We are anonymous, we are legion

Smriti Irani brings back focus on voyeurism prevailing in our country

praskrishna — 2015-05-08T00:59:30Z

The case of Union minister Smriti Irani finding a CCTV camera at Goa's Fab India has again brought back the focus on digital voyeurism and how a critical issue like surveillance can be exploited. Irani's case comes days after a woman found a mobile phone strapped to a changing room door of a Van Heusen store in Lajpat Nagar's Central market, a popular shopping hub.

The article by Amrita Madhukalya was published in DNA on April 6, 2015. Pranesh Prakash gave his inputs.

Bangalore girl Sumitra (name changed) remembers the day in 2009 she saw a camera when trying on a skirt at Palika Bazaar. "I looked around the tiny changing room and saw a camera with a dipping red light. I quickly rushed out and accused the shopkeeper. But, Palika is not a place of great repute, and my friend who was accompanying me asked me to forget the matter," she says, and that's what she did. She was a degree student at Delhi University, and being relatively unaware of the city, decided to keep mum. "But look at what has happened: if they can film a Union minister at a Fab India store, they will film anyone. We need stringent action."

One of the first cases of digital voyeurism was reported in Pune in 2003 when a peon in an establishment at Sahakar Nagar installed a web camera in a changing room. In 2005, landowner Mohan Kulkarni from Navi Peth was arrested for filming women tenants. In 2007, two MMS clips from the changing rooms of a renowned departmental store in Kolkata started making the rounds. In one, a girl was shown changing clothes while in the other a couple was shown having sex. Then a year later, shop assistant Sunil Kumar Jha was found filming women in a clothes store from below the trial room door in Kolkata.

Debarati Halder, advocate and founder of the Centre for Cyber Victim Counselling, feels that had it not been a politician like Irani, the case would not have been highlighted at all. "People would have brushed off the incident had it been another woman. It is hard to escape the amount of negative publicity a case like this garners," she says. This is reflected in the case of a woman who was filmed in a leading store in Mumbai and was scared to approach the police, as she and her father did not want to go through the "legal hassles" of the case. The woman spoke of her story to a journalist of a leading daily and the ensuing report eventually led to the arrest of the shop assistant.

Cyber security expert Pranesh Prakash says that digital voyeurism is a huge problem in India and elsewhere. "There is a mismatch between privacy protection provided in the IT Act against non-consensual sharing of certain forms of sexual images, and the utter disregard for privacy in other parts of the law. Given that cybercafes have often been places where users are secretly filmed, the law should seek to crack down on such invasions of privacy. Instead, the law doesn't prohibit that, and in fact the Cybercafe Rules, encourage cybercafe owners to photograph all users, including minors. The rules say that untrustworthy cybercafe owners keep these records for a minimum period of one year, but there is no maximum period," says Prakash.

Section 66E of the Information Technology Act, 2000, amended in 2008, deals with digital voyeurism. And section 354 (C) of the Indian Penal Code (IPC) deals with voyeurism in general.

But, there are many loopholes. "When the footage is shot by a government-run establishment, then the clause of surveillance is a cover, like in an MMS of Delhi Metro (where a couple was shown making out)."

For more details visit https://cis-india.org/internet-governance/news/dna-april-6-2015-amrita-madhukalya-smriti-irani-brings-back-focus-on-voyeurism-prevailing-in-the-country

Smartphone rumours spark series of mob killings in India

Admin — 2018-07-31T14:30:06Z

Nation reels from killings blamed on fake reports of kidnappers spread on WhatsApp

The article by Samanth Subramanian was published in the National on July 2, 2018. Pranesh Prakash was quoted.

All it takes these days to kill a man in India is the merest spark of mistrust, fuelled perhaps by a rumour on social media. Strangers travelling through villages, a transgender woman and even a government official have all been set upon by mobs and killed across the country over the past two months.

On Sunday, in the most recent attack, five men were beaten to death in the district of Dhule, in Maharashtra. Three others survived. The eight men had been seen getting off a bus near a village and talking to a young girl, police officials said.

Residents had been reading hoax messages on WhatsApp for a few days already, which claimed that kidnappers were in the area, looking for victims. So a group confronted the eight travellers at the local market and, choosing not to believe their story, beat them to death with sticks.

On Monday, police said they had arrested 23 people in connection with the killing. "I appeal to everybody not to believe in such posts that are circulated on social media," Deepak Kesarkar, Maharashtra's junior home minister, said. "The law should not be taken into one's own hands."

Including the incident in Dhule, at least 19 people in 11 states have been killed in public killings since the beginning of May. Dozens more have been injured in such attacks.

In Tamil Nadu, a 55-year-old woman was killed for handing out sweets to children — again, the residents suspected her to be a kidnapper. In Hyderabad, a transgender woman was killed, seemingly without provocation. In Assam, two men were set upon and killed when they stopped in a rural part of the state to ask for directions.

The darkest case is laced with irony. Sukanta Chakrabarty was appointed by the government of the state of Tripura to tour its villages and dispel social media rumours about child kidnappers. Last Thursday, he was mistaken for a kidnapper and killed by four young men in the village of Kalacherra.

In response, the government of Tripura cut mobile internet services for two days, to try to cut down the spread of rumours. Other states have also reacted. In Hyderabad in May, police arrested a Facebook user for posting a false video about a "kidnapper" named "Afzal Sagar".

Karnataka’s police department has a social media control room that monitors viral posts. And Tamil Nadu's police have launched awareness drives to alert users about the dubious nature of forwarded WhatsApp messages.

But in a country with nearly 500 million smartphone users, the state is hard pressed to curb the flow of information on WhatsApp and social media.

At least 200 million Indians are on WhatsApp, a messaging platform owned by Facebook. In a statement released two weeks ago, a WhatsApp spokesman encouraged users to "report problematic messages so that we can take action. We're also stepping up our education efforts so that people know how to spot fake news or hoaxes on WhatsApp."

A new WhatsApp feature, which appends a "Forwarded" tag as a caveat to any forwarded message, has not yet been introduced across the entire platform.

The violence instigated by such messages, however, is as much a societal problem as a technological one, said Pranesh Prakash, a fellow with the Centre for Internet and Society, a think tank in Bengaluru.

"I don't think this is a particular moment in time where people are being taken over by a hatred of the outsider,” Mr Prakash said. “I was doing a little digging and found a very similar case even in 2015, in Maharashtra. But what's new is the speed with which this has spread across the country over the past few months."

In part, Mr Prakash said, the violence betrays mistrust of outsiders but also a lack of confidence in law enforcement. People are not sure that reporting suspected kidnappers to the police will result in a prompt or thorough investigation.

"In a newspaper, I read about how someone in the town of Salem [in Tamil Nadu] had said: ‘Why would the police ever tell us the truth?’ That’s uniquely problematic."

But the adequacy of WhatsApp's response is also under scrutiny, especially given Facebook's troubles over fake news and the manipulation of users in the US and other countries.

"It's important that they do all they can to cut down on the spread of these rumours without impinging upon the freedom of speech," Mr Prakash said.

For more details visit https://cis-india.org/internet-governance/news/the-national-july-2-2018-samanth-subramanian-smartphone-rumours-spark-series-of-mob-killings-in-india

Smart City Standardization - ICT Perspective

Admin — 2018-12-10T16:00:28Z

An event on Smart City standardization – ICT Perspective was organized by the Bureau of Indian Standards in Bangalore on October 30, 2018. Gurshabad Grover attended the event.

Different efforts and challenges in the space of smart city standardisation were discussed by the speakers and panelists. See the agenda.

For more details visit https://cis-india.org/internet-governance/news/smart-city-standardization-ict-perspective

Smart City Policies and Standards: Overview of Projects, Data Policies, and Standards across Five International Smart Cities

Kiran A. B., Elonnai Hickok and Vanya Rakesh — 2016-06-11T13:29:04Z

This blog post aims to review five Smart Cities across the globe, namely Singapore, Dubai, New York City, London and Seoul, the Data Policies and Standards adopted. Also, the research seeks to point the similarities, differences and best practices in the development of smart cities across jurisdictions.

Download the brief: PDF.

Introduction

Smart City as a concept is evolutionary in nature, and the key elements like Information and Communication Technology (ICT), digitization of services, Internet of Things (IoT), open data, big data, social innovation, knowledge, etc., would be intrinsic to defining a Smart City [1].

A Smart City, as a “system of systems”, can potentially generate vast amounts of data, especially as cities install more sensors, gain access to data from sources such as mobile devices, and government and other agencies make more data accessible. Consequently, Big Data techniques and concepts are highly relevant to the future of Smart Cities. It was noted by Kenneth Cukier, Senior Editor of Digital Products at The Economist, that Big Data techniques can be used to enhance a number of processes essential to cities - for example, big data can be used to spot business trends, determine quality of research, prevent diseases, tack legal citations, combat crime, and determine real-time roadway traffic conditions [2]. Having said this, data is deemed to be the lifeblood of a Smart City and its availability, use, cost, quality, analysis, associated business models and governance are all areas of interest for a range of actors within a smart city [3]

This blog reviews five Smart Cities namely Singapore, Dubai, New York City, London and Seoul. In doing so, the research seeks to point the similarities, differences and best practices in the development of smart cities across jurisdictions. To achieve this, the research reviews:

The definition of a Smart City in a given context or project (if any).
Existing policy/regulations around data or notes the lack thereof.
The cities adherence to the International standards and providing an update on the current status of the Smart City programme.

Singapore

Introduction

The Smart Nation programme in Singapore was launched on 24th November, 2014. The programme is being driven by the Infocomm Development Authority of Singapore, through which Singapore seeks to harness ICT, networks and data to support improved livelihoods, stronger communities and creation of new opportunities for its residents [4] According to the IDA, a Smart Nation is a city where “people and businesses are empowered through increased access to data, more participatory through the contribution of innovative ideas and solutions, and a more anticipatory government that utilises technology to better serve citizens’ needs” [5]. The Smart Nation programme is driven by a designated Office in the Prime Minister’s Office [6]. As a core component to the Smart Nation Programme, the Smart Nation Platform has been developed as the technical architecture to support the Programme. This Platform enables greater pervasive connectivity, better situational awareness through data collection, and efficient sharing and access to collected sensor data, allowing public bodies to use such data to develop policy and practical interventions [7] Such access would allow for anticipatory governance - a goal of the Smart Nation Programme as noted by Dr. Yaacob Ibrahim, Minister for Communications and Information stating “Insights gained from this data would enable us to better anticipate citizens’ needs and help in better delivery of services” [8].

Status of the Project

The Smart Nation Programme is an ongoing initiative, being built on the past programme Intelligent Nation 2015 (iN2015 masterplan). The plan involves putting in place the infrastructure, policies, ecosystem and capabilities to enable a Smart Nation, by adopting a people-centric approach [9]. A number of co-creating solutions adopted by the Government include:

Development of Mobile Apps to facilitate communication between the public and the providers of public services.
Organization of Hackathons by government agencies or corporations in collaboration with schools and industry partners to ideate and develop solutions to tackle real-world challenges.
Adopt measure for smart mobility to create a more seamless transport experience and providing greater access to real-time transport information so that citizens can better plan their journeys.
Smart technologies are also being introduced to the housing estates [10].

Policies and Regulations

The Smart Nation plan derives its legitimacy from the constitution of Singapore, holding the Prime Minister responsible to take charge of the subject ‘Smart Nation’ blueprint under the Statutory body of ‘Smart Nation’ Programme Office [11]. Singapore has a comprehensive data protection law – the Personal Data Protection Act 2012, rules governing the collection, use, disclosure and care of personal data. The Personal Data Protection Commission of Singapore has committed to work closely with the private sector, and also to support the Smart Nation vision on data privacy and cyber security ecosystem [12] [13].

Towards achieving the Smart Nation vision the government has also promoted the use of open data. In 2015 the Department of Statistics has made a vast amount of data available (across multiple themes say transport, infocomm, population, etc.) for free to the public in order to encourage innovation and facilitate the Smart Nation [14]. Prior to this initiative, the government had adopted the Open Data Policy in 2011, enabling public data for analysis, research and application development [15]. The concept of Virtual Singapore, which is a part of the Smart Nation Initiative, has been developed to adopt and simulate solutions on a virtual platform using big data analytics [16].

Adoption of International Standards

The Smart Nation initiative follows the standards laid under the purview of the Singapore Standards Council (SSC). It specifies three types of Internet of Things (IoT) Standards – sensor network standards (TR38 - for public areas & TR40 - for homes), IoT foundational standards (common set of guidelines for IoT requirements and architecture, information and service interoperability, security and data integrity) and domain-specific standards (healthcare, mobility, urban living, etc.) [17].

Singapore is part of ISO/IEC JTC 1/WG7 Sensor Networks and ISO/IEC JTC 1/WG10 Internet of Things (IoT) [18]. Singapore IT standards abides to the international standards as defined by ISO, ITU, etc.Singapore is a member of many international standards forums (see Singapore International Standards Committee) which includes JTC1/WG9 - Big Data; JTC1/WG10 - Internet of Things; JTC1/WG11 - Smart Cities.

Dubai, United Arab Emirates

Introduction

The Dubai Smart City strategy was launched as part of the Dubai Plan 2021 vision, in the year 2015 [19]. Dubai Plan 2021 describes the future of Dubai evolving through holistic and complementary perspectives, starting with the people and the society and places the government as the custodian of the city’s development. Within the Plan, the smart city theme envisions a platform that is fully connected and integrated infrastructure that enables easy mobility for all residents and tourists, and provides easy access to all economic centers and social services, in line with the world’s best cities [20]. Center to the smart city platform is data and data analytics, particularly cross functional data and big data techniques to give a complete view of the city [21] As envisioned, the Dubai Data portal would provide a gateway to empower relevant stakeholders to understand the nuances of the city and pursue questions that will result in the greatest impact from the city’s data [22]. The platform will be based on current data and existing services, initiatives, and networks to identify opportunities for a smart city [23]. The Smart City Plan also includes a framework for aligning districts of Dubai with the Smart City vision and dimensions [24].

The Smart Dubai roadmap 2015 provides a consolidated report and planned smart city services, its status and the stage of its implementation, for e.g. Smart Grid, Mobile Payment, Smart Water, Health applications, Public Wi-Fi, Municipality, E-Traffic solutions, etc [25].

Status of the Project

The Smart Dubai strategy is envisioned to be completed by the year 2020, and currently it’s ongoing. The first phase of Smart Dubai masterplan is expected to end by 2016. Between 2017 and 2019, the plan aims to deliver new initiatives and services. The second phase of the masterplan is expected to be completed by the year 2020 [26].

Policies and Regulations

The Smart City Plan is being driven by the Dubai Smart City Office – which has been established under Law No. (29) of 2015 on the establishment of Dubai Smart City Office; Law No. (30) of 2015 on the establishment of Dubai Smart City Establishment; Decree No. (37) of 2015 on the formation of the Board of the Dubai Smart City Office; and Decree No (38) of 2015- appointing a Director General for the Office, which will develop overall policies and strategic plans, supervise the smart transformation process and approve joint initiatives, projects and services [27]. Also, an open data law called Dubai Open Data Law was issued to complete the legislative framework for transforming Dubai into a Smart City [28]. This law will enable the sharing of non-confidential data between public entities and other stakeholders.

Adoption of International Standards

In 2015 the Smart Dubai Executive Committee has collaborated through an agreement with the International Telecommunications Union (ITU) adopt the performance indicators by the ITU Focus Group on Smart Sustainable Cities to evaluate the feasibility of the indicators [29]. The Focus Group is working towards identifying global best practices for the development of smart cities [30].

New York City, United States of America

Introduction

The ‘One New York Plan’ announced in the year 2015 is a comprehensive plan for a sustainable and resilient city. It includes the adoption of digital technology and considers the importance of the role of data in transforming every aspect of the economy, communications, politics, and individual and family life [31]. Furthermore, through a publication on 'Building a Smart+Equitable City', the Mayor’s Office of Technology and Innovation (MOTI) describes efforts to leverage new technologies to build Smart city.

Accordingly, the plan seeks to establish better lives through establishing principles and strategic frameworks to guide connected device and Internet of Things (IoT) implementation; MOTI serving as the coordinating entity for new technology and IoT deployments across all City agencies; collaborating with academia and the private sector on innovative pilot projects, and partnering with municipal governments and organizations around the world to share best practices and leverage the impact of technological advancements [32].

Status of the Project

OneNYC represents a unified vision for a sustainable, resilient, and equitable city developed with cross-cutting interagency collaboration, public engagement, and consultation with leading experts in their respective fields. The Mayor’s Office of Sustainability oversees the development of OneNYC and now shares responsibility with the Mayor’s Office of Recovery and Resiliency for ensuring its implementation [33].

Policies and Regulations

As per the Local Law 11 of 2012, each City entity must identify and ultimately publish all of its digital public data for citywide aggregation and publication by 2018. In adherence to this law, there exists a NYC Open Data Plan which requires annual data updation [34].

The LinkNYC initiative, one of the key projects to make New York a ‘smart’ city, aims to connect everyone through a city wide wi-fi network. The LinkNYC initiative will retrofit payphones with kiosks to provide high-speed WiFi hotspots and charging stations for increased connectivity [35]. Data Privacy in the initiative is addressed through the customer first privacy policy, which considers user’s privacy on priority and will not sell any personal information or share with third parties for their own use. LinkNYC will use anonymized, aggregate data to make the system more efficient and to develop insights to improve your Link experience [36].

Adoption of International Standards

The ANSI Network on Smart and Sustainable Cities (ANSSC) is a forum for information sharing and coordination on voluntary standards, conformity assessment and related activities for smart and sustainable cities in the US [37]. The US is a signatory of the ISO/ITU defined standards on smart cities [38].

London, United Kingdom

Introduction

The Smart London Plan was unveiled in the year 2013 by the Mayor of London. The plan is being driven through the Greater London Authority, with the advice of the Smart London Board. The Smart London Plan envisions ‘Using the creative power of new technologies to serve London and improve Londoner’s lives’ [39]. ‘Smart London’ is about harnessing new technology and data so that businesses, Londoners and visitors experience the city in a better way, and do not face bureaucratic hassle and congestion. Smart London seeks to improve the city as a whole and focuses on city macro functions that result from the interplay between city subsystems - such as local labour markets to financial markets, from local government to education, healthcare, transportation and utilities. According to strategy documents, a smarter London recognises and employs data as a service and will leverage data to enable informed decision making and the design of new activities.

Status of the Project

This project is currently ongoing. Since its formation in March 2013, the Smart London Board has been advising the Greater London Authority.The Plan sits within the overarching framework of the Mayor’s Vision 2020 [40].

Policies and Regulations

The Smart London Plan incorporates the existing open data platform called ‘London DataStore’. The rules and guidelines for this platform are defined by the Greater London Authority, which includes working with public and private sector organisations to create, maintain and utilise it, enabling common data standards, identify and prioritise which data are needed to address London’s growth challenges, establish a Smart London Borough Partnership to encourage boroughs to free up London’s local level data. Also, privacy is protected and there is transparent use of data - to ensure data use is managed in the best interests of the public rather than private enterprise.⁴² The Smart London Plan aims to build on this existing datastore to identify and publish data that addresses specific growth challenges, with an emphasis on working with companies and communities to create, maintain, and use this data [41].

The Open Data White Paper, issued by the Office of Paymaster General, seeks to build a transparent society by releasing public data through open data platforms and leveraging the potential of emerging technologies [42]. The Greater London Authority processes personal data in accordance with the Data Protection Act 1998 [43].

Adoption of International Standards

The British Standards Institution (BSI) has already established Smart City standards and has associated with the ISO Advisory Group on smart city standards. The UK subscribes to the BSI standards for smart cities and has adopted the same [44]. The following standards and publications help address various issues for a city to become a smart city:

The development of a standard on Smart city terminology (PAS 180)
The development of a Smart city framework standard (PAS 181)
The development of a Data concept model for smart cities (PAS 182)
A Smart city overview document (PD 8100)
A Smart city planning guidelines document (PD 8101)
BS 8904 Guidance for community sustainable development provides a decision-making framework that will help setting objectives in response to the needs and aspirations of city stakeholders
BS 11000 Collaborative relationship management
BSI BIP 2228:2013 Inclusive urban design - A guide to creating accessible public spaces.

Further, the Smart London Plan incorporates open data standards in accordance with London DataStore [45]. Various government reports – Smart Cities background paper, Open Data White Paper, etc., have suggested the use of standards related to Internet of Things (IoT), open data standards, etc [46].

Seoul, Korea

Introduction

Smart Seoul 2015 was announced in June 2011 by the Seoul Metropolitan Government, which envisions integrating IT services into every field, including administration, welfare, industry and living. Through this, the Seoul Metropolitan Government plans to create a Seoul that uses smart technologies by 2015 [47]. Towards this, the Seoul Metropolitan Government plans to make use of Big Data in policy development, and through scientific analytics, will provide customized administrative services and reduce wasteful spending. Also, the government is utilising Big Data to analyse trends emerging from existing services [48]. Examples of projects that leverage big data that the government has undertaken include the Taxi Matchmaking Project – analyzes the data related to taxi stands and passengers, the Owl Bus [49] - maps the bus routes, etc.

Status of the Project

Building on the Smart Seoul 2015, the Seoul Metropolitan Government plans to establish 'Global Digital Seoul 2020 – New Connections, Different Experiences' vision in next five-years. In this multi-objective plan, it aims to establish a ’Big Data campus’ providing win-win cooperation among public, private, industry and university [50].

Policies and Regulations

The Smart Seoul 2015 aims to create a ‘Seoul Data Mart’, which will be an open platform that makes public information available for data processing [51]. Furthermore, Seoul has opened the Seoul Open Data Plaza [52], an online channel to share and provide citizens with all of Seoul’s public data, such as real-time bus operation schedules, subway schedules, non-smoking areas, locations of public Wi-Fi services, shoeshine shops, and facilities for disabled people, and the information registered in Seoul Open Data Plaza is provided in the open API format.⁴⁵

South Korea has a comprehensive law governing data privacy – Personal Information Protection Act, 2011. The law includes data protection rules and principles, including obligations on the data controller and the consent of data subjects, rights to access personal data or object to its collection, and security requirements. It also covers cookies and spam, data processing by third parties and the international transfer of data [53].

International Standards

The smart city standards are adopted in the development of smart cities in Korea [54]. Korea has adopted the ISO/TC 268, which is focused on sustainable development in communities. Korea also has one working group developing city indicators and another working group developing metrics for smart community infrastructures [55].

Conclusion

The smart city projects studied are at different levels of implementation and have both similarities and differences. Below is an analysis of some of the key similarities and differences between smart city projects, a comparison of these points to India’s 100 Smart City Mission, and a summary of best practices around the development of smart city frameworks.

Nodal Agency

All cities studied have nodal agencies driving the smart city initiatives and many have policies in place backing these initiatives. For example, while the Smart Nation programme in Singapore is being driven by the Infocomm Development Authority, in London the smart city project is governed by the Great London Authority. The Smart Seoul Project in Korea is governed by the Seoul Metropolitan Government and New York has the Mayor’s Office of Technology and Innovation serving as the coordinating entity for new technology and IoT deployments across all City agencies. In India, the nodal agency driving the 100 Smart Cities Project is the Ministry of Urban Development under the Indian Government. In India, the implementation of the Mission at the City level will be done by a Special Purpose Vehicle (SPV), which will be a limited company and will plan, appraise, approve, release funds, implement, manage, operate, monitor and evaluate the Smart City development projects.

Policies

Many of the cities had open data policies and data protection policies that pertain to the Smart City initiatives. In Dubai, an open data law called Dubai Open Data Law has been issued to complete the legislative framework for transforming Dubai into a Smart City and the Smart City Establishment will develop policies for the project. New York also has an Open Data Plan in place and LinkNYC will use anonymized, aggregate data to address data privacy of users. In London, the Smart London Plan incorporates the existing open data platform called ‘London DataStore’, the rules for which are defined by the Greater London Authority, which also ensures privacy and transparent use of data by processing personal data in accordance with the Data Protection Act 1998. For regulation of data in Seoul, a ‘Seoul Data Mart’ will be established to make public information available for data processing and the Seoul Open Data Plaza is an existing online channel to share and provide citizens with all of Seoul’s public data. South Korea has a comprehensive law governing data privacy in place as well. In Singapore, the Personal Data Protection Commission has committed to work and support the Smart Nation vision on data privacy and cyber security ecosystem. To achieve the vision of the project, the government has also promoted the use of open data. It can be said the these countries , with clearly laid out policies to support and guide the project, have well planned ecosystem for regulation and governance of systems, technologies and cities. All cities have incorporated open data into smart cities and many have developed guidelines for its use. All cities have similar goals of enhancing the lives of citizens and developing anticipatory regulation, however, there appears to be little discussion on the need to amend existing law or enable new law around privacy and data protection in light of data collection through smart cities. In India, no enabling legislation or policy has been formulated by the Government, apart from releasing “Mission Statement and Guidelines”, which provides details about the Project and vision, excluding a definition of a ‘smart city’ or the relevant applicable laws and policies. No information is publicly available regarding deployment of open data, use of specific technologies like cloud, big data, etc., the relevant policies and applicability of laws. Unlike India, all cities recognize the importance of big data techniques in enabling smart city visions, technology and policies. On the lines of these cities, India must work towards addressing the need for an open data framework in light of the 100 Smart Cities Mission to enable the sharing of non-confidential data between public entities and other stakeholders. This requires co-ordination to incorporate, enable and draw upon open data architecture in the cities by the Government with the existing open data framework in India, like the National Data Sharing and Accessibility Policy, 2012. Use of technology in the form of IoT and Big Data entails access to open data, bringing another policy area in its ambit which needs consideration. Also, identification and development of open standards for IoT must be looked at. Also, as data in smart cities will be generated, collected, used, and shared by both the public and private sector. It is essential that India’s existing data protection standards and regime must be amended to extend the data regulation beyond a body corporate and oversee the collection and use of data by the Government, and its agencies.

Standards

In Singapore, the Smart Nation initiative follows the standards laid under the purview of the Singapore Standards Council (SSC)and the Singapore IT standards abides to the international standards as defined by ISO, ITU, etc. The Country is also a member of many international standards forums (see Singapore International Standards Committee) which includes JTC1/WG9- Big Data; JTC1/WG10 - Internet of Things; JTC1/WG11 - Smart Cities. In Dubai, the Smart Dubai Executive Committee with the International Telecommunications Union (ITU) to adopt the performance indicators by the ITU Focus Group on Smart Sustainable Cities to evaluate the feasibility of the indicators. For the purpose of standards, the ANSI Network on Smart and Sustainable Cities (ANSSC) in New York is a forum smart and sustainable cities, along with US being a signatory of the ISO/ITU defined standards on smart cities. Also, The British Standards Institution (BSI) has already established Smart City standards and has associated with the ISO Advisory Group on smart city standards. The UK subscribes to the BSI standards for smart cities and has adopted the same and the Smart London Plan incorporates open data standards in accordance with London DataStore. For development of smart cities, Korea has adopted the ISO/TC 268, which is focused on sustainable development in communities and also has one working group developing city indicators and another working group developing metrics for smart community infrastructures. However, in India, the Bureau of Indian Standards (BIS) has undertaken the task to formulate standardised guidelines for central and state authorities in planning, design and construction of smart cities by setting up a technical committee under the Civil engineering department of the Bureau. However, adoption of the standards by implementing agencies would be voluntary and intends to complement internationally available documents in this area. Also, The Global Cities Institute (GCI) has undertaken a mission in the year 2015 to align with the Bureau of Indian Standards regarding development of standards of smart cities and also to forge relationships with Indian cities in light of ISO 37120. It can be said that India has currently not yet adopted international standards, but is in the process of developing national standards and adopting key international standards. Unlike other cities,which are adopting standards - national, ISO, or ITU, Indian cities are yet to adopt standards for regulation of the future smart cities.

Notes for India

India is in the nascent stages of developing smart cities across the country. Drawing from the practices adopted by cities across the world, smart cities in India should adopt strong regulatory and governance frameworks regarding technical standards, open data and data security and data protection policies. These policies will be essential in ensuring the sustainability and efficiency of smart cities while safeguarding individual rights. Some of these policies are already in place - such as India’s Open Data Policy and India’s data protection standards under section 43A of the ITA. It will be important to see how these policies are adopted and applied to the context of smart cities.

References

[1] Smart Cities and Transparent Evolution, http://www.posterheroes.org/Posterheroes3/_mat/PH3_eng.pdf.

[2] "Data, Data Everywhere." The Economist, February 25, 2010. Accessed March 17, 2016, http://www.economist.com/node/15557443.

[3] "Smart Cities." ISO. 2015. Accessed March 17, 2016, http://www.iso.org/iso/smart_cities_report-jtc1.pdf.

[4] Transcript of Prime Minister Lee Hsien Loong's speech at Smart Nation launch on 24 November, http://www.pmo.gov.sg/mediacentre/transcript-prime-minister-lee-hsien-loongs-speech-smart-nation-launch-24-november.

[5] Smart Nation Vision, https://www.ida.gov.sg/Tech-Scene-News/Smart-Nation-Vision.

[6] Smart Nation, http://www.pmo.gov.sg/smartnation.

[7] Smart Nation Platform, https://www.ida.gov.sg/~/media/Files/About%20Us/Newsroom/Media%20Releases/2014/0617_smartnation/AnnexA_sn.pdf.

[8] Transcript of Prime Minister Lee Hsien Loong's speech at Smart Nation launch on 24 November, https://www.ida.gov.sg/blog/insg/featured/singapore-lays-groundwork-to-be-worlds-first-smart-nation/.

[9] Prime Ministers’ Office Singapore-Smart Nation, http://www.pmo.gov.sg/smartnation.

[10] Prime Ministers’ Office Singapore-Smart Nation, http://www.pmo.gov.sg/smartnation.

[11] Constitution of the Republic of Singapore (Responsibility of the Prime Minister) Notification 2015, http://statutes.agc.gov.sg/aol/search/display/view.w3p;page=0;query=Status%3Acurinforce%20Type%3Aact,sl%20Content%3A%22smart%22;rec=4;resUrl=http%3A%2F%2Fstatutes.agc.gov.sg%2Faol%2Fsearch%2Fsummary%2Fresults.w3p%3Bquery%3DStatus%253Acurinforce%2520Type%253Aact,sl%2520Content%253A%2522smart%2522;whole=yes.

[12] Personal Data Protection Singapore-Annual Report 2014-15, https://www.pdpc.gov.sg/docs/default-source/Reports/pdpc-ar-fy14---online.pdf.

[13] Balancing Innovation and Personal Data Protection, https://www.ida.gov.sg/Tech-Scene-News/Tech-News/Digital-Government/2015/9/Balancing-innovation-and-personal-data-protection.

[14] Department of Statistics Singapore- Free Access to More Data on the SingStat Website from 1 March 2015, http://www.singstat.gov.sg/docs/default-source/default-document-library/news/press_releases/press27022015.pdf.

[15] Singapore Marks 50th Birthday With Open Data Contest, https://blog.hootsuite.com/singapore-open-data/.

[16] Virtual Singapore - a 3D city model platform for knowledge sharing and community collaboration, http://www.sla.gov.sg/News/tabid/142/articleid/572/category/Press%20Releases/parentId/97/year/2014/Default.aspx.

[17] Internet of Things (IoT) Standards Outline to Support Smart Nation Initiative Unveiled, http://www.spring.gov.sg/NewsEvents/PR/Pages/Internet-of-Things-(IoT)-Standards-Outline-to-Support-Smart-Nation-Initiative-Unveiled-20150812.aspx.

[18] Information Technology Standards Committee, https://www.itsc.org.sg/technical-committees/internet-of-things-technical-committee-iottc and https://www.ida.gov.sg/~/media/Files/Infocomm%20Landscape/iN2015/Reports/realisingthevisionin2015.pdf.

[19] Government of Dubai-2021 Dubai Plan-Purpose, http://www.dubaiplan2021.ae/the-purpose/.

[20] Government of Dubai-2021 Dubai Plan, http://www.dubaiplan2021.ae/dubai-plan-2021/.

[21] Smart Dubai, http://www.smartdubai.ae/foundation_layers.php.

[22] The Internet of Things: Connections for People’s happiness, http://www.smartdubai.ae/story021002.php.

[23] Smart Dubai - Current State, http://www.smartdubai.ae/current_state.php.

[24] Smart Dubai - District Guidelines, http://smartdubai.ae/districtguidelines/Smart_Dubai_District_Guidelines_Public_Brief.pdf.

[25] See; http://roadmap.smartdubai.ae/search-services-public.php and http://roadmap.smartdubai.ae/search-initiatives-public.php.

[26] Smart Dubai-Smart District Guidelines, http://smartdubai.ae/districtguidelines/Smart_Dubai_District_Guidelines_Public_Brief.pdf.

[27] Dubai Ruler issues new laws to further enhance the organisational structure and legal framework of Dubai Smart City, https://www.wam.ae/en/news/emirates/1395288828473.html.

[28] See: http://slc.dubai.gov.ae/en/AboutDepartment/News/Lists/NewsCentre/DispForm.aspx?ID=147&ContentTypeId=0x01001D47EB13C23E544893300E8367A23439 and http://www.smartdubai.ae/dubai_data.php.

[29] Dubai first city to trial ITU key performance indicators for smart sustainable cities, http://www.itu.int/net/pressoffice/press_releases/2015/12.aspx#.VtaYtlt97IU.

[30] Smart Dubai Benchmark Report 2015 Executive Summary, http://smartdubai.ae/bmr2015/methodology-public.php.

[31] Building a Smart + Equitable City, http://www1.nyc.gov/assets/forward/documents/NYC-Smart-Equitable-City-Final.pdf

[32] Building a Smart + Equitable City, http://www1.nyc.gov/site/forward/innovations/smartnyc.page.

[33] One New York: The Plan for a Strong and Just City, http://www1.nyc.gov/html/onenyc/about.html

[34] Open Data for All, http://www1.nyc.gov/assets/home/downloads/pdf/reports/2015/NYC-Open-Data-Plan-2015.pdf.

[35] 7 public projects that are turning New York into a “smart city”, http://www.builtinnyc.com/2015/11/24/7-projects-are-turning-new-york-futuristic-technology-hub.

[36] LinkNYC, https://www.link.nyc/faq.html#privacy.

[7] ANSI Network on Smart and Sustainable Cities, http://www.ansi.org/standards_activities/standards_boards_panels/anssc/overview.aspx?menuid=3

[38] IoT-Enabled Smart City Framework, http://publicaa.ansi.org/sites/apdl/Documents/News%20and%20Publications/Links%20Within%20Stories/IoT-EnabledSmartCityFrameworkWP20160213.pdf.

[39] Smart London (UK) Plan: Digital Technologies, London and Londoners, http://munkschool.utoronto.ca/ipl/files/2015/03/KleinmanM_Smart-London-UK-v5_30AP2015.pdf.

[40] Smart London Plan, http://www.london.gov.uk/sites/default/files/smart_london_plan.pdf.

[41] Smart London Plan, http://www.london.gov.uk/sites/default/files/smart_london_plan.pdf.

[42] Open Data White Paper, https://data.gov.uk/sites/default/files/Open_data_White_Paper.pdf.

[43] London Datastore-Privacy, http://data.london.gov.uk/about/privacy/.

[44] Future Cities Standards Centre in London, https://eu-smartcities.eu/commitment/5937.

[45] Smart London Plan, http://www.london.gov.uk/sites/default/files/smart_london_plan.pdf.

[46] Smart Cities background paper, October 2013, https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/246019/bis-13-1209-smart-cities-background-paper-digital.pdf.

[47] Presentation of 2015 Blueprint of Seoul as ‘State-of-the-art Smart City’, http://english.seoul.go.kr/presentation-of-2015-blueprint-of-seoul-as-%E2%80%98state-of-the-art-smart-city%E2%80%99/.

[48] “Policy Where There is Demand,” Seoul Utilizes Big Data, http://english.seoul.go.kr/policy-demand-seoul-utilizes-big-data/

[49] Seoul’s “Owl Bus” Based on Big Data Technology, http://www.citiesalliance.org/sites/citiesalliance.org/files/Seoul-Owl-Bus-11052014.pdf

[50] Seoul Launches “Global Digital Seoul 2020”, http://english.seoul.go.kr/seoul-launches-global-digital-seoul-2020/

[51] Smart Seoul 2015, http://english.seoul.go.kr/wp-content/uploads/2014/02/SMART_SEOUL_2015_41.pdf

[52] Disclosing public data through the Seoul Open Data Plaza, http://english.seoul.go.kr/policy-information/key-policies/informatization/seoul-open-data-plaza/

[53] Data protection in South Korea: overview, http://uk.practicallaw.com/2-579-7926.

[54]Smart Cities Seoul: a case study, https://www.itu.int/dms_pub/itu-t/oth/23/01/T23010000190001PDFE.pdf

[55] Smart Cities-ISO, http://www.iso.org/iso/livelinkgetfile-isocs?nodeid=16193764.

For more details visit https://cis-india.org/internet-governance/blog/policies-and-standards-overview-of-five-international-smart-cities

Smart Cities in India: An Overview

vanya — 2016-01-11T01:30:07Z

The Government of India is in the process of developing 100 smart cities in India which it sees as the key to the country's economic and social growth. This blog post gives an overview of the Smart Cities project currently underway in India. The smart cities mission in India is at a nascent stage and an evolving area for research. The Centre for Internet and Society will continue work in this area.

Overview of the 100 Smart Cities Mission

The Government of India announced its flagship programme- the 100 Smart Cities mission in the year 2014 and was launched in June 2015 to achieve urban transformation, drive economic growth and improve the quality of life of people by enabling local area development and harnessing technology. Initially, the Mission aims to cover 100 cities across the countries (which have been shortlisted on the basis of a Smart Cities Proposal prepared by every city) and its duration will be five years (FY 2015-16 to FY 2019-20). The Mission may be continued thereafter in the light of an evaluation to be done by the Ministry of Urban Development (MoUD) and incorporation of the learnings into the Mission. The Mission aims to focus on area-based development in the form of redevelopment of existing spaces, or the development of new areas (Greenfield) to accommodate the growing urban population and ensure comprehensive planning to improve quality of life, create employment and enhance incomes for all - especially the poor and the disadvantaged. ^{^[1]} On 27th August 2015 the Centre unveiled 98 smart cities across India which were selected for this Project. Across the selected cities, 13 crore population ( 35% of the urban population will be included in the development plans. ^{^[2]} The mission has been developed for the purpose of achieving urban transformation. The vision is to preserve India's traditional architecture, culture & ethnicity while implementing modern technology to make cities livable, use resources in a sustainable manner and create an inclusive environment. ^{^[3]}

The promises of the Smart City mission include reduction of carbon footprint, adequate water and electricity supply, proper sanitation, including solid waste management, efficient urban mobility and public transport, affordable housing, robust IT connectivity and digitalization, good governance, citizen participation, security of citizens, health and education.

Questions unanswered

Why and How was the Smart Cities project conceptualized in India? What was the need for such a project in India?
What was the role of the public/citizens at the ideation and conceptualization stage of the project?
Which actors from the Government, Private industry and the civil society are involved in this mission? Though the smart cities mission has been initiated by the Government of India under the Ministry of Urban Development, there is no clarity about the involvement of the associated offices and departments of the Ministry.

How are the Smart Cities being selected?

The 100 cities were supposed to be selected on the basis of Smart cities challenge^{^[4]} involving two stages. Stage I of the challenge involved Intra-State city selection on objective criteria to identify cities to compete in stage-II. In August 2015, The Ministry of Urban Development, Government of India announced 100 smart cities ^{^[5]} evaluated on parameters such as service levels, financial and institutional capacity, past track record, called as the 'shortlisted cities' for this purpose. The selected cities are now competing for selection in the Second stage of the challenge, which is an All India competition. For this crucial stage, the potential 100 smart cities are required to prepare a Smart City Proposal (SCP) stating the model chosen (retrofitting, redevelopment, Greenfield development or a mix), along with a Pan-City dimension with Smart Solutions. The proposal must also include suggestions collected by way of consultations held with city residents and other stakeholders, along with the proposal for financing of the smart city plan including the revenue model to attract private participation. The country saw wide participation from the citizens to voice their aspirations and concerns regarding the smart city. 15th December 2015 has been declared as the deadline for submission of the SCP, which must be in consonance with evaluation criteria set by The MoUD, set on the basis of professional advice. ^{^[6]} On the basis of this, 20 cities will be selected for the first year. According to the latest reports, the Centre is planning to fund only 10 cities for the first phase in case the proposals sent by the states do not match the expected quality standards and are unable to submit complete area-development plans by the deadline, i.e. 15th December, 2015. ^{^[7]}

Questions unanswered

Who would be undertaking the task of evaluating and selecting the cities for this project?
What are the criteria for selection of a city to qualify in the first 20 (or 10, depending on the Central Government) for the first phase of implementation?

How are the smart cities going to be Funded?

The Smart City Mission will be operated as a Centrally Sponsored Scheme (CSS) and the Central Government proposes to give financial support to the Mission to the extent of Rs. 48,000 crores over five years i.e. on an average Rs. 100 crore per city per year. ^{^[8]} The additional resources will have to be mobilized by the State/ ULBs from external/internal sources. According to the scheme, once list of shortlisted Smart Cities is finalized, Rs. 2 crore would have been disbursed to each city for proposal preparation.^{^[9]}

According to estimates of the Central Government, around Rs 4 lakh crore of funds will be infused mainly through private investments and loans from multilateral institutions among other sources, which accounts to 80% of the total spending on the mission. ^{^[10]} For this purpose, the Government will approach the World Bank and the Asian Development Bank (ADB) for a loan costing £500 million and £1 billion each for 2015-20. If ADB approves the loan, it would be it will be the bank's highest funding to India's urban sector so far.^{^[11]} Foreign Direct Investment regulations have been relaxed to invite foreign capital and help into the Smart City Mission. ^{^[12]}

Questions unanswered

The Government notes on Financing of the project mentions PPPs for private funding and leveraging of resources from internal and external resources. There is lack of clarity on the external resources the Government has/will approach and the varied PPP agreements the Government is or is planning to enter into for the purpose of private investment in the smart cities.

How is the scheme being implemented?

Under this scheme, each city is required to establish a Special Purpose Vehicle (SPV) having flexibility regarding planning, implementation, management and operations. The body will be headed by a full-time CEO, with nominees of Central Government, State Government and ULB on its Board. The SPV will be a limited company incorporated under the Companies Act, 2013 at the city-level, in which the State/UT and the Urban Local Body (ULB) will be the promoters having equity shareholding in the ratio 50:50. The private sector or financial institutions could be considered for taking equity stake in the SPV, provided the shareholding pattern of 50:50 of the State/UT and the ULB is maintained and the State/UT and the ULB together have majority shareholding and control of the SPV. Funds provided by the Government of India in the Smart Cities Mission to the SPV will be in the form of tied grant and kept in a separate Grant Fund.^{^[13]}

For the purpose of implementation and monitoring of the projects, the MoUD has also established an Apex Committee and National Mission Directorate for National Level Monitoring^{^[14]}, a State Level High Powered Steering Committee (HPSC) for State Level Monitoring^{^[15]} and a Smart City Advisory Forum at the City Level ^{^[16]}.

Also, several consulting firms^{^[17]} have been assigned to the 100 cities to help them prepare action plans.^{^[18]} Some of them include CRISIL, KPMG, McKinsey, etc. ^{^[19]}

Questions unanswered

What policies and regulations have been put in place to account for the smart cities, apart from policies looking at issues of security, privacy, etc.?
What international/national standards will be adopted while development of the smart cities? Though the Bureau of Indian Standards is in the process of formulating standardized guidelines for the smart cities in India^{^[20]}, yet there is lack of clarity on adoption of these national standards, along with the role of international standards like the ones formulated by ISO.

What is the role of Foreign Governments and bodies in the Smart cities mission?

Ever since the government's ambitious project has been announced and cities have been shortlisted, many countries across the globe have shown keen interest to help specific shortlisted cities in building the smart cities and are willing to invest financially. Countries like Sweden, Malaysia, UAE, USA, etc. have agreed to partner with India for the mission.^{^[21]} For example, UK has partnered with the Government to develop three India cities-Pune, Amravati and Indore.^{^[22]} Israel's start-up city Tel Aviv also entered into an agreement to help with urban transformation in the Indian cities of Pune, Nagpur and Nashik to foster innovation and share its technical know-how.^{^[23]} France has piqued interest for Nagpur and Puducherry, while the United States is interested in Ajmer, Vizag and Allahabad. Also, Spain's Barcelona Regional Agency has expressed interest in exchanging technology with the Delhi. Apart from foreign government, many organizations and multilateral agencies are also keen to partner with the Indian government and have offered financial assistance by way of loans. Some of them include the UK government-owned Department for International Development, German government KfW development bank, Japan International Cooperation Agency, the US Trade and Development Agency, United Nations Industrial Development Organization and United Nations Human Settlements Programme. ^{^[24]}

Questions unanswered

Do these governments or organization have influence on any other component of the Smart cities?
How much are the foreign governments and multilateral bodies spending on the respective cities?
What kind of technical know-how is being shared with the Indian government and cities?

What is the way ahead?

On the basis of the SCP, the MoUD will evaluate, assess the credibility and select 20 smart cities out of the short-listed ones for execution of the plan in the first phase. The selected city will set up a SPV and receive funding from the Government.

Questions unanswered

Will the deadline of submission of the Smart Cities Proposal be pushed back?
After the SCP is submitted on the basis of consultation with the citizens and public, will they be further involved in the implementation of the project and what will be their role?
How will the MoUD and other associated organizations as well as actors consider the implementation realities of the project, like consideration of land displacement, rehabilitation of the slum people, etc.
How are ICT based systems going to be utilized to make the cities and the infrastructure "smart"?
How is the MoUD going to respond to the concerns and criticism emerging from various sections of the society, as being reflected in the news items?
How will the smart cities impact and integrate the existing laws, regulations and policies? Does the Government intend to use the existing legislations in entirety, or update and amend the laws for implementation of the Smart Cities Mission?

^{^[1]} Smart Cities, Mission Statement and Guidelines, Ministry of Urban Development, Government of India, June 2015, Available at : http://smartcities.gov.in/writereaddata/SmartCityGuidelines.pdf

^{^[2]} http://articles.economictimes.indiatimes.com/2015-08-27/news/65929187_1_jammu-and-kashmir-12-cities-urban-development-venkaiah-naidu

^{^[3]} http://india.gov.in/spotlight/smart-cities-mission-step-towards-smart-india

^{^[4]} http://smartcities.gov.in/writereaddata/Process%20of%20Selection.pdf

^{^[5]} Full list : http://www.scribd.com/doc/276467963/Smart-Cities-Full-List

^{^[6]} http://smartcities.gov.in/writereaddata/Process%20of%20Selection.pdf

^{^[7]} http://www.ibtimes.co.in/modi-govt-select-only-10-cities-under-smart-city-project-this-year-report-658888

^{^[8]} http://smartcities.gov.in/writereaddata/Financing%20of%20Smart%20Cities.pdf

^{^[9]} Smart Cities presentation by MoUD : http://smartcities.gov.in/writereaddata/Presentation%20on%20Smart%20Cities%20Mission.pdf

^{^[10]} http://indianexpress.com/article/india/india-others/smart-cities-projectfrom-france-to-us-a-rush-to-offer-assistance-funds/

^{^[11]} http://indianexpress.com/article/india/india-others/funding-for-smart-cities-key-to-coffer-lies-outside-india/#sthash.5lnW9Jsq.dpuf

^{^[12]} http://india.gov.in/spotlight/smart-cities-mission-step-towards-smart-india

^{^[13]} http://smartcities.gov.in/writereaddata/SPVs.pdf

^{^[14]} http://smartcities.gov.in/writereaddata/National%20Level%20Monitoring.pdf

^{^[15]} http://smartcities.gov.in/writereaddata/State%20Level%20Monitoring.pdf

^{^[16]} http://smartcities.gov.in/writereaddata/City%20Level%20Monitoring.pdf

^{^[17]} http://smartcities.gov.in/writereaddata/List_of_Consulting_Firms.pdf

^{^[18]} http://pib.nic.in/newsite/PrintRelease.aspx?relid=128457

^{^[19]} http://economictimes.indiatimes.com/articleshow/49242050.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

^{^[20]} http://www.business-standard.com/article/economy-policy/in-a-first-bis-to-come-up-with-standards-for-smart-cities-115060400931_1.html

^{^[21]} http://accommodationtimes.com/foreign-countries-have-keen-interest-in-development-of-smart-cities/

^{^[22]} http://articles.economictimes.indiatimes.com/2015-11-20/news/68440402_1_uk-trade-three-smart-cities-british-deputy-high-commissioner

^{^[23]} http://www.jpost.com/Business-and-Innovation/Tech/Tel-Aviv-to-help-India-build-smart-cities-435161?utm_campaign=shareaholic&utm_medium=twitter&utm_source=socialnetwork

^{^[24]} http://indianexpress.com/article/india/india-others/smart-cities-projectfrom-france-to-us-a-rush-to-offer-assistance-funds/#sthash.nCMxEKkc.dpuf

For more details visit https://cis-india.org/internet-governance/blog/smart-cities-in-india-an-overview

Sixth Meeting of the two Sub-Groups on Privacy Issues under the Chairmanship of Justice AP Shah

praskrishna — 2012-08-23T09:48:55Z

The sixth meeting of the two sub-groups on privacy issues will be held on August 31, 2012 at 10.00 a.m. in Committee Room No. 228, Yojana Bhawan, Sansad Marg, New Delhi under the chairmanship of Justice AP Shah, former chief justice of Delhi High Court.

No. M-13040/43/2012-CIT&I (Pt. File)
Government of India
Planning Commission
(CIT&I Division)

Yojana Bhawan, Sansad Marg,
New Delhi, dated the 23rd August, 2012

Meeting Notice

Subject: Meeting of the Group of Experts on Privacy Issues to be held on 31st August, 2012 under the Chairmanship of Justice A.P. Shah, former Chief Justice of Delhi High Court.

The meeting of the Group of Experts on Privacy Issues under the Chairmanship of Justice A.P. Shah, former Chief Justice of Delhi High Court is scheduled to be held on 31st August, 2012, at 10.00 AM in the Committee Room No. 228, Yojana Bhawan, Sansad Marg, New Delhi - 110001.

The agenda of the meeting is to discuss and finalize the draft report prepared on the basis of the recommendations of the two Sub-Groups of the Expert Group (Copy enclosed).

You are requested to kindly make it convenient to attend the meeting.

(S. Bose)
Deputy Secretary (CIT&I)

Through e-mail to:

Justice A.P. Shah, Chairman
Shri R. S. Sharma, D.G., UIDAI
Dr. Gulshan Rai, D.G. CERT-In, DeITy
Shri Manoj Joshi, J.S. DOPT
Shri R. Ragupathi,Additional Secretary, Department of Legal Affairs
Shri Som Mittal, Nasscom
Ms. Barkha Dutt, NDTV
Ms. Usha Ramanathan
Shri Sunil Abraham, CIS
Dr. Kamlesh Bajaj
Ms. Mala Dutt
Shri R.K. Gupta

Copy for information to:
Dr. C.M. Kumar, Sr. Adviser (CIT&I)
PS to MOS (Planning, S&T and Earth Sciences)

(S. Bose)
Deputy Secretary (CIT&I)

For more details visit https://cis-india.org/news/sixth-meeting-of-sub-groups-on-privacy-issues

Sixth Annual Meeting of the Internet Governance Forum, Nairobi: A Summary

praskrishna — 2011-10-24T09:09:14Z

The sixth annual meeting of the Internet Governance Forum was held from 27 to 30 September 2011 at the United Nations Office in Nairobi, Kenya. Sunil Abraham participated in six workshops: Privacy, Security, and Access to Rights: A Technical and Policy Analyses, Use of Digital Technologies for Civic Engagement and Political Change: Lessons Learned and Way Forward, The Impact of Regulation: FOSS and Enterprise, Proprietary Influences in Free and Open Source Software: Lessons to Open and Universal Internet Standards, Access and Diversity of Broadband Internet Access and Putting Users First: How Can Privacy be Protected in Today’s Complex Mobile Ecosystem?

Privacy, Security, and Access to Rights: A Technical and Policy Analyses

Workshop No. 219
The workshop was moderated by Kim Pham, Expression Technologies, Civil Society (United States). The panel members included Carlos Affonso Pereira de Souza, Centro de Technologica e Socieda (Brazil), Christopher Soghoian, Indiana University (United States), Karen Reilly, Tor Project, Technical/Civil Society (United States) and Sunil Abraham, Centre for Internet and Society (India).
See the workshop details here

Use of Digital Technologies for Civic Engagement and Political Change: Lessons Learned and Way Forward

Workshop No. 184
The workshop was moderated by Katim S Touray Council Vice Chair, Free Software and Open Source Foundation for Africa and Member, ICANN Board of Directors. Fouad Bajwa of Gerry Morgan Foundation (Pakistan) was the remote moderator. Nnenna Nwakanma of Nnenna.org, Simeon Oriko of @TheKuyuProject &@StorySpaces, Wael Khalil, Activist and Sunil Abraham of the Centre for Internet & Society were the panel members. Nishant Shah from the Centre for Internet & Society participated remotely from Bangalore.
See the workshop details here
See the entire transcription here

The Impact of Regulation: FOSS and Enterprise

Workshop No. 211
The workshop was moderated by Dorothy Gordon, Director General, AITI-KACE, Judy Okite was the remote moderator. The panel members were Satish Babu, ICFOSS, India, Yves Miezan Ezo, Smile Training, Manager, (France), Sunil Abraham, Executive Director, Centre for Internet & Society, Bangalore, Evans Ikua, FOSS Certification Manager, ict@innovation program.
See the workshop details here
See the entire transcription here

Proprietary Influences in Free and Open Source Software: Lessons to Open and Universal Internet Standards

Workshop No. 201
The workshop was moderated by Alejandro Pisanty, Director General for Academic Computing Services of the National University of Mexico (UNAM), Mexico. Tracy Hackshaw, Computer Society of Trinadad and Tobago, Trinadad and Tobago, Venkatesh Hariharan, Head of Public Policy and Government Affairs at Google, India and Scott O Bradner, University Technology Security Officer, Harvard University, USA were the panel members.
See the workshop details here
See the entire transcription here

Access and Diversity of Broadband Internet Access

Workshop No. 113
The workshop was moderated by N Ravi Shanker, Addl Secy, Department of Information Technology, Ministry of Information Technology, Government of India (Chair). Abhishek Singh, Director, Department of Information Technology, Ministry of Information Technology, Government of India, Venkatesh Hariharan, Head of Public Policy and Government Relations, Google India and Sunil Abraham, Executive Director, The Centre for Internet and Society, India were the panel members.
See the workshop details here
See the entire transcription here

Putting users First: How can Privacy be Protected in Today’s Complex Mobile Ecosystem?

Workshop No. 75
This workshop was moderated by Ambassador David Gross, Partner, Wiley Rein LLP, Yiannis Theodorou, Regulatory Policy Manager, GSMA was the remote moderator. The panel members included Pat Walshe, Director of Privacy-GSMA), Jeff Brueggeman (Vice President-Publiy Policy AT&T), Patrick Ryan, Policy Counsel, Open Internet for Google Inc, Ms Juliana Rotich, Executive Director of Ushahidi Inc, Sunil Abraham, Executive Director, The Centre for Internet and Society (India) and Ian Brown, co-director of Oxford University's Information Security and Privacy Programme.
See the workshop details here
See the entire transcription here

For more details visit https://cis-india.org/internet-governance/blog/sixth-annual-meeting-igf

Siri, did you hear me? Adapting Privacy to New Technologies, Automated Decision-making, and Cloud Computing

Admin — 2018-03-25T03:21:24Z

Amber Sinha participated as a panelist in the discussion on adapting privacy to new technologies organised by the USIBC on March 6, 2018 in New Delhi.

The way consumers interact with technology is quickly evolving, and there are distinct implications for privacy as these new applications and products become embedded in our daily lives. Many new technologies eliminate the need for consumers to interface with a screen, relying on sensor data, verbal interactions, or innate human communications – a grin or hand gesture. As technology evolves, so must the privacy protections.

Moderator: Ashutosh Chadha, Group Director, government Affairs & Public policy, Microsoft India

Panelists:

Shaundra Watson, Director, Policy, BSA | The Software Alliance
Betsy Broder, Counsel for International Consumer Protection, U.S. FTC
Amber Sinha, Senior Programme Manager, Centre for Internet and Society (CIS)
Riccardo Masucci, Global Director of Privacy Policy, Intel
Srinivas Poosarla, Vice President & Head (Global), Privacy & Data Protection, Infosys Limited

For more details visit https://cis-india.org/internet-governance/news/siri-did-you-hear-me-adapting-privacy-to-new-technologies-automated-decision-making-and-cloud-computing

Silence on the Dera Front

Sat Singh — 2017-12-20T15:58:44Z

Strap: How DSS followers, accused of violent protests after their leader was sentenced, manage without the internet.

Sirsa, Haryana: Raj Rani’s two expensive smartphones are her whole world. But the 32-year-old entrepreneur from Haryana’s Hisar district found them entirely useless when she needed them most – on August 25, during the violent protests by members of the spiritual group Dera Sacha Sauda (DSS) after their leader Gurmeet Ram Rahim was convicted of rape.

“My family follows DSS, and had gone to attend the monthly congregation on August 15 (which also happened to be Ram Rahim’s birthday), when were told that ‘Pitaji’ asked us to stay back in the premises, in case of an adverse verdict by the court in rape cases against him,” she says. This is understood to have been done as a show of support that could put pressure on the judiciary and state for a favourable verdict.

Along with lakhs of other followers, Rani was present in Dera’s Sirsa headquarters with her two children. She stayed in constant touch with her husband Sunny Kumar, a businessman based in New Delhi. "Every day, I showed him the Dera premises and religious activities through WhatsApp video calls,” she says.

She recalls “the nightmarish moment” on the night of August 24 when the Haryana police and the Indian army surrounded the Dera. They imposed a curfew in the town, and restricted people from coming in and going outside the premises spread over 700 acres.

Rani says that the government blocked the internet on August 24 – a day before the self-styled godman appeared in the Panchkula court. Service providers of different companies, including mobile phone and landline services, were also barred at the Dera Sacha Sauda headquarters. As a result, Rani lost all contact with her husband. “I was confident until I was connected with my family over WhatsApp call and video chat, but as soon as this went away, I started losing faith, and felt afraid,” she says.

After the curfew was imposed and internet was shut down, Rani says the devotees started to panic. They demanded that the DSS management permit them to go to their respective homes after Gurmeet’s arrest on August 25. After his conviction for rape, Rani says the politically influential and funds-flushed DSS fell like a house of cards. “There was chaos all around,” she says.

Fearing that Dera followers would vandalise public property to protest their leader’s conviction, the police had restricted public transport. Private vehicles were being allowed to move only after multiple security checks. On the morning of August 27, hundreds of devotees started to leave the Dera premises by foot. Rani walked about 50 kms along the national highway 10 (Hisar-Sirsa) up to Fatehabad district.

It was a coordination committee of police, legislators, and bureaucrats from Haryana, Punjab and Chandigarh, under the chairmanship of Punjab governor and union territory administrator VP Singh Badnore, that took the decision to ban the internet. After the order on August 24, all the SMSes, dongle, and data services provided on mobile network were suspended. The government only allowed phone calls during the internet shutdown in affected districts in these states.

Dissing the police’s claims that Dera followers started the violence first, provoking the cops to fire, 32-year-old shopkeeper Gaurav Soni, an ardent DSS follower for seven years, insists that things went out of control because the internet connection was snapped. He says that senior members in the Dera’s internal WhatsApp groups couldn’t send messages to calm angry followers. “Whatever happened was a result of a communication gap,” says Soni, who joined the protests. “No one asked the followers to get violent, and followers never attempt such things without proper instructions. But since there was a leadership gap, thanks to the break in communication, all this occurred.”

Vikas Kumar, an IT expert of the Dera Sacha Sauda agrees, "As soon as we came to know about the conviction, we tried to send a message from Dera chairperson Vipasana Insan, requesting followers to maintain peace, and keep faith in the judicial process. But we couldn’t upload this message because mobile internet and broadband services were banned." They also tried to call key Dera leaders. “But it was too late by then, and followers clashed with law enforcement agencies," Vikas adds.

The Dera’s protests, and the related internet and transport shutdown seemed to have impacted the group’s own followers too.

Those outside Haryana received misleading or panic-inducing forwards and videos, worrying them, but also worsening the anger against the state administration. Rajat Singh, a 65-year-old Dera follower from Mansa district, Punjab, says his son Rishipal Singh, had gone with several followers to the court in Panchkula, Haryana, where Gurmeet’s case was being heard. Rajat Singh says that since the internet was not banned at Punjab’s Mansa, he continuously received photographs of bullet-ridden bodies, charred cars, massive fires, and vandalism on WhatsApp. It’s unclear how Dera members from Haryana were able to send these pictures, overriding the blocked internet. “I was so disturbed,” he says. “As soon as we came to know that the Haryana police had opened fire on the followers, I started calling my son,” he says. But phone networks were constantly busy or spotty. “My son’s phone was not reachable. I asked relatives to send him text messages, or messages on WhatsApp, but the internet was not working.” It was much later, when Rishipal made a rushed call, that they were assured of his well-being.

Unaware of the violence at the Dera, 37-year-old Rakesh Kumar, a DSS follower from Ghaziabad, Uttar Pradesh, was visiting Sirsa on August 24. “I booked a hotel in Sirsa district through an app, and chose to pay at the hotel. When I reached Sirsa, the internet was off.” Kumar went to the Dera taking lifts from a few vehicles plying on the sly, but soon returned to his hotel after followers went on a rampage. He wanted to leave Sirsa, but “got stuck” because the hotel didn’t allow him to leave without paying. ATMs were closed, vandalised, or not working, and it was generally unsafe to go out. “I had some balance on PayTM, but that was also not working as there was no internet connection,” he says.

Without Facebook or Twitter accounts, the Sirsa police had no way to counter rumours, discourage violence, or call for peace, says additional deputy commissioner (ADC) Sirsa, Munish Nagpal. A ban, he says, was the only way for them to nip crowd mobilisation in the bud, and curb rumours from spreading to Dera followers in other states of north India.

“The ban controlled the situation to a certain extent, but it handicapped us, and slowed the process of our communication with seniors in Chandigarh,” admitted Ashwin Shenvi, the superintendent of police (SP).

The Haryana police, chief minister and health minister are usually active on social media, and the government too prides itself on being digitally savvy, but during the ban, every account was inactive. This despite the state offices having broadband.

It is worth pointing out that DSS is credited for the Bharatiya Janata Party’s first ever win in Haryana in the 2014 state elections. Gurmeet Ram Rahim and CM Manohar Lal Khattar have even shared stages multiple times for photo-ops. Many believe this to be the reason behind the state government not being very vocal, online or offline, in condemning the violence by Gurmeet’s followers. It could have ticked off DSS’s over 50 million followers, a large votebank. The political dynamics, hence, were also responsible for internet becoming a victim of the violence unleashed.

Sat Singh is a Rohtak-based journalist and a member of 101Reporters.com, a pan-India network of grassroots reporters.

Shutdown stories are the output of a collaboration between 101 Reporters and CIS with support from Facebook.

For more details visit https://cis-india.org/internet-governance/blog/silence-on-the-dera-front

Shreya Singhal and 66A

sunil — 2015-04-19T08:09:42Z

Most software code has dependencies. Simple and reproducible methods exist for mapping and understanding the impact of these dependencies. Legal code also has dependencies --across court orders and within a single court order. And since court orders are not produced using a structured mark-up language, experts are required to understand the precedential value of a court order.

The article was published in the Economic and Political Weekly Vol-L No.15. Vidushi Marda, programme officer at the Centre for Internet and Society, was responsible for all the research that went into this article. PDF version here.

As a non–lawyer and engineer, I cannot authoritatively comment on the Supreme Court’s order in Shreya Singhal vs Union of India (2015) on sections of the Information Technology Act of 2000, so I have tried to summarise a variety of views of experts in this article. The Shreya Singhal order is said to be unprecedented at least for the last four decades and also precedent setting as its lucidity, some believe, will cause a ripple effect in opposition to a restrictive understanding of freedom of speech and expression, and an expansiveness around reasonable restrictions. Let us examine each of the three sections that the bench dealt with.

The Section in Question

Section 66A of the IT Act was introduced in a hastily-passed amendment. Unfortunately, the language used in this section was a pastiche of outdated foreign laws such as the UK Communications Act of 2003, Malicious Communications Act of 1988 and the US Telecommunications Act, 1996.¹ Since the amendment, this section has been misused to make public examples out of innocent, yet uncomfortable speech, in order to socially engineer all Indian netizens into self-censorship.²

Summary: The Court struck down Section 66A of the IT Act in its entirety holding that it was not saved by Article 19(2) of the Constitution on account of the expressions used in the section, such as "annoying," "grossly offensive," "menacing,", "causing annoyance." The Court justified this by going through the reasonable restrictions that it considered relevant to the arguments and testing them against S66A. Apart from not falling within any of the categories for which speech may be restricted, S66A was struck down on the grounds of vagueness, over-breadth and chilling effect. The Court considered whether some parts of the section could be saved, and then concluded that no part of S66A was severable and declared the entire section unconstitutional. When it comes to regulating speech in the interest of public order, the Court distinguished between discussion, advocacy and incitement. It considered the first two to fall under the freedom of speech and expression granted under Article 19(1)(a), and held that it was only incitement that attracted Article 19(2).

Between Speech and Harm

Gautam Bhatia, a constitutional law expert, has an optimistic reading of the judgment that will have value for precipitating the ripple effect. According to him, there were two incompatible strands of jurisprudence which have been harmonised by collapsing tendency into imminence.³ The first strand, exemplified by Ramjilal Modi vs State of UP⁴ and Kedar Nath Singh vs State of Bihar,⁵ imported an older and weaker American standard, that is, the tendency test, between the speech and public order consequences. The second strand exemplified byRam Manohar Lohia vs State of UP,⁶ S Rangarajan vs P Jagjivan Ram,⁷ andArup Bhuyan vs Union of India,⁸ all require greater proximity between the speech and the disorder anticipated. In Shreya Singhal, the Supreme Court held that at the stage of incitement, the reasonable restrictions will step in to curb speech that has a tendency to cause disorder. Other experts are of the opinion that Justice Nariman was doing no such thing, and was only sequentially applying all the tests for free speech that have been developed within both these strands of precedent. In legal activist Lawrence Liang's analysis, "Ramjilal Modi was decided by a seven judge bench and Kedarnath by a constitutional bench. As is often the case in India, when subsequent benches of a lower strength want to distinguish themselves from older precedent but are unable to overrule them, they overcome this constraint through a doctrinal development by stealth. This is achieved by creative interpretations that chip away at archaic doctrinal standards without explicitly discarding them."⁹

Compatibility with US Jurisprudence

United States (US) jurisprudence has been imported by the Indian Supreme Court in an inconsistent manner. Some judgments hold that the American first amendment harbours no exception and hence is incompatible with Indian jurisprudence, while other judgments have used American precedent when convenient. Indian courts have on occasion imported an additional restriction beyond the eight available in 19(2)-the ground of public interest, best exemplified by the cases of K A Abbas¹⁰ and Ranjit Udeshi.¹¹ The bench in its judgment-which has been characterised by Pranesh Prakash as a masterclass in free speech jurisprudence¹²-clarifies that while the American first amendment jurisprudence is applicable in India, the only area where a difference is made is in the "sub serving of general public interest" made under the US law. This eloquent judgment will hopefully instruct judges in the future on how they should import precedent from American free speech jurisprudence.

Article 14 Challenge

The Article 14 challenge brought forward by the petitioners contended that Section 66A violated their fundamental right to equality because it differentiated between offline and online speech in terms of the length of maximum sentence, and was hence unconstitutional. The Court held that an intelligible differentia, indeed, did exist. It found so on two grounds. First, the internet offered people a medium through which they can express views at negligible or no cost. Second, the Court likened the rate of dissemination of information on the internet to the speed of lightning and could potentially reach millions of people all over the world. Before Shreya Singhal, the Supreme Court had already accepted medium-specific regulation. For example in K A Abbas, the Court made a distinction between films and other media, stating that the impact of films on an average illiterate Indian viewer was more profound than other forms of communication. The pessimistic reading of Shreya Singhal is that Parliament can enact medium-specific law as long as there is an intelligible differentia which could even be a technical difference-speed of transmission. However, the optimistic interpretation is that medium-specific law can only be enacted if there are medium-specific harms, e g, phishing, which has no offline equivalent. If the executive adopts the pessimistic reading, then draconian sections like 66A will find their way back into the IT Act. Instead, if they choose the optimistic reading, they will introduce bills that fill the regulatory vacuum that has been created by the striking down of S66A, that is, spam and cyberbullying.

Section 79

Section 79 was partially read down. This section, again introduced during the 2008 amendment, was supposed to give legal immunity to intermediaries for third party content by giving a quick redressal for those affected by providing a mechanism for takedown notices in the Intermediaries Guidelines Rules notified in April 2011. But the section and rules had enabled unchecked invisible censorship¹³ in India and has had a demonstrated chilling effect on speech¹⁴ because of the following reasons:

One, there are additional unconstitutional restrictions on speech and expression. Rule 3(2) required a standard "rules and regulation, terms and condition or user agreement" that would have to be incorporated by all intermediaries. Under these rules, users are prohibited from hosting, displaying, uploading, modifying, publishing, transmitting, updating or sharing any information that falls into different content categories, a majority of which are restrictions on speech which are completely out of the scope of Article 19(2). For example, there is an overly broad category which contains information that harms minors in any way. Information that "belongs to another person and to which the user does not have any right to" could be personal information or could be intellectual property. A much better intermediary liability provision was introduced into the Copyright Act with the 2013 amendment. Under the Copyright Act, content could be reinstated if the takedown notice was not followed up with a court order within 21 days.¹⁵ A counter-proposal drafted by the Centre for Internet and Society for "Intermediary Due Diligence and Information Removal," has a further requirement for reinstatement that is not seen in the Copyright Act.¹⁶

Two, a state-mandated private censorship regime is created. You could ban speech online without approaching the court or the government. Risk-aversive private intermediaries who do not have the legal resources to subjectively determine the legitimacy of a legal claim err on the side of caution and takedown content.

Three, the principles of natural justice are not observed by the rules of the new censorship regime. The creator of information is not required to be notified nor given a chance to be heard by the intermediary. There is no requirement for the intermediary to give a reasoned decision.

Four, different classes of intermediaries are all treated alike. Since the internet is not an uniform assemblage of homogeneous components, but rather a complex ecosystem of diverse entities, the different classes of intermediaries perform different functions and therefore contribute differently to the causal chain of harm to the affected person. If upstream intermediaries like registrars for domain names are treated exactly like a web-hosting service or social media service then there will be over-blocking of content.

Five, there are no safeguards to prevent abuse of takedown notices. Frivolous complaints could be used to suppress legitimate expressions without any fear of repercussions and given that it is not possible to expedite reinstatement of content, the harm to the creator of information may be irreversible if the information is perishable. Transparency requirements with sufficient amounts of detail are also necessary given that a human right was being circumscribed. There is no procedure to have the removed information reinstated by filing a counter notice or by appealing to a higher authority.

The judgment has solved half the problem by only making intermediaries lose immunity if they ignore government orders or court orders. Private takedown notices sent directly to the intermediary without accompanying government orders or courts order no longer have basis in law. The bench made note of the Additional Solicitor General's argument that user agreement requirements as in Rule 3(2) were common practice across the globe and then went ahead to read down Rule 3(4) from the perspective of private takedown notices. One way of reading this would be to say that the requirement for standardised "rules and regulation, terms and condition or user agreement" remains. The other more consistent way of reading this part of the order in conjunction with the striking down of 66A would be to say those parts of the user agreement that are in violation of Article 19(2) have also been read down.

This would have also been an excellent opportunity to raise the transparency requirements both for the State and for intermediaries: for (i) the person whose speech is being censored, (ii) the persons interested in consuming that speech, and (iii) the general public. It is completely unclear whether transparency in the case of India has reduced the state appetite for censorship. Transparency reports from Facebook, Google and Twitter claim that takedown notices from the Indian government are on the rise.¹⁷ However, on the other hand, the Department of Electronics and Information Technology (DEITY) claims that government statistics for takedowns do not match the numbers in these transparency reports.¹⁸ The best way to address this uncertainty would be to require each takedown notice and court order to be made available by the State, intermediary and also third-party monitors of free speech like the Chilling Effects Project.

Section 69A

The Court upheld S69A which deals with website blocking, and found that it was a narrowly-drawn provision with adequate safeguards, and, hence, not constitutionally infirm. In reality, unfortunately, website blocking usually by internet service providers (ISPs) is an opaque process in India. Blocking under S69A has been growing steadily over the years. In its latest response to an RTI (right to information)¹⁹ query from the Software Freedom Law Centre, DEITY said that 708 URLs were blocked in 2012, 1,349 URLs in 2013, and 2,341 URLs in 2014. On 30 December 2014 alone, the centre blocked 32 websites to curb Islamic State of Iraq and Syria propaganda, among which were "pastebin" websites, code repository (Github) and generic video hosting sites (Vimeo and Daily Motion).²⁰ Analysis of leaked block lists and lists received as responses to RTI requests have revealed that the block orders are full of errors (some items do not exist, some items are not technically valid web addresses), in some cases counter speech which hopes to reverse the harm of illegal speech has also been included, web pages from mainstream media houses have also been blocked and some URLs are base URLs which would result in thousands of pages getting blocked when only a few pages might contain allegedly illegal content.²¹

Pre-decisional Hearing

The central problem with the law as it stands today is that it allows for the originator of information to be isolated from the process of censorship. The Website Blocking Rules provide that all "reasonable efforts" must be made to identify the originator or the intermediary who hosted the content. However, Gautam Bhatia offers an optimistic reading of the judgment, he claims that the Court has read into this "or" and made it an "and"-thus requiring that the originator must also be notified of blocks when he or she can be identified.²²

Transparency

Usually, the reasons for blocking a website are unknown both to the originator of material as well as those trying to access the blocked URL. The general public also get no information about the nature and scale of censorship unlike offline censorship where the court orders banning books and movies are usually part of public discourse. In spite of the Court choosing to leave Section 69A intact, it stressed the importance of a written order for blocking, so that a writ may be filed before a high court under Article 226 of the Constitution. While citing this as an existing safeguard, the Court seems to have been under the impression that either the intermediary or the originator is normally informed, but according to Apar Gupta, a lawyer for the People's Union for Civil Liberties, "While the rules indicate that a hearing is given to the originator of the content, this safeguard is not evidenced in practice. Not even a single instance exists on record for such a hearing."²³ Even worse, block orders have been unevenly implemented by ISPs with variations across telecom circles, connectivity technologies, making it impossible for anyone to independently monitor and reach a conclusion whether an internet resource is inaccessible as a result of a S69A block order or due to a network anomaly.

Rule 16 under S69A requires confidentiality with respect to blocking requests and complaints, and actions taken in that regard. The Court notes that this was argued to be unconstitutional, but does not state their opinion on this question. Gautam Bhatia holds the opinion that this, by implication, requires that requests cannot be confidential. Chinmayi Arun, from the Centre for Communication Governance at National Law University Delhi, one of the academics supporting the petitioners, holds the opinion that it is optimism carried too far to claim that the Court noted the challenge to Rule 16 but just forgot about it in a lack of attention to detail that is belied by the rest of the judgment.

Free speech researchers and advocates have thus far used the RTI Act to understand the censorship under S69A. The Centre for Internet and Society has filed a number of RTI queries about websites blocked under S69A and has never been denied information on grounds of Rule 16.²⁴ However, there has been an uneven treatment of RTI queries by DEITY in this respect, with the Software Freedom Law Centre²⁵ being denied blocking orders on the basis of Rule 16. The Court could have protected free speech and expression by reading down Rule 16 except for a really narrow set of exceptions wherein only aggregate information would be made available to affected parties and members of the public.

Conclusions

In Shreya Singhal, the Court gave us great news: S66A has been struck down; good news: S79(3) and its rules have been read down; and bad news: S69A has been upheld. When it comes to each section, the impact of this judgment can either be read optimistically or pessimistically, and therefore we must wait for constitutional experts to weigh in on the ripple effect that this order will produce in other areas of free speech jurisprudence in India. But even as free speech activists celebrate Shreya Singhal, some are bemoaning the judgment as throwing the baby away with the bathwater, and wish to reintroduce another variant of S66A. Thus, we must remain vigilant.

Notes

1 G S Mudur (2012): "66A 'Cut and Paste Job,'" The Telegraph, 3 December, visited on 3 April, 2015, http://www.telegraphindia.com/1121 203/jsp/frontpage/story_16268138.jsp

2 Sunil Abraham (2012): "The Five Monkeys and Ice Cold Water," Centre for Internet and Society, 26 September, visited on 3 April 2015, http://cis-india.org/internet-governance/www-deccan-chronicle-sep-16-201...

3 Gautam Bhatia (2015): "The Striking Down of 66A: How Free Speech Jurisprudence in India Found Its Soul Again," Indian Constitutional Law and Philosophy, 26 March, visited on 4 April 2015, https://indconlawphil.wordpress.com/2015/03/26/the-striking-down-of-sect...

4 Ramjilal Modi vs State of UP, 1957, SCR 860.

5 Kedar Nath Singh vs State of Bihar, 1962, AIR 955.

6 Ram Manohar Lohia vs State of UP, AIR, 1968 All 100.

7 S Rangarajan vs P Jagjivan Ram, 1989, SCC(2), 574.

8 Arup Bhuyan vs Union of India, (2011), 3 SCC 377.

9 Lawrence Liang, Alternative Law Forum, personal communication to author, 6 April 2015.

10 K A Abbas vs Union of India, 1971 SCR (2), 446.

11 Ranjit Udeshi vs State of Maharashtra,1965 SCR (1) 65.

12 Pranesh Prakash (2015): "Three Reasons Why 66A Verdict Is Momentous"/ Times of India/(29 March). Visited on 6 April 2015, http://timesofindia.indiatimes.com/home/sunday-times/all-that-matters/Th...

13 Pranesh Prakash (2011): "Invisble Censorship: How the Government Censors Without Being Seen," The Centre for Internet and Society, 14 December, visited on 6 April 2015, http://cis-india.org/internet-governance/blog/invisible-censorship

14 Rishabh Dara (2012): "Intermediary Liability in India: Chilling Effects on Free Expression on the Internet," The Centre for Internet and Society, 27 April, visited on 6 April 2015, http://cis-india.org/internet-governance/chilling-effects-on-free-expres... .

15 Rule 75, Copyright Rules, 2013.

16 The Draft Counter Proposal is available at http://cis-india.org/internet-governance/counter-proposal-by-cis-draft-i...

17 According to Facebook's transparency report, there were 4,599 requests in the first half of 2014, followed by 5,473 requests in the latter half. Available at https://govtrequests.facebook. com/country/India/2014-H2/ also see Google's transparency report available at http: //www.google. com/transparencyreport/removals/government/IN/?hl=en and Twitter's report, available at https:// transparency.twitter.com/country/in

18 Surabhi Agarwal (2015): "Transparency Reports of Internet Companies are Skewed: Gulashan Rai," Business Standard, 31 March, viewed on 5 April 2015, http://www.business-standard.com/article/current-affairs/transparency-re... .

19 http://sflc.in/deity-says-2341-urls-were-blocked-in-2014-refuses-to-reve...

20 "32 Websites Go Blank," The Hindu, 1 January 2015, viewed on 6 April 2015, http://www.thehindu.com/news/national/now-modi-govt-blocks-32-websites/a...

21 Pranesh Prakash (2012): "Analysing Latest List of Blocked Sites (Communalism and Rioting Edition)," 22 August, viewed on 6 April 2015, http://cis-india.org/internet-governance/blog/analysing-blocked-sites-ri... . Also, see Part II of the same series at http://cis-india.org/internet-governance/analyzing-the-latest-list-of-bl... and analysis of blocking in February 2013, at http://cis-india.org/internet-governance/blog/analyzing-latest-list-of-b...

22 Gautam Bhatia (2015): "The Supreme Court's IT Act Judgment, and Secret Blocking," Indian Constitutional Law and Philosophy, 25 March, viewed on 6 April 2015, https://indconlawphil.wordpress.com/2015/03/25/the-supreme-courts-it-act...

23 Apar Gupta (2015): "But What about Section 69A?," Indian Express, 27 March, viewed on 5 April 2015, http://indianexpress. com/article/opinion/ columns/but-what-about-section-69a/

24 Pranesh Prakash (2011): DIT's Response to RTI on Website Blocking, The Centre for Internet and Society, 7 April, viewed on 6 April 2015, http://cis-india.org/internet-governance/blog/rti-response-dit-blocking ). Also see http://cis-india.org/internet-governance/blog/analysis-dit-response-2nd-... and http://cis-india.org/internet-governance/resources/reply-to-rti-applicat...

25 http://sflc.in/wp-content/uploads/2015/04/RTI-blocking-final-reply-from-...

For more details visit https://cis-india.org/internet-governance/blog/economic-and-political-weekly-sunil-abraham-april-11-2015-shreya-singhal-and-66a

Should you worry about identity theft?

Admin — 2017-11-26T11:24:56Z

Laws in India regarding data protection may be weak, but following basic cyber hygiene rules can make your own defences stronger.

The article by Shaikh Zoaib Saleem was published in Livemint on September 20, 2017. Pranesh Prakash quoted.

Earlier this month, US-based credit information company Equifax Inc. said its systems had been struck by a cybersecurity incident that may have affected about 143 million US consumers. A report by Bloomberg said the incident could be ranked among one of the largest data breaches in history. The intruders accessed names, social security numbers, birth dates, addresses, driver’s licence numbers and also credit card numbers, Equifax said in a statement.

While this reiterates what cyber security professionals say, that nothing is hack proof, it does remind us of the range of cyber crimes, which revolve around identity theft and frauds. It gives us a chance to reflect upon how well prepared we are, if a cyber attack strikes us, or if our personally identifiable data gets leaked.

According to the Norton Cyber Security Insights Report 2016, 49% of India’s online population, or more than 115 million Indians, are affected by cybercrime at some point with the country ranking second in terms of highest number of victims. “No government or organisation creates something that is designed to fail deliberately. People find the gaps in that system and then try to misuse it,” said Ritesh Chopra, country manager, consumer business unit, Symantec India, a cyber security company.

While it can be debated as to who should take the blame in different instances, one underlying theme is following basic cyber hygiene. “There are several mobile apps that leak data. While downloading and installing an app, you may give out access to several other things in your device,” said Chopra.

Most cyber crimes involve leak or breach of public information, which leads to identity fraud. Let’s take a look at what an identity fraud could mean.

Identity theft and frauds

Everything that we do online is linked to a digital identity—an email ID, a phone number or even an IP address of a device. Harshil Doshi, strategy security consultant, Forcepoint India, a cyber security firm, said that as long as the leaked information is limited to names, email addresses, addresses and mobile numbers, there may not be a reason for worrying. “There needs to be a distinction between what information is publicly available and what can be used only privately. People also talk about Aadhaar leaks. As long as it is not my fingerprint and retina scan, there is no cause of concern, because information like name and address are anyway public,” he said.

However, not everyone agrees with this point of view. Pranesh Prakash, policy director at advocacy group Centre for Internet and Society, said email addresses, date of birth and mobile phone number of an individual are not necessarily public information. “Work-related email addresses may be publicly available online but personal ones are not,” he said. Prakash, however, added that our notion of public information keeps changing.

Identity fraud impact

The concept of identity theft has become complicated as our digital lives expand. “Everything about you as an individual is your identity, including something personal like blood group and medical history. Your social media profile, bank transactions, blogs or online comments are also a part of this. From a fraud perspective, it is equally complex,” said Chopra.

Your identity can be impersonated in several ways. “The most common methods of identity fraud all require collecting publicly-available information about you,” said Prakash. For example, celebrity leaks in the US (cloud storage was hacked) happened also because there is more information about celebrities publicly available than for an average individual, he said.

Another example could be misuse of information regarding foreign exchange. “In India, there is a limit of buying foreign exchange worth $30,000 for an individual in a year. If information on how many times you exhaust that limit falls in the wrong hands, it can be used for money laundering in your name. How many people think about how PAN and passport copy that one shares to buy foreign exchange, can be misused?” said Chopra.

Further, health insurance can be fudged and somebody can use the benefit under your name or buy restricted medicines misusing your medical prescription.

What the law says

There are provisions in the Indian Penal Code that deal with issues like cheating by impersonation to some extent. “There isn’t anything that adequately covers activities such as getting access to your personal data, which leads to identity fraud, or sufficiently penalizes things like data breaches or data leaks that facilitate identity fraud,” said Prakash.

The government is working towards data protection laws. A committee for data protection framework has been constituted under Justice B.N. Srikrishna, former judge of Supreme Court.

But it needs to be seen what comes out of these deliberations. “I am quite apprehensive, yet hopeful, about what the committee will produce, especially because they will need to deal with protection of biometric data, leaks of which will be far worse than any other leaks because biometrics is something that cannot be changed at will subsequent to a leak, unlike one’s phone number, email address or password,” said Prakash.

According to cyber security professionals, prevention seems the only way out. “We have forgotten the difference between the real and virtual worlds. In the real world, if somebody knocks at your door, you will check before opening the door ,” said Chopra. The problem for individuals starts when we click on a malicious link or download a file like a song or an image which could have a malware loaded on it. Once it enters our system, it immediately starts stealing information.

While the law may take some time to evolve and address the issues arising out of larger data breaches from corporate entities or even from the government, it is important to be vigilant, which includes having complex passwords, not sharing passwords, being aware of suspicious emails and messages and downloading files and software only from reputed sources. While this alone may not guarantee you protection online, it certainly minimises the risk.

For more details visit https://cis-india.org/internet-governance/news/livemint-shaikh-zoaib-saleem-september-20-2017-should-you-worry-about-identity-theft

Should online political advertising be regulated?

P.J. George — 2019-11-13T15:12:46Z

Micro-targeting could have potentially damaging results in the context of political advertising.

The article by P.J. George was published in the Hindu on November 8, 2019. Pranesh Prakash was interviewed.

On October 31, Twitter announced that it will no longer carry political advertisements as the power of Internet advertising “brings significant risks to politics, where it can be used to influence votes”. On the other hand, Facebook has said it will not fact-check political advertisements as it does not want to stifle free speech. In a conversation moderated by P.J. George, Pranesh Prakash (board member, The Centre for Internet and Society) and Kiran Chandra (General Secretary, Free Software Movement of India) discuss how platforms and constitutional authorities can deal with the challenges posed by online political advertising to democracies. Edited excerpts:

We have always had political advertising. What is it that makes online political advertisements different or maybe even problematic?

Pranesh Prakash: There are two things that make online political advertising different. One is targeting. Online advertising allows, especially on social networks, for a kind of targeting that wasn’t possible at the same level before. Earlier, if you wanted to target a particular segment of people for your political messaging, you could find out what kind of magazines they subscribe to and put fliers in those magazines. But you couldn’t engage in personalised targeting based on multiple attributes that is possible through platforms like Facebook and Twitter. The second is the invisibility of this kind of advertising. If there’s a billboard in the real world, everyone gets to see it. However, if there’s targeted advertising on a social media platform, not everyone gets to know of it.

Kiran Chandra: App-based organisations have designed advertisement models to specifically allow targeting. Facebook, for instance, allowed you to choose a person from a particular caste and also from a particular class in the same caste. If somebody wants to look at an advertisement for an Audi, they can go to one class of newspapers or look at billboards in some localities; the very existence of the product is not opaque to society. But targeted advertising makes it possible for two people connected to the Internet from the same source, using the same equipment, studying in the same school or college, working in the same workplace, and living in the same habitat to get two different advertisements. And micro-targeting has got potentially damaging results in the context of political advertising, particularly for elections. These platforms make it possible to go from manufacturing consent to manipulating consent. A person is continuously fed with information to vote for a particular party.

Twitter said it will no longer carry political advertisements, considering the repercussions seen in the U.S. in the past elections. On the contrary, Facebook says political advertisements are necessary and that people should see if their politicians are lying. How culpable is a platform in the case of a problematic online political advertisement?

KC: Platforms, particularly Facebook, have been washing their hands of the issue saying they are only intermediaries providing space; that the content is being generated by the people to be consumed by the people, and they have no role to play. But this is false. If you look at the complete business model of Facebook, Google, or any of the platforms, they clearly provide micro-targeting, or allow people to be manipulated for a particular purpose. So, these platforms can’t just wash their hands of the issue. In the Maharashtra election, you saw a lot of advertisements coming out which are untraceable. How can this happen without the platform itself allowing for such a possibility? The Election Commission (EC) needs to step in on all these issues. These corporations need to be very transparent in the context of elections. They need to bring out all the ways in which advertisements are displayed and also the money associated with it.

When somebody publishes it [an ad] on a Facebook wall, it is as good as publishing it in a newspaper. So, all the legislation that apply now for reasonable restrictions and freedom of speech and the freedom of press also apply to these platforms. These platforms are culpable when the very intent of their business model allows such subversion of the democratic process. They need to be brought in line to ensure that Indian democracy is safe.

PP: I completely disagree with Kiran on a number of points. For instance, those who are running a platform shouldn’t automatically be liable for what people are seeing on those platforms. The people who are actually saying things should be liable, not necessarily those who are carrying it without knowing what they’re carrying most of the time. Kiran also mentioned manipulation. The job of all advertising is to manipulate. The job of newspapers is to manipulate public opinion. And there’s always money associated with this. Newspapers carry advertisements as well. You don’t necessarily know who has paid for each ad in the newspaper. What online platforms are able to provide is actually greater transparency in this regard, at least based on what Facebook is attempting to do with its ad library. Calling this manipulation doesn’t quite work. Because then you have to specify why certain categories of things you think of as manipulating, while other categories you think of as influencing.

Second, as far as I know, Facebook does not ask for your caste. Nor does it actually allow advertisers to use caste as a category for advertising. To address the larger question of whether to carry political advertisements or not, I don’t think there are simple answers. For instance, in different jurisdictions there are different rules as to whether different kinds of media are allowed to carry political advertisements or not. In the U.S., all broadcasters are required by law not to censor on the basis of the content of political advertising. Which means that broadcasters in the U.S. cannot say to a candidate, ‘this advertisement that you’ve sent to us contains a lie and we’re not going to associate ourselves with the lie and we’re not going to carry it’. Now, when a platform like Facebook says that it will voluntarily adopt a similar standard as applies to broadcast organisations by law, all hell breaks loose. And again, there might be good reasons for it. But to say that political advertising should not contain lies, and hence should be censored, is not a viable opinion across the board.

KC: I would like to clarify one thing here. There is a clear distinction between Facebook asking your caste and Facebook allowing you to micro-target people based on their caste and class. In 2016, I created an advertisement with a tag called Brahmin bags and it allowed inclusion and exclusion based on caste and economic status. And now, after this had been made an issue for the last three years, Facebook says that advertisers can select topics that are specific to a particular caste. For instance, Dalit topics, Iyengar topics, etc. So Facebook, in its design, allows such kind of sensitivities to be used for micro-targeting. And one should not confuse general advertising with political advertising. If the advertisement is just about manipulating for buying a particular product, that has something to do with the business houses; even if one agrees with it or not. But when you speak about political advertising, when people come to participate and engage in a democratic process, the EC and The Representation of the People Act (RPA) mandate that people should be allowed to take a very clear stand, to look at what has happened in the last five years, and decide how to vote, freely and fairly. That is why the RPA clearly lists a certain set of things for free and fair elections, where even the use of money and manipulation should not be allowed to happen. Yes, the U.S. has a different context. American democracy is different from Indian democracy. We have got our own statute. This methodology in which these platforms have got their business models and are engaging deeply in subverting the Indian democratic process is a serious cause of concern. The EC should come up with new methodologies, if the existing ones are not sufficient.

Can you elaborate on how the EC can play a role in this?

KC: We brought these issues to the notice of the EC prior to the 2019 general election. The EC said it does not have enough manpower to deal with this situation for now. The EC does not have power over the police or the administration; but once the elections are on, it has the capability to take in different departments and ensure that such subversion of the democratic process does not happen. A fundamental problem with the EC’s method is that it said it was in discussion with the digital platforms to make more people vote in the election. And that itself is problematic. How is it going to be done? The EC should make public the way in which this advertising is being conducted, the money associated with it, and the people who are being reached with it. For instance, if we look at TV channels for ads during primetime, there is a mechanism, like TRP ratings, which allows them to understand and evaluate the target sections. If you look at the Maharashtra election, the advertiser itself is not known. Have people been sent communal messages? Have people been targeted based on caste, which can disqualify the contestant? The EC should reach out to the Government of India and look at the departments that are capable of handling this. If they don’t exist, it should start creating infrastructure that will be able to look into all these aspects. Also, concrete guidelines should be given to these digital platforms. And whatever comes in contradiction, or comes in the way of implementing the RPA, the EC should stop the platforms from doing it.

PP: For me, it’s not clear to what extent I would draw a distinction between advertising and other things which the EC has not been able to curtail, such as paid news and political ownership of media, which allow for very skewed viewpoints to be expressed. But insofar as what can be done about online platforms — and again, only online platforms which deal in advertising — the biggest source of online political messaging in India is WhatsApp. So, excluding the elephant in the room from this discussion, what the EC could do is bring the largest platforms together to get transparency commitments from them. Then this information needs to be made publicly available, so that the invisibility which happens with targeting gets countered. The second thing... Given that elections are geographical in nature in India, if you want to engage in advertising, you have to do it on the basis of geography, not on the basis of specific kinds of attributes of a person. And let’s also be aware that most of these attributes or guesses about people that these platforms are making are based on what people post on social media platforms, what they click. So, the one thing that can be done on a global level is transparency and restrictions on various targeting but anything else such as limitations on, say, lying in political advertising, I don't think that can or should be sold on a global level. It’s dependent far too much on each country and their models and how they interpret freedom of expression.

For more details visit https://cis-india.org/internet-governance/news/hindu-pj-george-november-8-2019-should-online-political-advertising-be-regulated

Should Nandan Nilekani's Aadhaar project, for identity proof and welfare delivery, exist at all?

praskrishna — 2014-04-14T10:27:57Z

The foundation of Aadhaar—a Congress flagship project to give every Indian a unique identity number and then use it to deliver services—has been under assault in the past three months.

The article by M. Rajshekhar was published in the Economic Times on April 3, 2014. Sunil Abraham is quoted.

Political, legal, reputational.

The political backlash is coming from leaders of BJP, the Congress' principal rival. Meenakshi Lekhi and Ananth Kumar are not, by any stretch of the imagination, the first or the last word on policy matters in the BJP, but they mince no words when they say that if their party forms a government, it will trash Aadhaar —a project that has delivered a unique ID to half of India and on which Rs 3,800 crore has been spent.

Even as BJP's loose cannons fired, the Supreme Court repeated on March 24 that the government cannot make Aadhaar mandatory to access welfare services like pensions and LPG subsidy. The same day, investigative journalism portal Cobrapost aired videos that allegedly showed agencies agreeing to enrol people from neighbouring countries for a bribe.

The BJP piled on. "It (Aadhaar) has served no purpose. They have issued cards to illegal migrants. We want citizenship cards," says Prakash Javadekar, spokesperson of BJP. His party does not have an official policy line on Aadhaar as yet, but another of its leaders, Yashwant Sinha, headed the Parliamentary panel that, in 2011, severely criticised and rejected the draft bill that provided the legal framework for Aadhaar. "We are for direct benefit transfer but not on the basis of Aadhaar, which is a very badly-designed scheme," Sinha told CNBC-TV18 on January 31. "We will give it to all citizens of India on the basis of NPR."

On the campaign trail in Bangalore, Nandan Nilekani, the chief architect and implementer of Aadhaar, defends his work as the chairman of Unique Identification Authority of India (UIDAI). "Aadhaar is a pro-development and an anti-corruption platform," says Nilekani, who was brought in by the Congress high command in 2009 and is contesting these elections on a party ticket against BJP's Kumar in Bangalore South. "It is a pity that some vested interests with narrow political and other motives are trying to stall the project."

Lost in those binaries are the objectives of Aadhaar, to universalise identity proof and to use it to plug leakages in delivery of welfare services. UIDAI, led by a hands-on Nilekani, pursued this agenda with a certain authority, great speed and an overriding emphasis on technology, all of which delivered outcomes.

But they also contributed to shortcomings that saw the project stumble on its way and for which it is now being critiqued. "This is the only way transformation takes place," says K Koshy, who was part of the team that conceptualised Aadhaar and is now with Ernst & Young. "When you know the ultimate system is workable, you sort out the problems as you go along."

Except, given the political winds blowing, it's anyone's guess what the new dispensation will feel about Aadhaar and UIDAI, from where Nilekani resigned on March 13 and which is seeing many officers who came from other parts of the government, on deputation, returning. Will the new dispensation see Aadhaar as an idea that is sound but with parts that need strengthening? Or, will they see it as an idea that is, by itself, fallacious? "I don't know where this is going," says Abhijit Sen, member, Planning Commission, under which UIDAI is housed.

At one level, it's a political question. "The next Parliament will have to decide what UIDAI can and cannot do," says Sen. At another level, even that political answer will stem from the answers to three questions that go to the core of what Aadhaar was meant to be and where it fell short.

1. Does Aadhaar Provide a Unique and Definitive Identity?

Yes and no. UIDAI collects two sets of information from an individual. The first is biometrics: prints of all 10 fingers and a scan of the iris in both eyes. Biometric data, which is supposed to be unique to every individual, is used to assign a unique number to the individual. The second set is basic personal information: name, address, father's name, date of birth and address. Individuals can show existing documents—like voter's I-card or passport —as verification. For those who did not have identification documents, UIDAI allowed certain people to attest for them.

Aadhaar is better at identifying individuals through their biometrics than ensuring the accuracy of their add-on data. This is partly due to its design. When Aadhaar was being conceptualised, says Shrikant Nadhamuni, who headed technology for UIDAI: "We wanted to move the ID game—from a state where some people had no ID and others had paper ID to something beyond even what Singapore had, in the form of smart cards, to online. Like biometric. Which is the future.

Here, your presence is enough to vet your ID." This is also partly due to how UIDAI did its enrolments. Shortly after taking charge, Nilekani announced UIDAI would issue 600 million Aadhaar numbers by March 2014. The initial plan was that the National Population Register (NPR), which conducts the decadal Census and which is housed under the ministry of home, would do the enrolments— capturing biometrics and information— and UIDAI would only issue the numbers.

Soon after, Nilekani decided he could not meet his 600 million target if he waited for NPR to give him biometric packets, and offered to do enrolments too. To meet the target, UIDAI wanted to outsource enrolment to multiple vendors. And compared to NPR, UIDAI collected very little demographic data. UIDAI appointed public and private companies as enrolment agencies. Quality issues arose. "90% of the larger enrolment agencies offloaded the work to local, small-time guys," says the head of a Gurgaon-based enrolment agency, not wanting to be named.

Instances of incomplete addresses, spelling mistakes, people bribing enrolment staff to obtain numbers, emerged. "There is always a trade off between inclusion and accuracy," says Nilekani. "And the fact that these errors happened only shows that the gates were kept wide enough to ensure there would be no exclusion." "The Aadhaar database is based on very weak data," says Sunil Abraham, the head of Bangalore-based Centre for Internet and Society, an Internet and governance think-tank. "It is basically linking biometrics to a person and the name/address he claims as his." This weakness started showing up as the government began to deliver welfare services by transferring money directly into bank accounts of beneficiaries, using Aadhaar. The first step was to add the Aadhaar number to the department and bank databases.

Reddy Subramanyam, joint secretary of NREGA, tried to seed Aadhaar numbers into his database of NREGA workers. "The current matching is just 25-30%." The mismatch arises because, say, the name will be S Kumar in one and Sunil Kumar in another. Aadhaar is "less ID project and more identification project," says legal researcher Usha Ramanathan. "The onus for ensuring the demographic information is correct falls on the number-holder."

2. Are Aadhaar-enabled Cash Transfers Delivering?

If giving every Indian a unique ID was Aadhaar's main mandate, revamping welfare delivery became its second. In 2011, Nilekani headed a committee to create a roadmap to move to a system of welfare delivery where money was transferred directly into bank accounts of beneficiaries—or direct benefit transfers (DBTs). The architectures it proposed pivoted around Aadhaar and online, realtime biometric authentication. This was to replace the existing smart-card architecture, which can work even in areas even without connectivity.

UIDAI saw the cloud as the future. "We were not very taken with the smart-card solution," says Nadhamuni. "Farmers have to carry multiple smart cards around. And then, there is the cost of the card." Smart-card companies, staring at the prospect of their investments going waste, protested. "Customers and service providers deserve the right to make a convenient choice. Can someone building a public highway insist that only a certain sort of a vehicle can ply on it?" Abhishek Sinha, CEO of Eko India, a mobile-banking start-up told ET in November 2011.

"The question is whether the model is working better now than what existed before," defends Koshy. It's a question that has not been answered conclusively and credibly: there have been no independent evaluations by the government of Aadhaarbased DBTs till now. "Aadhaar should not have been rolled out on a mission mode till it was tested on some scale," says MS Sriram, visiting faculty at IIM Bangalore's Centre for Public Policy. When asked about this, Sen says: "There was no independent evaluation. Everyone was rushing." From the field came reports about manual labourers and the aged struggling to authenticate using biometrics.

Nor were comparative studies conducted to check alternative ways to improve welfare delivery. Economist Reetika Khera argues that Chhattisgarh has removed corruption from its PDS programme through a mix of computerisation and community supervision. This echoes an observation made by the Parliamentary panel while rejecting the UIDAI bill: the government had not considered comparative costs of Aadhaar and other existing ID documents.

Yet, in November 2012, the Congress decided to make DBTs its calling card for the 2014 elections. At a rally in Dudu, Rajasthan, attended by Congress leaders and Nilekani, it announced DBT rollout in the state. A year later, after a patchy rollout, the Congress lost power in the state. And on January 30, the UPA pressed pause on DBTs for cooking gas.

3. Are there Strong Safeguards to Protect a Person's Privacy?

On February 26, the Mumbai High Court directed UIDAI to share its Goa biometrics with the CBI to help it solve a rape case in the state the agency was struggling to solve. UIDAI refused, saying this would violate the privacy of its number holders. The High Court agreed with the CBI. UIDAI went to the Supreme Court, which ruled that its biometric information cannot be shared with any government agency without the consent of number holders.

But the CBI request had shown what could go wrong. "Once you create an ID system, other things happen," says Sen. "The most inevitable one is that government departments—like the police—want to access it. A database exists and I want to use it." Says a Supreme Court lawyer, not wanting to be named: "You innocently give your fingerprints to UIDAI because you want your scholarship or gas subsidy or something. You volunteer this information and then you realise this can be used as evidence against you in a criminal trial?" In time, more agencies will use Aadhaar. "The moment you start putting the Aadhaar number into multiple databases, you make them comparable," says Abraham. "Land registry, tax records, etc, all become comparable." Adds Sen: "We need to think about who can use the authentication service."

He cites the example of banks using Aadhaar to judge a borrower's credit record as a good thing. Conversely, he adds, an insurer using a customer's Aadhaar to access hospital records, and take a call on premiums or policy issuance, is a bad outcome. "Insurance is supposed to work by pooling risk. Should they (insurers) even have the right to ask for authentication?" asks Sen. UIDAI officials say three things in their defence. One, they collect innocuous information, which they don't share. Two, for authentication queries, they only give 'yes/no' answers. Three, they have safeguards.

What is missing is a legal framework that governs collection, use and retention of biometrics. "India has not passed a data privacy law," says Nadhamuni. "This is a very important legislation we need to draft and enact for projects that use large-scale IT systems, be it Aadhaar, NREGA, voter card, income tax, etc. In the absence of such laws, UIDAI came up with rigorous data privacy and security policies to secure resident data." However, the Parliamentary panel, while rejecting the bill, noted that UIDAI began collecting biometric data even as the government worked on a privacy bill and a data protection bill. "The idea that databases can be used by anyone makes people vulnerable, especially in a state where there is neither law nor much respect for law," says Ramanathan.

Aadhaar stands at an uncomfortable junction. A new government, eager to ensure only citizens have unique numbers, could ask all Aadhaar holders to provide address proof and delete the others. Events of the past three months have framed the issues concerning Aadhaar, sometimes with a touch of rhetoric. "This is a good time to open the regulation issue," says Sen.

For more details visit https://cis-india.org/news/economic-times-april-3-2014-m-rajshekhar-should-nandan-nilekani-aadhar-project-for-identity-proof-and-welfare-delivery-exist

Should an Inability to Precisely Define Privacy Render It Untenable as a Right?

amber — 2017-08-04T01:49:56Z

The judges may still be able to articulate the manner in which limits for a right to privacy may be arrived at, without explicitly specifying them.

The article was published in the Wire on August 2, 2017.

Ludwig Wittgenstein wrote in his book, Philosophical Investigations, that things which we expect to be connected by one essential common feature, may be connected by a series of overlapping similarities, where no one feature is common. Instead of having one definition that works as a grand unification theory, concepts often draw from a common pool of characteristics. Drawing from overlapping characteristics that exist between family members, Wittgenstein uses the phrase ‘family resemblances’ to refer to such concepts.

In his book, Understanding Privacy, Daniel Solove makes a case for privacy being a family resemblance concept. Responding to the discontent in conceptualising privacy, Solove attempted to ground privacy not in a tightly defined idea, but around a web of diverse yet connected ideas. Some of the diverse human experiences that we instinctively associate with privacy are bodily privacy, relationships and family, home and private spaces, sexual identity, personal communications, ability to make decisions without intrusions and sharing of personal data. While these are widely diverse concepts, intrusions upon or interferences with these experiences are all understood as infringements of our privacy.

Other scholars too have recognised this dynamic, evolving and difficult to pinpoint nature of privacy. Robert Post described privacy as a concept “engorged with various and distinct meanings.” Helen Nissenbaum advocates a dynamic idea of privacy to be understood in terms of contextual norms.

The ongoing arguments in the Supreme Court on the existence of a constitutional right to privacy can also be viewed in the context of the idea of privacy as a family resemblance concept. In their arguments, the counsels for the petitioners have tried to make a case for privacy as a multi-dimensional fundamental right. Senior advocate Gopal Subramanium argued before the court that privacy inheres in the concept of liberty and dignity under Constitution of India, and is presupposed by various other rights such as freedom of speech, good conscience, and freedom to practice religion. He further goes on say that there are four aspects to privacy – spatial, decisional, informational and the right to develop personality. Shyam Divan, also arguing for the petitioners, further added that privacy includes the right to be left alone, freedom of thought, freedom to dissent, bodily integrity and informational self-determination.

When the chief justice brought up the need to define the extent of the right to privacy, the counsels raised concerns about the right being defined too specifically. This reluctance was borne out of the recognition that by its very nature, the right to privacy is a cluster of rights, with multiple dimensions manifesting themselves in different ways depending on the context. Both advocates, Subramaniam and Arvind Datar, argued that court must not engage in an exercise to definitively catalog all the different aspects of the right, foreclosing the future development of the law on point. This reluctance was also a result of the fact that the court has isolated the question of the existence of the right to privacy and how it may apply in the case of the Aadhaar project. Usually judges are able to ground legal principles in the relevant facts of the case while developing precedents. The referral to this bench is only on the limited question of the existence of a constitutional right to privacy. Therefore, any limits that are articulated by the court on the right exist without the benefit of a context.

On the other hand, the Attorney General (AG) argued that this very aspect of privacy was a rationale for not declaring it a fundamental right. At various points during the arguments, he indicated that the ambiguous and vague nature of the concept of privacy made it unsuitable as a fundamental right. Similarly, Tushar Mehta, arguing for Unique Identification Authority of India, also sought to deny privacy’s existence as a fundamental right as it is too subjective and vague.

The above argument assumes that the inability to precisely define privacy renders its untenable as a right. The key question is whether this lack of a common denominator makes privacy too vague a right, liable to expansive misinterpretations. Conceptions that do not have fixed and sharp boundaries, are not boundless. What it means is that the boundaries can often be fuzzy and in a state of constant evolution, but the limits and boundaries always exist.

At one point during the hearings, Justice Rohinton Nariman wanted the counsels to work on the parameters of challenge for state action with respect to privacy. As mentioned earlier, in the absence of facts to work with, such an exercise is fraught with risks. However, the judges may still be able to articulate the manner in which such limits may be arrived at, without specifying them. Justice Nariman himself later agrees that the judicial examination must proceed on a case by case basis, taking into account not only the tests under Article 14,19 and 21 under which petitioners have tried to locate privacy, but also under any other concurrent rights which may be infringed.

The AG also argued that the infringement of privacy in itself does not amount to a violation of the rights under Article 21, rather in some cases the transgressions on privacy may lead to an infringement of a person’s right to liberty and only in such cases should the fundamental rights be invoked. Thus, the argument made was that there was no need to declare privacy as a fundamental right but only to acknowledge that limiting privacy may sometimes lead to violations of the already existing rights. This argument may have been more cogent had he identified specific dimensions of privacy which, according to him, do not qualify as fundamental rights. However, this might have meant conceding that other dimensions of privacy, in fact do amount to fundamental rights.

It must be remembered that the problem of changing or multiple meanings is not limited to privacy. As the bench noted, drawing comparisons to the concepts of ‘liberty’ and ‘dignity’, these are constitutionally recognised values which equally suffer from a multitude of meanings based on context. The government’s position here is in line with critiques of privacy that Solove seeks to bust in his book. The idea of privacy evolves with time and people. And people, whether from a developed or developing polity, have an instinctive appreciation for it. The absence of a precise definition does not necessarily do great disservice to a concept, especially one that is fundamental to our freedoms.

For more details visit https://cis-india.org/internet-governance/blog/the-wire-amber-sinha-august-2-2017-should-an-inability-to-precisely-define-privacy-render-it-untenable-as-a-right

Should Aadhaar be mandatory?

amber — 2017-12-18T15:54:39Z

This week, a constitutional bench of the Supreme Court will adjudicate on limited questions of stay orders in the Aadhaar case. After numerous attempts by the petitioners in the Aadhaar case, the court has agreed to hear this matter, just shy of the looming deadline of December 31 for the linking of Aadhaar numbers to avail government services and benefits.

The article was published in Deccan Herald on December 9, 2017.

Getting their day in the court to hear interim matters is but a small victory in what has been a long and frustrating fight for the petitioners. In 2012, Justice K S Puttaswamy, a former Karnataka High Court judge, filed a petition before the Supreme Court questioning the validity of the Aadhaar project due its lack of legislative basis (the Aadhaar Act was passed by Parliament in 2016) and its transgressions on our fundamental rights.

Over time, a number of other petitions also made their way to the apex court challenging different aspects of the Aadhaar project. Since then, five different interim orders of the Supreme Court have stated that no person should suffer because they do not have an Aadhaar number.

Aadhaar, according to the Supreme Court, could not be made mandatory to avail benefits and services from government schemes. Further, the court has limited the use of Aadhaar to only specific schemes, namely LPG, PDS, MNREGA, National Social Assistance Program, the Pradhan Mantri Jan Dhan Yojna and EPFO.

The then Attorney General, Mukul Rohatgi, in a hearing before the court in July 2015 stated that there is no constitutionally guaranteed right to privacy. But the judgement by the nine-judge bench earlier this year was an emphatic endorsement of the constitutional right to privacy.

In the course of a 547-page judgement, the bench affirmed the fundamental nature of the right to privacy, reading it into the values of dignity and liberty.

Yet months after the judgement, the Supreme Court has failed to hear arguments in the Aadhaar matter. The reference to a larger bench and subsequent deferrals have since delayed the entire matter, even as the government has moved to make Aadhaar mandatory for a number of government schemes.

At this point, up to 140 government services have made linking with Aadhaar mandatory to avail these services. Chief Justice of India Dipak Misra has promised a constitution bench this week, likely to look only into interim matters of stay on the deadline of Aadhaar-linking. It is likely that the hearings for the final arguments are still some months away. The refusal of the court to adjudicate on this issue has been extremely disappointing, and a grave disservice to the court's intended role as the champion of individual rights.

It is worth noting that the interim orders by the Supreme Court that no person should suffer because they do not have an Aadhaar number, and limiting its use only to specified schemes, still stand.

However, since the passage of the Aadhaar Act, which allows the use of Aadhaar by both private and public parties, permits making it mandatory for availing any benefits, subsidies and services funded by the Consolidated Fund of India, the spate of services for which Aadhaar has been made mandatory suggests that as per the government, the Aadhaar Act has, in effect, nullified the orders by the Supreme Court.

This was stated in so many words by Union Law Minister Ravi Shankar Prasad in the Rajya Sabha in April. This view is an erroneous one. While acts of Parliament can supersede previous judicial orders, they must do so either through an express statement in the objects of the Act, or implied when the two are mutually incompatible. In this case, the Aadhaar Act, while permitting the government authorities to make Aadhaar mandatory, does not impose a clear duty to do so.

Therefore, reading the orders and the legislation together leads one to the conclusion that all instances of Aadhaar being made mandatory under the Aadhaar Act are void.

The question may be more complicated for cases where Aadhaar has been made mandatory through other legislations, such as Prevention of Money Laundering Act, as they clearly mandate the linking of Aadhaar numbers, rather than merely allowing it. However, despite repeated appeals of the petitioners, the court has so far refused to engage with the question of the legality of such instances.

How may the issues finally be resolved? When the court deigns to hear final arguments, the Aadhaar case will be instructive in how the court defines the contours of the right to privacy. The right to privacy judgement, while instructive in its exposition of the different aspects of privacy, does not delve deeply into the question of what may be legitimate limitations on this right.

In one of the passages of the judgement, "ensuring that scarce public resources are not dissipated by the diversion of resources to persons who do not qualify as recipients" is mentioned as an example of a legitimate incursion into the right to privacy. However, it must be remembered that none of the opinions in the privacy judgement were majority judgements.

Therefore, in future cases, lawyers and judges must parse through the various opinions to arrive at an understanding of the majority opinion, supported by five or more judges. While the privacy judgement was a landmark one, its actual impact on the rights discourse and on matters like Aadhaar will depend extensively on the how the judges choose to interpret it.

For more details visit https://cis-india.org/internet-governance/blog/should-aadhaar-be-mandatory