We are anonymous, we are legion

India ranks second globally in accessing private details of users

praskrishna — 2012-11-19T04:49:23Z

According to the latest transparency report released by Google, India ranks second in the world for accessing private details of its citizens, only after the U.S. The Google report lists out requests it received from governments across the world to access details of users of its various services.

Kul Bhushan's blog post was published in thinkdigit on November 15, 2012. Pranesh Prakash is quoted.

Google's data reveals India had made 2,319 requests involving 3,467 users in the first six months. The U.S. made 7,969 requests, while Brazil, which ranks third, made 1,566 requests during the same period. Worldwide 20,938 requests were made during the January-June period. The report says the information shared included complete Gmail account, chat logs, Orkut profile and search terms among others.

The requests for accessing user data from India had grown two-fold from 1,061 in July-December 2009 to 2,207 in July-December 2011, the report points out.

According to the report, India has been consistently sending requests to remove content which it brands as defamatory and against national security. The court orders, however, to take down content has remained almost stagnant over the years; though requests from the executive and police have grown.

In the first six months this year, there were 20 court orders and 64 requests from executive/police that resulted in 596 items being taken down from the web. During the January-June 2010 period, there were only eight court orders and 22 executive/police requests, resulting in 125 items being taken down. Read about Google's previous transparency report here.

"Though India is a large country with a significant number of internet users, this data is nonetheless an indicator of growing surveillance," Times of India quotes Pranesh Prakash, policy director at Centre for Internet and Society ( CIS), a Bangalore-based organization looking at issues of public accountability, internet freedom and openness, as saying.

"India lacks a general privacy law that helps set guidelines for such user requests, despite privacy being a constitutional right as part of the right to life," added Prakash.

For more details visit https://cis-india.org/news/thinkdigit-internet-kul-bhushan-nov-15-2012-india-ranks-second-globally-in-accessing-private-details-of-users

India Puts Tight Leash on Internet Free Speech

praskrishna — 2011-05-01T02:20:24Z

Free speech advocates and Internet users are protesting new Indian regulations restricting Web content that, among other things, can be considered “disparaging,” “harassing,” “blasphemous” or “hateful.” This article by Vikas Bajaj was published in the New York Times on April 27, 2011.

An Internet cafe in New Delhi. New rules require Web sites and service providers to remove some content that officials and even private citizens find objectionable.

The new rules, quietly issued by the country’s Department of Information Technology earlier this month and only now attracting attention, allow officials and private citizens to demand that Internet sites and service providers remove content they consider objectionable on the basis of a long list of criteria.

Critics of the new rules say the restrictions could severely curtail debate and discussion on the Internet, whose use has been growing fast in India.

The list of objectionable content is sweeping and includes anything that "threatens the unity, integrity, defense, security or sovereignty of India, friendly relations with foreign states or public order."

The rules highlight the ambivalence with which Indian officials have long treated freedom of expression. The country’s constitution allows “reasonable restrictions” on free speech but lawmakers have periodically stretched that definition to ban books, movies and other material about sensitive subjects like sex, politics and religion.

An Indian state, for example, recently banned an American author’s new biography of the Indian freedom fighter Mohandas Gandhi that critics have argued disparages Mr. Gandhi by talking about his relationship with another man.

Although fewer than 10 percent of Indians have access to the Internet, that number has been growing fast — especially on mobile devices. There are more than 700 million cellphone accounts in India.

The country has also established a thriving technology industry that writes software and creates Web services primarily for Western clients.

Even before the new rules — known as the Information Technology (Intermediaries guidelines) Rules, 2011 — India has periodically tried to restrict speech on the Internet. In 2009, the government banned a popular and graphic online comic strip, Savita Bhabhi, about a housewife with an active sex life. Indian officials have also required social networking sites like Orkut to take down posts deemed offensive to ethnic and religious groups.

Using a freedom of information law, the Center for Internet and Society, a Bangalore-based research and advocacy group, recently obtained and published a list of 11 Web sites banned by the Department of Information Technology. Other government agencies have probably blocked more sites, the group said.

The new Internet rules go further than existing Indian laws and restrictions, said Sunil Abraham, the executive director for the Center for Internet and Society. The rules require Internet “intermediaries” — an all-encompassing group that includes sites like YouTube and Facebook and companies that host Web sites or provide Internet connections — to respond to any demand to take down offensive content within 36 hours. The rules do not provide a way for content producers to defend their work or appeal a decision to take content down.

"These rules overly favor those who want to clamp down on freedom of expression," Mr. Abraham said. "Whenever there are limits of freedom of expression, in order for those limits to be considered constitutionally valid, those limits have to be clear and not be very vague. Many of these rules that seek to place limits are very, very vague."

An official for the People’s Union for Civil Liberties, an advocacy group based in New Delhi, said on Wednesday that it was considering a legal challenge to the constitutionality of the new rules.

"What are we, Saudi Arabia?" said Pushkar Raj, the group’s general secretary. "We don’t expect this from India. This is something very serious."

An official at the Department of Information Technology, Gulshan Rai, did not return calls and messages.

The rules are based on a 2008 information technology law that India’s Parliament passed shortly after a three-day siege on Mumbai by Pakistan-based terrorists that killed more than 163 people. That law, among other things, granted authorities more expansive powers to monitor electronic communications for reasons of national security. It also granted privacy protections to consumers.

While advocates for free speech and civil liberties have complained that the 2008 law goes too far in violating the rights of Indians, Internet firms have expressed support for it. The law removed liability from Internet intermediaries as long as they were not active participants in creating content that was later deemed to be offensive.

Subho Ray, the president of the Internet and Mobile Association of India, which represents companies like Google and eBay, said the liability waiver was a big improvement over a previous law that had been used to hold intermediaries liable for hosting content created by others. In 2004, for instance, the police arrested eBay’s top India executive because a user of the company’s Indian auction site had offered to sell a video clip of a teenage couple having sex.

"The new I.T. Act (2008) is, in fact, a large improvement on the old one," Mr. Ray said in an e-mail response to questions.

Mr. Ray said his association had not taken a stand on the new regulations. An India-based spokeswoman for Google declined to comment on the new rules, saying the company needed more time to respond.

Along with the new content regulations, the government also issued rules governing data security, Internet cafes and the electronic provision of government services.

Read the original article published by the New York Times here

For more details visit https://cis-india.org/news/internet-free-speech

India Proposes Restrictions on Tapping Telephone Calls

praskrishna — 2011-05-06T05:53:43Z

An Indian government report has recommended that interception of telephone calls by government agencies should be limited to situations when there is a "public emergency" or "public safety" is at stake. John Riberio's article appeared in the PC World, TechWorld and CIO. Pranesh Prakash, program manager from the Centre for Internet and Society has been quoted in these articles.

John Riberio's article was published in the following publications:

PC World [April 26, 2011]
TechWorld [April 26, 2011]
CIO [April 26, 2011]

For more details visit https://cis-india.org/news/tapping-telephone-calls

India Proposes Law to Give Indians Complete Control of their Digital Health Data

Admin — 2018-06-01T13:57:42Z

India’s health ministry has proposed a law to govern data security in the healthcare sector that would give individuals complete ownership of their health data.

The article by Madhur Singh was published as a cover story in IndiaSpend on May 31, 2018. Shweta Mohandas and Amber Sinha were quoted.

Individuals would have the absolute right to refuse or allow data to be generated, collected, accessed, transmitted or used. And data collectors such as hospitals would be prohibited from refusing treatment to those who do not want their data collected or used.

This would make India one of the world’s foremost jurisdictions in the regulation of healthcare data, at a time when governments around the world are scrambling to keep a check on who gets to generate and use data and how, especially as citizens do not completely understand the data privacy and security implications of the innumerable applications they wittingly or unwittingly use.

The draft Digital Information Security in Healthcare Act was proposed by the health ministry on March 11, 2018. The period for stakeholder comment ended April 21, and a bill is currently being finalised. Experts say the health ministry is possibly waiting for a final verdict from the Supreme Court on petitions challenging the constitutional validity of Aadhaar–on which it has just completed the second-longest oral hearing in the history of the court. The ruling is expected in July or August.

The verdict will guide India’s data privacy framework, which is already being prepared by the Committee of Experts on a Data Protection Framework for India being chaired by Justice B. N. Srikrishna. It will also have implications for the health ministry’s proposed law.

Use of data

Digital health data (DHD), or electronic health records of individuals or the public (when aggregated), typically comprise information such as a patient’s age, contact information, vital signs, lab reports, medical history including immunisations, allergies, and current and past medications.

The use of DHD promises to revolutionise healthcare services by providing more comprehensive care using the most accurate records possible, possibly reducing costs and timelines for all involved.

The law would allow anonymised health data, which cannot be traced to individuals, to be used for specified public health purposes, such as early detection and rapid response to public health emergencies such as bioterror events and infectious disease outbreaks.

However, for data in identifiable form, the draft stipulates that explicit prior permission would be needed from the digital data owner before each transmission or use. For instance, often companies offer free medical checkups to all employees. By revealing a pregnancy or a serious chronic condition, these tests could imperil an employee’s situation with their employer. With the proposed law, an employee could refuse to allow the pathology laboratory to share their data with the employer.

In recognition of the serious privacy and security concerns over uses and misuses of digital health data, the proposed law would completely prohibit use of digital health data for ‘commercial purposes’, whether in an identifiable or anonymised form.

This would mean that insurance companies, employers, human resource consultants and pharmaceutical companies would not be allowed to access or use health data, the law firm Trilegal said in an analysis posted on its website on April 11, 2018.

“Currently, employers can process health data for employee benefits, office records and insurance purposes under labour legislations like Maternity Benefits Act, Employee Compensation Act and Employee State Insurance Corporation Act and as part of their internal policies,” Trilegal said, adding that the proposed law would allow the use of digital data only to the extent required by these laws. “However, access, use or disclosure of [digital health data] to employers or human resource consultants for any other purpose is prohibited,” Trilegal noted.

Similarly, insurance companies and drug makers would not be allowed to access or use digital health data, although use for academic, clinical and public health research would be allowed.

The central government would be tasked with establishing ‘health information exchanges’ that would regulate the exchange of DHD between various clinical establishments–hospitals, clinics, diagnostic centres, pathology laboratories, etc.–for purposes and in manners allowed under the law.

Data breach

The responsibility for ensuring data security and privacy would lie with the entity that has custody of the data, which could be penalised for data breach.

Currently, under Indian law, companies in India are not obligated to inform individuals of data breach, with the exception of banks, which are obligated to inform the Reserve Bank of India within six hours. The result is that individuals are often not aware that their details may have been compromised.

The draft law proposes to make breach notification mandatory. Data breaches would be ranked by severity, and the more serious kind would be punishable with a fine of at least Rs 1 lakh and a jail term of up to five years.

Clinical establishments and health information exchanges would have to notify the owner in case of a breach within three days. Data owners could claim compensation from the person who breached the data, and no limit has been prescribed for the compensation amount.

The draft also specifies punishment for various other offences such as unauthorised access and data theft of up to five years’ imprisonment.

Some concerns

The stringent provisions of the proposed law, particularly the blanket ban on use of DHD by insurance and pharmaceutical companies, has raised concerns among these industries.

“Most data protection laws allow healthcare institutes to process data so long as there exists a legitimate interest in doing so,” Rahul Kumar, country manager and director with security solutions company WinMagic India said, adding that provisions debarring insurance and pharmaceutical companies, “while being protective in nature might be excessively harsh under certain circumstances”.

The stringent privacy provisions also put the future of wearable devices in doubt, Shweta Mohandas of The Centre for Internet and Society (CIS) told IndiaSpend, “Perhaps a revised draft of the law, or rules framed under the final law, would specify these details.”

The draft does not clearly define the security measures that must be followed to prevent data breach, Mohandas and Amber Sinha, also of the CIS, told IndiaSpend. However, a National Electronic Health Authority proposed to be set up under the law could possibly define a clear set standards for maintaining security, they said.

Also, the draft proposes to allow for the withdrawal of consent but does not say how data would be removed from the system, Sinha and Mohandas said, adding that the roles of the various bodies to be established must be clearly defined.

Most commentators expect the finalised bill, which will be drafted after taking into account stakeholder comment, will iron out these issues.

“This law in its current form and further in its revised version will go a long way to help the industry be more secure,” Kumar said, adding, “Compliance is known to bring in a level playing field for industries and also give the end user the confidence that the critical data is secure.”

Many commentators also have questioned the timing of the health ministry’s draft law, given that India is currently in the process of creating a framework and an overarching legislation on data privacy and security. “It is curious that the Ministry has chosen to not wait for the draft law, before framing and releasing their draft,” Sinha and Mohandas said, “This suggests a lack of coordination between the different ministries, and if due care is not taken, could lead to inconsistencies across sectoral regulations of data.”

However, they said, it is possible that the health ministry will wait for the Supreme Court verdict in the Aadhaar litigation before finalising the bill.

(Singh is a contributing editor with IndiaSpend.)

For more details visit https://cis-india.org/internet-governance/news/india-spend-madhur-singh-may-31-2018-india-proposes-law-to-give-indians-complete-control-of-their-digital-data

India Privacy Meet

praskrishna — 2012-07-02T10:48:54Z

Microsoft, DSCI and Greyhead came together to organise India Privacy Meet at Hotel LeMeridien on June 29, 2012 in New Delhi. Sunil Abraham was a panelist in the event.

Agenda

10:00a.m.- 10:10a.m.	Welcome and Introduction: Rahul Neel Mani, Editor & Co-founder Grey Head Media
10:10a.m.- 10:30a.m.	Conference Opening Remarks: Dr. Kamlesh Bajaj, CEO Data Security Council of India
10:30a.m.- 10:45a.m.	Theme Address: Deepak Rout, CSO & Director Privacy, Microsoft India
10:45a.m.- 11:00a.m.	Tea/Coffee Break
11:00a.m.- 12:00p.m.	Panel 1: Consumer Privacy – Creating the Right Balance

Brief: Data Privacy is perhaps the most concerning issue in the digital age. Consumer privacy or customer privacy, involves the handling and protection of sensitive personal information that individuals provide in the course of everyday commercial or professional transactions. This involves exchange or use of data electronically or by other means, including telephone, fax, writing, and word of mouth. With the advent and evolution of Internet and other electronic methods of mass communications, consumer privacy has become a major concern to deal with. Personal information, when misused or inadequately protected, can result in identity theft, financial fraud, and other problems that collectively cost individuals, businesses, and governments. In addition, Internet crimes and civil disputes consume law enforcement and judicial resources, confound legislators and bureaucracy, and produce untold personal aggravation.

Key Discussion Areas:

Handling of Personal Information including Sensitive Personal Information
Customer education on understanding business models and motives behind collection and use of Personal Information?
Privacy legislation and striking the right balance between various objectives
Privacy by design, online tracking, and transparency issues
Role of Government, Academia and Citizen groups

Panelists:

Chair - Dr. Kamlesh Bajaj, CEO, Data Security Council of India (DSCI)
Sivarama Krishnan, Executive Director, PwC India
Pankaj Agarwal, Head of IT Governance & CISO Aircel
Prashant Mali, Advocate & Cyber Law Expert
Deepak Rout, CSO & Director Privacy, Microsoft India
Vishal Jain, Director, Ernst & Young

12:00p.m.- 01:00p.m.	Panel 2: Citizen Privacy Transparency, Accountability and Social Progress

Brief: While citizens are adopting new technologies which are increasingly making it easier to share information more freely and thereby track individuals more easily, they are also demanding more accountability and openness. Experience indicates that having a more informed citizenry improves services, and accelerates innovation; thus the era of copious content has the potential to generate a host of new services and businesses. However, there is a need for greater transparency in the handling of citizen data and its legitimate use in governance and law enforcement. While new age technologies, if inappropriately used, have a potential impact on citizens’ privacy, they also arm us with the capability to protect citizen data and provide opportunities for privacy conscious and transparent usage of such data, provided there is an enabling environment created by informed and responsible privacy legislation.

Key Discussion Areas:

Core objectives for privacy legislation
Role of government in protecting citizen privacy
Citizen awareness of privacy concerns in today’s legal, business and technology landscape
Expectations of government and citizens on policies around usage and collection of personal data and ability to build profiles for being used for different purposes
Model privacy legislation

Panelists:

Chair - Nirmaljeet Singh Kalsi, Jt. Secretary, Ministry of Home Affairs
Na Vijaya Shankar, E-business Consultant & Cyber Law Specialist (Coordinator)
Sunil Abraham, Executive Director, Centre for Internet & Society
Akhilesh Tuteja, Executive Director, KPMG India
A P Singh, DDG, Unique Identification Authority of India (UIDAI)
Kailas Karthikeyan, Regulatory & Pub Policy Manager, Legal and Corp Affairs Microsoft

01:00p.m.- 01:10p.m.	Conference Closing Remarks by Deepak Rout, CSO & Director, Privacy Microsoft India Vote of Thanks
01:15p.m. onwards	Lunch

For more details visit https://cis-india.org/news/india-privacy-meet

India partially lifts Porn Ban?

praskrishna — 2015-09-20T06:30:34Z

India is said to have partially removed the porn ban. But many internet service providers have refused to restore access, due to a 'vague' government order.

The blog post by Nazhat Khan was published in DESI blitz on August 7, 2015.

India has partially lifted the ban of online pornography, just days after blocking user access to 857 adult websites.

The Indian government enforced the ban on July 30, 2015, only to reverse its decision on August 4, 2015. Ravi Shankar Prasad, the Communications and IT Minister, clarifies the ban only targets websites promoting child pornography.

He says: “A new notification will be issued shortly. The ban will be partially withdrawn. Sites that do not promote child porn will be unbanned.” Under the new order, internet service providers (ISPs) in India are allowed to unblock these 857 websites – except for those that contain child pornography.

This has caused another outrage. ISPs complain it is not within their capability and responsibility to do so. Internet Service Providers Association of India (ISPAI) explains: “ISPs have no way or mechanism to filter out child pornography from URLs, and the further unlimited sub-links.

“Hence, we request your good self to advise us immediately on the future course of action in this regard.

“Till your further directive, the ISPs are keeping the said 857 URLs disabled.”

An executive at an Indian ISP tells the Wall Street Journal: “How can we go ahead? What if something comes up tomorrow [on one of these sites], which has child porn, or something else?”

Pranesh Prakash, policy director at the Centre for Internet and Society, points out it is not right for the government to pass the ball over to private companies.

He says: “The onus cannot be put on the service providers. What the government is doing is inherently unfair, it is not what the law requires.” In effect, porn sites in India are still blocked. The Supreme Court and senior officials are yet to provide clearer directives for ISPs.

For more details visit https://cis-india.org/internet-governance/news/desi-blitz-august-7-2015-nazhat-khan-india-partially-lifts-porn-ban

India No Haven For Net Freedom But It Did Not Oppose UN Move on Internet Rights

praskrishna — 2016-07-09T02:25:51Z

India hasn’t had the best record when it comes to Internet rights. The country regularly carries out Internet shutdowns under flimsy pretexts, is still fumbling when it comes to the drafting of a comprehensive privacy bill, and most recently came out with a geospatial information regulation bill that would establish ownership over all forms of location data.

The article by Anuj Srinivas was published in the Wire on July 6, 2016.

So, last week, when the United Nations Human Rights Council (UNHRC) passed a resolution on the “promotion, protection and enjoyment of human rights on the Internet”, it wasn’t surprising to see the wave of media criticism of the amendments that were proposed by countries such as China and Russia – and which were supported by India.

South Africa’s Mail & Guardian ran a story headlined “South Africa votes with China, Russia and India against Internet freedoms in UN resolution”. Private Internet Access’s headline was “These 17 Countries Don’t Believe that Freedom of Expression on the Internet is a Human Right”. Popular tech website The Verge noted that the resolution was opposed “by a minority of authoritarian regimes including Russia, China and Saudi Arabia, as well as democracies like South Africa and India. These nations called for the UN to delete a passage in the resolution that ‘condemns unequivocally measures to intentionally prevent or disrupt access to our dissemination of information online’.”

The Verge‘s report was followed up by a number of Indian publications including IndiaToday and Medianama – the latter incorrectly stating that the UNHRC resolution “recognised Internet usage as a basic human right – as well a host of other global publications.

The facts
There were two fundamental mistakes with some of these reports. Firstly, the resolution was adopted without vote (with oral revision) as noted by the UNHRC. Therefore, while there were a number of countries which co-sponsored the resolution and many that didn’t, it is completely wrong to state that India – as the Mail & Guardian reported – or any other country, voted against the resolution.

Secondly, as noted by the Centre for Internet and Society, none of the four amendments supported by India called for the deletion of a passage that condemned the prevention or disruption of Internet access and online information dissemination. Although it may fit neatly within India’s history of issuing Internet block orders, no country was opposed to this paragraph at the UNHRC forum (although many countries including India flout this clause in spirit back at home). No such amendment was proposed.

What then were these four amendments, which Article 19, an organisation that advocates freedom of expression, statedwould “substantially weaken the resolution”? Out of the four amendments (referred to as L85-88 in the UNHRC resolution), the first amendment (L85) – which sought to include a reference to fighting against the exploitation of children online – was withdrawn by Russia before it was considered by member states.

The other three amendments, while not completely endorsed by the countries that co-sponsored the resolution, do carry a certain level of nuance. Only one of the amendments (L86) can truly be described as diluting language regarding freedom of expression online, although this could have been potentially a result of procedural politics.

L88: Including Reference to Hate Speech
This amendment – proposed by Belarus, China, Iran and the Russian Federation – asks to introduce a new paragraph that states:

“Expresses its concern at the use of the Internet and information and communications technology to disseminate ideas based on racial superiority or hatred, and incitement to racial discrimination, xenophobia and related intolerance.”

Article 19 says of this amendment that it would “undermine the intended focus of the draft resolution on protecting human rights online, in particular freedom of expression..” While it is true that a few paragraphs of the resolution’s preamble include a reference to hate speech, it is difficult to see what harm this amendment would have brought in and even more difficult to accept that it would dilute the focus of the overall resolution.

Using the Internet and other online media technologies for incitement and as a means of propagating intolerance and xenophobia is a very real problem in India and other Asian countries, the most notable example of which was the role that social media played in the exodus of north-east Indian migrants from Bangalore four years ago. While shutdowns are obviously not the best way of dealing with this, it is important to acknowledge the role of the Internet as a medium in this aspect. In sum, this amendment certainly would not have diluted the resolution’s aim of promoting freedom of expression online.

L87: Human-Rights Approach
The second amendment replaces the term “human rights-based approach” with “comprehensive and integrated approach” in two paragraphs on expanding Internet access:

PP17: Stressing the importance of applying a comprehensive and integrated (human rights-based approach) in providing and expanding access to the Internet and for the Internet to be open, accessible and nurtured by multistakeholder participation,

OP5: Affirms also the importance of applying a comprehensive and integrated (human rights-based approach) in providing and in expanding access to Internet and requests all States to make efforts to bridge the many forms of digital divides..

This amendment was a little trickier. According to people involved in the country stakeholder discussions, whom The Wirespoke with, the aversion to a ‘human-rights’ approach towards expanding Internet access came as a result of China and Russia playing procedural politics. The language that was proposed in the amendment – “comprehensive and integrated” – while certainly not the strongest possible language that could have been used, would not have legally diluted the proposal to expand Internet access while maintaining an open and multistakeholder approach towards Internet governance.

Stepping back, what would a human rights-based approach in expanding Internet access look like? Would it include legitimising the act of zero-rating and the approval of schemes such as Facebook’s Free Basics? Both of which, incidentally, have been banned in India. While the proposed amendment certainly does not speak well of the motivations of China, Russia and India, the term is also vague enough that its mere removal doesn’t indicate a lack of support towards Internet freedom.

L88 – Right to privacy and removal of UDHR reference
This amendment, proposed by China and the Russian Federation, was more straightforward. In two paragraphs, it sought to add the specific term ‘right to privacy’, while in another paragraph it proposed removing reference to language from, and articles in, the Universal Declaration of Human Rights. Had the amendment been passed, the changes in the following paragraphs would have been made:

PP7: Noting that the exercise of human rights, in particular the right to freedom of expression and the right to privacy, on the Internet is an issue of increasing interest and importance as the rapid pace of technological development enables individuals all over the world to use new information and communication technologies,

OP15: Decides to continue its consideration of the promotion, protection and enjoyment of human rights, including the right to freedom of expression and the right to privacy, on the Internet and other information and communication technology, as well as of how the Internet can be an important tool for fostering citizen and civil society participation, for the realisation of development in every community and for exercising human rights, in accordance with its programme of work.

OP1: Affirms that the same rights that people have offline must also be protected online, in particular freedom of expression ~~which is applicable regardless of frontiers and through any media of one’s choice~~, and the right to privacy in accordance with articles 17 and 19 of the ~~Universal Declaration of Human Rights and the~~ International Covenant on Civil and Political Rights;

On one hand, this amendment would have added specific reference to the right to privacy. That specific term doesn’t appear in the draft resolution, although there are a few references to privacy in general in the resolution’s preamble.

However, the addition of a ‘right to privacy’ is coupled with a watering down of clear references to the protection of freedom of expression. Cynical observers would rightly note that China and Russia are probably less concerned with online privacy and more irked with the clear support of freedom of expression “regardless of frontiers” and “in accordance with the Universal Declaration of Human Rights”; which is probably why this particular proposed amendment combined both issues to improve its chances of passing. While there is little doubt that this amendment would have diluted the resolution’s focus on protecting freedom of expression, the alternative phrasing also doesn’t create legal loopholes that renders it useless. Moreover, it still contains reference to the International Covenant on Civil and Political Rights, especially Article 19, which goes beyond Article 19 of the UDHR .

India, a guardian?
It would be naive and wrong to take a strong position either way. To state that the amendments supported by India are all antithetical to the spirit of the UNHRC resolution, as some have done, is simply incorrect. On the other hand, this doesn’t mean India, and even less, China and Russia, are guardians of Internet freedom.

The UNHRC resolution in its entirety is a fine document. While non-binding, it provides a foundation for claiming that the same rights people have offline “must also be protected online”. Other crucial sections state that governments “should ensure accountability for all human rights violations and abuses committed against persons for exercising their human rights online”, while condemning “measures to intentionally prevent or disrupt access to or dissemination of information online”.

While the amendments India supported may not wholly oppose this resolution, it is also true that successive Indian governments also do not have an admirable track-record of upholding the resolution’s aims. Freedom for online speech had to be reclaimed in the form of court judgements, with the current government still supporting regulations that would allow it clamp down on online freedom of expression. In certain states within the country, Internet shutdowns happen without public explanations or justifiable reasoning. Over the last four years, for instance, Jammu and Kashmir has lost 18 days of Internet access. While it may not have wholly opposed the UNHRC resolution, the country still has a ways to go in terms of Internet freedom.

For more details visit https://cis-india.org/internet-governance/news/the-week-anuj-srinivas-july-6-2016-india-no-haven-for-net-freedom-but-did-not-oppose-un-move-on-internet-rights

India needs better cyber police

praskrishna — 2014-06-04T07:56:33Z

On Wednesday, one of the largest online shopping and auction portals, eBay, revealed that earlier this year, cybercriminals accessed details of 145 million of its customers.

The article by Surabhi Agarwal was published in the Business Standard on May 23, 2014. Sunil Abraham is quoted.

Even though eBay's customers' financial details are said to be safe, the incident is being termed a "historic breach" given the enormity of the data compromised. Globally, eBay is being criticised not just for its laxity in securing the digital perimeter but also for reacting too late. The company has said that it first came to know of the breach "two weeks" ago. Records that have been accessed contain passwords as well as email addresses, birth dates, mailing addresses and other personal information.

The situation is worse when it comes to reporting such instances in India, say cyber security experts. The Indian Information Technology Act requires companies to adopt "reasonable security measures" to protect consumers' sensitive personal information such as passwords and financial details. It also makes companies duty bound to report breaches and also defines liabilities in case a firm is found not to be adhering to best data security practices. However, implementation is patchy and most such instances go unreported.

Pavan Duggal, an advocate specialising in cyber security, says most users do not come to know if there has been a breach. "Awareness is also low among consumers about the legal recourse available in case their data has been compromised," he adds. Unlike in the West, lack of a proper data protection and privacy law in India is to be blamed for this. "Companies, too, are inclined not to report such instances as they fear being negatively impacted in the market," he points out.

In case of a breach, a user can contact the adjudicating officer, which is the state infotech secretary, for legal recourse. However, the onus is on the user to prove the breach. In the US, a consumer can get a subpoena (court order) issued against a company that makes it duty bound to provide details of the breach. "In India, the regime is too lax. It is very difficult to notify the government," says Sunil Abraham, executive director of the Centre for Internet and Society.

"There are stringent compliance requirements in countries such as the US. The laws in India need to come tougher if we want companies to become more serious about this," adds Duggal.

eBay has advised consumers, many of whom could be Indians, to immediately change their passwords. While people tend to use the same password across many sites, emails and phones numbers act as verifying tools for several financial transactions and could be misused. Moreover, unlike India, the US does not require additional authentication apart from credit card and CVV number, which makes transactions slightly more vulnerable. "It may be a good idea to include a one-time password as a security layer," says Abraham.

Over 200 million Indians are online. The Indian e-commerce market is estimated at $2 billion (Rs 12,000 crore) and is expected to cross $20 billion over the next four years.

"There is no such thing as 100 per cent protection in the digital world. The choice is between transacting online or not," says Akhilesh Tuteja, executive director of consulting firm KPMG. "Technology is becoming so sophisticated that what was good yesterday is not good today." A bigger dialogue is needed on people treating theft of digital assets just as they would physical assets, he adds.

The last big breach was reported at software maker Adobe Systems in October 2013, when it was uncovered that hackers accessed about 152 million user accounts. Last December Target said some 40 million payment card numbers and another 70 million customer records were hacked into.

For more details visit https://cis-india.org/news/business-standard-may-23-2014-surabhi-agarwal-india-needs-better-cyber-police

India needs an independent privacy law, says NGO Privacy India

praskrishna — 2012-02-03T11:46:22Z

India needs an independent privacy law though there are a number of provisions in existing legislations that protect a citizen's privacy, according to an NGO that is lobbying for the cause. The story was published in the Economic Times on 2 February 2012.

Privacy India, a conglomerate of the Centre for Internet and Society (CIS) and the Society in Action Group (SAG), with support from Privacy International, conducted a study of the existing laws in India related to privacy over a period of one and a half years in various cities.

A report, which will be released soon, has documented their findings about privacy laws and issues in India and high-level conclave and a national symposium on privacy will be held in Delhi on February 3 and 4.

Lawyer-activist Prashant Bhushan and NCPRI head Aruna Roy will take part in the discussions on privacy in transparency, e-governance initiatives, national security, banking and health issues.

"India doesn't have a privacy law, but there are provisions for it in different laws. During the course of the research, we found that the Indian judiciary has not been very strict in overseeing the implementation of the privacy clauses in various laws," CIS member Prashant Iyengar said, while reporting some of the findings of the study.

Stricter implementation of the existing laws could go a long way in curbing most privacy issues, Iyengar said.

Published in the Economic Times on 2 February 2012. Prashant Iyengar is quoted in this.

For more details visit https://cis-india.org/news/india-needs-an-independent-privacy-law-says-ngo-privacy-india

India must support UN's e-snooping move: Human rights activists

praskrishna — 2013-11-19T09:10:02Z

India is facing pressure from internet and human rights activists to support a United Nations resolution that calls for an end to electronic spying after revelations of mass illegal surveillance by the United States.

The article by Indu Nandakumar was published in the Economic Times on November 11, 2013. Sunil Abraham is quoted.

The resolution, jointly submitted by Brazil and Germany - vocal opponents of US cyber spying - urged UN member states to act against excessive surveillance. Records leaked by whistleblower Edward Snowden had exposed US eavesdropping on Brazil's President Dilma Rousseff and German Chancellor Angela Merkel.

Internet activists and experts said the world's largest democracy must join the resolution as a reaction to unfair surveillance by the US. Confidential documents from Snowden, a former US National Security Agency contractor showed India was one of the victims of US snooping.

"Decision-makers in India haven't made a principled stand on the issue. They are still debating and deliberating," said Oleg Demidov, program director for international information security and global internet governance at the Russian Center for Policy Studies.

Demidov said India was unlikely to join the resolution as it has strong language and measures that need to be implemented immediately. "Joining this would mean a big political step." The resolution, while not legally binding, can still be a formal vote against US spying. A senior government official in New Delhi said Brazil and Germany on Friday held consultations with all UN member states including India on the draft resolution.

India will take 'detailed' look

He said India will take a "detailed look" at the resolution over the coming days before deciding whether it wants to be part of it. Revelations about US government snooping on communication between governments and individuals has caused global outrage over the past few months.

Popular email and internet service providers locating their servers in the US makes tapping into communication lines easier for that country. Brazil is considering legislation that would require internet companies to store data locally.

Latest documents revealed by Snowden showed that NSA had been monitoring data that travels between servers of Yahoo and Google, thus accessing personal data of millions of internet users across the world, including Indian users. It had prompted strong reaction from Google, whose executive chairman Eric Schimdt called such snooping "outrageous."

A representative for the German federal foreign office said the resolution was submitted to "protect human rights in the digital age more effectively" and that all member states are invited to co-sponsor the resolution.

"Indians should press their own government to forcefully object to the United States' surveillance policies and demand that those policies be brought into conformity with international law," said Jameel Jaffer, deputy legal director of the American Civil Liberties Union, an influential civil rights union based in New York. Jaffer said while no one questions the US government's right to engage judicially supervised surveillance, "dragnet surveillance of entire populations is a severe and unnecessary infringement on the privacy of millions."

He said that reforming the policies of NSA would require pressure from outside the US, especially foreign governments.

The pushback against mass surveillance is taking place in the backdrop of India and US looking to strengthen their economic relationship. Issues such as the US immigration reform bill which is seen as detrimental by India's $75 billion softw are export industry, and India's nuclear liability law, which US companies find unreasonable, have been irritants in bilateral relations.

Another senior government official said India's stance on US surveillance has been soft as any discussion on the subject would bring India's Central Monitoring System into the spotlight. The system, similar to the US government's PRISM project, gives the government access to phone calls, text messages and even social media conversations of individuals.

Sunil Abraham, executive director of Bangalore based think-tank Centre for Internet and Society, said India must be a part of the efforts by Brazil and Germany.

"Surveillance needs to be addressed both at technological as well as policy levels." Former diplomat and foreign affairs expert G Parthasarathy acknowledged the need for international consensus to protect individual privacy but doubted whether snooping by governments will ever end.

"Yes, the Americans are over-doing it, but India cannot condemn it because we have been doing the same thing. India monitored conversations between (Pakistan army chief) Pervez Musharraf and his chief of general staff (Mohammed Aziz) during the Kargil conflict. The point is everyone does it, but Americans got caught."

For more details visit https://cis-india.org/news/economic-times-november-11-2013-indu-nandakumar-india-must-support-un-e-snooping-move

India may not be guilty of opposing UN move to save internet rights

praskrishna — 2016-07-09T02:58:53Z

India is a democratic country, but the standards for freedom of expression promised to us—online and offline—are highly questionable, especially with online content being censured and comedians being threatened to be arrested for sedition.

This was published by Ciol on July 7, 2016.

So the media criticism came as no surprise when India supported the amendments proposed by countries like China and Russia last week when the United Nations Human Rights Council (UNHRC) passed a resolution on the “promotion, protection and enjoyment of human rights on the Internet”.

According to some media reports, countries like Russia, China, and Saudi Arabia, as well as democracies like South Africa and India, called for the UN to delete a passage in the resolution that ‘condemns unequivocally measures to intentionally prevent or disrupt access to our dissemination of information online’.”

India has also been struggling to draft a comprehensive privacy bill, and most recently came out with a geospatial information regulation bill that would establish ownership over all forms of location data.

However, the fact that the resolution was adopted without a vote (with oral revision)—as noted by the UNHRC—puts these news reports on a faulty ground. So technically, India did not ‘vote against’ the resolution. Moreover, none of the four amendments supported by India called for the deletion of a passage that condemned the prevention or disruption of Internet access and online information dissemination, as noted by the Centre for Internet and Society. Although, India flouts the said clause in spirit, back at home.

Out of the four amendments—L85-88 in the UNHRC resolution–the first amendment (L85) sought to include a reference to fighting against the exploitation of children online. This was withdrawn by Russia before it was considered by member states. L86 can truly be described as diluting language regarding freedom of expression online. L88 includes reference to hate speech, asks to introduce a new paragraph that states “Expresses its concern at the use of the Internet and information and communications technology to disseminate ideas based on racial superiority or hatred, and incitement to racial discrimination, xenophobia, and related intolerance.” This amendment was proposed by Belarus, China, Iran and the Russian Federation.

Considering that the Internet and other online media technologies are increasingly used for incitement and as a means of propagating intolerance and xenophobia in India and other Asian countries, the resolution does touch on an important issue. But it doesn’t seek to limit internet freedom particularly.

For more details visit https://cis-india.org/internet-governance/news/ciol-july-7-2016-india-may-not-be-guilty-of-opposing-un-move-to-save-internet-rights

India limits social media after civil unrest

praskrishna — 2012-09-04T11:59:01Z

Indian officials have gone too far in limiting text messages and pressuring local Internet firms as well as Twitter and others to block accounts, critics say.

This article by Mark Magnier was published in Los Angeles Times on August 23, 2012 and re-posted in Channel 6 News on August 24, 2012. Sunil Abraham is quoted.

Has the Indian government lost its sense of humor?

That's what some in India were asking as word spread that authorities had pressured Twitter into blocking several accounts parodying the prime minister after civil unrest that saw dozens of people from northeastern India killed and thousands flee in panic.

This week, the government also imposed a two-week limit of five text messages a day — raised Thursday to 20 — potentially affecting hundreds of millions of people, and pressured local Internet companies as well as Facebook, Twitter and Google to block hundreds of websites and user accounts.

Although journalists, free speech advocates and bloggers said the effort to squelch rumors may be justified, several criticized the actions as excessive.

"You cannot burn the entire house to kill one mischievous mouse," said Gyana Ranjan Swain, a senior editor at Voice & Data, a networking trade magazine. "You're in the 21st century. Their thinking is still 50 years old. It's just 'kill the messenger.'"

Comedians said Indian political humor is evolving and there's more leeway to make fun of politicians than a decade ago, but the nation's mores still call for greater respect than in the West.

"If I tried something like South Park, I'd be put behind bars tomorrow," said Rahul Roushan, founder of Faking News website, which satirizes Indian current events.

Faking News has lampooned the recent corruption scandals, including specious stories about theme restaurants (where customers must bribe waiters or go hungry); and a tongue-in-cheek report that India has banned the zero because too many of them appear nowadays in auditors' reports, after recent coal and telecommunications scandals each allegedly involving more than $30 billion.

Roushan, whose site isn't blocked, said he hopes low-level officials misinterpreted government directives.

"I'm still in a state of disbelief," he said. "I don't think the government is so stupid that it can ask that parody accounts get taken down. If they did, God help this country."

A spokesman for the prime minister's office said the blocking of six fake Twitter accounts attributed to the prime minister has been in the works for months and wasn't related to the recent crisis. He said the move was in response to tweets containing hate language and caste insults that readers could easily mistake as the Indian leader's. A dozen Twitter accounts and about 300 websites were blocked, according to news reports.

"We have not lost our sense of humor," said Pankaj Pachauri, the prime minister's spokesman. "We started a procedure to take action against people misrepresenting themselves."

But some Twitter users whose accounts are frozen, including media consultant Kanchan Gupta, counter that the government may be using the crisis to muzzle critics.

"I'm very clear in my mind this is a political decision," said Gupta, who has been critical of corruption and the government's policy drift. "If they were openly confrontational of me, they'd go nowhere, so they're trying this."

Attempts to access his Twitter page Thursday were met with the message: "This website/URL has been blocked until further notice either pursuant to Court orders or on the Directions issued by the Department of Telecommunications."

Even Britain's Queen Elizabeth II has numerous parody accounts so India needs to lighten up, consultant Gupta said.

He's received several messages from worried Pakistani friends since the news broke. "They ask if I'm all right, say they hope they haven't frog-marched you to jail," he said. "What irony."

The restrictions are the latest chapter of a crisis that started in July when Muslims and members of the Bodo tribal community in northeastern India clashed over land, jobs and politics. The result: 75 people killed and 300,000 displaced.

Muslims in Mumbai, formerly Bombay, staged a sympathy demonstration last week; two more people were killed and dozens injured.

Rumors, hate messages and altered photos of supposed atrocities against Muslims soon spread on social media sites, and several people from northeastern India were beaten in Bangalore and other cities, prompting the crackdown.

New Delhi has accused Pakistani websites of fanning the online rumors. (Islamabad said it would investigate if there's any proof.) But Indian news media also reported that 20% of the websites blocked contained inflammatory material uploaded by Hindu nationalist groups in India that were apparently trying to stir up sectarian trouble.

The Twitter community has responded with derision and humor to limits on text messages on prepaid cellphones.

"Feeling deeply insulted that I still have not been blocked," tweeted user @abhijitmajumder. "Victim of govt apathy."

Sunil Abraham, head of the Bangalore civic group Center for Internet and Society, said this week's restrictions are the latest in a series of regulations and recommendations aimed at tightening Internet control.

For more details visit https://cis-india.org/news/articles-latimes-com-mark-magnier-aug-23-2012-india-limits-social-media-after-civil-unrest

India limits social media after civil unrest

praskrishna — 2012-08-24T12:33:21Z

Has the Indian government lost its sense of humour? That’s what some in India were asking as word spread that authorities had pressured Twitter into blocking several accounts parodying the prime minister after civil unrest that saw dozens of people from northeastern India killed and thousands flee in panic.

Published in the Australian Financial Review. Sunil Abraham is quoted.

This week, the government also imposed a two-week limit of five text messages a day – raised Thursday to 20 – potentially affecting hundreds of millions of people, and pressured local internet companies as well as Facebook, Twitter and Google to block hundreds of websites and user accounts.

Although journalists, free speech advocates and bloggers said the effort to squelch rumours may be justified, several criticised the actions as excessive.

“You cannot burn the entire house to kill one mischievous mouse,” said Gyana Ranjan Swain, a senior editor at Voice & Data, a networking trade magazine. “You’re in the 21st century. Their thinking is still 50 years old. It’s just ‘kill the messenger’. ”

Comedians said Indian political humour is evolving and there’s more leeway to make fun of politicians than a decade ago, but the nation’s mores still call for greater respect than in the West.

“If I tried something like South Park, I’d be put behind bars tomorrow,” said Rahul Roushan, founder of Faking News website, which satirises Indian current events.

Faking News has lampooned the recent corruption scandals, including specious stories about theme restaurants (where customers must bribe waiters or go hungry); and a tongue-in-cheek report that India has banned the zero because too many of them appear nowadays in auditors’ reports, after recent coal and telecommunications scandals each allegedly involving more than $US30 billion.

Roushan, whose site isn’t blocked, said he hopes low-level officials misinterpreted government directives.

“I’m still in a state of disbelief,” he said. “I don’t think the government is so stupid that it can ask that parody accounts get taken down. If they did, God help this country.”

A spokesman for the prime minister’s office said the blocking of six fake Twitter accounts attributed to the prime minister has been in the works for months and wasn’t related to the recent crisis. He said the move was in response to tweets containing hate language and caste insults that readers could easily mistake as the Indian leader’s. A dozen Twitter accounts and about 300 websites were blocked, according to news reports.

“We have not lost our sense of humour,” said Pankaj Pachauri, the prime minister’s spokesman. “We started a procedure to take action against people misrepresenting themselves.”

Muslims in Mumbai, formerly Bombay, staged a sympathy demonstration last week; two more people were killed and dozens injured.

Rumours, hate messages and altered photos of supposed atrocities against Muslims soon spread on social media sites, and several people from northeastern India were beaten in Bangalore and other cities, prompting the crackdown.

New Delhi has accused Pakistani websites of fanning the online rumours. (Islamabad said it would investigate if there’s any proof.) But Indian news media also reported that 20 per cent of the websites blocked contained inflammatory material uploaded by Hindu nationalist groups in India that were apparently trying to stir up sectarian trouble.

The Twitter community has responded with derision and humour to limits on text messages on prepaid mobile phones.

“Feeling deeply insulted that I still have not been blocked,” tweeted user @abhijitmajumder. “Victim of govt apathy.”

Sunil Abraham, head of the Bangalore civic group Centre for Internet and Society, said this week’s restrictions are the latest in a series of regulations and recommendations aimed at tightening internet control.

“Before, the government’s had no grounds for censorship, it was only acting on the bruised egos of bureaucrats and officials,” he said. “This time, it’s got a legitimate right given the disruption of public order. But it hasn’t done so very effectively.”

For more details visit https://cis-india.org/news/afr-com-aug-24-2012-mark-magnier-india-limits-social-media-after-civil-unrest

India launches crackdown on online porn

pranesh — 2015-08-05T01:21:12Z

India has launched a crackdown on internet pornography, banning access to more than 800 adult websites, including Playboy and Pornhub.

The article by James Crabtree published in Financial Times on August 3, 2015 quotes Pranesh Prakash.

The restrictions followed a ruling from India’s telecoms ministry ordering internet service providers, including international telecoms groups operating in the country such as the UK’s Vodafone, to block 857 such sites.

Prime Minister Narendra Modi’s government provided no public justification for the unexpected ban when it came into effect at the weekend. However, on Monday India’s telecoms ministry said that the order, issued under India’s Information Technology Act, had been prompted by comments made by a supreme court judge during a hearing in July.

The ministry said that the restrictions were temporary and did not amount to a “blanket” ban, arguing that internet users running virtual private networks, which can be used to access blocked sites, could still view the material. “It isn’t that they are being banned lock, stock and barrel,” the ministry said. “The justice noted that free and open access to these websites.... should be controlled, but these sites will continue to be available through the mechanism of a VPN.”

The crackdown is set to raise fresh concerns about sudden and sweeping legal restrictions in India, after the introduction of a ban on the sale of beef earlier this year in the western state of Maharashtra, a move that was supported by Mr Modi’s government. The ruling also drew criticism from legal experts following broader concerns about a recent rise in poorly-targeted internet rules, including some restrictions on global social media sites such as Facebook and Twitter.

Pranesh Prakash of the Bangalore-based Centre for Internet and Society think-tank questioned the basis of the ruling, describing it as a further example of a “clumsy” approach to online regulation.

“There is no proper justification that they have given for banning all porn, rather than child porn or revenge porn or something like that,” he said. “The reaction is heavy handed, and has been done under the cloak of secrecy.” The remarks by a judge cited by India’s government as a rationale for the ban were a comment made in court rather than a legal ruling, Mr Prakash added, casting further doubt on the basis for the restrictions.

India’s mix of strict regulation and conservative public morals mean explicit sexual content is almost unheard of in mainstream media, where Bollywood films seldom featuring more than a chaste on-screen embrace.However India’s fast-growing internet population of about 300m is now both the world’s second largest after China, and an increasingly important sources for traffic for global pornographic websites.

Pornhub, which is the world’s 66th most visited website according to ranking service Alexa, said Indians were the fourth largest national users of its content during 2014.

For more details visit https://cis-india.org/internet-governance/news/financial-times-james-crabtree-august-3-2015-india-launches-crackdown-on-online-porn

India is building a biometric database for 1.3 billion people — and enrollment is mandatory

praskrishna — 2017-05-12T16:22:35Z

Inside the buzzing enrollment agency, young professionals wearing slim-fitting jeans and lanyards around their necks tapped away at keyboards and fiddled with fingerprint scanning devices as they helped build the biggest and most ambitious biometric database ever conceived.

The article by Shashank Bengali was published in the Los Angeles Times on May 12, 2017.

Into the office stepped Vimal Gawde, an impoverished 75-year-old widow dressed in a floral print sari. She had come to secure her ticket to India’s digital future — to enroll in the identity program, called Aadhaar, or “foundation,” that aims to record the fingerprints and irises of all 1.3 billion Indian residents.

Nearly 9 out of 10 Indians have registered, each assigned a unique 12-digit number that serves as a digital identity that can be verified with the scan of a thumb or an eye. But Gawde came to the enrollment office less out of excitement than desperation: If she didn’t get a number, she worried that she wouldn’t be able to eat.

Designed as a showcase of India’s technological prowess — offering identity proof to the poor and reducing waste in welfare programs — Aadhaar’s grand promises have been muddied by controversy as the government makes enrollment mandatory for a growing number of essential services.

Indians now need an Aadhaar number to pay taxes, collect pensions and obtain certain welfare benefits. The rapid expansion of a program that was originally described as voluntary has sparked criticism that India is vacuuming up citizens’ personal information with few privacy safeguards and creating hardship for the very people the initiative was supposed to help.

Like many Indians living in poverty, Gawde uses a ration card to purchase her monthly allotment of subsidized rice and cooking gas. But the shopkeeper told her that starting next month, he would sell to her only if she produced an Aadhaar number.

She had visited the enrollment agency three times but had yet to be approved, for reasons she did not understand. (Enrollment agents would not comment on individual cases.)

Reaching into her canvas bag, Gawde pulled out the familiar panoply of documents — ration card, voter card, electricity bill, income tax ID — that Indians use to navigate a dizzying bureaucracy. Aadhaar, she was told, would supplant all these papers.

But she had to get the number first.

“I’m nervous,” Gawde said outside the enrollment office on a sweltering morning. “I first applied three years ago and submitted all my documents, but didn’t follow up. Now that it’s becoming compulsory, I’m doing everything I can to get it.”

Indian Prime Minister Narendra Modi, who had criticized Aadhaar as a “political gimmick” before he took office, has embraced the futuristic idea of an all-in-one digital identity. His party pushed through a law last year that paved the way for a dramatic expansion of Aadhaar, allowing government entities and private businesses wide latitude to access the database, which collects not just people’s names and birth dates but also phone numbers, email addresses and other information.

Soon, as more private companies use the database, it could become difficult to open a bank account, get a new cellphone number or buy plane or train tickets without being enrolled.

Supporters say the program, which has cost about $1 billion to implement, will save multiples of that by curbing tax evasion and ensuring that welfare subsidies are not stolen by middlemen.

“Aadhaar was always meant to be an instrument of inclusion,” Nandan Nilekani, a tech billionaire and the program’s first chairman, said in an interview. “I’m really happy that the current government is completely endorsing Aadhaar and using it for a wide variety of services that will transform governance.”

Nilekani calls Aadhaar “hugely empowering” for the poor, but not long ago even he argued that enrollment should remain optional so that no Indians were prevented from accessing essential services. India’s Supreme Court agreed, ruling in 2015 that the government could not require Aadhaar for any benefit to which a person was otherwise entitled, as long as they could prove their identity by some other means.

Yet the court has stayed silent as Aadhaar creeps into every facet of Indian life, even for children.

A 12-year-old girl named Saiba is a case in point. After the girl’s grandmother passed away in their family’s ancestral village in northern India, Saiba’s mother moved her and her four siblings to a crowded neighborhood on the rough fringes of New Delhi, near a car parts market thick with the smell of grease.

When Saiba’s mother, Rani, went to the local school in April to register her for the sixth grade, administrators turned her down, saying every student must have an Aadhaar number.

But to get a number, a child usually needs a birth certificate — and like one-quarter of children born in this country, Saiba and her siblings did not have them because their village did not routinely register births.

Sitting with her mother in the cramped offices of the local advocacy group Pardarshita, above a noisy street lined with vegetable sellers, the girl puffed her round cheeks in an expression of helplessness.

“I don’t know anything about this,” said Saiba, who, like many Indians, has only one name. “I just want to go to school.”

Rakesh Thakur, a board member of Pardarshita, is trying to obtain Aadhaar numbers for dozens of children barred from Delhi schools. He called the policy “a clear violation” by the municipal government of both the Supreme Court order and India’s Right to Education Act, which guarantees every child younger than 14 free schooling.

A Twitter account called “Rethink Aadhaar” logs new instances almost daily of Indians who have suffered because scanners couldn’t read their fingerprints or because of errors in the database.

In Jawhar, a forested zone about 60 miles north of Mumbai, administrators have told local tribal communities that they will soon use Aadhaar to distribute welfare rations and school lunches. But the area lies outside cellphone range, leading residents to wonder how scanners will connect to the Internet to verify their identities.

“The idea of Aadhaar and the technology may be good, but do we have the infrastructure to make it mandatory?” said Vivek Pandit, a former lawmaker who runs a nonprofit group in the area. “The law is city-centric, and it would only lead to the social exclusion of rural India.”

This month lawyers opposing Aadhaar argued before the Supreme Court that the government could not force Indians to share their biometric data. Atty. Gen. Mukul Rohatgi countered that Indians had no constitutional right to privacy and could not claim an “absolute right” over their bodies.

Without privacy protections, activists worry that as Aadhaar numbers are linked to more and more services, intelligence agencies could use the database to more easily track Indians’ calls, travels and purchases.

“It’s become very clear that this is not a project about the poor,” said Usha Ramanathan, a lawyer and anti-Aadhaar activist. “The government’s ambitions have gotten greater over time.”

This month, the Center for Internet and Society, a New Delhi think tank, reported that federal and state agencies had published up to 135 million Aadhaar numbers — some including sensitive information such as a person’s caste and religion, or details of pension payments — on unsecured websites accessible through just a few clicks.

It’s become very clear that this is not a project about the poor. — Usha Ramanathan, a lawyer and anti-Aadhaar activist

Pranesh Prakash, the center’s policy director, said that when Indian authorities can’t even keep Aadhaar numbers private, as the law requires, it suggests the entire database is vulnerable — particularly after sensitive information involving 22 million Americans was exposed when federal databases were hacked in 2015.

“When these kinds of leaks are happening, it’s rather foolhardy to maintain a database of 1.2 billion people’s biometrics, because once this gets breached, it becomes completely unusable,” Prakash said.

“If your PIN number or password leaks, you can change it. You can’t change your fingerprints.”

Praveen Chakravarty, a former investment banker who worked with Nilekani to launch Aadhaar, believes the lack of safeguards undermines the project’s ideals of efficiency and empowerment. He said many Indians were right to worry that Modi’s government, which has cracked down on political activists and nonprofit groups it opposes, could use Aadhaar to snoop on citizens.

“Maybe Aadhaar didn’t need to be this big,” Chakravarty said, adding that the government could simply have worked to fix inefficiencies in individual welfare programs.

“People could ask, ‘Did we need this at all?’” he said. “It’s a good question.”

For Gawde, the widow, Aadhaar remained an idea of the future. She left the enrollment agency that day empty-handed, told by a young employee that her number had not been assigned. But she retained hope that the new ID would make life easier.

“We are just poor people,” she said. “We have to trust what the government tells us.”

For more details visit https://cis-india.org/internet-governance/news/los-angeles-times-shashank-bengali-may-12-2017-india-is-building-a-biometric-database-for-1.3-billion-people-and-enrollment-is-mandatory