in 2008 and in some cases makes behaviour that is perfectly legal offline into a criminal activity when online.

Sedition and social harmony

The Indian Penal Code criminalises sedition; speech intended to cause enmity between communities; speech intended to ‘outrage religious feelings of any class’; selling, singing or displaying anything obscene; and defamation. It also prohibits ‘causing someone, by words or gestures, to believe they’re the target of divine displeasure’. Each of these provisions has been misused, as there are indeed many catagories of speech that are not seen as being protected under thw US constitution, and even speech that is protected may be restrained in a number of ways.

In recent years, sedition charges have been brought against human rights activists (Binayak Sen and Arundhati Roy), journalists (Seema Azad), cartoonists (Aseem Trivedi) and protesters (thousands of villagers in Koodankulam and neighbouring villages who demonstrated against a nuclear reactor in their area). It is usually the higher judiciary that dismisses such cases, while the lower judiciary seems to be supplicant to the bizarre claims of government, the police and complainants. Similarly, the higher judiciary has had to intervene in cases where books and films have been banned for ‘causing enmity between communities’ or for intentionally hurting the sentiments of a religious group.

Of the last six books banned by the Maharashtra government, all but one (RV Bhasin’s Islam: A Concept of Political World Invasion by Muslims) have been overturned by the Mumbai High Court. In one case, the court criticised the government for using a violent protest (organised by the Sambhaji Brigade, one of many right-wing political groups that frequently stage demonstrations) as reason enough for banning an academic book on the Maratha king Shivaji. In its decision, the judge pointed out that it is the government’s job to provide protection against such violence. Given India’s history of communal violence there is indeed a need for the law to address incitement to violence – but these laws should be employed at the actual time of incitement, not after the violence has already taken place. But, as recent events have shown, the government is willing to censor ‘harmful’ books and films and less likely to take action against individuals who incite violence during demonstrations.

Online speech and the law

There are regular calls for the government to introduce legislation that deals specifically with online behaviour, despite the fact that the vast majority of the laws regarding sedition and social harmony apply online as well as offline. One example is the recent move to introduce amendments to the Indecent Representation of Women Act (1986) so that it applies to ‘audiovisual media and material in electronic form’.

But the government’s attempts to control online speech began long before the introduction of any internet-specific legislation. Indeed, when state-monopoly internet service provider VSNL censored content, it did so under the terms of a contract it had entered with its customers, not under any law. In 1998, a mailing list called Middle East Socialist Network was blocked on national security grounds. In 1999, Pakistani newspaper Dawn’s website was blocked during the Kargil conflict. In both of the latter cases, the government relied on the Indian Telegraph Act (1885) to justify its actions, though that act contains no explicit provisions for such censorship.

In 2000, the Information Technology (IT) Act was passed and the Indian Computer Emergency Response Team (CERT-In) was created, which (unlawfully) assumed the role of official online censor. Importantly, while the IT Act did
make the publication of obscene content online illegal (though it already was under the IPC), it did not grant permission for authorities to block websites. Despite this, an executive order passed on 27 February 2003 granted CERT-In the power to block. Had this been challenged in a court, it may well have been deemed unconstitutional since, in the absence of a statutory law, an executive order cannot reverse the freedom granted under Article 19. And although the telecommunications sector in India was being liberalised around this time, as part of their licence agreements, all internet service providers (ISPs) have to agree to block links upon being requested to do so by the government. In 2008, when the IT Act was amended, it clearly stated that the government can block websites not only when it deems it necessary to do so but also when it is deemed expedient in relation to matters of public interest, national security and with regard to maintaining friendly relations with foreign states. The power to block does not, however, extend to obscenity or defamation offences. At the same time, further categories of speech crimes were introduced, along with other new offences, including the electronic delivery of ‘offensive messages through communication services’ or anything ‘for the purpose of causing annoyance or inconvenience’. This has often been abused, including by the chief minister of West Bengal, who issued proceedings against a professor for forwarding an email containing a cartoon that mocked him. Under this draconian and unconstitutional provision, the police do not need an arrest warrant and the punishment can be as much as three years’ imprisonment, longer than even the punishment for causing death by negligence. The amendment also granted the government extensive powers to monitor and intercept online speech and data traffic, greatly extending the powers provided under colonial laws such as the Indian Telegraph Act (1885). As legislation has been introduced, the penalties for online offences have increased significantly. For example, the penalty for the first-time publication of an obscene ebook is up to five years in prison and a 1,000,000 rupee (US$18,800) fine, compared with two years’ imprisonment and a 2,000 rupee (US$38) fine as stipulated in the IPC for publishing that same material in print version. New laws introduced in 2009 pertain specifically to blocking (section 69a), interception, decryption and monitoring (69 and 69b) and are in accordance with the constitution. However, the amendments were brought in without any attempt at transparency or accountability.

Power in the hands of intermediaries

In April 2011, despite critical submissions received during its public consultation, the government announced new ‘intermediary guidelines’ and ‘cyber cafe rules’, both of which have adverse effects on freedom of expression. The rules, which were issued by the Department of Information and Technology (DIT), grant not only the government but citizens significant powers to censor the internet. They require all intermediaries – companies that handle content, including web hosts, telecom companies, domain name providers and other such intermediaries – to remove ‘disparaging’ content that could ‘harm minors in any way’. They prohibit everything from jokes (if the person sharing the joke does not own copyright to it) to anything that is disparaging. In a recent case, in December 2011, thousands of people used the hashtag #=IdiotKapilSibal on Twitter to criticise the minister of communications and information technology, Kapil Sibal, who had requested that officials from Google, Microsoft, Yahoo! and Facebook in India pre-screen online content. These guidelines and rules are badly drafted and unconstitutional, as they go beyond the limits allowed under Article 19 in the constitution. And do so in a manner that lacks any semblance of due process and
fairness. They are inconsistent with offline laws, too: for example, because the guidelines also refer to gambling, the government of Sikkim can publish advertisements for its PlayWin lottery in newspapers but not online. It’s far easier to persuade officials to remove online material than it is to persuade them to remove books from a bookstore or artwork from a gallery. Police are only empowered to seize books if the government or a court has been persuaded that it violates a law and issues such an order. This fact is always recorded, in government or legal records, police files or in the press. By contrast, web content can be removed on the basis of one email complaint; intermediaries are required to ‘disable’ the relevant content within 36 hours of the complaint. A court order is not required, nor is there a requirement to notify the owner of the content that a complaint has been received or that material has been removed. The effect is that of almost invisible censorship.

This assertion – that it only takes one complaint – may seem far-fetched. But a researcher from the Centre for Internet and Society sent complaints to several intermediaries on a number of occasions, resulting in content being removed in a majority of cases. If intermediaries choose not to take action, they risk losing their immunity against punishment for content. In essence, the law is the equivalent of punishing a post office for the letters that people send via the postal service.

The amendments were brought in without any attempt at transparency or accountability

In 1984, Indira Gandhi was forced to sue Salman Rushdie for defamation in a London court in order to ensure one sentence was expurgated from his novel Midnight’s Children. Today Gandhi wouldn’t need to win a lawsuit against publishers. She would merely have to send a complaint to websites selling the book and it would have to be removed from sale. It is easier to block Akbari.in – the online newspaper run by Vinay Rai, who filed a criminal complaint against multiple internet companies in December 2011 for all manner of materials – than it is to prevent its print publication. There is no penalty for frivolous complaints, such as those sent by researchers from the Centre for Internet and Society, nor is there any requirement for records to be kept of who has removed what. Such great powers of censorship without any penalties for abuse of these powers are a sure-fire way of moving towards greater intolerance, with the internet – that republic of opinions and expressions – being a casualty.

Censorship outside the law

Since 2011, governments and private companies alike have increasingly engaged in internet censorship. In April 2011, in response to a right to information request, the DIT released a list of 11 websites that had been officially blocked under the IT Act since 2009, when the amended act came into force. But, according to a recent Google Transparency Report, government requests for the removal of material far exceeds that number. The report reveals that the government (including state governments) requested that Google remove 358 items from January 2011 to June 2011. Of this number, only eight were considered to be hate speech and only one item was related to concerns over national security. The remaining material, 255 items (71 per cent of all requests), was taken down because of ‘government criticism’. Criticism of the government is protected under the country’s constitution but, nonetheless, Google complied with take-down requests 51 per cent of the time. It’s clear, then, that governmental censorship is far more widespread than officially acknowledged.

In July 2011, Reliance Entertainment obtained a ‘John Doe’ order to protect its intellectual property rights with regard to its film Singham, which was scheduled for release that month. The order prohibited both online and offline infringement of copyright for the film and was sent to a number of ISPs, which then blocked access to file-sharing websites, even though there was no proof of the film having been available on any of them. According to Reliance Entertainment, they merely asked ISPs ‘not to make the film available’ on their networks, even though the order did not authorise it. But a right to information request pertaining to a similar case dealing with the distribution of the film Dhammu showed that the entertainment company’s lawyers had in fact asked for dozens of websites – not just deep-link URLs to infringing content – to be blocked, despite publicly claiming otherwise. If web users encountered any information at all about why access to the sites was blocked, it was that the Department of Telecom had ordered the blocking, which was plainly untrue. In February 2012, following a complaint from the Indian Music Industry (a consortium of 142 music companies), the Calcutta High Court ordered 387 ISPs to block 107 websites for music piracy. At least a few of those, including Paktimes.com and Filmicafe.com, were general interest entertainment sites. The most famous of these sites, Songs.pk, re-emerged shortly after the block as Songspk.pk, highlighting the pointlessness of the block. And outside the realm of copyright, in December 2011, the domain name CartoonsAgainstCorruption.com was suspended based on an unlawful complaint from the Mumbai police requesting its suspension, despite there being no powers for them to do so under any law.

Between August and November 2011, the DIT also went to great efforts to compel big internet companies including Indiatimes, Facebook, Google, Yahoo!, and Microsoft, to ‘self-regulate’. This revealed the department’s desire to gain ever greater powers to control ‘objectionable’ content online, effectively bypassing the IT Act. It’s obvious, too, that by encouraging internet companies to ‘self-regulate’ the government will avoid embarrassing statistics such as those revealed by Google’s Transparency Report.

New dangers

A way forward, at least for internet-specific laws, could be to rekindle the Cyber Regulations Advisory Committee – a multi-stakeholder committee required by the IT Act – and to practise at home what we preach abroad on matters of internet governance: the value of a multi-stakeholder system, which includes industry, academia and civil society and not just governments. The idea of a multi-stakeholder framework has gained prominence since it was placed at the core of the ‘Declaration of Principles’ at the first World Summit on Information Society in Geneva in 2003. It has also been at the heart of India’s pronouncements at the Internet Governance Forum and the India-Brazil-South Africa Dialogue Forum. The Internet Governance Division, which formulates the country’s international stance on internet governance, has long recognised that these decisions must be taken in an open and collaborative manner. It is time the DIT’s Cyber-Law and ESecurity Group, which formulates the country’s national stance on the internet, realises the same.

Freedom of speech means nothing in a democratic society if it does not allow everyone to speak. Despite the internet being a very elite space, the number of people who have used it to express themselves since its introduction in India in 1994 is vast, especially when compared to the number of people in India who have expressed themselves in print since 1947 when the country won its independence. Online speech is indeed a big shift from edited and usually civil discussions in the world of print media. Perhaps this gives us some indication of why there is some support among the mass media for government regulations on speech. Too many discussions of online speech laws in India descend into arguments about the lack of civility online. However, the press – and all of us – would do well to remember that civility and decency in speech, while desirable in many contexts, cannot be the subject of legislation. But in India, the greatest threat to freedom of expression is not a government clampdown on dissent but threats from political and corporate powers with a range of tools at their disposal, including fostering a climate of selfcensorship. The government has passed bad laws that have given way to private censorship. And many of these laws are simply a result of gross ineptitude.

We cannot take sufficient comfort in the fact that, in India, censorship is limited and nowhere on the scale that it is in China or Iran. It is crucial that, from a legal, cultural and technological standpoint we do not open the door for further censorship. And currently, we are failing.

Pranesh Prakash is Policy Director at the Centre for Internet and Society in Bangalore. Part of this article appeared in a blog by the author on the centre’s website, cis-india.org, in January 2012

For more details visit https://cis-india.org/internet-governance/blog/index-on-censorship-august-2012-pranesh-prakash-indias-internet-jam

India's Identity Crisis

malavika — 2014-01-09T07:56:08Z

Malavika Jayaram's article was published in 2013 Internet Monitor Annual Report: Reflections on the Digital World, published by Harvard's Berkman Center for Internet and Society.

India’s Unique Identity (UID) project is already the world’s largest biometrics identity program, and it is still growing. Almost 530 million people have been registered in the project database, which collects all ten fingerprints, iris scans of both eyes, a photograph, and demographic information for each registrant. Supporters of the project tout the UID as a societal game changer. The extensive biometric information collected, they argue, will establish the uniqueness of each individual, eliminate fraud, and provide the identity infrastructure needed to develop solutions for a range of problems. Despite these potential benefits, however, critical concerns remain about the UID’s legal and physical architecture as well as about unforeseen risks associated with the linking and analysis of personal data.

The most basic concerns regarding the UID project stem from the fact that biometric technologies have never been tested on such a large population. As a result, well-founded concerns exist around scalability, false acceptance and rejection rates, and the project’s core premise that biometrics can uniquely and unambiguously identify people in a foolproof manner. Some of these concerns are based on technical issues—collecting fingerprints and iris scans “in the field,” for instance, can be complicated when a registrant’s fingerprints are eroded by manual labor or her irises are affected by malnutrition and cataracts. Other concerns relate to the project’s federated implementation architecture, which, by outsourcing collection to a massive group of private and public registrars and operators, increases the chance for data breaches, error, and fraud.

Perhaps even more vexing are concerns regarding how the UID, which promises financial inclusion (by reducing the identification barriers to opening bank accounts, for example), might in fact lead to new types of exclusion for already marginalized groups. Members of the LGBT community, for instance, question whether the inclusion of the transgender category within the UID scheme is a laudable attempt at inclusion, or a new means of listing and targeting members of their community for exclusion. More fundamentally, as more and more services and benefits are linked to the UID, the project threatens to exclude all those who cannot or will not participate in the scheme due to logistical failures or philosophical objections.

It is worth noting that the UID is not the only large data project in India. A slew of “Big Brother” projects exist: the Centralised Monitoring System (CMS), the Telephone Call Interception System (TCIS), the National Population Register (NPR), the Crime and Criminal Tracking Network and Systems (CCTNS), and the National Intelligence Grid (NATGRID), which is working to aggregate up to 21 different databases relating to tax, rail and air travel, credit card transactions, immigration, and other domains. The UID is intended to serve as a common identifier across these databases, creating a massive surveillance state. It also facilitates an ecosystem where access to goods and services, from government subsidies to drivers’ licenses to mobile phones to cooking gas, increasingly requires biometric authentication.

The UID project was originally vaunted as voluntary, but the inexorable slippery slope toward compulsory participation has triggered a series of lawsuits challenging the legality of forced enrollment and the constitutionality of the entire project. Most recently, in September 2013, India’s federal Supreme Court affirmed by way of an interim decision that the UID was not mandatory, that not possessing a UID should not disadvantage anybody, and that citizenship should be ascertained as a criteria for registering in order to ensure that UIDs are not issued to illegal immigrants. This last stipulation is particularly thorny given that the Unique Identification Authority of India (UIDAI, the body in charge of the UID project) has consistently distanced the UID from questions of citizenship under the justification that it is a matter beyond their remit (i.e., the UID is open to residents, and is not linked to citizenship). The government moved quickly to urge a modification of the order, but the Supreme Court declined to do so and will instead release its final decision after it reviews a batch of petitions from activists and others. The UIDAI approached the court, arguing that not making the UID mandatory has serious consequences for welfare schemes, but the court recently ordered the federal government, the Reserve Bank of India, and the Election Commission to delink the LPG cooking gas scheme from the UID. This is a considerable setback for the project, given that this was one of the most hyped linkages for the UID. It remains to be seen whether the court will similarly halt other attempts to make the UID mandatory.

In the meantime, the UID project is effectively being implemented in a legal vacuum without support from the Supreme Court or Parliament. The Cabinet is seeking to rectify this and has cleared a bill that would finally provide legal backing for the UID program—its previous attempt was rejected by the Standing Committee on Finance in 2010. This bill is scheduled to come up for debate during the winter session of Parliament. The bill’s progress, along with the final decision of the Supreme Court, will have far reaching consequences for the UID project’s implementation and longevity, as well as for the relationship between India’s citizens and the state.

If fully implemented, the UID system will fundamentally alter the way in which citizens interact with the government by creating a centrally controlled, technology-based standard that mediates access to social services and benefits, financial systems, telecommunications, and governance. It will undoubtedly also have implications for how citizens relate to private sector entities, on which the UID rests and which have their own vested interests in the data. The success or failure of the UID represents a critical moment for India. Whatever course the country takes, its decision to travel further toward or turn away from becoming a “database nation” will have implications for democracy, free speech, and economic justice within its own borders and also in the many neighboring countries that look to it as a technological standard bearer.

The Indian government seems to envision “big data” as a panacea for fraud, corruption, and abuse, but it has given little attention to understanding and addressing the fraud, corruption, and abuse that massive databases can themselves engender. The government’s actions have yet to demonstrate an appreciation for the fact that the matrix of identity and surveillance schemes it has implemented can create a privacy-invading technology layer that is not only a barrier to online activity but also to social participation writ large.

The lack of identification documents for a large portion of the Indian population does need to be addressed. Whether the UID project is the best means to do this—whether it has the right architecture and design, whether it can succeed without an overhaul of several other failures of governmental institutions, and whether fixing the identity piece alone causes more harm than good—should be the subject of intense debate and scrutiny. Only through rigorous threat modeling and analysis of the risks arising out of this burgeoning “data industrial complex” can steps be taken to stem the potential repercussions of the project not just for identity management, fraud, corruption, distributive justice, and welfare generally, but also for autonomy, openness, and democracy.

Click to download the article published in the annual report of Berkman's Center for Internet and Society (PDF 7223 Kb)

For more details visit https://cis-india.org/internet-governance/blog/internet-monitor-2013-malavika-jayaram-indias-identity-crisis

India's HIV-positive trans people find 'new strength' in technology

Annie Banerji — 2019-10-18T15:28:18Z

Shoved, cursed and ridiculed, Nisha's hospital visits were always stressful as a transgender woman and got worse after she was diagnosed as HIV-positive.

The article by Annie Banerji was published in Reuters on October 17, 2019 and mirrored in the Jakarta Post as well. Ambika Tandon was quoted. It was mirrored in ET Healthworld.com as well.

But a new app introduced as part of a drive to end an HIV epidemic in India by 2030 is providing her and the transgender community better access to doctors, lifesaving drugs - and hope - although it has raised concerns about digital privacy.

India has the world's third largest population living with HIV - 2.1 million people - according to UNAIDS, with recognition that help is needed in the transgender community where the prevalence is 3.1% compared to 0.26% among all adults.

Nisha tested HIV positive last year after earning a living as a sex worker in New Delhi. On the job, she said, condoms would often break or she would not use one for more money.

"That was a bad idea. I ended up with HIV. I felt suicidal after I found out," Nisha, 29, a trans woman who goes by one name, told the Thomson Reuters Foundation.

"It didn't help that going to the hospital was torturous. People made faces, passed lewd comments ... a doctor even kicked me out."

Despite the Supreme Court recognizing India's 2 million transgender people as a third gender with equal rights in 2014, they are often kicked out by their families and denied jobs, education and healthcare, leading them to begging or sex work.

Trans women like Nisha say they face "double discrimination" and the risk of being shunned and abused - first because of their gender identity and then because of their HIV status.

But a counselling program along with a new app is helping health workers track down HIV-positive transgender people, monitor their treatment and link them to doctors and antiretroviral therapy (ART) to suppress the AIDS virus.

"I have found new strength. I don't feel depressed or nervous anymore," said Nisha, who now begs at traffic lights.

"The app helps keep me physically healthy and she ensures I'm mentally and emotionally (healthy)," she said, pointing to her outreach worker Samyra, an HIV-positive trans woman.

The eMpower app - developed by IBM in partnership with India HIV/AIDS Alliance and the Global Fund to Fight AIDS, Tuberculosis and Malaria - monitored more than 1.2 million people between January 2018 and March 2019.

'Half the battle won'

With mobile tablets in hand, HIV-positive transgender outreach workers keep a tab on others in their community living with HIV and counsel them and accompany them to see doctors.

"I tell them 'I'm like you. I'm HIV-positive and I'm taking medicines too. You're not alone'," said Samyra, who works with Vihaan, a national initiative to expand counselling, outreach and follow-up programs to people living with HIV.

"That makes a huge difference because it's coming from one of your own. Half of the HIV battle is won when you have someone to hold your hand along the way."

Health experts said transgender focused initiatives like this and the launch in March of India's first HIV treatment clinic in Mumbai city run for and by LGBT+ people were pushing the country towards its target to end the epidemic by 2030.

But to achieve this target they said it was critical for patients to stick with ART. Sometimes stigma and side effects can cause them to drop out of the treatment.

That is why health workers follow up with clients every few months and record information on the eMpower app, including their weight, viral load and CD4 - white blood cells that fight HIV - and advise them on everything from their diet to safe sex.

They also note whether a client has faced discrimination, and arrange for partners and family members to get tested.

Sonal Mehta, head of India HIV/AIDS Alliance, said the app has helped boost Vihaan's outreach numbers as well as the confidence of trans clients and workers, who often come from poor, semi-literate backgrounds.

"The trans clients definitely feel much more secure ... but the outreach workers themselves also feel very empowered. They are professional officers working on the field, talking to doctors, government officers, engaging with various organisations," she said.

Double-edged sword

While such technological advances are seen as key in the HIV/AIDS fight, health and software experts warn they can come at the cost of privacy.

The eMpower app creates a profile for each client with personal information including name, biometric ID number, occupation and monthly income, and a map pinning their location.

Without proper safeguards, such an app runs the risk of data breach and sharing information with third-parties, which can further ostracize an already marginalized community, said Ambika Tandon, a cyber security expert.

"The potential to monetize is definitely a risk factor," said Tandon, policy officer in gender-based research at the Banaglore-based Centre for Internet and Society.

"Another is informational privacy ... (clients) may not necessarily know where their information is being stored, who will have access to it ... There could be multiple points at which their data could be vulnerable."

Saravanan RM, a senior technical officer at India HIV/AIDS Alliance, said the eMpower app a "fool-proof system".

He said all sensitive data was stored on the organisation's server, which could only be accessed by specific workers through a password-protected system.

None of the information can be seen by any partners - not IBM, state or federal governments. It is further beefed up by a mobile device management (MDM), he said.

"For example, if any device is lost or has gone into someone else's hands, what we can do through MDM is clean out the entire tablet and the data will not be acquired," he said.

Dr. V Sam Prasad, India program manager of the AIDS Healthcare Foundation, said the app should not be dismissed because there was a privacy risk as it came with major benefits.

Several HIV-positive transgender people like Swati, a trans woman who contracted HIV after injecting drugs, felt the same.

"Even if it (personal data) is leaked, what's the worst that could happen? I've faced unimaginable things. Nothing scares me, at least not such things," said Swati, 25, after a follow-up meeting with her outreach worker at her one-room home.

"It is (eMpower) saving me. It is not an enemy."

For more details visit https://cis-india.org/internet-governance/news/reuters-annie-banerji-october-17-2019-indias-hiv-positive-trans-people-find-new-strength-in-technology

India's Data Protection Framework Will Need to Treat Privacy as a Social and Not Just an Individual Good

amber — 2018-05-18T06:22:57Z

The idea that technological innovations may compete with privacy of individuals assumes that there is social and/or economic good in allowing unrestricted access to data. However, it must be remembered that data is potentially a toxic asset, if it is not collected, processed, secured and shared in the appropriate way.

Published in Economic & Political Weekly, Volume 53, Issue No. 18, 05 May, 2018. Article can be accessed online here.

In July 2017, the Ministry of Electronics and Information Technology (MeITy) in India set up a committee headed by a former judge, B N Srikrishna, to address the growing clamour for privacy protections at a time when both private collection of data and public projects like Aadhaar are reported to pose major privacy risks (Maheshwari 2017). The Srikrishna Committee is in the process of providing its input, which will go on to inform India’s data-protection law.

While the committee released a white paper with provisional views, seeking feedback a few months ago, it may be discussing a data protection framework without due consideration to how data practices have evolved.

In early 2018, a series of stories based on investigative journalism by Guardianand Observer revealed that the data of 87 million Facebook users was used for the Trump campaign by a political consulting firm, Cambridge Analytica, without their permissions. Aleksandr Kogan, a psychology researcher at the University of Cambridge, created an application called “thisisyourdigitallife” and collected data from 270,000 participants through a personality test using Facebook’s application programming interface (API), which allows developers to integrate with various parts of the Facebook platform (Fruchter et al 2018). This data was collected purportedly for academic research purposes only. Kogan’s application also collected profile data from each of the participants’ friends, roughly 87 million people.

The kinds of practices concerning the sharing and processing of data exhibited in this case are not unique. These are, in fact, common to the data economy in India as well. It can be argued that the Facebook–Cambridge Analytica incident is representative of data practices in the data-driven digital economy. These new practices pose important questions for data protection laws globally, and how these may need to evolve to address data protection, particularly for India, which is in the process of drafting its own data protection law.

Privacy as Control

Most modern data protection laws focus on individual control. In this context, the definition by the late Alan Westin (2015) characterises privacy as:

The claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to other.

The idea of “privacy as control” is what finds articulation in data protection policies across jurisdictions, beginning with the Fair Information Practice Principles (FIPP) from the United States (US) (Dixon 2006). These FIPPs are the building blocks of modern information privacy law (Schwartz 1999) and not only play a significant role in the development of privacy laws in the US, but also inform data protection laws in most privacy regimes internationally (Rotenberg 2001), including the nine “National Privacy Principles” articulated by the Justice A P Shah Committee in India. Much of this approach is also reflected in the white paper released by the committee, led by Justice Srikrishna, towards the creation of data protection laws in India (Srikrishna 2017)

This approach essentially involves the following steps (Cate 2006):

(i) Data controllers are required to tell individuals what data they wish to collect and use and give them a choice to share the data.
(ii) Upon sharing, the individuals have rights such as being granted access, and data controllers have obligations such as securing the data with appropriate technologies and procedures, and only using it for the purposes identified.

The objective in this approach is to make the individual empowered and allow them to weigh their own interests in exercising their consent. The allure of this paradigm is that, in one elegant stroke, it seeks to “ensure that consent is informed and free and thereby also (seeks) to implement an acceptable tradeoff between privacy and competing concerns.” (Sloan and Warner 2014). This approach is also easy to enforce for both regulators and businesses. Data collectors and processors only need to ensure that they comply with their privacy policies, and can thus reduce their liability while, theoretically, consumers have the information required to exercise choice. In recent years, however, the emergence of big data, the “Internet of Things,” and algorithmic decision-making has significantly compromised the notice and consent model (Solove 2013).

Limitations of Consent

Some cognitive problems, such as long and difficult to understand privacy notices, have always existed with regard to the issue of informed consent, but lately these problems have become aggravated. Privacy notices often come in the form of long legal documents, much to the detriment of the readers’ ability to understand them. These policies are “long, complicated, full of jargon and change frequently” (Cranor 2012).

Kent Walker (2001) lists five problems that privacy notices typically suffer from:

(i) Overkill: Long and repetitive text in small print.
(ii) Irrelevance: Describing situations of little concern to most consumers.
(iii) Opacity: Broad terms that reflect limited truth, and are unhelpful to track and control the information collected and stored.
(iv) Non-comparability: Simplification required to achieve comparability will lead to compromising of accuracy.
(v) Inflexibility: Failure to keep pace with new business models.

Today, data is collected continuously with every use of online services, making it humanly impossible to exercise meaningful consent.
The quantity of data being generated is expanding at an exponential rate. With connected devices, smartphones, appliances transmitting data about our usage, and even the smart cities themselves, data now streams constantly from almost every sector and function of daily life, “creating countless new digital puddles, lakes, tributaries and oceans of information” (Bollier 2010).

The infinitely complex nature of the data ecosystem renders consent of little value in cases where individuals may be able to read and comprehend privacy notices. As the uses of data are so diverse, and often not limited by a purpose identified at the beginning, individuals cannot conceptualise how their data will be aggregated and possibly used or reused.

Seemingly innocuous bits of data revealed at different stages could be combined to reveal sensitive information about the individual. While the regulatory framework is designed such that individuals are expected to engage in cost–benefit analysis of trading their data to avail services, this ecosystem makes such individual analysis impossible.

Conflicts Between Big Data and Individual Control

The thrust of big data technologies is that the value of data resides not in its primary purposes, but in its numerous secondary purposes, where data is reused many times over (Schoenberger and Cukier 2013).

On the other hand, the idea of privacy as control draws from the “data minimisation” principle, which requires organisations to limit the collection of personal data to the minimum extent necessary to obtain their legitimate purpose and to delete data no longer required. Control is excercised and privacy is enhanced by ensuring data minimisation. These two concepts are in direct conflict. Modern data-driven businesses want to retain as much data as possible for secondary uses. Since these secondary uses are, by their nature, unanticipated, their practices run counter to the very principle of purpose limitation (Tene and Polonetsky 2012).

It is evident from such data-sharing practices, as demonstrated by the Cambridge Analytica–Facebook story, that platform architectures are designed with a clear view to collect as much data as possible. This is amply demonstrated by the provision of a “friends permission” feature by Facebook on its platform to allow individuals to share information not just about themselves, but also about their friends. For the principle of informed consent to be meaningfully implemented, it is necessary for users to have access to information about intended data practices, purposes and usage, so they consciously share data about themselves.

In reality, however, privacy policies are more likely to serve as liability disclaimers for companies than any kind of guarantee of privacy for consumers. A case in point is Mark Zuckerberg’s facile claim that there was no “data-breach" in the Cambridge Analytica–Facebook incident. Instead of asking each of the 87 million users whether they wanted their data to be collected and shared further, Facebook designed a platform that required consent in any form only from 270,000 users. Not only were users denied the opportunity to give consent, their consent was assumed through a feature which was on by default. This is representative of how privacy trade-offs are conceived by current data-driven business models. Participation in a digital ecosystem is by itself deemed as users’ consent to relinquish control over how their data is collected, who may have access to it, and what purposes it may be used for.

Yet, Zuckerberg would have us believe that the primary privacy issue of concern is not about how his platform enabled the collection of users’ data without their explicit consent, but in the subsequent unauthorised sharing of the data by Kogan. Zuckerberg’s insistence that collection of data of people without their consent is not a data breach is reminiscent of the UIDAI’s recent claims in India that publication of Aadhaar numbers and related information by several government websites is not a data breach, so long as its central biometric database in secure (Sharma 2018). In such cases also, the intended architecture ensured the seeding of other databases with Aadhaar numbers, thus creating multiple potential points of failure through disclosure. Similarly, the design flaws in direct benefit transfers enabled Airtel to create payments bank accounts with the customers’ knowledge (Hindu Business Line 2017). Such claims clearly suggest the very limited responsibility data controllers (both public and private) are willing to take for personal data that they collect, while wilfully facilitating and encouraging data practices which may lead to greater risk to data.

On this note, it is also relevant to point out that the Srikrishna committee white paper begins with identifying informational privacy and data innovation as its two key objectives. It states that “a firm legal framework for data protection is the foundation on which data-driven innovation and entrepreneurship can flourish in India.”

Conversations around privacy and data have become inevitably linked to the idea of technological innovation as a competing interest. Before engaging in such conversations, it is important to acknowledge that the value of innovation as a competing interest itself is questionable. It is not a competing right, nor a legitimate public interest endeavour, nor a proven social good.

The idea that in policymaking, technological innovations may compete with privacy of individuals assumes that there is social and/or economic good in allowing unrestricted access to data. The social argument is premised on the promises of mathematical models and computational capacity being capable of identifying key insights from data. In turn, these insights may be useful in public and private decision-making. However, it must be remembered that data is potentially a toxic asset, if it is not collected, processed, secured and shared in the appropriate way. Sufficient research suggests that indiscriminate data collection is greatly increasing the ratio of noise to signal, and can lead to erroneous insights. Further, the greater the amount of data you collect, the greater is the attack surface that leads to cybersecurity risks. Further, incidents such as Facebook–Cambridge Analytica demonstrate that toxicity of data in various ways and underscores the need for data regulation at every stage of the data lifecycle (Scheiner 2016). These are important tempering factors that need to be kept in mind while evaluating data innovation as a key mover of policy or regulation.

Privacy as Social Good

As long as privacy is framed as arising primarily from individual control, data controllers will continue to engage in practices that compromise the ability to exercise choice. There is a need to view privacy as a social good, and policymaking should ensure its preservation and enhancement. Contractual protections and legal sanctions can themselves do little if platform architectures are designed to do the exact opposite.

More importantly, policymaking needs to recognise privacy not merely as an individual right, available for individuals to forego when engaging with data-driven business models, but also as a social good. The recognition of something as a social good deems it desirable by definition, and a legitimate goal of law and policy, rather than rely completely on market forces for its achievement.

The Puttaswamy judgment (K Puttaswamy v Union of India 2017) lends sufficient weight to privacy’s social value by identifying it as fundamental to any individual development through its dependence on solitude, anonymity, and temporary releases from social duties.

Sociological scholarship demonstrates that different types of social relationships, be it Gesellschaft (interest groups and acquaintances) or Gemeinschaft (friendship, love, and marriage), and the nature of these relationships depend on the ability to conceal certain things (Simmel 1906). Demonstrating this in the context of friendships, it has been stated that such relationships “present a very peculiar synthesis in regard to the question of discretion, of reciprocal revelation and concealment.” Friendships, much like most other social relationships, are very much dependent on our ability to selectively present ourselves to others. Contrast this with Zuckerberg’s stated aim of making the world more “open” where information about people flows freely and effectively without any individual control. Contrast this also with government projects such as the Aadhaar which intends to act as one universal identity which can provide a 360-degree view of citizens.

Other scholars such as Julie Cohen (2012) and Anita Allen (2011) have demonstrated that data that a person produces or has control over concerns both herself and others. Individuals can be exposed not only because of their own actions and choices, but also made vulnerable merely because others have been careless with their data. This point is amply demonstrated in the Facebook–Cambridge Analytica incident. What this means is that protection of privacy requires not just individual action, but in a sense, requires group co-ordination. It is my argument that this group interest of privacy as a social good must be the basis of policymaking and regulation of data in the future, in addition to the idea of privacy as an individual right. In the absence of attention to the social good aspect of privacy, individual consumers are left to their own devices to negotiate their privacy trade-offs with large companies and governments and are significantly compromised.

What this translates into is a regulatory framework and data protection frameworks should not be value-neutral in their conception of privacy as a facet of individual control. The complete reliance of data regulation on the data subject to make an informed choice is, in my opinion, an idea that has run its course. If privacy is viewed as a social good, then the data protection framework, including the laws and the architecture must be designed with a view to protect it, rather than leave it entirely to the market forces.

The Way Forward

Data protection laws need to be re-evaluated, and policymakers must recognise Lawrence Lessig’s dictum that “code is law.” Like laws, architecture and norms can play a fundamental role in regulation. Regulatory intervention for technology need not mean regulation of technology only, but also how technology itself may be leveraged for regulation (Lessig 2006; Reidenberg 1998). It is key that the latter is not left only in the hands of private players.
Zuckerberg, in his testimony (Washington Post 2018) before the United States Senate's Commerce and Judiciary committees, asserted that "AI tools" are central to any strategy for addressing hate speech, fake news, and manipulations that use data ecosystems for targeting.

What is most concerning in his testimony is the complete lack of mention of standards, public scrutiny and peer-review processes, which “AI tools” and regulatory technologies need to be subject to. Further, it cannot be expected that data-driven businesses will view privacy as a social good or be publicly accountable.

As policymakers in India gear up for writing the country’s data protection law, they must acknowledge that their responsibility extends to creating norms and principles that will inform future data-driven platforms and regulatory technologies.

Since issues of privacy and data protection will have to be increasingly addressed at the level of how architectures enable data collection, and more importantly how data is used after collection, policymakers must recognise that being neutral about these practices is no longer enough. They must take normative positions on data collection, processing and sharing practices. These positions cannot be implemented through laws only, but need to be translated into technological solutions and norms. Unless a multipronged approach comprising laws, architecture and norms is adopted, India’s new data protection regime may end up with limited efficacy.

For more details visit https://cis-india.org/internet-governance/blog/epw-amber-sinha-may-18-2018-for-indias-data-protection-regime-to-be-efficient-policymakers-should-treat-privacy-as-a-social-good