We are anonymous, we are legion

Why you should keep a close eye on the net neutrality debate in the US

Admin — 2018-01-18T14:50:52Z

As the United State's FCC Chairman Ajit Pai gears up to repeal the net neutrality laws put in place in 2015, India should sit up and take note.

The blog post by Subhrojit Mallick was published by Digital.in on November 24, 2017.

Back in 2014, a group of Redditors started debating net neutrality in India after Airtel announced it would charge extra for Voice Over IP (VoIP) services like Skype. Soon, that snowballed into a nation-wide campaign with over a million internet users participating. Things didn’t help when Facebook too wanted to provide a bunch of internet services for free in India through its Internet.org or Free Basics initiative. However, a year-long discussion and public outrage against the two, led the Telecom Regulatory Authority of India (TRAI) to rule in favour of net neutrality and stop both Airtel and Facebook in their tracks of violating a free and open internet.

Fast forward three years down the line and America, the birthplace of the internet, is struggling with the problem of internet freedom. The Federal Communications Commission (FCC) under the Donald Trump Administration led by Chairman Ajit Pai submitted a final draft proposal yesterday to repeal the existing net neutrality laws put in force by the Obama administration in 2015. The draft proposal will be voted upon by FCC by the end of the year and considering the FCC has a Republican majority under Ajit Pai, the proposal is likely to pass.

What is FCC chairman Ajit Pai doing?

The draft removes almost every net neutrality rule from 2015, making ISPs the gatekeepers of the internet. It states internet providers will have the freedom to implement fast and slow speed lanes, prioritise traffic and block apps and services. The only rule they have to follow -- publicly disclose when they are doing any of the things stated above.

Executive director of the Centre for Internet and Society, Sunil Abraham elaborated on what's on Pai's mind.

"Ajit Pai's ideology is pro-market. He believes the market will sort all problems out. According to Pai, the magic of competition will eliminate all the harms emerging from net neutrality violation," he said.

"Pai has said, you do what you want to do, but you have to disclose that to the public. You can block, throttle, have fast lanes, prioritise traffic, have discriminatory pricing, but you disclose them. If the customer doesn't like it, he can swith to another network. Pai believes the transparency requirements will allow the magic of the market to diminish and eliminate harm. His regulation of net neutrality is transparency," Abraham further added.

However, such a move will have drastic effects on the free flow of internet traffic. Telecom companies and ISPs can handpick services by charging customers to access some sites or by slowing down the speeds of others. For instance, ISPs can make consumers pay more to watch high-quality content on Netflix.

With net neutrality rules repealed, the internet will become a pay-to-play service. It will essentially divide the internet into fast and slow lanes. One will be a speedy service that could be priced higher and another, much slower and cheaper. While big players like Amazon, Facebook, Google, Netflix and the likes can easily pay the higher fees and stay unfettered, newcomers and smaller players will have it tough. Although, the move will lead to cuts in profits for everyone. A higher price to consumers will eat into the user base of these companies, while startups and new voices in the media will find entry and success prohibitive.

Although it’s true that no single ISP in the US has the entire market to itself and the market is indeed divided into a handful of players, they do operate in a de facto monopolised way. How? ISPs in the US have sliced up the entire country into areas such that users in a particular area have only one choice of service provider. That essentially leaves users at the mercy of whatever Comcast or Spectrum is offering (or not offering).

By putting the net neutrality rules in place in 2015, the US had ensured these ISPs won’t do anything grossly uncompetitive. The current rules make broadband in the country a public utility, same as electricity. And now, Ajit Pai-led FCC is about to repeal those very rules that kept them grounded.

Will the FCC ruling make apps and services expensive in other countries?

While Pai’s jurisdiction does not extend beyond the United States, his tirades against a free internet will most definitely have rippling effects across the world. More importantly, it will raise the cost of operations of companies like Netflix and Amazon who will have to hire legal experts and lobbyists to negotiate deals with service providers. That extra cost will be burdened on the US consumers of course, but since they have a large international presence, it is likely that the extra cost will trickle down to users outside the US as well.

And that’s not just the streaming companies. All the tech giants hail from the US and it is only logical that a rise in their costs of operation will have an impact on their global operations.

Although, if the level playing field in the US is disrupted, companies will look for greener pastures and if that means moving out of the US to other countries, it could happen.

How will FCC’s decision impact India?

While US is grappling with such a reality, Indians fought against it and won. Or did they? Last year, after Airtel and Facebook were asked to drop their plans for differential pricing, TRAI released a paper on net neutrality and differential pricingto finalise its views on the matter. The regulatory body released a 14-question long consultation paper seeking comments on internet traffic management from the public.

“Increasingly, concerns have been raised globally relating to discriminatory treatment of Internet traffic by access providers. These concerns relating to nondiscriminatory access have become the centre of a global policy debate. The purpose of this second stage of consultation is to proceed towards the formulation of final views on policy or regulatory interventions, where required, on the subject of NN,” the paper read.

“Net Neutrality being repealed in the US will hurt innovation in that country, and will lead to a consolidation of power with those Internet companies which have the money to partner with US carriers. This hurts Indian product startups, because it means that their apps may not be as easily available to users in the US. The Internet is one world, and we need the same Internet to be available everywhere, across the world: one Internet for the entire world,” Nikhil Pahwa, Co-Founder of Internet Freedom Foundation told Digit.

That means, essentially, the debate on net neutrality is not over in India. In fact, both RS Sharma, the Chairman of TRAI and FCC’s Ajit Pai agree on the need to bridge the digital divide. Both are exploring ways to keep the internet open while providing access to the unconnected. Thankfully, both differs on the approach to meet that goal.

Pai believes the internet should be left unregulated despite the “hypothetical harms” to the consumer. He thinks the current rules were put in place to avoid theoretical harms which were not based on hard evidence. Pai claims there should be evidence-based regulation of the internet.

Sharma, in contrast, disagrees on an evidence-based approach.

“The TRAI's view of Net Neutrality has so far been diametrically opposite to Ajit Pai's FCC, and with good reason. Net Neutrality ensures that all ISPs and telecom operators act as exchanges of data between users, and do not discriminate on the basis of the type or source of that data. This allows for permission-less innovation on the Internet, which has given us the Internet that we have today,” Pahwa added.

Will India’s stance on net neutrality change after the FCC’s decision?

Rajan Mathews, Director General of Cellular Operators Association of India believes the FCC’s decision will no doubt have some impact on the path India takes.

“I think the policymakers will look at the decision the US makes. They had taken their decision as a point of reference before and the FCC’s ruling is too large an issue to not look at it. Both the DoT (Department of Telecom) and TRAI will have to reevaluate their approach in the context of the what happens in the US,” he said.

“Net neutrality approach in both countries is still in flux and India is going to tread lightly on net neutrality issues,” he added. As per Mathews, in India, the situation is different from the US where a handful of telecom companies and ISPs wield control of the entire country. In India, there is a licensed environment which provides a minimal standard of net neutrality, which is applied across the board and everybody who is providing a similar service is made to follow similar guidelines.

However, Mathews did attribute India’s efforts to enforce net neutrality to the United States’ efforts to place the rules in the first place in 2015 under the Obama administration, when internet was deemed as a public utility, same as electricity or telephone.

“Net neutrality in India emerged from the US definition. Now that they are going to repeal it, people in India who were looking at the US as a model will evaluate the implications of the move,” Mathews elaborated.

The US is looking to implement an ex-post approach to regulating the internet wherein the ISPs and telcos will adopt a free market approach and will only be investigated if they violate a rule. India, Mathews says, is adopting an ex-ante approach where there will be some commonly accepted criteria of net neutrality, but operators will have the ability to manage their traffic to ensure quality of service.

Minister of Information and Broadcasting, Ravi Shankar Prasad also helped alleviate fears of India following suit. During the Global Summit for Cyberspace Security held yesterday, he said, "The citizens' right of accessing the internet is "non-negotiable" and the government will not allow any company to restrict people's entry to the worldwide web."

Prime Minister Narendra Modi also came in support of net neutrality in India. He tweeted, "The internet, by nature, is inclusive and not exclusive. It offers equity of access and equality of opportunity."

Pahwa, who fought hard against Airtel and Facebook to ensure the internet remains neutral, was confident the decision won’t affect India’s stance on net neutrality. However, he is apprehensive that Indian telecom companies might borrow a leaf from their US counterparts and lobby hard to repeal the rules.

“I don't think the FCC decision affects the Indian regulation in any way, because the Indian regulator TRAI has already established strong and well rooted principles for Net Neutrality regulations in India. The only thing that worries me is that Indian telecom operators will use the developments in the US to push back against Net Neutrality with renewed vigour,” he said.

So, on the face of it, while India is well insulated from the catastrophe the United States has embarked upon, it is important to watch what the US is doing closely and make sure we don’t repeat their mistakes here.

For more details visit https://cis-india.org/internet-governance/news/digit-in-subhrojit-mallick-november-24-2017-why-you-should-keep-a-close-eye-on-the-net-neutrality-debate-in-the-us

Indian activists slam FCC decision to ditch net neutrality

Admin — 2017-12-18T15:27:04Z

Indian net neutrality activists are assured the ongoing net neutrality tussle in the US will have no impact on India.

The article by Kul Bhushan was published in the Hindustan Times on November 23, 2017.

Net neutrality is in the news again. This time it is because the US’ Federal Communications Commission (FCC) has decided to formally scrap existing protections that are meant to keep access to internet equitable.

India had its own tryst with the idea of net neutrality after it blocked the zero-rating programmes by social networking giant Facebook — which proposed to rollout the Internet.org or Free Basics project in February last year.

A powerful social media campaign made Facebook back down and the Telecom Regulatory Authority of India (TRAI) to announce that ‘differential pricing’ — a practice where some services or sites are priced in a special manner — will no longer be allowed.

Some people who were at the forefront of the net neutrality campaign in here almost three years ago have expressed their displeasure over the FCC’s move.

“I think the approach the FCC is taking is flawed. Spectrum is a public resource and it needs to be spent on maximisation of public good. That public good, and the utility of the Internet is based on the freedom that people have to create new apps and services, without needing permission from ISPs, or the fear that ISPs might discriminate against them or favour their competitors. This is what net neutrality enables,” said Nikhil Pahwa, founder of publication Medianama and one of the activists.

“By going against Net Neutrality, FCC chairman Ajit Pai is attacking the core of what makes the Internet tick. We didn’t let that happen in India, and instead, focused on increasing competition between ISPs and telecom operators, because of which we’ve see broadband prices drop, quality of service improve, a tremendous growth in Internet users in India. For this, we owe a great debt to all those who supported Net Neutrality, especially the TRAI,” he added.

Apar Gupta, who is closely associated with the ‘Save the Internet’ initiative and is the co-founder of Internet Freedom Foundation, said, “FCC’s move to take back the internet order is a huge setback to the global campaign to ensure open internet because it undermines the net neutrality.”

“I don’t think the development should impact the regulatory process in India considering TRAI’s strong support for net neutrality. I hope that TRAI comes out with a comprehensive network neutrality regulation in the future,” he responded when asked about the possible impact on India of the FCC move.

Sunil Abraham, executive director of Bangalore-based research organisation Centre for Internet and Society, said there should be no impact on India from the FCC move.

He also slammed FCC chief Pai’s attempt to change the existing net neutrality rules. “What Ajit Pai is trying to do he’s not saying he will not regulate. He is saying when companies violate net neutrality principles they should be transparent about it. He hopes the magic of market competition will help resolve the problem,” he said

“Pai’s approach to the net neutrality might work in a market where there is a lot of competition. In the US, there is no competition and that in case damage will be immediate,” he added.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-kul-bhushan-november-23-2017-indian-activists-slam-fcc-decision-to-ditch-net-neutrality

Global Technology Summit 2017

Admin — 2017-12-05T13:47:57Z

The 2017 Global Technology Summit will take place on December 7 and 8, 2017 at the Hotel Leela Palace, Bangalore. Sunil Abraham is a speaker at the event.

Link to the original published by Carnegie here

The inaugural edition of the Global Technology Summit convened leading scholars, experts, and officials from more than ten countries for wide-ranging discussions on policy frameworks for technological innovation.

Building on its success, leading innovators, researchers, and entrepreneurs in cutting-edge technologies from around the world will engage with regulators, policy experts, and civil society actors this December in Bangalore.

The Summit will focus on new directions in technology policy, such as tech-diplomacy, data protection, and building an innovation ecosystem, as well as fields like digital finance, e-mobility, robotics, and smart cities, where massive technological transformation is likely in the coming years.

Agenda here

Panel Description

Navigating Big Data Challenges: Access to data, and capabilities to analyze the same, redefine the business moat for corporations and governance opportunities for governments. Data dictates product and policy success. It also raises complex challenges. With ever increasing hacks and vulnerabilities, data security continues to confound us. Data-driven businesses and governments also question core assumptions of privacy and individual reputation. Machine learning and deep learning, facilitated by data crunching algorithms, can either be coded to discriminate or learn from human data sets and imbibe the very same prejudices. This panel will deliberate upon these varied challenges, and explore possible policy frameworks to address them.

The panelists are:

Ann Cavoukian
Rahul Matthan
Vishnu Shankar
Rob Sherman
Sunil Abraham

Chaired by B.N. Srikrishna, former judge, Supreme Court of India

For more details visit https://cis-india.org/internet-governance/news/global-technology-summit-2017

Cyberattacks a significant threat to democracy: Modi

Admin — 2017-11-24T13:29:17Z

We have to ensure that cyberspace does not become a playground for dark horses of radicalism, says PM Narendra Modi at the fifth Global Conference on Cyber Space in Delhi.

The article by Komal Gupta was published in Livemint on November 24, 2017.

Prime Minister Narendra Modi on Thursday said creating a safe and secure cyberspace is on the primary agenda of the government as cyberattacks were a threat to democracy.

Modi’s assurance of decisively dealing with cyberattacks comes at a time when policymakers are making an unprecedented push to popularize digital transactions and cut down use of cash in order to have a more transparent and accountable economic environment. The government is at present working on a draft policy for tackling ransomware, a malicious software.

“We have to ensure that cyberspace does not become a playground for dark horses of radicalism,” Modi said, while inaugurating the fifth Global Conference on Cyber Space (GCCS) in the national capital.

A total of 50 incidents of cyberattacks affecting 19 financial organizations were reported from 2016 until June 2017, PTI reported in August.

With multiple cyberattacks affecting key infrastructure assets like ports and major payment companies recently, the government has decided to come out with a draft policy for tackling ransomware, a senior government official told Mint during the conference. “CERT-In (The Indian Computer Emergency Response Team) is working on a draft policy for tackling ransomware which will be put up for consultation by various stakeholders, including organized enterprise users of IT (Information Technology), solution providers and internet service providers (ISPs),” Ajay Kumar, additional secretary in the ministry of electronics and information technology said.

Kumar said the draft policy will focus on the proprietary steps the country will take in case of a ransomware attack. This will include the steps for the sharing of information to try and restrict the loss as much as possible. A centre of excellence will be set up to find solutions to attacks or neutralise the malware, he added.

The need to set up a safe and secure cyberspace is one the major concerns of the government as it is moving to create a ‘less-cash’ economy. Earlier this year, the government announced the “DigiDhan Mission” to achieve a 25 billion digital transactions target, outlined in the Union budget for this fiscal.

Modi said empowerment through digital access is the aim of the government and digital technology has saved around $10 billion so far by eliminating middlemen.

The MyGov platform is a prime example of how technology strengthens offices. PRAGATI has resulted in faster governance decisions through general consensus, he added.

PRAGATI (Pro-Active Governance And Timely Implementation) is an interactive platform aimed at addressing the common man’s grievances and monitoring and reviewing programmes and projects of the central and state governments.

Umang stands for Unified Mobile Application for New-age Governance. It provides all pan India e-Gov services ranging from central to local government bodies and other citizen-centric services like Aadhaar and Digilocker on one single platform or mobile app.

Modi said, “the app will provide over hundred citizen-centric services. It will automatically add pressure among peers and result in a better performance.”

Law and IT minister Ravi Shankar Prasad, speaking at the event, said privacy of individuals was of utmost importance but “privacy cannot withhold innovation.” He further said the citizens’ right of accessing the internet is “non-negotiable” and the government will not allow any company to restrict people’s entry to the worldwide web.

Speaking on Facebook’s Free Basics programme, Prasad said the government did not allow social networking giant’s programme because it offered access to select internet services. Facebook had introduced its Free Basics programme in India in 2015 to offer free basic internet access to people in partnership with telecom operators. Prasad said the idea behind Free Basics was that everything will be free, namely eduction, health, entertainment and others, if one enters the Net through one gate (Facebook’s).

“I said India is a democracy, we don’t believe in one gate. We believe in multiple gates. Therefore, this gate locking for India will not be accepted and I did not allow it. This stems (from) our commitment that internet must be accessible to all,” he added.

Sri Lankan Prime Minister Ranil Wickremesinghe, who was present at the event, said there was no legal framework on cyberspace and he hoped the conference would lead to a consensus to finalize the terms of the framework. “Our government has a lot more to do in net neutrality but we have taken progressive and revolutionary step in this regard,” added Wickremesinghe.

Wickremesinghe is on a four-day visit to India with the aim of boosting bilateral ties.

On the first day of the conference, India agreed to establish a joint working group with Iran to work in different IT areas.

India will provide technical advice to Mauritius for setting up the digilocker infrastructure. An MoU has been signed with Denmark for future cooperation in the IT sector.

“While a policy on ransomware is welcome, there is much more to be done. Implementation of the 2014 National Cybersecurity Policy has been very slow. Even the simplest bits, such as a secure process for receiving vulnerability disclosure has been lacking,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bengaluru-based think tank.

PTI contributed to this story.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-24-2017-komal-gupta-cyberattacks-a-significant-threat-to-democracy-modi

Privacy issues exist even without Aadhaar

Admin — 2017-11-23T16:12:11Z

There is a critical need for a data privacy regulator to penalize unauthorized disclosure of personal information.

The article by Ronald Abraham was published by Livemint on November 15, 2017.

In part I, I argued that while Aadhaar can be a tool to infringe upon our right to privacy, it is merely one such; there exist other tools that can be similarly exploited. This becomes evident when you analyse each privacy issue related to Aadhaar using the National Privacy Principles framework, and compare Aadhaar’s data privacy risks to other national ID systems. We need an independent data privacy regulator, backed by a robust law, to safeguard against the risks.

Here, we explore two such data privacy issues: data disclosure and voluntariness (database linking was analysed in part I).

Data disclosure

According to the National Privacy Principle on data disclosure, “a data controller shall not disclose personal information to third parties, except after providing notice and seeking informed consent from the individual for such disclosure”.

On paper, the Aadhaar Act appears compliant with this principle as Section 29 prohibits the disclosure of personal information. Exceptions exist for courts to request demographic data, and for joint secretaries and higher ranks to request biometric data; the latter on the grounds of “national security”. However, greater clarity is required on whether individuals will be informed of data disclosures.

In practice, however, data disclosures well beyond these exceptions have taken place. A study by the Centre for Internet and Society found that nearly 130 million Aadhaar numbers had been published online by four government departments. In many cases, these were published along with information on “caste, religion, address, photographs and financial information”. If someone manages to steal these individuals’ fingerprints as well (which is becoming less difficult), one possibility is that Aadhaar-linked bank accounts can be cleaned out using micro-ATMs.

Demographic data disclosure, however, is not limited to Aadhaar. For transparency reasons, state election commission websites disclose the personal information of every person registered to vote online. Agencies scrape these databases and sell them.

Like database linking, the onus of abiding by the principle of data disclosure is on the “data controller”. The four government agencies that disclosed Aadhaar data—not the Unique Identification Authority of India (UIDAI)—are the relevant data controllers in this case. However, UIDAI has not pressed charges against them; under the Aadhaar Act, it is solely authorized to do so. Given UIDAI’s role of working with the government to enable and encourage the use of Aadhaar, it should not also be responsible for regulating them. Additionally, the Election Commission’s data disclosure norms demonstrate that the issue is bigger than Aadhaar.

This, therefore, points to the critical need for a data privacy regulator to investigate and penalize unauthorized disclosure of sensitive personal information. A strong regulator, with a clear law, will also serve as an effective deterrent for negligent disclosure practices.

Voluntariness

The ability to voluntarily opt in and out of data systems, based on informed consent, is central to the National Privacy Principle of “Choice and Consent”. Once an individual opts in, the principle clarifies that they “also have an option to withdraw (their) consent given earlier to the data controller”.

With regard to opting in, UIDAI has maintained that Aadhaar enrolment is voluntary. However, Section 7 of the Aadhaar Act and various orders by government agencies require Aadhaar to access basic services. Though exceptions are allowed, in practice they are implemented inconsistently, making Aadhaar near-mandatory.

To be sure, the choice principle states that data controllers can choose not to provide services if an individual doesn’t consent to provide data, “if such information is necessary for providing the goods or services”. However, we need more explicit guidelines on what features satisfy this condition, something that can be defined in a data privacy law.

With regard to opting out, no such UIDAI provision exists. One argument is that more data increases UIDAI’s capability to establish the uniqueness of new enrollees. However, it is unclear why this is the case because even if millions opt out of Aadhaar, UIDAI’s ability to guarantee the uniqueness of new enrollees compared to existing enrollees doesn’t diminish.

While voluntariness is actively discussed with Aadhaar, the same is not true for other IDs and data initiatives. For example, fingerprints are collected to issue Indian passports, but the use of this is not clear—raising concerns around voluntariness as well as purpose limitation.

Through this analysis, it becomes clear that data privacy issues exist even without Aadhaar. To tackle the risks to privacy, India requires a strong, competent and independent data privacy regulator, backed by a robust law.

With the recent Supreme Court judgement and upcoming hearings, we have a unique opportunity to strengthen our institutional ability to manage future risks. We must seize this opportunity to try and secure a privacy-protected future.

Ronald Abraham is a partner at IDinsight and co-author of ‘State of Aadhaar’ report 2016-17.

Research contributions from Shreya Dubey and Akash Pattanayak.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-23-2017-ronald-abraham-privacy-issues-exist-even-without-aadhaar

Financial CERT to combat cyber threats, says MoS home affairs

Admin — 2017-11-23T16:07:21Z

To tackle cyber threats to India’s financial institutions, the central government is mulling to establish a financial Computer Emergency Response Team (CERT).

This was published by CISO MAG on November 17, 2017

Addressing the 15th Asia Pacific Computer Emergency Response Team (APCERT) Open Conference in New Delhi on November 15, 2017, IT Secretary Ajay Prakash Sawhney said, “right now, the one which is directly being worked on is the financial CERT. We are getting the framework in place and once that is there, we will look at other sectors. It will oversee the entire financial sector including banks and financial institutions.”

In March this year, the power ministry had announced to create four sectoral CERTs for cybersecurity in power systems: CERT (Transmission), CERT (Thermal), CERT (Hydro), and CERT (Distribution).

Udbhav Tiwari, program manager at the Centre for Internet and Society, a Bengaluru-based think tank, highlighted the responsibilities of the financial CERT in a conversation with Live Mint. “The biggest task of sectoral CERT is to share information with the others in the industry. For example, if a bank undergoes an attack, normally the bank will perform all the necessary actions to limit the attack and to prevent it from happening in the future. But the obligation of sharing how the attack happened with all the other banks in India to make sure that they can protect their respective systems from such an attack, can be carried out by a financial CERT,” he said.

Cybersecurity Chief Gulshan Rai, who was also present at the event, said “from April to October 2017, around 50,000 cyber security incidents have been handled by CERT-In; including phishing, malware attacks, attacks on digital payments and targeted attacks on some of the critical industries.”

On August 1, 2017, MoS home affairs Hansraj Gangaram Ahir had said “as per the information by the Indian computer emergency response team (CERT-In), 50 incidents affecting 19 financial organizations have been reported during the period of November, 2016 to June, 2017.”

For more details visit https://cis-india.org/internet-governance/news/ciso-mag-financial-cert-to-combat-cyber-threats-says-mos-home-affairs

Global Commission on the Stability of Cyberspace (GCSC)

Admin — 2017-11-23T14:38:12Z

The Global Commission on the Stability of Cyberspace organized a meeting on November 21, 2017 in New Delhi. The meeting took place at Taj Diplomatic Enclave Hotel on the sidelines of the 5th Global Conference on Cyberspace. Pranesh Prakash participated in the event.

GSC commissioners engaged in discussions with leading experts on cyber diplomacy, cyber norms and counter-proliferation. See the Draft Agenda here.

For more details visit https://cis-india.org/internet-governance/news/global-commission-on-the-stability-of-cyberspace-gcsc

Counter Comments on TRAI's Consultation Paper on Privacy, Security and Ownership of Data in Telecom Sector

amber — 2017-11-23T14:29:06Z

The Centre for Internet & Society (CIS) has commented on the Consultation Paper on Privacy, Security and Ownership of Data in Telecom Sector published by the Telecom Regulatory Authority of India on August 9, 2017.

The submission is divided in three main parts. The first part 'Preliminary' introduces the document. The second part 'About CIS' is an overview of the organization. The third part contains the 'Counter Comments' on the Consultation Paper taking into account the submission made by other stakeholders.

Download the full submission here

For more details visit https://cis-india.org/internet-governance/blog/counter-comments-on-trais-consultation-paper-on-privacy-security-and-ownership-of-data-in-telecom-sector

Elements of a Decentralized Web

Admin — 2017-11-23T14:16:26Z

Gene Kogan will deliver a talk on the elements of a decentralized web at the Centre for Internet (CIS) office in Bengaluru on December 11, 5.30 p.m. to 7.30 p.m.

The internet is broken. Straying far from the original vision of democratizing access to knowledge, large tech companies now resemble the industrial barons of the 19th century, presiding over what many scholars regard as a public utility but nevertheless unregulated. As machine learning has entered the picture, the usual suspects like Facebook, Reddit, and Quora, have begun training sophisticated algorithms on personal data to route traffic in order to maximize attention, leading to a web which is more atomized, addictive, and anxiety-inducing.

In response to this, some have begun writing about, conceptualizing, and implementing the open-source protocols of what they consider the future web 3.0. Cryptocurrency enthusiasts have expanded their focus to more generalized blockchains which enable trust in decentralized platforms, while initiatives like IPDB and IPFS ambitiously promise to make hosting, storage, database querying, and even computation itself possible inside of peer-to-peer networks. But all is not well in this techno-utopia -- as the speculative bubble around this "internet of money" grows, so too does interest from the very institutions these new initiatives seek to overcome. The landscape is beginning to look like Silicon Valley of the 1990s and the threat of a crash looms. It's up to us to determine which way this one will play out.

Gene Kogan

Gene Kogan is an artist and a programmer who is interested in generative systems, computer science, and software for creativity and self-expression. He is a collaborator within numerous open-source software projects, and gives workshops and lectures on topics at the intersection of code and art. Gene initiated ml4a, a free book about machine learning for artists, activists, and citizen scientists, and regularly publishes video lectures, writings, and tutorials to facilitate a greater public understanding of the subject.

Links:

genekogan.com

twitter.com/genekogan

For more details visit https://cis-india.org/internet-governance/events/elements-of-a-decentralized-web-talk-by-gene-kogan

India’s internet missionaries: The women Google is relying on to spread its Next Billion message

Admin — 2017-11-23T02:33:35Z

Google’s internet saathis have brought 11.5 million women in 105,000 villages online. But there’s a catch: the women are taught to use only Google products.

The article by Sunny Sen was published by Livemint on November 21, 2017.

Until Google came calling at Khaula, one of the nearly 100,000 villages in Uttar Pradesh, early in 2016, few among the womenfolk there had heard about the internet. A few had seen their men watching videos on smartphones, but none had accessed the internet on her own.

Now, more than 1,100 women in Khaula and neighbouring villages know how to access the internet and regularly log in. They teach their children, they teach themselves new skills, they look up fixes to niggling medical problems, and watch YouTube videos.

Khaula is ground zero for an ambitious Google initiative called Next Billion to spread use of the internet in developing economies. The initiative rides on the shoulders of women—internet saathis, who have been roped in to carry the “here’s how to access the internet” message across India. The success or failure of the saathis (saathi means friend in Hindi) in the internet literacy project will make or break the programme.

India, whose over 400 million data consumers make it the No. 2 market by internet users, only behind China, is the top focus country in the Next Billion programme. The project also covers Brazil, Indonesia, Nigeria, and parts of Africa.

The internet saathi programme, run by Google along with Tata Trusts is designed in such a way that two-three women in a village are handpicked and trained to use the internet. They, then, further train thousands of village women—not men—on how to access it. This design is with good reason: less than one-third of internet users in India are women and the number is far lower in its villages, explained Rajan Anandan, Google’s vice president for Southeast Asia and India, in a Mint newspaper article in April.

Neetu’s story

Four years ago, Neetu Bhagour, now 22, had made news in the village when she won a state-level wrestling event and was selected at the national level. But, she never made it to the nationals. “My parents didn’t allow me to… girls in our villages are not allowed to play much,” Bhagour said, her disappointment showing in her smile.

After leaving wrestling, she decided to pursue studies. The college was far away from the village and she didn’t attend every day, yet completed her graduation in science earlier this year—one of the few to do so in Khaula.

It was on one of the days she was home, bunking college, that her uncle told her that if she had time, she could teach village women how to access the internet. That was about one-and-a-half years ago.

“I had only seen my brother using (the internet). He had an Android phone, but he would never let us use it,” Bhagour said. “I decided to learn how to use the internet. People from Google trained us for three-four days… That was the first time I used the internet.”

Google gave her a Lava smartphone and a Celkon tablet—both entry-level brands—to use and train other village women. The cost of the two devices was around Rs11,000, a price that the women of Khaula would perhaps never be able to afford. The trainers also get an umbrella and 2GB of monthly data for each device—all provided by Google.

Till now Google has spent about Rs50 crore on training 35,000 saathis. That’s a tab of between Rs14,000 and Rs15,000 per saathi which includes the Rs11,000 spent on the devices, umbrella and data.

It was not easy for Bhagour to convince women in her village that learning to access the internet would be useful. Often they would scoff at her: “We don’t need it.” She stayed persistent. “It’s okay if you don’t need the internet, but teach it to your children,” she told them. “Use Google to know anything in this world.”

Next billion

Bhagour is one of the 35,000 internet saathis in India Google is backing. And, in a move atypical of the search giant, it is pouring crores of rupees training them. “Tata Trusts are equally funding the initiative for us. Google brings in the devices, the data, and the technical know-how of training the saathis. And Tata Trusts are managing the on-ground implementation, the saathi stipend,” said Neha Barjatya, head of ads marketing & digitizing initiatives, Google India.

The saathis are trained on how the web works, especially how to use various Google products such as Chrome, Search, YouTube, and PlayStore. They are not trained to use any other product, not Facebook or WhatsApp.

Since the beginning of the internet saathis project in 2015, Google has covered 105,000 villages in 12 states and taught 11.5 million women how to use the internet—making it the biggest project by Google under its Next Billion initiative and perhaps the single largest such outreach programme anywhere in the world.

Google wants to take the programme to 300,000 villages. “These women discover the internet (through Google and its products), and eventually discover how to use the internet for their needs,” said Barjatya.

Internet hard-sell

It wasn’t easy for Bhagour or any of the other saathis, initially.

Deepa Rajput of Dehtora village (near Khaula) is a Ph.D in Hindi. She teaches at the Shree Jagdamba Degree College in Agra. She was introduced to the internet saathi initiative by a friend of her husband’s. “Our family is one of the progressive ones in the village, so it was easy to convince my in-laws,” said Rajput.

But when she went out to teach, it was a problem. At the start, women didn’t allow her to take their picture, which is needed to enrol them in the programme. Some even refused to fill the enrolment form.

Rajput’s pitch was simple, yet compelling. “Google pe saara vishwa ka jankari prapt kar sakte hai… Agar aapka bhains bimar ho jata hai toh aap uske karan dekh sakte hai (You can find the entire world’s information on Google… If your buffalo falls sick, you find the reasons there),” she told the village women.

Most women liked the idea but they had to take the permission of their in-laws and husbands. “Women are weak… their survival depends on how much their husbands provide,” Rajput said.

When Google first went to a few villages in 2013, it started by training women directly for three-four hours. This was done at a school or the village community centre. It didn’t work out. The turnout was dismal. Folks at Google knew that they had to fix it if they had to expand beyond towns.

A pilot was done in a village near the Maheshwar town in Madhya Pradesh. Google piloted something called the internet cart, like an ice cream cart, which had internet-enabled tablets. Google-contracted agents would go from village to village, home to home, with these carts and teach the village women how to use the internet.

But, even that wasn’t enough. Google realized that it was important to stay in the village for a long period of time and keep training the women. That’s when the internet saathi concept was born.

The other problem was that women didn’t have devices to access the internet on. So Google gave them devices and free data. In 2015, Google and Tata Trusts started identifying trainers. Initially, Google also provided the saathis with a cycle in 1,500 villages, but stopped it as the women preferred walking.

Changing lives

For many of these beneficiaries, the internet is the only form of empowerment. For Deepmala, a primary school teacher in Atus village not far from Khaula, the internet helps her children learn English. “Children often ask things we don’t know… I have started using Google to explain things to children,” she said.

Deepmala’s first acquaintance with the internet was when she enrolled to become a saathi. She has trained 1,500 women since then. It wasn’t easy to convince her husband to allow her to learn how to use the internet but his mother stepped in. “My mother-in-law allowed me to learn… she used to go with me for the training,” she said.

For all the world that the internet has opened up for her, some centuries-old habits haven’t changed. Deepmala doesn’t know much about her husband’s work or what he earns. All she knows is that her husband works in a shoe factory near Agra. Without her mother-in-law’s backing, Deepmala said, she wouldn’t have been able to become a saathi.

When she showed the village women the internet, they were initially afraid to use it. There are a lot of myths about the ills of the internet in the villages. Rightly so, as often boys and men in the villages click pictures of girls and upload them to porn sites.

Women are shy and shun anything that may intrude on their privacy. It is in such a context that the world of information—access to Bollywood, culture, lifestyle, pornography, information, email, voice calling, and dozens of applications—suddenly opened up to them.

The saathis need to have a minimum education of up to Class VIII and should be comfortable with English. But there are no restrictions on the saathis to pick educated women. Many of their students don’t know how to read or write. For them, Deepa Rajput of Dehtora village said, Google voice commands are the easiest way to search the internet. “Women are seeing videos condemning domestic violence and oppression of women… That is a big change,” she said.

Making money

Deepmala, the school teacher saathi, taught women to search for mehendi designs and facial makeup on Google and YouTube. “Some of them have even started searching new salwar and blouse designs… The women tailors make more money for these designs,” she said.

Some women have started charging Rs50 for drawing mehendi designs. Others have started using the internet to look for agriculture and health-related information.

There are other avenues of making money, too. Deepmala and few of the women she trained landed a contract from research firm Nielsen to do a survey of the villages and the shops, for which they were paid. A list of 96 shops was given to them with a list of 80 questions. “The form was on the internet, we surveyed these villages and filled the form. It was about things like what products are sold, which shops have shut down, updating contact information…,” said Deepmala.

Monica Sisodiya from Barhan village has trained 2,000 women, most of them who are young. After being trained by Monica, two of them opened a beauty parlour. “She gets customers from 10-12 villages because of the new ways she has introduced,” said Monica, who wanted to study law in Agra, but couldn’t because her family wouldn’t allow her to go to the city. She is now pursuing a nursing course at Maa Bhagwati College, 7km from her home.

Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Others like Babita Singh are evidence that the lack of information access is not a problem of the poor alone. Babita, 20, whose father is an intelligence officer with the Uttar Pradesh police, lives in a house that is prosperous by Dehtora standards. Her house has four CCTV cameras monitoring the front and rear of the building. The images are captured on a 42-inch LED television on the living room wall.

Yet, Babita used the internet for the first time only four months ago after getting trained by Deepa. Babita refers to the Chrome browser as ‘kromee’. She said she uses the internet to fill forms for banking entrance exams. At leisure, she browses designs of cushion covers and sweaters and tries out new food recipes that she pulls up from the Net.

Babita’s neighbour, Malti Rajput, teaches in a school for the mentally challenged in a nearby village. She isn’t well off and got her first phone from Google.

“We have started using the internet in our schools to teach the children dance steps… They also see craft designs. We sell some of these products to raise some money for the children,” said Malti.

It’s business, of course

For Google, this is not any corporate social responsibility activity. It is about getting every individual in India online. “This is not a social initiative for us. It is very much a business or marketing objective,” said Barjatya.

Getting more people to use the internet lies at the heart of Google’s business. Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Barjatya said Google does not measure what it is getting back from the initiative. “It’s very much to get these women online and the rest will follow,” she said. “We are only seeing how many villages and how many women are coming online, and how does it tie back into our Next Billion initiative.”

But experts say Google alone can’t change rural India. “Google is probably worried that rural India might end up like Myanmar where most users stay within Facebook and do not explore the rest of the internet,” said Sunil Abraham, executive director of Bengaluru-based research organization Centre for Internet and Society.

Click here for enlarge

Moving the needle

All the saathis FactorDaily spoke with said that at their training sessions they are taught only how to use Google products, apart from handling the hardware. Those, too, only on Android phones. No Facebook, no WhatsApp, no Snapchat, no Twitter, no Paytm, no Flipkart...

“This is a smart business decision for Google but it does not really bridge the digital divide. We need all stakeholders, including Google to work together to reduce the cost of hardware and connectivity,” Abraham said.

Still, a Google-commissioned study by research firm Ipsos suggests that the internet giant has made some headway in rural India. Here are some pointers from the study:

■ 90% of women who have attended the training have a better understanding of the internet

■ 25% of women continue to use the internet (Gujarat is the highest at 35%)

■ 7% of women trained under the program feel that their social standing has improved

■ 33% trained women think that their economic condition has improved by learning new skills

■ 1% increase in village income in instances where training was conducted

Even though most of the women are not taught to use Facebook and WhatsApp, most of them eventually get on to social media. This is little consolation for Facebook, which has failed to mainstream itself in rural India the way Google has.

While Google gets a large number of the first-time users, some of the women have also started buying things online. Mamta Mahour of Bijpuri village bought earphones and books from Amazon and a saree from Voonik. The products are delivered at one of the shops in the village and Mamta collects it from there.

Some of the households have also started disconnecting their cable connections, said Mamta. Her’s and Deepmala’s houses are two, for instance. Deepmala watches ‘Piya Albela’ and ‘Big Boss’ on YouTube. “We can watch it anytime. There is so much (power) load-shedding that you can’t watch an entire episode on television… that’s not the case on YouTube,” she said.

Slow going

Mamta has taken a Reliance Jio connection. She watches her shows on JioTV and YouTube. “JioTV is free. I don’t see the need of having a cable connection at home. Rather I would use that money to recharge my phone,” she said.

Still, the going is grindingly slow. While Google has been successful in teaching women in these villages to use the internet, three out of four stop using the internet after the training.

When the saathi project started, internet penetration in villages was about 10%, said Barjatya. A recent report by industry lobby Internet and Mobile Association of India and market researcher Kantar IMRB shows that it has gone up to 17%.

Barjatya said Google spent a lot of time understanding the needs of the rural India. These 11.5 million women trained by Google have at least been introduced to the internet. “Over time we have seen that they have found value in going and buying a smartphone,” Barjatya is optimistic.

The data story in India is changing, especially after the launch of Reliance Jio. Google is already in talks with Reliance Jio to provide 4GB of 4G data at Rs149 a month to the saathis. Right now it is 2GB of 2G data.

The feedback from the saathis, meanwhile, is that the training module needs to change: the time is too short to train someone who had never used the internet, according to them. The saathis were given the target of training 250 women in a week, based on which they would receive a stipend from Tata Trust. It varies between Rs4 and Rs8 for each woman trained.

Barjatya said the target has been brought down to 100 women a month.

Changing data story

While Google has set up a call centre to check how many beneficiaries use the internet after training, there is no way it can ensure that women continue to use it. Call centre agents make random calls to check if the training is sufficient and if they are using the internet. Google might also contemplate returning to the same village to train more women.

Also, very few women own devices in male-dominated rural Indian society. “We haven’t really got into creating access beyond spreading awareness. However, yes, this is something we are open to and can consider. But right now it is just the literacy part,” Barjatya said, talking about subsidising mobile phones for women in villages.

In the next two years, Google will need more devices and more data. For its target of covering 300,000 villages, it will need an army of about 100,000 saathis— nearly a 10-fold jump.

Meanwhile, back at Khaula, Bhagour, the former wrestler, has started studying for the entrance test to join Delhi police. YouTube, she said, is handy for her studies. She is learning tricks to solve math problems quicker. Something else happened on Dhanteras, the festival to worship wealth, that made Bhagour proud.

“I got Rs4,211 for training the women. I got the money on the day of Dhanteras,” she said. “I gave the money to my father to get the house painted.”

This story has been published in association with FactorDaily.

For more details visit https://cis-india.org/internet-governance/news/sunny-sen-livemint-november-23-2017-indias-internet-missionaries

Aadhaar seeding: benefits and concerns

Admin — 2017-11-23T02:02:45Z

Products and services such as bank accounts, life insurance policies and phone connections have to be linked with Aadhaar. But is this of any real help?

The article by Shaikh Zoaib Saleem was published by Livemint on November 14, 2017.

The government has made it mandatory for consumers to link many important services with Aadhaar. You too may be getting frequent reminders to link your banks account, mutual fund and mobile number with Aadhaar. Recently, the Reserve Bank of India also clarified that it is mandatory to link bank accounts with Aadhaar.

The latest addition to this list are insurance policies. In a circular, the Insurance Regulatory and Development Authority of India (Irdai) has stated that linking of Aadhaar number to insurance policies is mandatory under the Prevention of Money-laundering (Maintenance of Records) Second Amendment Rules, 2017.

The issue is being discussed intensively, with the Supreme Court taking a decision in favour of linking Aadhaar biometrics and the number with a host of services. Several petitions have been filed challenging not just the linking of these services with Aadhaar but also the validity of Aadhaar itself. We spoke to people who support and those who oppose this linking, to understand how either case impacts consumers.

The benefits

According to the Unique Identification Authority of India (UIDAI), government schemes are asking for Aadhaar as it helps to clean out duplications and fakes, and provides accurate data to enable implementation of direct benefit programmes. “Use of Aadhaar reduces the cost of identifying persons and provides increased transparency to the government in implementation of its schemes,” the Authority states under frequently asked questions on its website (read more at: https://uidai.gov.in/your-aadhaar/help/faqs.html) So, when you link your bank account with your Aadhaar, government benefits such as subsidy on LPG cylinders is credited directly to that account. The FAQs, however, do not elaborate how such linking helps an individual who does not get, or does not wish to get, such subsidies. In a tweet, UIDAI had said that verifying a bank account using Aadhaar adds an additional layer of security.

Nakul Saxena, a former banker who now works on policy advocacy at the software think tank iSpirt Foundation, said that linking of Aadhaar with these services will help eradicate fake accounts, fake insurance policies and unauthorised mobile connections. “It is possible that there are many accounts in the system that have been opened using such documents and copied signatures and even the banks may not be aware of it. Some people may not even be aware that an account exists in their name. These accounts need to be verified using Aadhaar now,” he said.

The government claims to have removed millions of fake beneficiaries for government benefits by Aadhaar linking. As reported by Mint in May 2017, over 23 million fake ration cards have been scrapped, potentially saving the government Rs14,000 crore in food subsidy every year. Another Mint report in August says, three states discovered that about 2,72,000 fake students were availing the mid-day meal (MDM) scheme.

However, those who are against linking Aadhaar disagree with these arguments. “Initially, Aadhaar was about delivery of services. But linking everybody’s phone number and bank account is not about that anymore. The real question is, what purpose this linking serves. If the intention is to update the databases, then there can be other means to update those,” said Rahul Narayan, a Supreme Court advocate who is among the lawyers representing petitioners who have challenged Aadhaar linking in court.

The concerns

The fundamental objection to this linking of services is that all information on an individual will be available at a single place, which could make surveillance easier and also increase the risks if this information is hacked. “As of now, your bank knows something about you, your insurance company knows something and your mobile phone company knows something about you. Each of these are different silos of information. When these converge, which is then accessible to a single person, that person knows almost everything about you,” said Narayan.

Moreover, a user’s Aadhaar number and fingerprint are permanent identifiers, and at least the Aadhaar number has been compromised for over 130 million citizens, as per a study by Centre for Internet & Society, said Nikhil Pahwa, co-founder of the SaveTheInternet.in (https://internetfreedom.in) campaign for net neutrality in India. “This leaves the users vulnerable to social hacks, some of which we have already been reading about in the news. To forcefully and mandatorily link Aadhaar to bank accounts means that their finances are at risk,” he said.

Saxena said the data leaks that have been highlighted have been typically about demographic details such as name, date of birth and address “which have been commonly available so far.” However, given the heightened sensitivities in this digital age, customers must ask their service providers to not publish such details, nor provide this information freely, he added.

Grievance redressal and data privacy

Another major concern is the absence of a clear redressal mechanisms for consumers in case of a data leak, misuse or hack. “When things go wrong, consumers need to have access to a proper complaints mechanism. In the case of Aadhaar, such access is to be provided through the establishment of ‘contact centres’ under the Regulation 32 of the UIDAI Enrolment and Update Regulations. To the best of our knowledge, not much beyond Regulation 32 has yet been specified by the UIDAI,” said Renuka Sane, associate professor at the National Institute of Public Finance and Policy, who has worked on data privacy and security issues.

Apart from this, Section 47 of the Aadhaar Act stipulates that only UIDAI or its authorised officers can file a criminal complaint for violations of the Act, she added.

“The UIDAI has been given complete discretion in determining if and when to file a criminal complaint for violations of the Act, and an individual aggrieved by actions of a third person is left to rely upon the bonafide actions of the UIDAI,” Sane added. The government is also working towards a data privacy legislation, that is needed to give citizens protection against misuse of their data, and them having some control over who gets their data, how it is used, and where it can be shared. “However, a data privacy legislation and mechanism will not ensure that data remains secure and protected, and that processes are followed. The Act disallowing people from sharing Aadhaar numbers did not prevent government departments from publishing details online,” said Pahwa. He also said that systems can get hacked, which could include the Aadhaar database, the parallel Aadhaar databases with state governments, or eKYC databases held with banks and telecom operators.

Saxena said the UIDAI has clarified that biometric information is not stored with user agencies, and stored biometrics can't be used for Aadhaar authentication or eKYC. “Hence, customers can be assured when using Aadhaar and biometrics with authorized entities,” he said. “The data privacy law will address data privacy and protection in all digital systems, not just Aadhaar. It will equally apply to social media and mobile apps. It should also go into the aspect of ‘right to be forgotten’,” said Saxena.

Pahwa, however, insists that the least that should be done is to give citizens the right to not link their Aadhaar and use other IDs for authentication, plus the ability to change their ID number if the system gets compromised.

What you should do

For now, the deadlines for linking bank accounts with Aadhaar is 31 December 2017, and for mobile phones it is 7 February 2018. In its latest hearing on the matter, the Supreme Court has directed service providers to mention these deadlines in their reminders. “Right now, regardless of what they say, nobody is going to shut down your bank account or disconnect your mobile connection, at least till the deadline. There are several petitions being heard in the Supreme Court. The matter is supposed to be taken up by the Supreme Court in the last week of November. The final word from the court is yet to come and it is quite possible that at least the deadlines gets extended,” said Narayan.

If you have already linked these services with Aadhaar, you are in no trouble. But if you are having second thoughts, the linking cannot be undone. If you are concerned about safety or other aspects, you can wait to get more clarity from the Supreme Court.

For more details visit https://cis-india.org/internet-governance/news/shaikh-zoaib-saleem-livemint-november-14-2017-aadhaar-seeding-benefits-and-concerns

UIDAI admits 210 government websites made Aadhaar details public

Admin — 2017-11-21T16:03:29Z

The Unique Identification Authority of India (UIDAI) has admitted that Aadhaar details were leaked on over 200 central and state government websites.

The article was published in the Financial Express on November 20, 2017.

The Unique Identification Authority of India (UIDAI) has admitted that Aadhaar details were made public on over 200 central and state government websites. According to an RTI reply, these websites publicly displayed name, address and other details of Aadhaar beneficiaries, which was removed when the breach was identified.

However, UIDAI does not have information about the time of the breach. It also said that Aadhaar details have never been made public by UIDAI. “However, it was found that approximately 210 websites of the central government, state government departments including educational institutes were displaying the list of beneficiaries along with their name, address, other details and Aadhaar numbers for information of the general public,” it said.

UIDAI issues Aadhaar — a 12-digit unique identification number — which acts as a proof of identity and addresses anywhere in the country. Lately, Aadhaar has been creating furore for security and privacy reasons, especially after the Narendra Modi government began aggressively pushing the identification number to be linked with social benefits, banks, PAN, mobile number et al. In a landmark judgement this August, the Supreme Court ruled that privacy was a fundamental right of citizens, weakening the case for pushing Aadhar.

Currently, cases are being heard in the apex court on linking Aadhaar to banks and mobile numbers. In May, the Centre for Internet and Society had claimed that Aadhaar numbers of as many as 135 millions could have been leaked. “Based on the numbers available on the websites looked at, the estimated number of Aadhaar numbers leaked through these four portals could be around 130-135 million,” the report by CIS had said. Further, as many as 100 million bank account numbers could have been “leaked” from the four portals, it had added.

UIDAI and the government had been vehemently denying that Aadhaar details can be leaked despite apprehension from different sections of society. Soon after the RTI reply appeared in media, UIDAI refuted the news of leaks, calling it a “skewed presentation of facts. “Such report is a skewed presentation of the facts and poses as if the Aadhaar data is breached or leaked which is not the true presentation. Aadhaar data is fully safe and secure and there has been no data leak or breach at UIDAI,” press release by PIB said.

It said that the data on these websites was placed in public domain as a measure of proactive disclosure under the RTI Act.

For more details visit https://cis-india.org/internet-governance/news/financial-express-november-20-2017-government-websites-made-aadhaar-details-public

National Privacy Workshop

Admin — 2017-12-05T14:24:16Z

Centre for Internet & Society is organizing a round-table to discuss the potential impact of numerous policy developments with wide ranging implications for recognition and governance of privacy in India. The round-table will be held on December 9, 2017 at India International Centre in New Delhi, 10.30 a.m. to 5.00 p.m.

Background

The recent past in India has seen numerous policy developments with wide ranging implications for recognition and governance of privacy in India. The emphatic and unanimous avowal of the right to privacy by the Supreme Court, the government’s stated commitment to a data protection law and the formation of the Sri Krishna Committee are developments which will continue to inform policymaking around privacy in India for a long time to come. The Supreme Court’s conception of a robust right to privacy encompassing different element - spatial, decisional and informational, and its guidance on strict limiting tests may have a wide impact on a range of issues. The impact of this judgment and a data protection law on informational privacy in India will be immense and it is important to delve in challenges and issues that it may throw up. In last year, we have also seen instances of purported conflict between the transparency instruments such as the right to information and the right to informational privacy. How these conflicts are resolved in law and practice will be key to these two essential human rights in the modern information society. Further, while these general consensus on privacy principles, the appropriate ways to govern and enforce privacy remains an open issue, and the success of any data protection framework will depend as much on what kind of privacy governance models are adopted.This roundtable will look to discuss the potential impact of these policy decisions, what theories should guide the data protection law in India, what models of privacy governance are workable and how privacy can co-exist with transparency principle and robust RTI regime.

Agenda

10.30 - 11.00	Tea
11.00 - 11.30	Welcome and setting the scene
11.30 - 12.30	Session 1: Policy Developments around Informational Privacy in India What do different policy developments indicate about privacy in India? What are the (potential) impacts of these developments? What questions are being asked and are these the right questions to ask? How do we expect the ‘state of privacy’ to change in India in response to these policy developments?
12.30 - 13.30	Session 2: Approaches to Privacy and Data Protection for India What are different approaches to privacy and government the Indian government can take? What cultural/political etc. aspects should be taken into consideration when thinking through this question? What are the pros and cons to different approaches? What are the pros and cons to the below approaches: - Privacy as control - Data as property - Utilitarian approaches - Technological Solutions
13.30 - 14.30	Lunch
14.30 - 15.30	Session 3: Transparency and Privacy How can transparency from the private sector enable the right to privacy? What are key principles that can guide this relationship? Where is transparency from the private sector most needed with respect to privacy? What are incentives that governments can adopt to encourage privacy?
15.30 - 16.30	Governance Models for Data Protection What kind of institutional framework is required for governance of privacy in India? How do we address questions of liability, penalties and enforcement? What role do sectoral players have in a data governance framework? What is best way for other stakeholders like industry, civil society and academia in collaborative governance of privacy?
16.30 - 17.00	Tea and snacks

Speakers

Usha Ramanathan
Rahul Sharma
Apar Gupta
Malavika Raghavan
Shankar Narayanan
Ujwala Uppaluri
Rebecca MacKinnon
Nikhil Pahwa
Kamlesh Bajaj
Manasa Venkatraman
Smitha K Prasad

Download the Agenda

For more details visit https://cis-india.org/internet-governance/events/national-privacy-workshop-at-india-international-centre

Breach Notifications: A Step towards Cyber Security for Consumers and Citizens

Amelia Andersdotter — 2017-11-14T15:38:15Z

Through the Digital India project the Indian government is seeking to establish India as a digital nation at the forefront. Increasingly, this means having good cyber-security policies in place and enabling a prosperous business environment for companies that implement sound cyber-security policies. This paper will look at one such policy, which enables investments in cyber-security for IT products and services through giving consumers a way to hold business owners and public authorities to account when their security fails.

Electronic data processing has awarded societies with lots of opportunities for improvements that would not have been possible without them. Low market entrance barriers for new innovators have caused a flood of applications and automations that have the potential to improve citizens’ and consumers’ lives, as well as government operations. But while the increasing prevalence of electronic hardware and programmable software in many different parts of society and industry, combined with the intricate value chains of international communications networks, devices and equipment markets and software markets, have created a large number of opportunities for economic, social and public activity, they have also brought with them a number of specific problems pertaining to consumer rights.

Read full report here

For more details visit https://cis-india.org/internet-governance/blog/breach-notifications-a-step-towards-cyber-security-for-consumers-and-citizens

Cross Border Sharing of Data: Challenges and Solutions

Admin — 2017-11-20T15:20:18Z

Centre for Internet & Society (CIS) has been following the debates around MLAT process taking place globally and researching potential areas of tension in the tools that India uses to access data across borders. As part of this research, CIS is hosting a workshop on cross border sharing of data on December 8, 2017 at India Islamic Centre from 10.30 a.m. to 5.00 p.m.

For more details visit https://cis-india.org/internet-governance/events/cross-border-sharing-of-data-challenges-and-solutions