We are anonymous, we are legion

In India, Privacy Policies of Fintech Companies Pay Lip Service to User Rights

shweta — 2019-07-31T02:21:40Z

A study of the privacy policies of 48 fintech companies that operate in India shows that none comply with even the basic requirements of the IT Rules, 2011.

The article by Shweta Mohandas highlighting the key observations in Fintech study conducted by CIS was published in the Wire on July 30, 2019.

Earlier this month, an investigation revealed that a Hyderabad-based fintech company called CreditVidya was sneakily collecting user data through their devotional and music apps to assess people’s creditworthiness.

This should be unsurprising as the privacy policies of most Indian fintech companies do not specify who they will be sharing the information with. Instead, they employ vague terminology to identify sharing arrangements such as ‘third-party’, ‘affiliates’ etc.

This is one of the many findings that we came across while analysing the privacy policies of 48 fintech companies that operate in India.

The study looked at how the privacy policies complied with the requirements of the existing data protection regime in India – the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

The IT Rules, among other things, require that privacy policies specify the type of data being used, the purpose of collection, the third parties the data will be shared with, the option to withdraw consent and the grievance redressal mechanism.

The rules also require the privacy policy to be easily accessible as well as easy to understand. The problem is that they are not as comprehensive and specific as, say, the draft Personal Data Protection Bill, which is awaiting passage through parliament, and hence require the companies to do much less than privacy and data protection practices emerging globally.

Nevertheless, despite the limited requirements, none of the companies in our sample of 48 were fully compliant with the parameters set by the IT Rules.

While 95% of the companies did fulfil the basic requirement of actually formulating and having a privacy policy, two major players stood out as defaulters: Airtel Payments Bank and Bhim UPI, for which we were not able to locate a privacy policy.

Though a majority of the privacy policies contained the statement “we take your privacy and security seriously”, 43% of the companies did not provide adequate details of the reasonable security practices and procedures followed.

The requirement in which most companies did not provide information for was regarding a grievance redressal mechanism, where only 10% of the companies comply.

While 31% of the companies provided the contact of a grievance redressal officer (some without even mentioning the redressal mechanism), 37% of the companies provided contact details of a representative but did not specify if this person could be contacted in case of any grievance.

Throughout the study, it was noted that the wording of the IT Rules allowed companies to use ambiguous terms to ensure compliance without exposing their actual data practices. For example, Rule 5 (7) requires a fintech company to provide an option to withdraw consent. Twenty three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums but they did not allow the user to withdraw their consent completely. While several of 17 companies did provide the option to withdraw consent, they did not clarify whether the withdrawal also meant that the user’s data was no processed or shared.

However, when it came to data retention, most of the 27 companies that provided some degree of information about the retention policy stated that some data would be stored for perpetuity either for analytics or for complying with law enforcement. The remaining 21 companies say nothing about their data retention policy.

In local languages

The issue of ambiguity most clearly arises when the user is actually able to cross the first hurdle – reading an app’s privacy policy.

With fintech often projected as one of the drivers of greater financial inclusion in India, it is telling that only one company (PhonePe) had the option to read the privacy policy in a language other than English. With respect to readability, we noted that the privacy policies were difficult to follow not just because of legalese and length, but also because of fonts and formatting – smaller and lighter texts, no distinction between paragraphs etc. added to the disincentive to read the privacy policy.

Privacy policies act as a notice to individuals about the terms on which their data will be treated by the entity collecting data. However, they are a monologue in terms of consent where the user only has the option to either agree to it or decline and not avail the services. Moreover, even the notice function is not served when the user is unable to read the privacy policy.

They, thus, serve as mere symbols of compliance, where they are drafted to ensure bare minimum conformity to legal requirements. However, the responsibility of these companies lies in giving the user the autonomy to provide an informed consent as well as to be notified in case of any change in how the data is being handled (this could be when and whom the data is being shared with, if there has been a breach etc).

With the growth of fintech companies and the promise of financial inclusion, it is imperative that the people using these services make informed decisions about their data. The draft Personal Data Protection Bill – in its current form – would encumber companies processing sensitive personal data with greater responsibility and accountability than before. However, the Bill, similar to the IT Rules, endorses the view of blanket consent, where the requirement for change in data processing is only of periodic notice (Section 30 (2)), a lesson that needs to be learnt from the CreditVidya story.

In addition to blanket consent, the SPD/I Rules and well as the PDP Bill does not require the user to be notified in all cases of a breach. While the information that is provided to data subjects is necessary to be designed keeping the user in mind, neither the SPD/I Rules, nor the PDP Bill take into account the manner in which data flows operate in the context of ‘disruptive’ business models that are a hallmark of the ‘fintech revolution’.

For more details visit https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights

Facebook Data for Good in New Delhi

Admin — 2019-07-31T02:10:23Z

When data is shared responsibly with the communities that need it, it can improve well being and save lives. Anubha Sinha participated in a session organized by Facebook on 29 July 2019 at University of Chicago Center in New Delhi.

Click to download the brochure

For more details visit https://cis-india.org/internet-governance/news/facebook-data-for-good-delhi

July 2019 Newsletter

praskrishna — 2019-08-09T13:50:49Z

Centre for Internet & Society (CIS) newsletter for July 2019.

Highlights for July 2019
CIS presented its comments on the proposed rules 29,30,31 of the Draft Copyright (Amendment) Rules, 2019 to the Department for Promotion of Industry and Internal Trade, Ministry of Commerce and Industry, Govt. of India. The comments were made in response to Notification G.S.R 393(E) published in the Gazette of India on May 30, 2019. CIS submitted that in the domestic approach to modernising our copyright legislation, we must refrain from considering distribution of born-digital/ digitised works over the public Internet equivalent to the function of broadcasting works over cable/ satellite. The Indian National Trust for Art & Heritage Pune Chapter is working with various organisations to preserve the natural heritage places like rivers in Pune district of Maharashtra, India. After the presentation of 'Project Jalbodh' by CIS-A2K in River Dialogue organised by INTACH in April 2018, several organisations have shown keen interest in collaboration. Subodh Kulkarni shares some insights in his report. ICANN has Advisory Committees which help guide the policy recommendations that the ICANN community develops while its Supporting Organizations are charged with developing policy recommendations for a particular aspect of ICANN's operations. ICANN publishes a combined budget for all these bodies under the head of policy development. CIS inquired about the financial resources allocated to each of them specifically. CIS in partnership with the Internet Society organized an event on the impact of consolidation in the Internet economy. It was divided into two roundtable discussions, the first one focusing on the policies and regulation while the latter dealt with the technical evolution of the Internet. The roundtables aimed to analyze how growing forces of consolidation, including concentration, vertical and horizontal integration, and barriers to market entry and competition would influence the Internet in the next 3 to 5 years. The report by Akriti Bopanna and Gurshabad Grover provides an insight into the developments. As part of its Researchers at work programme on key thematics at the intersections of internet and society, CIS called for abstracts for essays that explore social, economic, cultural, political, infrastructural, or aesthetic dimensions of the ‘list’. Ten abstracts would be shortlisted by August 9 from the list of submissions and the selected authors would be requested to submit the full essay of their draft by September 15. Final versions of the essays are expected to be published in October. With the rise and popularity of app-based platforms such as Ola, Uber, Swiggy Zomato, and others, there is a growing public conversation about regulation of such 'gig-work' platforms and the working conditions of people who work for them. To explore this further CIS conducted a panel discussion at its Bangalore office. Researchers associated with the project presented their preliminary findings. Panelists preliminary field insights along with reflections on what it meant to do such studies, how they went about studying gig-work, and challenges that arose in their work. An excerpt from an essay by Maya Indira Ganesh, written for and published as part of the Bodies of Evidence collection of Deep Dives titled You auto-complete me: romancing the bot explains human relations with bots. The Bodies of Evidence collection, edited by Bishakha Datta and Richa Kaul Padte, is a collaboration between Point of View and the Centre for Internet and Society, undertaken as part of the Big Data for Development Network supported by International Development Research Centre, Canada.

CIS and the News

The following articles were authored by CIS secretariat during the month:

Fostering Strategic Convergence in US-India Tech Relations: 5G and Beyond (Justin Sherman and Arindrajit Basu; The Diplomat; July 3, 2019).
Fix Problems Before Complete Failure (Shyam Ponappa; Business Standard; July 4, 2019).
What is the problem with ‘Ethical AI’? An Indian Perspective (A rindrajit Basu and Pranav M.B; cyberBRICS; July 17, 2019).
Old Isn't Always Gold: FaceApp and Its Privacy Policies (Mira Swaminathan and Shweta Reddy; The Wire; July 20, 2019).
The worrying survival of moon landing conspiracy theorists (Nishant Shah; Indian Express; July 22, 2019).
India Is Falling Down the Facial Recognition Rabbit Hole (Karan Saini and Prem Sylvester; The Wire; July 23, 2019).
Why I’m not going to tell you about the dangers of apps like FaceApp (Nishant Shah; Indian Express; July 28, 2019).
The Digital Identification Parade (Aayush Rathi and Ambika Tandon; Indian Express; July 29, 2019). The authors acknowledge Sumandro Chattapadhyay, Amber Sinha and Arindrajit Basu for their edits and Karan Saini for his inputs.
In India, Privacy Policies of Fintech Companies Pay Lip Service to User Rights (Shweta Mohandas; The Wire; July 30, 2019).

CIS in the News

CIS secretariat was consulted for the following articles published during the month in various publications:

PIB plans a fact-checking unit to counter fake news (Smriti Kak Ramachandran; Hindustan Times; July 3, 2019).
How Sai Baba Was Made To Spy On Your Phone For Credit Ratings (Gopal Sathe; Huffington Post; July 4, 2019).
Mozilla is funding a way to support Julia in Firefox (Catalin Cimpanu; ZD Net; July 8, 2019).
Deepfakes: Algorithms at war, trust at stake (Rajmohan Sudhakar; Deccan Herald; July 14, 2019).
Digital public information system design: Talk to experts, find the right way (Prachatai; July 18, 2019).
Easing the US-India divergence on data localisation (Shashidhar KJ and Kashish Parpiani; Observer Research Foundation; July 22, 2019).
For sex workers, mobile phone becomes a double-edged sword (Tushar Kaushik; Economic Times; July 23, 2019).
Twitter reacts to the India's cryptocurrency drama (Rajarshi Mitra; FXStreet; July 26, 2019).

Access to Knowledge

Access to Knowledge is a campaign to promote the fundamental principles of justice, freedom, and economic development. It deals with issues like copyrights, patents and trademarks, which are an important part of the digital landscape.

Copyright and Patent

Research on harms caused to consumers, developing countries, human rights, and creativity/innovation from excessive regimes of copyright, patents, and other such monopolistic rights over knowledge:

Submission

Comments on the Draft Copyright (Amendment) Rules, 2019 concerning Statutory Licensing (Anubha Sinha; July 11, 2019). This submission presents comments to the Department for Promotion of Industry and Internal Trade (“DPIIT”), Ministry of Commerce and Industry pertaining to the notification G.S.R 393(E) containing the draft Copyright (Amendment) Rules, 2019 issued on 30th May 2019.

Wikipedia

Under a grant from Wikimedia Foundation we are doing a project for the growth of Indic language communities and projects by designing community collaborations and partnerships that recruit and cultivate new editors and explore innovative approaches to building projects.

Blog Entries

Orientation programme, Wikipedia workshop & Action Plan meeting in PAH Solapur University (Subodh Kulkarni; July 19, 2019).
Wikimedia Workshop on Rivers under Project Jalbodh (Subodh Kulkarni; July 30, 2019).
Re-licensing Sessions with Authors and Organisations (Subodh Kulkarni; July 31, 2019).

Openness

Our work in the Openness programme focuses on open data, especially open government data, open access, open education resources, open knowledge in Indic languages, open media, and open technologies and standards - hardware and software:

Participation in Event

Learning and Understanding the Frameworks of Rights at Work (Organized by Kai Hsin Hung; IT for Change; Bangalore; July 13, 2019). Torsha and Mira attended the workshop.

Internet Governance

The Tunis Agenda of the second World Summit on the Information Society has defined internet governance as the development and application by governments, the private sector and civil society, in their respective roles of shared principles, norms, rules, decision making procedures and programmes that shape the evolution and use of the Internet. As part of internet governance work we work on policy issues relating to freedom of expression primarily focusing on the Information Technology Act and issues of liability of intermediaries for unlawful speech and simultaneously ensuring that the right to privacy is safeguarded as well.

Freedom of Speech & Expression

Under a grant from the MacArthur Foundation, CIS is doing research on the restrictions placed on freedom of expression online by the Indian government and contribute studies, reports and policy briefs to feed into the ongoing debates at the national as well as international level. As part of the project we bring you the following outputs:

Blog Entry

DIDP #34 On granular detail on ICANN's budget for policy development process (Akriti Bopanna; July 6, 2019).

Participation in Events

13th European Summer School on Internet Governance (Organized by European Summer School on Internet Governance; Meissen; July 13 - 20, 2019). Akriti Bopanna attended the school.
ICANN 65 De-briefing Meeting (Organized by Indian Council for Research on International Economic Relations ; July 16, 2019). Akriti Bopanna remotely presented on the Human Rights related developments that took place at the Marrakech meeting, over the course of the 4 days.

Privacy

Under a grant from Privacy International and IDRC we are doing a project on surveillance. CIS is researching the history of privacy in India and how it shapes the contemporary debates around technology mediated identity projects like Aadhar. As part of our ongoing research, we bring you the following outputs:

Blog Entry

The Impact of Consolidation in the Internet Economy on the Evolution of the Internet (Akriti Bopanna and Gurshabad Grover; July 3, 2019). The blog post was edited by Swaraj Barooah, Elonnai Hickok and Vishnu Ramachandran. Swagam Dasgupta provided inputs.

Participation in Events

Digital ID Forum 2019 (Organized by UNDP; Chulalongkorn University, Thailand; July 3, 2019). Sunil Abraham was one of the panelists at this event.
BIS LITD 17 meeting (Organized by Bureau of Indian Standards; New Delhi; July 3, 2019). Gurshabad Grover attended the sixteenth meeting of the Information Systems Security and Biometrics Section Committee (LITD17).
Facebook Data for Good in Bangalore (Organized by Facebook; Indian Institute of Science, Bangalore; July 25, 2019).
Roundtable with the WhatsApp leadership (Organized by WhatsApp; Mountbatten, The Oberoi, New Delhi; July 26, 2019). Will Cathcart, WhatsApp's new global head, visited India and invited Sunil Abraham for a discussion.
Facebook Data for Good in New Delhi (Organized by Facebook; University of Chicago Center, New Delhi; July 29, 2019).

IT / Information Technology

A research on the usage of systems (computers and telecommunications) for storing, retrieving and sending information as well as the IT Act:

Participation in Event

Leveraging Web Application Vulnerabilities for Reconnaissance and Intelligence Gathering (Organized by Has Geek; GRD College of Science, Coimbatore; July 5, 2019). Karan Saini gave a talk at the JSFoo Conference.

Artificial Intelligence

With origins dating back to the 1950s Artificial Intelligence (AI) is not necessarily new. However, interest in AI has been rekindled over the recent years due to advancements of technology and its applications to real-world scenarios. We conduct research on the existing legal and regulatory parameters:

Participation in Events

Roundtable Discussion on “The Future of AI Policy in India” (Organized by Indian Council for Research on International Economic Relations, New Delhi; July 1, 2019).
Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward (Organized by HEaL (Health, Ethics, and Law Institute of Training, Research and Advocacy) of FMES (Forum for Medical Ethics Society) in collaboration with CPS (Centre for Policy Studies), Indian Institute of Technology-Bombay; July 13, 2019). Radhika Radhakrishnan, participated in a roundtable discussion on "Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward."

Gender

Presentation to Amnesty International on researching the Future of Work (Organized by Amnesty Interntional, New Delhi; July 18, 2019). Aayush Rathi and Ambika Tandon made a presentation on CIS research on Future of Work.

Telecom

The growth in telecommunications in India has been impressive. While the potential for growth and returns exist, a range of issues need to be addressed for this potential to be realized. One aspect is more extensive rural coverage and the second aspect is a countrywide access to broadband which is low at about eight million subscriptions. Both require effective and efficient use of networks and resources, including spectrum.

Monthly Blog

Fix Problems Before Complete Failure (Shyam Ponappa; Organizing India Blogspot; July 4, 2019).

Researchers@Work

The researchers@work programme at CIS produces and supports pioneering and sustained trans-disciplinary research on key thematics at the intersections of internet and society; organise and incubate networks of and fora for researchers and practitioners studying and making internet in India; and contribute to development of critical digital pedagogy, research methodology, and creative practice.

Event Organized

#MappingDigitalLabour - Panel discussion on platform-work in Mumbai and New Delhi (CIS, Bangalore; July 19, 2019). Watch the session recording video here.

Blog Entries

Studying the Internet Discourse in India through the Prism of Human Rights (Deva Prasad M.; July 1, 2019).
#DigitalPedagogies (Ashutosh Potdar, Maya Dodd, Nidhi Kalra, and Ravikant Kisana; July 1, 2019).
#OpenAccessScholarlyPublishing (Abhishek Shrivastava, Dibyaduti Roy, and Nirmala Menon; July 11, 2019).
#RenarrationWeb (Anuja Mirchandaney, Deepak Prince, Dinesh and Shalini; July 23, 2019).

About CIS

CIS is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. The areas of focus include digital accessibility for persons with disabilities, access to knowledge, intellectual property rights, openness (including open data, free and open source software, open standards, open access, open educational resources, and open video), internet governance, telecommunication reform, digital privacy, and cyber-security. The academic research at CIS seeks to understand the reconfigurations of social and cultural processes and structures as mediated through the internet and digital media technologies.

Follow CIS on:

Twitter: http://twitter.com/cis_india
Twitter - Access to Knowledge: https://twitter.com/CISA2K
Twitter - Information Policy: https://twitter.com/CIS_InfoPolicy
Facebook - Access to Knowledge: https://www.facebook.com/cisa2k
E-Mail - Access to Knowledge: a2k@cis-india.org
E-Mail - Researchers at Work: raw@cis-india.org
List - Researchers at Work: https://lists.ghserv.net/mailman/listinfo/researchers

Support CIS:

Please help us defend consumer and citizen rights on the Internet! Write a cheque in favour of 'The Centre for Internet and Society' and mail it to us at No. 194, 2nd 'C' Cross, Domlur, 2nd Stage, Bengaluru - 5600 71.

Collaborate with CIS:

We invite researchers, practitioners, artists, and theoreticians, both organisationally and as individuals, to engage with us on topics related internet and society, and improve our collective understanding of this field. To discuss such possibilities, please write to Sunil Abraham, Executive Director, at sunil@cis-india.org (for policy research), or Sumandro Chattapadhyay, Research Director, at sumandro@cis-india.org (for academic research), with an indication of the form and the content of the collaboration you might be interested in. To discuss collaborations on Indic language Wikipedia projects, write to Tanveer Hasan, Programme Officer, at tanveer@cis-india.org.

CIS is grateful to its primary donor the Kusuma Trust founded by Anurag Dikshit and Soma Pujari, philanthropists of Indian origin for its core funding and support for most of its projects. CIS is also grateful to its other donors, Wikimedia Foundation, Ford Foundation, Privacy International, UK, Hans Foundation, MacArthur Foundation, and IDRC for funding its various projects.

For more details visit https://cis-india.org/about/newsletters/july-2019-newsletter

Easing the US-India divergence on data localisation

Shashidhar KJ and Kashish Parpiani — 2019-07-30T01:40:24Z

Addition of data localisation to the basket of persisting trade issues warrants greater compartmentalisation and consultative approaches to US-India ties.

The article by Shashidhar KJ and Kashish Parpiani was published by Observer Research Foundation on July 22, 2019.

The Reserve Bank of India’s (RBI) finally clarified its position eight months after it issued the controversial April 2018 circular mandating the storage of all payment data of Indians in the country and allowing the central bank “unfettered access”. The circular particularly aimed at US-based companies such as Mastercard, Visa, American Express, PayPal, Facebook and Google, as they scrambled to comply. The clarification was a welcome relief for companies seeking guidance on how to comply, what kind of data needs to be stored in India, and if the payment companies needed to move their processing infrastructure. Note, the RBI has yet to issue a formal directive with these clarifications.

Meanwhile, media reports have indicated that Facebook-owned WhatsApp would obey the RBI norm as it looks to kick off its payments business. This runs counter to what Facebook CEO Mark Zuckerberg had told investors in April:

“You should expect that we won’t store sensitive data in countries where it might be improperly accessed because of weak rule of law or governments that can forcibly get access to your data.”

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

This has revealed yet another faultline in the persisting trade issues between the US and India.

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

Indian data rights vs. American IPR protectionism

New Delhi has started to assert its right over its citizens’ data as India’s footprint on the Internet increases. Moreover, without clear guidance from Personal Data Protection legislation, there has been a glut of policy prescriptions from sector regulators. The Centre for Internet and Society published a paper in which it chronicles 10 policy measures for both ‘soft’ and ‘hard’ data localisation across health, telecommunications, e-commerce, insurance and others. These measures range from storing copies of specific data, local content production requirements, or imposing conditions on cross-border data transfers that act as a localisation mandate.

This oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip. For example, one of the reasons for insisting on localisation is security, but even if companies localise data, there is no framework to access this data by the local security apparatus.

India’s policy thinking on the matter often begins with the idea: ‘data is the new oil.’ The thinking is that data generated by Indians should be viewed as a natural resource that must be protected by the state through localisation. This notion is problematic. Data, unlike oil, which is found in limited quantities, has different properties. Newer ideas of regulation must be thought of and that’s where Indian policy makers have not been accommodative.

Oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip.

A gripe that US-based companies mention is that there is a distinctive domestic tilt and that company representatives have turned away from consultations as they do not serve the “national interests.” This was best exemplified in October 2018 when a closed-door discussion between the RBI and the US-India Strategic Partnership Forum (USISPF representing the interests of US companies) broke downand the latter accused the RBI of having a bias. During the discussions, the RBI placed a lot of emphasis on the inputs from iSPIRT (Indian Software Product Industry Roundtable), an Indian think tank which has been advocating for data protectionism.

The aforementioned sentiment has been carried over to international summits. At the recently concluded G20 summit, India boycotted the Osaka Track on the digital economy as it felt that it would undermine multilateral consensus-based decisions on trade and deny policy space for digital industrialisation. The Osaka Track pushed hard for the creation of laws which would allow data flows between countries and the removal of data localisation.

India’s foreign secretary, Vijay Gokhale, mentioned that data is a new form of wealth and wanted latitude on domestic rule-making on data. And in the age of digital commerce, this may signify a broader trend of a developed-developing nations’ impasse. The tussle has now moved beyond the security angle with the United States enacting the Clarifying Lawful Overseas Use of Data (CLOUD) Act for security agencies to procure data stored in servers regardless of whether in the US or foreign soil. With monetisation now at the core of the dispute, the discussed divergences on data localisation tie into the US’ broader, long-standing issues pertaining to US-India bilateral trade.

Divergence on data localisation issue crosses path with trade tensions

The 2019 National Trade Estimate (NTE) by the Office of the United States Trade Representative (USTR) focuses on reducing “barriers to digital trade.” Taking a tone of American stewardship on open liberal market economics, it notes:

“When governments impose unnecessary barriers to cross-border data flows or discriminate against foreign digital services, local firms are often hurt the most, as they cannot take advantage of cross-border digital services that facilitate global competitiveness.”

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

President Trump’s ‘America First’ worldview in many ways upended conventional tenets of US foreign policy. But on some fronts, it has presented opportunities for marginal establishment agendas. For instance, Trump’s heightened focus on ties with Israel and the US’ Sunni allies in the Middle East, complements the realisation of neoconservatives’ penchant for regime change in Iran.

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

On Trump’s fixation with recalibrating US trade relationships on “fair and reciprocal” footing, the American trade establishment successfully addressed US’ belated concerns over absence of digital trade rules in case of the North American Free Trade Agreement (NAFTA) with Canada and Mexico. Similarly, the emerging divergences over data localisation with India are subsumed under the ongoing — albeit repeatedly stalled, US-India trade negotiations.

Hence, the NTE underscores India’s decision with regards to payment service suppliers to be part of trade barriers hampering digital commerce and US-India trade at-large.

Fixing the strained Carter mantra via compartmentalisation and consultation

India has approached trade talks from the standpoint of addressing the Trumpian aberration of the US pushing for reduction of its trade deficits with other countries. Whereas, USTR negotiators have approached negotiations with India with regards to, what they view as longstanding issues in bilateral trade, such as market access for dairy products and price caps on medical equipment.

In the past, those outstanding issues were downplayed in view of the promising long-term trajectory of US-India strategic ties. The same has come to be known as the understated dictum of the Carter mantra — named after former US Secretary of Defense Ashton Carter and architect of the US-India Defense Technology and Trade Initiative. The approach encompassed the US to focus on harnessing strategic ties and not let differences on other fronts like trade to crowd out minimal-yet-positive developments.

In recent times, that dictum has come under strain as trade tensions have resurfaced. Cases in-point being, the Trump administration’s recent revocation of India’s designation as a “beneficiary developing country” under its Generalised System of Preferences programme, and India’s imposition of retaliatory tariffs on 28 US products.

The US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels.

Furthermore, ahead of Secretary of State Mike Pompeo’s visit to New Delhi last month, the Trump administration reportedly mulled capping the issuance of H1B visas to about 15 percent for any country that “does data localisation.” It bore ominous prospects for India’s $150 billion IT sector as 70 percent of the 85,000 H1B visas issued every year go to Indians. With regards to the broader trajectory of US-India ties, the report came to be seen as another blow to the Carter mantra’s prescription for compartmentalisation of issues from promising aspects of the bilateral relationship.

Both sides however, have attempted to temper tensions, and keep the Carter mantra in place with the continued focus on evolving strategic ties — with continued impetus on US-India defence trade and force interoperability agreements.

More importantly, there seems to be an overt attempt to reinstitute a sense of compartmentalisation. For instance, Secretary Pompeo, during his visit to New Delhi eased fears by denouncing reports about the US considering H1B visa caps. Whereas, India, too, has sought to institute a sense of compartmentalisation with Commerce Minister Piyush Goyal announcing that the contentious data protection issue will be kept out of the e-commerce policy draft, and will be dealt with by the IT ministry instead.

Lastly, the US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels. Examples of which include, the US-India 2+2 consultative platform between foreign and defense portfolio chiefs, and the India-US Strategic Energy Partnership working groups between India’s Petroleum Minister and US Energy Secretary. The upcoming editions of these forums are set to be critical in addressing outstanding issues in the strategic realm, like India’s purchase of the Russian S-400 systems inviting the prospect of American CAATSA sanctions, and India’s push for a gas-based economy in light of reduced oil purchases from Iran following recent tensions between Washington and Tehran.

Similarly, on easing the hardening American and Indian stances on data localisation, in addition to compartmentalisation, a consultative approach must be explored. Towards that end, the India-US Commercial Dialogue and India-US CEO Forum could serve as appropriate starting points for a joint working group involving a diverse set of stakeholders from the public and private realm.

For more details visit https://cis-india.org/internet-governance/news/observer-research-foundation-shashidhar-kj-and-kashish-parpiani-july-22-2019-easing-the-us-india-divergence-on-data-localisation

For sex workers, mobile phone becomes a double-edged sword

Tushar Kaushik — 2019-07-30T01:01:26Z

Our research on the use of mobile phones by sex workers, as part of the project on Feminist Information Infrastructure in collaboration with Sangama, was cited in an article in the Economic Times.

The article by Tushar Kaushik was published in the Economic Times on July 23, 2019. CIS research was quoted.

A mobile phone makes sex workers more vulnerable to harassment and abuse; however, it also helps them protect themselves better, according to recent reports. The report compiled by research and advocacy group Centre for Internet and Society (CIS) in May was based on surveys and interviews of 64 sex workers in rural Bengaluru and Hassan conducted by the nonprofit Sangama, which works with sexual minorities and sex workers. It said most sex workers use basic phones rather than smartphones.

Some respondents said phones helped them conduct sex work discreetly and avoid solicitation on roads and in public spaces. “This was especially advantageous for workers employed in addition to sex work, allowing them to schedule appointments for sex work for short periods during the day,” the report said. Some respondents said it helped them stay connected with friends and family while working.

But, in some cases, clients circulated workers’ contacts, leading to frequent calls and messages, some of which turned abusive. Some said clients would circulate photos and videos that had them in a compromising situation, or record calls with them, and threaten to circulate the content among families and communities of the workers. Pooja S (name changed), 27, said many clients shared her numbers with others, who would then call and harass her. “Clients have sometimes taken my photos and videos without my knowledge,” she said. However, Pooja is also aware of the advantage of having a mobile phone — in case of any problem with any client, she can immediately call someone for help.

Many transgender sex workers also said the advantages of a mobile phone far outweigh the disadvantages. Trans-activist Uma Umesh, who works to help many sex workers from the community, said, “Some clients call workers for frivolous reasons, and when workers don’t respond well, clients turn abusive.” Some sex workers use a separate sim card when with clients, she said.

A journal published in February, titled ‘Female Sex Workers’ Use of Mobile Phones in India,’ made similar conclusions based on discussions with 67 sex workers and 18 staff members from local NGOs in Mumbai and parts of Karnataka between January and May 2015. The journal highlighted how phones helped workers to be less dependent on brokers. It also mentioned cases where the police, upon apprehending sex workers, called clients whose contacts were saved on the workers’ phone to use them as a witness.

Shubha Chacko, one of the authors and executive director at Solidarity Foundation, which works with sex workers, said the workers are being trained to use phones to minimise threats. “For instance, some clients don’t pay. We advise workers to seek digital payment in advance.”

For more details visit https://cis-india.org/internet-governance/news/economic-times-july-23-2019-tushar-kaushik-for-sex-workers-mobile-phone-becomes-a-double-edged-sword

Roundtable with the WhatsApp leadership

Admin — 2019-07-30T00:33:15Z

Will Cathcart, WhatsApp's new global head, visited India and invited Sunil Abraham for a discussion on 26 July 2019 at the Mountbatten, The Oberoi, New Delhi. Sunil met with some other people from WhatsApp leadership.

Discussions took place on the changing policy landscape in India. The event was a free flowing off the record discussion for about an hour between Will Cathcart and representatives of leading civil society organizations.

For more details visit https://cis-india.org/internet-governance/news/roundtable-with-the-whatsapp-leadership

Twitter reacts to the India's cryptocurrency drama

Rajarshi Mitra — 2019-07-30T00:25:58Z

An Inter-Ministerial Committee led by Subhash Chandra Garg, secretary, Department of Economic Affairs (DEA) has submitted a report which will recommend a ban on cryptocurrency in India to the finance ministry.

The blog post by Rajarshi Mitra was published by FX Street on July 26, 2019. Pranesh Prakash tweeted on this issue.

The IMC is, however, encouraging the use of blockchain technology and is agnostic about digital currencies backed by the Reserve Bank of India (RBI). Prominent members of the crypto community have sounded off on the situation in India.

Tim Draper - Founder of DFJ Venture Capital:

“People behaving badly! India's government banned Bitcoin, a currency providing great hope for prosperity in a country that desperately needs it. Shame on India leadership. Pathetic and corrupt. #India #bitcoin.”

Anthony Pompliano - Co-founder & Partner at Morgan Creek Digital:

“We need to pay attention to what is happening in India around cryptocurrency regulation. I’m willing to fly to meet with lawmakers and regulators if someone can get me a meeting. Who can help?”

Pranesh Prakash:

“India's proposed #cryptocurrency ban would cover non-crypto currencies too, if they go ahead with the current definition. For instance, Amazon gift cards will also get covered, and be banned.”

Ajeet Khurana - CEO Zebpay:

“I have talked to most of the cryptocurrency decision makers in the Indian establishment and know that they are brilliant people with the best interest of India at heart. I implore them to avoid denying India its rightful place in history.”

XRPcryptowolf:

“Indian panel thinks a #Cryptocurrency created by RBI could be a boon for india & that regulators should consider creating a sovereign #Cryptocurrency At the same time they proposed a ban & up to 10 years in prison for general use of #Crypto in India What a bunch of hypocrites‍♂️.”

For more details visit https://cis-india.org/internet-governance/news/fxstreet-rajarshi-mitra-july-26-2019-twitter-reacts-to-india-s-crypto-currency-drama

The Digital Identification Parade

Aayush Rathi and Ambika Tandon — 2019-07-30T00:19:25Z

NCRB’s proposed Automated Facial Recognition System impinges on right to privacy, is likely to target certain groups.

The article by Aayush Rathi and Ambika Tandon was published in the Indian Express on July 29, 2019. The authors acknowledge Sumandro Chattapadhyay, Amber Sinha and Arindrajit Basu for their edits and Karan Saini for his inputs.

The National Crime Records Bureau recently issued a request for proposals for the procurement of an Automated Facial Recognition System (AFRS). The stated objective of the AFRS is to “identify criminals, missing persons/children, unidentified dead bodies and unknown traced children/persons”. It will be designed to compare images against a “watchlist” curated using images from “any […] image database available with police/other entity”, and “newspapers, raids, sent by people, sketches, etc.” The integration of diverse databases indicates the lack of a specific purpose, with potential for ad hoc use at later stages. Data sharing arrangements with the vendor are unclear, raising privacy concerns around corporate access to sensitive information of crores of individuals.

While a senior government official clarified that the AFRS will only be used against the integrated police database in India — the Crime and Criminal Tracking Network and Systems (CCTNS) — the tender explicitly states the integration of several other databases, including the passport database, and the National Automated Fingerprint Identification System. This is hardly reassuring. Even a targeted database like the CCTNS risks over-representation of marginalised communities, as has already been witnessed in other countries. The databases that the CCTNS links together have racial and colonial origins, recording details of unconvicted persons if they are found to be “suspicious”, based on their tribe, caste or appearance. However, including other databases puts millions of innocent individuals on the AFRS’s watchlist. The objective then becomes to identify “potential criminals” — instead of being “presumed innocent”, we are all persons-who-haven’t-been-convicted-yet.

The AFRS may allow indiscriminate searching by tapping into publicly and privately installed CCTVs pan-India. While facial recognition technology (FRT) has proliferated globally, only a few countries have systems that use footage from CCTVs installed in public areas. This is the most excessive use of FRT, building on its more common implementation as border technology. CCTV cameras are already rife with cybersecurity issues, and integration with the AFRS will expand the “attack surface” for exploiting vulnerabilities in the AFRS. Additionally, the AFRS will allow real-time querying, enabling “continuous” mass surveillance. Misuse of continuous surveillance has been seen in China, with the Uighurs being persecuted as an ethnic minority.

FRT differs from other biometric forms of identification (such as fingerprints, DNA samples) in the degree and pervasiveness of surveillance that it enables. It is designed to operate at a distance, without any knowledge of the targeted individual(s). It is far more difficult to prevent an image of one’s face from being captured, and allows for the targeting of multiple persons at a time. By its very nature, it is a non-consensual and covert surveillance technology.

Potential infringements on the right to privacy, a fundamental right, could be enormous as FRT allows for continuous and ongoing identification. Further, the AFRS violates the legal test of proportionality that was articulated in the landmark Puttaswamy judgment, with constant surveillance being used as a strategy for crime detection. Other civil liberties such as free speech and the right to assemble peacefully could be implicated as well, as specific groups of people such as dissidents and protests can be targeted.

Moreover, facial recognition technology has not performed well as a crime detection technology. Challenges arise at the stage of input itself. Variations in pose, illumination, and expression, among other factors, adversely impact the accuracy of automated facial analysis. In the US, law enforcement has been using images from low-quality surveillance feed as probe photos, leading to erroneous matches. A matter of concern is that several arrests have been made solely on the basis of likely matches returned by FRT.

Research indicates that default camera settings better expose light skin than dark, which affects results for FRT across racial groups. Moreover, the software could be tested on certain groups more often than others, and could consequently be more accurate in identifying individuals from that group. The AFRS is envisioned as having both functionalities of an FRT — identification of an individual, and social classification — with the latter holding significant potential to misclassify minority communities.

In the UK, after accounting for a host of the issues outlined above, the Science and Technology Committee, comprising 14 sitting MPs, recently called for a moratorium on deploying live FRT. It will be prudent to pay heed to this directive in India, in the absence of any framework around data protection, or the use of biometric technologies by law enforcement.

The experience of law enforcement’s use of FRT globally, and the unique challenges posed by the usage of live FRT demand closer scrutiny into how it can be regulated. One approach may be to use a technology-neutral regulatory framework that identifies gradations of harms. However, given the history of political surveillance by the Indian state, a complete prohibition on FRT may not be too far-fetched.

For more details visit https://cis-india.org/internet-governance/blog/aayush-rathi-and-ambika-tandon-indian-express-july-29-2019-the-digital-identification-parade

European Summer School on Internet Governance

Admin — 2019-07-23T00:30:15Z

The 13th European Summer School on Internet Governance was held at Meissen in Germany from 13 - 20 July 2019. Akriti Bopanna attended the school. The event was organized by EuroSSIG.

More information on the event can be accessed on this page.

For more details visit https://cis-india.org/internet-governance/news/european-summer-school-on-internet-governance

Leveraging Web Application Vulnerabilities for Reconnaissance and Intelligence Gathering

Admin — 2019-07-22T01:39:14Z

Karan Saini gave a talk at the JSFoo Conference at the GRD College of Science in Coimbatore, Tamil Nadu on July 5, 2019. The event was organized by Has Geek.

Click to view Karan's presentation

For more details visit https://cis-india.org/internet-governance/news/leveraging-web-application-vulnerabilities-for-reconnaissance-and-intelligence-gathering

Lecture at International Summer School, Delhi

Admin — 2019-07-22T01:11:00Z

Ambika Tandon and Aayush Rathi, on July 12, 2019, delivered a lecture at the International Summer School, Delhi.

The ISS is in its 6th year now, and is convened annually as a six week academic program. The ISS is held in affiliation with the Department of Political Science at Jamia Millia Islamia - A Central University (JMI) and with regular support from the Ministry of External Affairs (MEA) over the years.

The lecture formed a part of the Innovation, Technology and the Future of Work course module at this year's edition. The speakers focused specifically on placing an intersectional lens to drive home the point that there will be not one future of work, but multiple. And how it is that we can begin to interrogate the various competing narratives that are being propagated. Ambika and Aayush also focused on how the present gendered ordering of the labour market stands to be reproduced in the various shapes work will take going forward.

The presentation can be accessed here.

For more details visit https://cis-india.org/internet-governance/news/lecture-at-international-summer-school-delhi

Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward

Admin — 2019-07-21T15:47:27Z

On July 13, 2019, Radhika Radhakrishnan, participated in a roundtable discussion on "Emerging AI technology in health care in India, health equity and justice: Critical reflections and charting out way forward." The event was organized by HEaL (Health, Ethics, and Law Institute of Training, Research and Advocacy) of FMES (Forum for Medical Ethics Society) in collaboration with CPS (Centre for Policy Studies), Indian Institute of Technology-Bombay.

Radhika chaired a session on the ethics of AI in healthcare in India, and my main submissions included: the medicalization of and experimentation on women's bodies under a medical-industrial complex for the design of AI-based healthcare models, and FAT (Fairness, Accountability, Transparency) concerns with AI. She was also invited to draft some of this content into a paper submission to the Indian Journal of Medical Ethics which is a peer-reviewed and indexed academic journal run by FMES.

For more details visit https://cis-india.org/internet-governance/news/emerging-ai-technology-in-health-care-in-india-health-equity-and-justice-critical-reflections-and-charting-out-way-forward

Deepfakes: Algorithms at war, trust at stake

Rajmohan Sudhakar — 2019-07-21T15:42:12Z

A case in point is the video that surfaced of an Indian journalist not so long ago.

The article by Rajmohan Sudhakar was published in Deccan Herald on July 14, 2019. Elonnai Hickok was quoted.

Now machines are learning to manipulate imagery. That is a real worry. Deepfakes for instance. They are AI-manipulated videos achieved by machine learning. Products of the humongous volume of images and videos now available online.

The danger is, this imagery could be yours or mine. Imagine artificial intelligence of neural networks creating convincing identities of our real counterparts, and starts posting videos. Absurd.

“Society has grappled with spurious and specious content in media over time. Media has been modified for various reasons, usually by those with access to significant resources and influence in the past,” says Elonnai Hickok, COO of the Bengaluru-based Centre for Internet and Society.

From an AI and machine learning perspective, deepfakes could be understood by what is known as GAN -- generative adversarial networks, essentially two algorithms at war. One is a generator, the other a discriminator. They compete with each other based on set inputs, in time bettering the version they together help create. These are behind what are now known as deepfakes of popular figures floating around online. Barack Obama is seen saying in a purported deepfake, “stay woke bitches”, which of course he did not say.

Another deepfake has Mark Zuckerberg boasting: “I have total control of billions of people’s stolen data, all their secrets, their lives, their futures.” “Deepfakes are media modified by current technology and techniques. Easy availability of technology and media allows anyone to create, tailor or manipulate media for their own ends. Deepfakes present an opportunity for introspection and research into the contours of freedom of expression as well as societal frameworks for dealing with fake content,” explains Hickok.

One of the horrid instances of a deepfake-like attack was the video that surfaced of an Indian woman journalist not so long ago. Or the child-kidnapping rumours that spread through WhatsApp and the subsequent mob lynchings. However, there’s the view that in post-truth times, deepfakes would be seen with caution in the inherent dilemma over believing what one views online.

“In India, people do not take these so seriously, especially on social media. It is mostly entertainment for many. Now, we are seeing people with diametrically opposing views. They often view content which they like to see. It would rather work as a reinforcer of views than a transformer,” feels political analyst Sandeep Shastri.

Open source software can create basic deepfakes if someone wanted to hurt somebody. The potential scale of danger and damage looms larger for influential figures and nations at war.

“While deep fakes can be used to damage societies, it is important that collectively society takes steps to become sensitised to ways that media can be used to manipulate opinions and choices, and allow people to develop skills that build awareness and context to what they see and believe,” adds Hickok.

A video emerged recently of an ‘Iranian’ boat near an attacked oil tanker in the Persian Gulf. Deepfake or not, the authenticity of the video was questionable. If used wily, it could have triggered a war.

According to Hickok, society has to get more resilient to manipulation. “This includes spoken, written, seen as well as heard information. We have to learn to question the basis on which we confirm trust. Multiple forms of verification may help to address spurious media and information,” she says.

Deepfakes are no surprise as social media feed into the small and large divisions and differences of multitudes. Emergence of such potentially dangerous AIs isn’t taken quite seriously by the tech czars. In fact, it is a matter of economy for them.

Oscar Schwartz writes in The Guardian that ‘technological solutionism’ in the ‘attention economy’ may not be the real approach. “And herein lies the problem: by formulating deepfakes as a technological problem, we allow social media platforms to promote technological solutions to those problems – cleverly distracting the public from the idea that there may be more fundamental problems with powerful Silicon Valley tech platforms,” Schwartz warns.

“The measures do not fall on the regulators alone. I think, individuals (by introspection and building awareness), society (through education), the legal system (stringent evidentiary requirements and capacity building) industry (differentiating recreational and prejudicial content, tagging content that is manipulated, etc.) and regulators (enabling accountability, oversight, transparency and redress) can all contribute to a more resilient society,” observes Hickok.

In India, viewing a video is still considered close to truth, almost sacred by the vast majority. Necessarily, it would not require a technologically advanced deepfake, especially in the backward rural pockets, to rile up and aggravate biases and prejudices.

“Deepfakes can further existing biases and manipulate opinions and choices. They can disrupt trust inherent in societal groups to co-exist and politically, they can breed distrust in leadership and capability. That said, deepfakes can be used for humour and satire. Ultimately, the impact will be shaped by a number of factors including pre-existing biases, individual response, etc.,” Hickok elaborates.

On a lighter note, deepfakes could be helpful too. We could very well do away with some of our television news presenters.

For more details visit https://cis-india.org/internet-governance/news/deccan-herald-july-14-2019-rajmohan-sudhakar-deepfakes-algorithms-at-war-trust-at-stake

Presentation to Amnesty International on researching the Future of Work

Admin — 2019-07-21T15:23:52Z

Aayush Rathi and Ambika Tandon made a presentation to Amnesty International on July 18, 2019.

Amnesty International is in the midst of designing its next big global strategy and were seeking inputs to 5 key questions (attached here). They were soliciting provocations to make sure that future of work issues are not left out of their vision and future strategy. Also invited was Will Stronge, director of Autonomy, a think tank in the UK. While he spoke about Autonomy's work that looks at future of work as enmeshed with climate change issues, we brought in a global South perspective and also made a case for why looking at gender is crucial, and why there is a need for methodological innovation in the study of the future of work. Click to view the presentation.

For more details visit https://cis-india.org/internet-governance/news/presentation-to-amnesty-international-on-researching-the-future-of-work

ICANN 65 De-briefing Meeting

Admin — 2019-07-21T15:02:03Z

The Indian Council for Research on International Economic Relations (ICRIER) organized an ICANN65 de-briefing meeting on July 16, 2019. Akriti Bopanna remotely presented on the Human Rights related developments that took place at the Marrakech meeting, over the course of the 4 days.

Akriti's updates related to Workstream 2 Recommendations on Accountability, the Government Advisory Council's options in incorporating HR in their communication to the Board, their interest in our Human Rights Impact Assessment work and having a high interest session on the same at ICANN66. She also spoke about her contributions to the ICANN Board on their Anti-Harassment Policy along with details on the working group established to discussing the policy.

For more details visit https://cis-india.org/internet-governance/news/icann-65-de-briefing-meeting