We are anonymous, we are legion

Revisiting Aadhaar: Law, Tech and Beyond

praskrishna — 2017-05-19T14:47:32Z

Udbhav Tiwari attended a panel on "Revisiting Aadhaar: Law, Tech and Beyond" held at the India International Centre Annexe on May 9, 2017 in New Delhi, organised by the Software Freedom Law Centre (SFLC.in) in collaboration with Digital Empowerment Foundation and IT for Change.

The panel consisted of:

Saikat Datta; Policy Director, Centre for Internet and Society (Moderator)
Anivar Aravind; Founder/Director at Indic Project
Anupam Saraph; Professor and Future Designer
Prasanna S; Advocate
Shyam Divan; Senior Advocate, Supreme Court
Srinivas Kodali; Co-founder at Open Stats
Osama Manzar; Founder and Director, Digital Empowerment Foundation
Usha Ramanathan; Legal Researcher

The panel was quite enlightening (and Saikat was a stellar moderator), with Mr. Divan's elucidation on the arguments made in the court for the Aadhaar case in particular being a great learning experience. Benjamin and Sheetal (both interns in the Delhi office) along with Sumandro also attended the event.

The other learning was that for people who have attended multiple such panels/seminars and meetings on Aadhaar, they can have a lot of repeated content. I passed on the feedback to SFLC about how they could possibly include a small 10 to 15 minute session in future such panels on developments since the previous such event on the Aadhaar and include practical aspects about what people can do about minimising the harms that we are all slowly being co opted into facing with the system.

More info about the event here.

For more details visit https://cis-india.org/internet-governance/news/revisiting-aadhaar-law-tech-and-beyond

Revenge Porn Laws across the World

Shradha Nigam — 2018-04-25T16:58:26Z

The following is a compilation of laws dealing with revenge porn if and how they exist across multiple countries and jurisdictions.

Country-wise legislation on “revenge porn” laws, click to download the file (PDF, 636 Kb)

Europe

United Kingdom
England and Wales
Scotland
Northern Ireland
Malta
Germany
France

United States of America

Alabama
Alaska
Arizona
Arkansas
California
Colorado
Connecticut
Delaware
District of Columbia
Florida
Georgia
Hawaii
Idaho
Illinois
Iowa
Kansas
Louisiana
Maine
Maryland
Michigan
Minnesota
Nevada
New Hampshire
New Jersey
New Mexico
North Carolina
North Dakota
Oklahoma
Oregon
Pennsylvania
South Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Washington
West Virginia. 20
Wisconsin. 20

Australia

New South Wales
South Australia.
Western Australia
Victoria

Asia and Rest of the World

Canada
Philippines
Israel
Japan

1. Europe

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
United Kingdom
England and Wales	Section 33, Criminal Justice and Courts Act 2015	2015	Makes it an offence in England and Wales to disclose private sexual photographs and films without the consent of the individual depicted and with the intent to cause distress.	There is a maximum sentence of two years imprisonment	A call has been made to cover a wider range of offences through enactment of a new Act. The law is not applicable retroactively.
Scotland	Part 1, Section 2, Abusive Behaviour and Sexual Harm Act, 2016	2016	A person (“A”) commits an offence if— (a)A discloses, or threatens to disclose, a photograph or film which shows, or appears to show, another person (“B”) in an intimate situation, (b)by doing so, A intends to cause B fear, alarm or distress or A is reckless as to whether B will be caused fear, alarm or distress, and (c)the photograph or film has not previously been disclosed to the public at large, or any section of the public, by B or with B’s consent.	A person who commits such an offence is liable— (a)on summary conviction, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both), (b) on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).
Northern Ireland	Part 3, Section 51, Amendment to Justice Act	2016	It is an offence for a person to disclose a private sexual photograph or film if the disclosure is made— (a)without the consent of an individual who appears in the photograph or film, and (b)with the intention of causing that individual distress.	A person guilty of an offence under this section is liable— (a) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both), and (b) on summary conviction, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both).
Malta	Article 208E, Maltese Criminal Code 2016	2016	It punishes whoever, with an intent to cause distress, emotional harm or harm of any nature, discloses a private sexual photograph or film without the consent of the person or persons displayed or depicted in such photograph or film.	Such person would, on conviction be liable to imprisonment for a term of up to two years or to a fine of not less than €,3000 and not more than €5,000, or to both such imprisonment and fine
Germany	General Data Protection Regulation Art Copyright Law		Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation (GDPR) A person also has the right to object to the unauthorised dissemination or public display of his/her photograph (section 22, Art Copyright Law)	If privacy rights are infringed, the individual affected can seek civil law remedies, which include: Cease and desist orders, rectification and Compensatory damages.	In 2014, The Bundesgerichtshof (BGH), upheld an earlier ruling from a regional court in Koblenz, Germany, that said a man did not have the right to keep intimate photos of his ex-lover just because she had consented to taking them in the first place.
France	Digital Republic Act	2016	Under the new law, the persons have a right to oppose the use of their personal data.	Revenge porn may be sanctioned by 2 years of imprisonment and a 60.000 euro fine.

2. United States of America

State	Statute	Year	Constituents of the offence	Punishment	Remarks
Alabama	SB301. Code of Alabama 1975 Secs 15-20A-4 to 15-20A-43 amended.	2017	Distribution of an intimate, private image, also known as "revenge porn" or "nonconsensual pornography." The law applies when the depicted person has not consented to the transmission and the sender intends to harass or intimidate the depicted person.	A first offense is a Class A misdemeanor, punishable by up to a year in jail. Subsequent offenses are Class C felonies, punishable by up to 10 years in prison.
Alaska	Title 11. Criminal Law § 11.61.120		Provides that whoever publishes or distributes electronic or printed photographs, pictures, or films that show the genitals, anus, or female breast of the other person or show that person engaged in a sexual act commits a crime of harassment in second degree.	Harassment in the second degree is a class B misdemeanor. Class B misdemeanors are less serious crimes, punishable by up to 90 days in jail and a fine of up to $2,000.
Arizona	Unlawful Distribution of Private Images, 2016 through amending Section 13‑1425 of the Arizona Revised Statutes	2016	It provides that the distribution of images depicting states of nudity or specific sexual activities of another person is unlawful. If such disclosure is by electronic means, it is a Class 4 felony. If the person threatens to disclose but does not disclose, then it is a Class 1 Misdemeanor.	· Class 4 felonies are punishable up to 3.75 years in prison. · A class 1 misdemeanor is the most serious misdemeanor offense and is punishable by up to 6 months in jail, 3 years of probation (5 years maximum probation for DUI offenses) and a $2,500 fine plus surcharges.	· The earlier state revenge porn bill was scrapped due to an ACLU Lawsuit.
Arkansas	Arkansas Code 5-26-314	July, 2015	It criminalizes the distribution of an image, picture, video, or voice or audio recording of a sexual nature to harass, frighten, intimidate, threaten, or abuse a family or household member or a person in a current or former dating relationship; and for other purposes. Such an offence is a Class A misdemeanour.	· A Class A misdemeanor is the most serious type of misdemeanor in Arkansas and it is punishable by up to one year in jail and a fine of up to $2,500.	Defines a “dating relationship” as romantic/ intimate relationship between two individuals and provides additional factors.
California	Section 647(j)(4) of California Penal Code	2014	Under this provision an act of revenge porn is defined as someone who “photographs or records by any means the image of the intimate body part or parts of another identifiable person, under circumstances where the parties agree or understand that the image shall remain private, and the person subsequently distributes the image taken, with the intent to cause serious emotional distress, and the depicted person suffers serious emotional distress.	It shall be a disorderly conduct, misdemeanour.
Colorado	Colorado Revised Statutes 18-7-107 and 18-7-108.	2014	Posting a Private Image for Harassment and Posting a Private Image for Pecuniary Gain is a Class 1 Misdemeanor.	The defendant can be fined up to $10,000.
Connecticut	Section 53a-189a, Connecticut General Statutes	October 1, 2015	It provides that whoever indulges in Unlawful dissemination of an intimate image is guilty	The offence is a class A misdemeanor.
Delaware	§ 1335, Title 11 of the Delaware Code	2014	When a person knowingly reproduces, distributes, exhibits, publishes, transmits, or otherwise disseminates a visual depiction of a person who is nude, or who is engaging in sexual conduct, when the person knows or should have known that the reproduction, distribution, exhibition, publication, transmission, or other dissemination was without the consent of the person depicted and that the visual depiction was created or provided to the person under circumstances in which the person depicted has a reasonable expectation of privacy, such person shall be guilty of violation of privacy.	It is a class A misdemeanor; class G felony.
District of Columbia	Criminalization of Non-Consensual Pornography Act	2014	It provides that a person knowingly discloses one or more sexual images of another identified or identifiable person when: (1) The person depicted did not consent to the disclosure of the sexual image; (2) There was an agreement or understanding between the person depicted and the person disclosing that the sexual image would not be disclosed; and (3) The person disclosed the sexual image with the intent to harm the person depicted person depicted or to receive financial gain. (b) A person who violates this subsection shall be guilty of a misdemeanour.	Upon conviction such person shall be fined not more than the amount set forth in section 101 of the Criminal Fine Proportionality Amendment Act of 2012, approved June 11, 2013 (D.C. Law 19-317; D.C.42 Official Code § 22-3571.01), imprisoned for not more than 180 days, or both.
Florida	Florida Statute Section 784.049	2015	· “Sexually cyberharass” means to publish a sexually explicit image of a person that contains or conveys the personal identification information of the depicted person to an Internet website without the depicted person’s consent, for no legitimate purpose, with the intent of causing substantial emotional distress to the depicted person.	A person who willfully and maliciously sexually cyberharasses another person commits a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083. If a person who has one prior conviction for sexual cyber harassment and who commits a second or subsequent sexual cyber harassment commits a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.	Aggrieved person can also initiate civil action to recover damages.
Georgia	Article 3 of Chapter 11 of Title 16 of the Official Code of Georgia	2014	· Whoever Electronically transmits or posts or causes such transmission or posting, in one or more transmissions or posts, a photograph or video which depicts nudity or sexually explicit conduct of an adult when the transmission or post is harassment or causes financial loss to the depicted person and serves no legitimate purpose to the depicted person.	Such person shall be guilty of a misdemeanor of a high and aggravated nature; provided, however, that upon a second or subsequent violation of this Code section, he or she shall be guilty of a felony and, upon conviction thereof, shall be punished by imprisonment of not less than one nor more than five years, a fine of not more than $100,000.00, or both.	There is a rebuttable presumption on the Internet Service Provider that it was not aware of the content of such post
Hawaii	Section 711-1110.9, Hawaii Revised Statutes	2014	A person commits the offense of violation of privacy in the first degree if The person knowingly discloses an image or video of another identifiable person either in the nude, as defined in section 712-1210, or engaging in sexual conduct, as defined in section 712-1210, without the consent of the depicted person, with intent to harm substantially the depicted person with respect to that person’s health, safety, business, calling, career, financial condition, reputation, or personal relationships.	Violation of privacy in the first degree is a class C felony. In addition to any penalties the court may impose, the court may order the destruction of any recording made in violation of this section	Exception has been carved out for When the person was voluntarily nude in public or voluntarily engaging in sexual conduct in public.
Idaho	Idaho Code 18-6609(2)(b)	2017	Intentionally or with reckless disregard disseminating, publishing or selling (or conspiring) any image or images of the intimate areas of another person or persons without the consent of such other person or persons and he knows or reasonably should have known that one or both parties agreed or understood that the images should remain private.	The punishments are decided on a case by case basis, but seem to range from state prison terms of three to five years, and/or a fine of up to $5,000 based on the cases that have emerged
Illinois	Section 11-23.5 of The Illinois Criminal Code of 2012	2015	Criminalises the Non-Consensual Dissemination of Private Sexual Images.	It is a Class 4 Felony.
Iowa	Section708.7 of the Code of 2017	2017	Dissemination, publication, distribution or causing it thereof of photograph or film showing another person in partial or full nudity or engaged in a sex act, without consent, is harassment.	Such an offence is harassment in first degree and is an aggravated misdemeanour
Kansas	Section 21-6101(a)(8) of Kansas State Act	2016	Breach of privacy is knowingly and without lawful authority: disseminating any videotape, photograph, film or image of another identifiable person 18 years of age or older who is nude or engaged in sexual activity and under circumstances in which such identifiable person had a reasonable expectation of privacy, with the intent to harass, threaten or intimidate such identifiable person, and such identifiable person did not consent to such dissemination	Such an offence is a Severity level 8, person felony
Louisiana	R.S. 14:283.2	2015	A person commits the offense of non-consensual disclosure of a private mage when all of the following occur: (1) The person intentionally discloses an image of another person who is seventeen years of age or older, who is identifiable from the image or information displayed in connection with the image, and whose intimate parts are exposed in whole or in part. (2) The person who discloses the image obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private. (3) The person who discloses the image knew or should have known that the person in the image did not consent to the disclosure of the image. (4) The person who discloses the image has the intent to harass or cause emotional distress to the person in the image, and the person who commits the offense knew or should have known that the disclosure could harass or cause emotional distress to the person in the image	Whoever commits the offense of non-consensual disclosure of a private image shall be fined not more than ten thousand dollars, imprisoned with or without hard labour for not more than two years, or both	No liability is imposed on the computer service used for posting such image
Maine	Section 1 17-A MRSA §511-A	2015	A person is guilty of unauthorized dissemination of certain private images if the person, with the intent to harass, torment or threaten the depicted person or another person, knowingly disseminates, displays or publishes a photograph, videotape, film or digital recording of another person in a state of nudity or engaged in a sexual act or engaged in sexual contact in a manner in which there is no public or newsworthy purpose when the person knows or should have known that the depicted person: (1) Is 18 years of age or older; (2) Is identifiable from the image itself or information displayed in connection with the image; and (3) Has not consented to the dissemination, display or publication of the private image.	Unauthorized dissemination of certain private images is a Class D crime.
Maryland	§ 3-809, Maryland Code.	2014	A person may not intentionally cause serious emotional distress to another by intentionally placing on the internet an identifiable a photograph, film, videotape, recording, or any other reproduction of the image of the other person that reveals the identity of the other person with his or her intimate parts exposed or while engaged in an act of sexual contact: (1) knowing that the other person did not consent to the placement of the image on the internet; and (2) under circumstances in which the other person had a reasonable expectation that the image would be kept private.	A person who violates this section is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 2 years or a fine not exceeding $5,000 or both.
Michigan	Sec 145e of MCL	2016	If a person threatens, coerces, or intimidates dissemination of any sexually explicit visual material of another person shall be punishable under section 145f.	Section 145f- first offense punishable by 93 day sentence or fine up to $500.
Minnesota	§ 617.261, Minnesota Statutes	2016	A cause of action against a person for the non-consensual dissemination of private sexual images exists when: (1) a person disseminated an image without the consent of the person depicted in the image; (2) the image is of an individual depicted in a sexual act or whose intimate parts are exposed in whole or in part; (3) the person is identifiable: (i) from the image itself, by the person depicted in the image or by another person; or (ii) from the personal information displayed in connection with the image; and (4) the image was obtained or created under circumstances in which the person depicted had a reasonable expectation of privacy. The fact that the individual depicted in the image consented to the creation of the image or to the voluntary private transmission of the image is not a defense to liability for a person who has disseminated the image without consent.	Conviction for nonconsensual dissemination of private sexual images qualifies as a prior “qualified domestic violence-related offense” that enhances penalties for convictions for domestic assault, 4th & 5th degree assault, stalking, and violation of a harassment restraining order.	Consent to such image being taken is no defense
Nevada	Sections 2-6 of Chapter 200 of NRS	2015	A person commits the crime of unlawful dissemination of an intimate image when, with the intent to harass, harm or terrorize another person, the person electronically disseminates or sells an intimate image which depicts the other person and the other person: (1) did not give prior consent to the electronic dissemination or sale; (2) had a reasonable expectation that the intimate image would be kept private and would not be made visible to the public; and (3) was at least 18 years of age when the intimate image was created	Such person is guilty of a category D felony
New Hampshire	§ 644:9-a, N.H. Rev. Stat.	2016	Nonconsensual dissemination of private sexual images with the intent to harass, intimidate, threaten, or coerce the depicted person.	It is a felony.
New Jersey	§ 2C:14-9, New Jersey Code	2015	Making a nonconsensual recording that reveals another person’s "intimate parts" or shows the person engaged in a sexual act without consent.	Felony, three to five years in prison, a fine not to exceed $15,000.
New Mexico	HB 142, new section added to the New Mexico Criminal Code	2015	Unauthorised distribution of sensitive images without that person’s consent with the intent to harass, humiliate or intimidate that person or cause substantial emotional distress is a misdemeanour.	It is a misdemeanour. Upon a second or subsequent conviction, the offender is guilty of a fourth degree felony
North Carolina	§ 14-190.5A, Article 26 of Chapter 14 of the General Statutes	2015	A person is guilty of disclosure of private images if all of the following apply: (1) The person knowingly discloses an image of another person with the intent to do either of the following: a. Coerce, harass, intimidate, demean, humiliate, or cause financial loss to the depicted person. b. Cause others to coerce, harass, intimidate, demean, humiliate, or cause financial loss to the depicted person. (2) The depicted person is identifiable from the disclosed image itself or information offered in connection with the image. (3) The depicted person's intimate parts are exposed or the depicted person is engaged in sexual conduct in the disclosed image. (4) The person discloses the image without the affirmative consent of the depicted person. (5) The person discloses the image under circumstances such that the person knew or should have known that the depicted person had a reasonable expectation of privacy.	For an offense by a person who is 18 years of age or older at the time of the offense, the violation is a Class H felony. For a first offense by a person who is under 18 years of age at the time of the offense, the violation is a Class 1 misdemeanor. For a second or subsequent offense by a person who is under the age of 18 at the time of the offense, the violation is a Class H felony	The Court may order destruction of such image. This provision is in addition to civil and criminal remedies.
North Dakota	Section 12.1-17-07.2 of the North Dakota Century Code	2015	· A person commits the offense of distribution of intimate images if the person knowingly or intentionally distributes to any third party any intimate image of an individual eighteen years of age or older, if: (1) The person knows that the depicted individual has not given consent to the person to distribute the intimate image; (2) The intimate image was created by or provided to the person under circumstances in which the individual has a reasonable expectation of privacy; and (3) Actual emotional distress or harm is caused to the individual as a result of the distribution under this section.	Distribution of an intimate image is a class A misdemeanor
Oklahoma	Section 1040.13b of Title 21, Oklahoma Statutes	2016	· A person commits nonconsensual dissemination of private sexual images when he or she: (1) Intentionally disseminates an image of another person: a. who is at least eighteen (18) years of age, b. who is identifiable from the image itself or information displayed in connection with the image, and c. who is engaged in a sexual act or whose intimate parts are exposed, in whole or in part; (2) Disseminates the image with the intent to harass, intimidate or coerce the person, or under circumstances in which a reasonable person would know or understand that dissemination of the image would harass, intimidate or coerce the person (3) Obtains the image under circumstances in which a reasonable person would know or understand that the image was to remain private; and (4) Knows or a reasonable person should have known that the person in the image has not consented to the dissemination.	Any person who violates the provisions of this section shall be guilty of a misdemeanour punishable by imprisonment in a county jail for not more than one (1) year or by a fine of not more than. One Thousand Dollars ($1,000.00), or both such fine and imprisonment	The court shall have the authority to order the defendant to remove the disseminated image should the court find it is in the power of the defendant to do so.
Oregon	ORS 161.005	2015	· (1) A person commits the crime of unlawful dissemination of an intimate image if: (a) The person, with the intent to harass, humiliate or injure another person, knowingly causes to be disclosed through an Internet website an identifiable image of the other person whose intimate parts are visible or who is engaged in sexual conduct; (b) The person knows or reasonably should have known that the other person does not consent to the disclosure; (c) The other person is harassed, humiliated or injured by the disclosure; and (d) A reasonable person would be harassed, humiliated or injured by the disclosure.	Unlawful dissemination of an intimate image is a Class A misdemeanor. Unlawful dissemination of an intimate image is a Class C felony if the person has a prior conviction under this section at the time of the offense.
Pennsylvania	Title 18 Pennsylvania Consolidated Statutes § 3131	2014	A person commits the offense of unlawful dissemination of intimate image if, with intent to harass, annoy or alarm a current or former sexual or intimate partner, the person disseminates a visual depiction of the current or former sexual or intimate partner in a state of nudity or engaged in sexual conduct.	· An offense shall be: (1) A misdemeanor of the first degree, when the person depicted is a minor. (2) A misdemeanor of the second degree, when the person depicted is not a minor.
South Dakota	Section 4 of Chapter 22-21 of South Dakota Code of Laws	2015	No person may use or disseminate in any form any visual recording or photographic device to photograph or visually record any other person without clothing or under or through the clothing, or with another person depicted in a sexual manner, for the purpose of viewing the body of, or the undergarments worn by, that other person, without the consent or knowledge of that other person, with the intent to self-gratify, to harass, or embarrass and invade the privacy of that other person, under circumstances in which the other person has a reasonable expectation of privacy.	A violation of this section is a Class 1 misdemeanor. However, a violation of this section is a Class 6 felony if the victim is seventeen years of age or younger and the perpetrator is at least twenty-one years old.
Tennessee	Chapter 872 Tenn. Pub. Act	2017	(a) A person commits unlawful exposure who, with the intent to cause emotional distress, distributes an image of the intimate part or parts of another identifiable person if: (1) The image was photographed or recorded under circumstances where the parties agreed or understood that the image would remain private; and (2) The person depicted in the image suffers emotional distress. (b) As used in this section: (1) "Emotional distress" has the same meaning as defined in § 39-17-315; and (2) "Intimate part" means any portion of the primary genital area, buttock, or any portion of the female breast below the top of the areola that is either uncovered or visible through less than fully opaque clothing.	A violation of subsection (a) is a Class A misdemeanor. However, nothing in this section precludes punishment under any other section of law providing for greater punishment.
Texas	Chapter 98B, ATitle 4, Civil Practice and Remedies Code	2015	(a)A defendant is liable, as provided by this chapter, to a person depicted in intimate visual material for damages arising from the disclosure of the material if: (1)the defendant discloses the intimate visual material without the effective consent of the depicted person; (2)the intimate visual material was obtained by the defendant or created under circumstances in which the depicted person had a reasonable expectation that the material would remain private; (3)the disclosure of the intimate visual material causes harm to the depicted person; and (4)the disclosure of the intimate visual material reveals the identity of the depicted person in any manner, including through: (A)any accompanying or subsequent information or material related to the intimate visual material; or (B)information or material provided by a third party in response to the disclosure of the intimate visual material (b) defendant is liable, as provided by this chapter, to a person depicted in intimate visual material for damages arising from the promotion of the material if, knowing the character and content of the material, the defendant promotes intimate visual material described by Subsection (a) on an Internet website or other forum for publication that is owned or operated by the defendant.	An offense under this section is a Class A misdemeanor. If conduct that constitutes an offense under this section also constitutes an offense under another law, the actor may be prosecuted under this section, the other law, or both.	Aggrieved person may recover actual and exemplary damages. The provisions shall be liberally construed by the courts to promote its underlying purpose to protect Persons from, and provide adequate remedies to victims of, the disclosure or promotion of intimate visual material.
Utah	§ 76-5b-203, Utah Code.	2014	An actor commits the offense of distribution of intimate images if the actor, with the intent to cause emotional distress or harm, knowingly or intentionally distributes to any third party any intimate image of an individual who is 18 years of age or older, if: (a) the actor knows that the depicted individual has not given consent to the actor to distribute the intimate image; (b) the intimate image was created by or provided to the actor under circumstances in which the individual has a reasonable expectation of privacy; and (c) actual emotional distress or harm is caused to the person as a result of the distribution under this section.	Distribution of an intimate image is a class A misdemeanour.
Vermont	Sec. 2. 13 V.S.A. § 2606	2015	A person violates this section if he or she knowingly discloses a visual image of an identifiable person who is nude or who is engaged in sexual conduct, without his or her consent, with the intent to harm, harass, intimidate, threaten, or coerce the person depicted, and the disclosure would cause a reasonable person to suffer harm. A person may be identifiable from the image itself or information offered in connection with the image. Consent to recording of the visual image does not, by itself, constitute consent for disclosure of the image.	A person who violates this provision shall be imprisoned not more than two years or fined not more than $2,000.00, or both. A person who violates this provision with the intent of disclosing the image for financial profit shall be imprisoned not more than five years or fined not more than $10,000.00, or both.	In addition, the Court may order equitable relief, including a temporary restraining order, a preliminary injunction, or a permanent injunction ordering the defendant to cease display or disclosure of the image. The Court may grant injunctive relief maintaining the confidentiality of a plaintiff using a pseudonym.
Virginia	§ 18.2-386.2, Code of Virginia	2014	Any person who, with the intent to coerce, harass, or intimidate, maliciously disseminates or sells any videographic or still image created by any means whatsoever that depicts another person who is totally nude, or in a state of undress so as to expose the genitals, pubic area, buttocks, or female breast, where such person knows or has reason to know that he is not licensed or authorized to disseminate or sell such videographic or still image is guilty.	Such an offense is a Class 1 misdemeanor.
Washington	Title 9A RCW	2015	A person commits the crime of disclosing intimate images when the person knowingly discloses an intimate image of another person and the person disclosing the image: (a) Obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private; (b) Knows or should have known that the depicted person has not consented to the disclosure; and10 (c) Knows or reasonably should know that disclosure would cause harm to the depicted person.	The crime of disclosing intimate images: (a) Is a gross misdemeanor on the first offense; or (b) Is a class C felony if the defendant has one or more prior convictions for disclosing intimate images.	A person who is under the age of eighteen is not guilty of the crime of disclosing intimate images unless the person: (a) Intentionally and maliciously disclosed an intimate image of another person; (b) Obtained it under circumstances in which a reasonable person would know or understand that the image was to remain private; and (c) Knows or should have known that the depicted person has not consented to the disclosure
West Virginia	§61-8-28a, Code of West Virginia	2017	No person may knowingly and intentionally disclose, cause to be disclosed or threaten to disclose, with the intent to harass, intimidate, threaten, humiliate, embarrass, or coerce, an image of another which shows the intimate parts of the depicted person or shows the depicted person engaged in sexually explicit conduct which was captured under circumstances where the person depicted had a reasonable expectation that the image would not be publicly disclosed.	A person convicted is guilty of a misdemeanor and, upon conviction thereof, shall be confined in jail for not more than one year, fined not less than $1,000 nor more than $5,000, or both confined and fined.
Wisconsin	§ 942.09, Code of Wisconsin	2014	It provides for posting or publishing a sexually explicit image without consent and providing a penalty. Such an offence is a Class A misdemeanour.	Class A misdemeanors can result in fines up to $10,000, imprisonment up to 9 months or a combination of the two.

3. Australia

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
New South Wales	Section 91Q, Crimes Act 1900	2018	A person who intentionally distributes an intimate image of another person: (a) without the consent of the person, and (b) knowing the person did not consent to the distribution or being reckless as to whether the person consented to the distribution, is guilty of an offence. "intimate image" means: (a) an image of a person's private parts, or of a person engaged in a private act, in circumstances in which a reasonable person would reasonably expect to be afforded privacy, or (b) an image that has been altered to appear to show a person's private parts, or a person engaged in a private act, in circumstances in which a reasonable person would reasonably expect to be afforded privacy.	Maximum penalty: 100 penalty units or imprisonment for 3 years, or both.
South Australia	Summary Offences Act 1953	2018	A person who distributes an invasive image of another person, knowing or having reason to believe that the other person— (a) does not consent to that particular distribution of the image; or (b) does not consent to that particular distribution of the image and does not consent to distribution of the image generally, is guilty of an offence. An image of a person will be taken to be an invasive image of the person if it depicts the person in a place other than a public place— (a) engaged in a private act; or (b) in a state of undress such that— (i) in the case of a female—the bare breasts are visible; or (ii) in any case—the bare genital or anal region is visible. (3) However, an image of a person that falls within the standards of morality, decency and propriety generally accepted by reasonable adults in the community will not be taken to be an invasive image of the person.	Maximum penalty: (a) if the invasive image is of a person under the age of 17 years—$20000 or imprisonment for 4 years; (b) in any other case—$10 000 or imprisonment for 2 years.
Western Australia	Section 10G/61, Restraining Orders and Related Legislation Amendment (Family Violence) Act 2016	2016	A court may restrain the respondent from doing all or any of the following in the case of a family violence restraining order: distributing or publishing, or threatening to distribute or publish, intimate personal images of the person seeking to be protected;	2 years imprisonment.	Check comes into play only in case of a family violence restraining order and is not general protection.
Victoria	Section 41C, Summary Offences Act 1966	2012	A person who visually captures or has visually captured an image of another person's genital or anal region must not intentionally distribute that image.	2 years imprisonment.

4. Asia and Rest of the World

Country	Statute	Year	Contents – definition, classification, punishment, standard of proof	Punishment	Remarks
Canada	Section 162.1, Criminal Code through Bill C-13 or Cyberbullying Act	2015	Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty. In this section, “intimate image” means a visual recording of a person made by any means including a photographic, film or video recording, (a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity; (b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and (c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.	Punishment is: (a) of an indictable offence and liable to imprisonment for a term of not more than five years; or (b) of an offence punishable on summary conviction.
Philippines	Anti-Photo and Video Voyeurism Act of 2009		It is hereby prohibited and declared unlawful for any person: (a) To take photo or video coverage of a person or group of persons performing sexual act or any similar activity or to capture an image of the private area of a person/s such as the naked or undergarment clad genitals, public area, buttocks or female breast without the consent of the person/s involved and under circumstances in which the person/s has/have a reasonable expectation of privacy; (b) To copy or reproduce, or to cause to be copied or reproduced, such photo or video or recording of sexual act or any similar activity with or without consideration; (c) To sell or distribute, or cause to be sold or distributed, such photo or video or recording of sexual act, whether it be the original copy or reproduction thereof; or (d) To publish or broadcast, or cause to be published or broadcast, whether in print or broadcast media, or show or exhibit the photo or video coverage or recordings of such sexual act or any similar activity through VCD/DVD, internet, cellular phones and other similar means or device. The prohibition under paragraphs (b), (c) and (d) shall apply notwithstanding that consent to record or take photo or video coverage of the same was given by such person/s. Any person who violates this provision shall be liable for photo or video voyeurism as defined herein.	The penalty of imprisonment of not less that three (3) years but not more than seven (7) years and a fine of not less than One hundred thousand pesos (P100,000.00) but not more than Five hundred thousand pesos (P500,000.00), or both, at the discretion of the court shall be imposed upon any person found guilty of violating Section 4 of this Act. If the violator is a juridical person, its license or franchise shall be automatically be deemed revoked and the persons liable shall be the officers thereof including the editor and reporter in the case of print media, and the station manager, editor and broadcaster in the case of a broadcast media. If the offender is a public officer or employee, or a professional, he/she shall be administratively liable. If the offender is an alien, he/she shall be subject to deportation proceedings after serving his/her sentence and payment of fines.
Israel	Prevention of Sexual Harassment Law, 5758-1998 amended in 2014	2014	The distribution of still pictures or video recordings of a person’s image that focuses on his/her sexuality, including by editing or incorporation, is unlawful if made: 1. without the person’s consent; 2. in a way that facilitates identification of the person; and 3. under circumstances that may degrade or shame him/her The distribution of such an image constitutes sexual harassment under section 3(a) of the Prevention of Sexual Harassment Law and intentional harm to a person’s privacy under section 5 of the Protection of Privacy Law.	The crimes are punishable with five years of imprisonment, in addition to subjecting the perpetrator to civil liability and the duty to pay monetary compensation to the victim.
Japan	Act on Prevention of Damage by Provision of Private Sexual Image Records Act	2014	It criminalizes the provision of a private sexual image of another person without the person’s approval via a means of telecommunication to an unspecified number of or to many people. It allows Internet service providers to delete suspected revenge porn images without the uploader’s consent, in cases where: 1. the victim had notified the provider of the existence of the image; 2. the provider had requested the consent of the uploader to delete the image; and 3. the uploader did not respond or delete the image.	A maximum sentence of 500,000 yen or three years in jail.	The Act also obligates the national and local governments to ease victims’ embarrassment when they report the crime. For especially young potential victims, the Act further obligates the governments to educate people on how to avoid revenge porn.

For more details visit https://cis-india.org/internet-governance/blog/revenge-porn-laws-across-the-world

Revealed: Bangalore’s Basic Instincts

praskrishna — 2012-01-10T06:50:25Z

This is a first – a sex survey that focusses only on Bangalore. Sure, we have sex surveys telling us what the country thinks. But we wanted to know what our city thinks about the three-letter word. The article was published in the Bangalore Mirror on 8 January 2012. Sunil Abraham is quoted right near the end on why Bangalore might not figure in Google Search rends' top 10 India locations for porn-related queries.

And it wasn’t just sex that we discussed. We also quizzed people on fidelity – emotional and physical – homosexuality and love. Predictably, Bangalore’s responses were far from predictable.

Instant attraction

Cynics may scoff at love at first sight, but youngsters are not yet cynical. And love seems to be catching people very young with kids as young as 13 claiming to be struck by Cupid, leaving even school principals shocked.

D Shashi Kumar, principal of Blossoms School, says, “Even kids from fourth to sixth standard claim to have fallen in love at first sight. I am flabbergasted and it’s difficult to deal with this though it is normal even in primary schools. Where is the innocence that one associates with childhood? They seem to be in a hurry to grow up.”

But, given Bangalore’s overwhelming response in favour of instant love, we found someone with a happy ending. Hear it from Narasimha Murthy: “We looked, we smiled and I was a goner. It’s been eight years since we got married and that love still continues to make my heart beat faster every time I see her."

True love waits?

The rip-roaring double standards for the goose and gander does not exist more strongly in any other case. Despite the emergence of the metrosexual male, men still want virgin brides.

As a result, women find it difficult to confess about their previous sexual partners. For instance, 28-year-old Menaka has been married for more than four years, but her guilty conscience hasn’t given up. “I had a boyfriend in college with whom I was intimate. When I got married, I decided to let my past be and start afresh. Everybody has a past, why rake it up and ruin your future? The more practical reason for me to have made that decision was because I knew it would ruin my married life. But then, my husband recently confessed about his affairs before we got married and now I am consumed with guilt. But what would have been even more ideal was for me to have waited till I got married,” she says.

Masti after marriage?

A city that so overwhelmingly believes in love seems to think nothing of infidelity. It’s all about the thrill.

Abhishek Rana, for instance, is a self-confessed stud since college. His list of girlfriends was like a telephone directory and he managed to date multiple girls simultaneously. Finally, he tied the knot with his childhood sweetheart (who knew about his escapades) a couple of years ago and is quite happy with his marriage. But that has not stopped the Casanova. “If anything, I am going out with more women now than I did before I was married.

Back then, it was the thrill of watching me succeed with the ladies where the others failed. Now, it is the thrill of making sure I don’t get caught by my wife. It is forbidden so it makes it more attractive. I have to come up with innovative reasons when I go home late. Once I told her I was helping my Man Friday’s daughter with homework in the office and she bought it! It’s not that I’m not happy with my wife. But, you need to keep the zing in life,” says this alumnus of a top B-school in India.

Unhappy about gays

It has been nine long years since Adithya Rao’s (name changed) father has spoken to him. “I was 24 when I told him I was gay and that was it. He slapped me and that was the last time he ever spoke to me,” says this designer who takes his boyfriends home to introduce them to his mother. “She is the one who keeps peace in the family,” says Adithya.

Forget the decriminalisation of Article 377. Homosexuality is still taboo in the city. Nithin Manayath, who is gay and a very vocal activist for the rights of homosexuals, says it is the shame around the idea of being homosexual that is the main problem. This 33-year-old English literature professor says, “My extended family knows that I am gay because I have even appeared on television. But I still have overzealous aunts and uncles who tell me about this ‘nice girl’ that I should meet. So depending on who it is, I politely tell them to introduce me to guys instead. I don’t think it is the idea of men sleeping with men that has them in knots. Their problem is talking about it in public. Even my parents don’t really talk about it. My mum is sometimes okay talking about it. But dad prefers to just never bring it up.”

Live-in is in

For ad woman Ashima, 28, and HR professional Jeremy, 31, (names changed), after five years of being in a relationship, the next logical step was to move in together. Although the decision didn’t come easy with parents opposing it, the couple went ahead and moved in together in January last year. Ashima says she always wanted to live together with her partner before taking the plunge.

“When you are dating someone, it’s different. You don’t get to spend that much time together. It is only when you are living with a person that you can understand how your partner lives, know his personal hygiene, his moods, his habits. I thought living-in would be a good way to test our compatibility before deciding to get married,” said Ashima.

Jeremy says moving in was also a matter of convenience. “It made sense economically as well for us to move in together. Both our parents don’t live in the city but when we told them about our decision, their primary concern was what people would say,” he said.

Dr Bhupendra Chaudhury, consultant psychiatrist, The Apollo Clinic, Koramangala, says that live-in relationships are never permanent. “Live-in relationships are always transient. The good thing about a live-in relationship is that both the people in the relationship are not sure about where the relationship will lead. With a change in the demographic trend where most people are living away from their families, a live-in relationship is natural. With such couples, there is no family pressure and with both partners working, they can afford their own expenses and in most cases parents don’t know about it. A live-in relationship can either end in separation or marriage but I have never come across any couple who has lived together for long. It is never permanent,” said Dr Bhupendra.

In the case of Ashima and Jeremy, they passed the compatibility test and after a year of living together, they are ready to say ‘I do’ this month.

Pure emotions

When Uma Rao found out that her husband of 30 years had cheated on her with a young girl, it hit her hard. “At first, I thought he was going through a mid-life crisis and was looking to spice up his life. I imagined it was just a fling. But, when he said that he was in love with her, I was shattered,” says Uma who divorced her husband last month.

But what if it was the other way round? Rajesh, Uma’s former husband, says: “If Uma had had the affair, I don’t think I would have been able forgive her. I think it is a man-woman thing,” says the father of a 20-something daughter. Incidentally, he’s considering marrying his girlfriend who is also in her 20s.

One wild night

“Why not,” asks Pavithra (name changed), a college student who has already had multiple partners. “I am single and I have the right to enjoy life,” says the nubile young thing who does not label it as sexual promiscuity, but experimentation. “I don’t come from my mother’s generation to subscribe to the idea that you have to sleep with only your husband. Sexual attraction has nothing to do with love or other mushy emotions,” she says.

But for 39-year-old Manjunath, a photographer who indulges in one-night stands, “one-night-stands or a sexual partner is a much better option than dating somebody after you get married. It is too much risk with too little benefit. Enjoy the experience and move on.”

The work-shift rift

Any sexologist tell you that the most number of cases with marital problems are between couples who work in highly stressful jobs. “Couples are now older as people are more concerned about their careers. They do not realise that people have to give time to a marriage. I once had a couple come in after just two weeks of their marriage. While the wife worked in an advertising firm, the husband worked in a call centre.

So they had no time for each other and they realised this within two weeks of marriage. Relationships need patience and perseverance more than anything else. Finally, it came as no surprise that they were divorced within a year,” says Mamtha Shetty, a psychiatrist in the city.

Social network gets a poke

“My husband works in Mumbai and I work in Bangalore. We meet once in a month and Facebook is the only way I keep in touch with him and know what is happening in his life minute by minute. Now, most people think that we can do this over the phone, but we are so tired at the end of the day, I don’t have the energy to have a long-drawn conversation,” says Shefali Gupta.

There are many such couples, you realise, if you listen to Suma Gowda, a private marriage counsellor. “I had a case where the couple were on the verge of getting a divorce, because the husband had complimented his ex-girl friend on Facebook. But what made it even more weird was that their entire fight was going on on Facebook. They refused to talk about it at home whenever they got together. You need to understand that talking is what keeps the marriage going,” she says.

“The days of marriage as an institution are all but over. Today people see it as a compartment and that is where the problem begins. You have to emotionally invest in relationships. Couples today treat it like they can lock it away as a small part of their lives instead of looking at it as an anchor. They don’t have the patience to make a relationship work and it is not just marriage that I am talking about. It is almost like couples have a separate person for every need of theirs,” says Sushil Unni, a certified life coach.

Porn supremacy

Vinutha Reddy never understood why her husband would lock himself in his study. “My husband was uninterested in me sexually. We had had sex once in the six months that we were married. When I finally summoned the courage and told him that we need to get some help, he refused. After a lot of pressure from the family, he agreed, and it was then that he opened up about his fetish for middle-aged women. He would surf the internet all night to find these websites. There was nothing I could do about it,” says the homemaker who is still in the marriage since the last five years because of family pressure.

But despite this, Bangalore does not figure in the top 10 of porn-surfing cities in India while Mangalore makes it. Sunil Abraham, executive director, Centre for Internet Society, explains the science of surfing. “If you look at the Google trend or any other website, Bangalore does not figure among the top 10 cities that surfs for porn. But that does not mean that Bangalore does not surf porn. It only means that we have a very sophisticated surfer with a very specific type. They don’t go through Google or other websites. They know how to go about it. But whether it affects their personal lives is lot more complicated,” he says.

After a lot of family pressure, he opened up about his fetish for middle-aged women.

Read the original in Bangalore Mirror

For more details visit https://cis-india.org/news/revealed-bangalore2019s-basic-instincts

Rethinking the Internet: The Way Forward

praskrishna — 2013-03-13T04:53:21Z

Telecom Italia and Financial Times are organizing this event at Telecom Italia Future Centre in Italy on March 21 and 22, 2013. Pranesh Prakash is participating in this event.

Overview

The advent of smartphones and other mobile devices, and the resulting explosive growth in internet usage have transformed the way that societies communicate. The internet is a major driver for global economies as it continues to create new forms of interaction, and offers unprecedented business opportunities and profitable collaborations. The evolution of the internet is however also contributing to changing social perceptions of privacy and copyright, and concerns are developing about the security of countries and organisations, and the liabilities of internet intermediaries.

Another crucial issue is internet governance. Some doubts have been cast on the effectiveness of the present decision-making model in setting the basis for an investment-conducive and future-proof framework, and in balancing the interests of all the players involved in the market scenario.

Rethinking the Internet: The Way Forward, organised by the Financial Times and Telecom Italia, will contribute to this debate by featuring interactive CEO-level workshops that explore the impact of the internet on business models, the role of public and private collaborations in enabling innovation, the key policy, governance and security considerations that need to be addressed, and future implications of the internet evolution for all players in the global communications industry.

Agenda Day One: Thursday, March 22, 2013

10:30- 11:05	Registration and networking
11:05- 11:15	Chair's opening remarks
11:15- 11:30	Welcome address by Telecom Italia
11:30- 01:30	Introduction to Rethinking the Internet How will the internet continue to evolve and what implications does this have for future business models? Who will be the key industry players in the next 10 years and which collaborations, investments and infrastructure developments will yield sustainable growth? How sustainable is the internet as a business model? Will excessive policy-making and regulatory controls curb innovation? Where is the industry heading now?
01:30- 02:30	Lunch
02:30 - 04:30	A New Internet Governance What are the latest developments in internet governance policy-making? What changes can be expected in the near future? How can policy groups and organisations work together to create a balanced and fair internet governance model? What are the limitations of the current recommendations and what improvements need to be made? What are the implications for privacy, online anonymity and data protection?
04:30- 05:00	Refreshments
05:00 - 07:00	Internet Security What new threats and challenges are being created by the internet evolution and how are governments legislating for this? As cybersecurity continues to become a threat, can policies keep up with industry innovations and technological advances? How can a truly global internet be monitored and managed by international jurisdictions with different national priorities? What role do non-governmental entities have to play in policing the internet and making it more secure?
07:00 - 07:10	Chair's concluding remarks
07:10	Drinks reception, followed by Dinner

Agenda Day Two: Friday, March 23, 2013

08:30- 08:50	Arrival and networking
08:50- 09:00	Chair's opening remarks
09:00- 11:00	Internet Privacy and Copyrights Co-operation between policy-makers and industry players is critical in encouraging an open communications ecosystem. What pitfalls need to be avoided to ensure that all stakeholder interests are taken into account, including those of the customer? What safeguards need to be put into place to ensure that sensitive data is protected? How is copyright protected in the new digital age? Can the rights of content creators be protected whilst embracing an open internet? Does net neutrality necessarily equal internet freedom? And how is the right government intervention – internet freedom balance maintained?
11:00- 11:30	Refreshments
11:30- 01:30	Internet after OTT Why are commercial agreements among telco and other communication providers so critical to the provision of internet-enabled products and services? What collaborations are necessary to ensure that internet development and investment contribute to economic growth and market competition? And what role does policy have to play in supporting these commercial initiatives?
01:30- 02:30	Lunch
02:30- 04:00	Overview of Key Themes raised during the Two Day Meeting
04:00	Conclusion

Currently confirmed to participate now include:

Alessandro Acquisti, Associate Professor of Information Technology and Public Policy, Carnegie Mellon University

Jan Philipp Albrecht MdEP / MEP, Member, European Parliament

Virgilio Augusto Fernandes Almeida, Secretary for Information Technology Policies, Ministry of Science, Technology and Innovation (MCTI-SEPIN), Brazil

Suleyman Anil, Head, Cyber Defence Section, Emerging Security Challenges Division, NATO

Johannes M Bauer, Professor, Telecommunication, Information Studies, and Media and Director of Special Programs, Quello Center for Telecommunication Management & Law, Michigan State University

Franco Bernabè, Chairman and CEO of Telecom Italia

Anne Bouverot, Director General & Member of the Board, GSMA

Peter Bradwell, Campaigner, Open Rights Group

Angelo Maria Cardani, Chairman, AGCOM

James W. Cicconi, Senior Executive Vice President-External and Legislative Affairs, AT&T Services, Inc

Giuseppe Corasaniti, General Prosecutor, Italian Supreme Court

Juan Carlos De Martin, Faculty co-director, nexa center for internet & society, Politecnico di Torino and Faculty Fellow, berkman center for internet & society, Harvard University

Adrian Farrel, Routing Area Director, IETF, Juniper Networks and Old Dog Consulting

William W Fisher, Wilmer Hale Professor of Intellectual Property Law and Faculty Director, Berkman Center for Internet and Society, Harvard University

Luigi Gambardella, Chairman Executive Board, ETNO

Hartmut Richard Glaser, Executive Secretary/CGI.br, Brazilian Internet Steering Committee

David A. Gross, Former U.S. Coordinator for International Communications and Information Policy and Partner, Wiley Rein LLP

Ian Hargreaves, Professor of Digital Economy, Cardiff University

James Harkin, Author and Director, Flockwatching

Ahmad Abdulkarim Julfar, CEO, Etisalat Group

Dr Robert E Kahn, TCP/IP co-creator and Chairman, CEO and President, Corporation for National Research Initiatives (CNRI)

Loz (Laurence) Kaye, Leader, Pirate Party UK

Thomas M. Lenard, President and Senior Fellow, Technology Policy Institute

Gerd Leonhard, Futurist, Author and CEO, The Futures Agency

Jonathan Liebenau, Reader in Technology Management, Department of Management, London School of Economics

Robert Levine, Journalist and Author of Free Ride

Patrice Lyons, Corporate Counsel, Corporation for National Research Initiatives (CNRI)

Joe McNamee, Executive Director, European Digital Rights

Milton L Mueller, Professor, School of Information Studies, Syracuse University

Eli Noam, Director, Columbia Institute for Tele-Information, Professor of Finance and Economics and Garrett Professor of Public Policy and Business Responsibility, Columbia University Business School

Sam Paltridge, Directorate of Science Technology and Industry, OECD

Prof. Francesco Pizzetti, Chairman, Privacy Authority

Pranesh Prakash, Policy Director, Centre for Internet and Society

Philip R. Reitinger, Senior Vice President and Chief Information Security Officer, Sony Corporation

Dr Georg Serentschy, CEO Telecommunications, RTR-GmbH (Austrian Regulatory Authority for Broadcasting and Telecommunications)

Michael Skapinker, Assistant Editor and Columnist, Financial Times

Christopher Soghoian, Principal Technologist and Senior Policy Analyst, American Civil Liberties Union

Dr. Hamadoun I. Touré, Secretary General, International Telecommunication Union (ITU)

Nico van Eijk, Professor of Media and Telecommunications Law and Director of the Institute for Information Law, University of Amsterdam

Ben Verwaayen, CEO, Alcatel-Lucent

Philip L. Verveer, Ambassador, U.S. Coordinator, International Communications and Information Policy, US Department of State

Richard Waters, West Coast Editor, Financial Times

Christopher S Yoo, John H. Chestnut Professor of Law, Communication, and Computer & Information Science, Founding Director, Center for Technology, Innovation and Competition, University of Pennsylvania Law School

For more details visit https://cis-india.org/news/rethinking-the-internet

Rethinking the intermediary liability regime in India

torsha — 2019-08-16T01:49:47Z

The article consolidates some of our broad thematic concerns with the draft amendments to the intermediary liability rules, published by MeitY last December.

The blog post by Torsha Sarkar was published by CyberBRICS on August 12, 2019.

Introduction

In December 2018, the Ministry of Electronics and Information Technology (“MeitY”) released the Intermediary Liability Guidelines (Amendment) Rules (“the Guidelines”), which would be significantly altering the intermediary liability regime in the country. While the Guidelines has drawn a considerable amount of attention and criticism, from the perspective of the government, the change has been overdue.

The Indian government has been determined to overhaul the pre-existing safe harbour regime since last year. The draftversion of the e-commerce policy, which were leaked last year, also hinted at similar plans. As effects of mass dissemination of disinformation, propaganda and hate speech around the world spill over to offline harms, governments have been increasingly looking to enact interventionist laws that leverage more responsibility on the intermediaries. India has not been an exception.

A major source of these harmful and illegal content in India come through the popular communications app WhatsApp, despite the company’s enactment of several anti-spam measures over the past few years. Last year, rumours circulated on WhatsApp prompted a series of lynchings. In May, Reuters reported that clones and software tools were available at minimal cost in the market, for politicians and other interested parties to bypass these measures, and continue the trend of bulk messaging.

These series of incidents have made it clear that disinformation is a very real problem, and the current regulatory framework is not enough to address it. The government’s response to this has been accordingly, to introduce the Guidelines. This rationale also finds a place in its preliminarystatement of reasons.

While enactment of such interventionist laws has triggered fresh rounds of debate on free speech and censorship, it would be wrong to say that such laws were completely one-sided, or uncalled for.

On one hand, automated amplification and online mass circulation of purposeful disinformation, propaganda, of terrorist attack videos, or of plain graphic content, are all problems that the government would concern itself with. On the other hand, several online companies (including Google) also seem to be in an uneasy agreement that simple self-regulation of content would not cut it. For better oversight, more engagement with both government and civil society members is needed.

In March this year, Mark Zuckerberg wrote anop-ed for the Washington Post, calling for more government involvement in the process of content regulation on its platform. While it would be interesting to consider how Zuckerberg’s view aligns with those similarly placed, it would nevertheless be correct to say that online intermediaries are under more pressure than ever to keep their platforms clean of content that is ‘illegal, harmful, obscene’. And this list only grows.

That being said, the criticism from several stakeholders is sharp and clear in instances of such law being enacted – be it the ambitious NetzDG aimed at combating Nazi propaganda, hate speech and fake news, or the controversial new European Copyright Directive which has been welcomed by journalists but has been severely critiqued by online content creators and platforms as detrimental against user-generated content.

In the backdrop of such conflicting interests on online content moderation, it would be useful to examine the Guidelines released by MeitY. In the first portion we would be looking at certain specific concerns existing within the rules, while in the second portion, we would be pushing the narrative further to see what an alternative regulatory framework may look like.

Before we jump to the crux of this discussion, one important disclosure must be made about the underlying ideology of this piece. It would be unrealistic to claim that the internet should be absolutely free from regulation. Swathes of content on child sexual abuse, or terrorist propaganda, or even the hordes of death and rape threats faced by women online are and should be concerns of a civil society. While that is certainly a strong driving force for regulation, this concern should not override the basic considerations for human rights (including freedom of expression). These ideas would be expanded a bit more in the upcoming sections.

Broad, thematic concerns with the Rules

A uniform mechanism of compliance

Timelines

Rule 3(8) of the Guidelines mandates intermediaries, prompted by a court order or a government notification, to take down content relating to unlawful acts within 24 hours of such notification. In case they fail to do so, the safe harbour applicable to them under section 79 of the Information Technology Act (“the Act”) would cease to apply, and they would be liable. Prior to the amendment, this timeframe was 36 hours.

There is a visible lack of research which could rationalize that a 24-hour timeline for compliance is the optimal framework, for all intermediaries, irrespective of the kind of services they provide, or the sizes or resources available to them. As Mozilla Foundation has commented, regulation of illegal content online simply cannot be done in an one-size-fits-all approach, nor can regulation be made with only the tech incumbents in mind. While platforms like YouTube can comfortably remove criminal prohibited content within a span of 24 hours, this still can place a large burden on smaller companies, who may not have the necessary resources to comply within this timeframe. There are a few unintended consequences that would arise out of this situation.

One, sanctions under the Act, which would include both organisational ramifications like website blocking (under section 69A of the Act) as well as individual liability, would affect the smaller intermediaries more than it would affect the bigger ones. A bigger intermediary like Facebook may be able to withstand a large fine in lieu of its failure to control, say, hate speech on its platform. That may not be true for a smaller online marketplace, or even a smaller online social media site, targeted towards a very specific community. This compliance mechanism, accordingly, may just go on to strengthen the larger companies, and eliminating the competition from the smaller companies.

Two, intermediaries, in fear of heavy criminal sanctions would err on the side of law. This would mean that the decisions involved in determining whether a piece of content is illegal or not would be shorter, less nuanced. This would also mean that legitimate speech would also be under risk from censorship, and intermediaries would pay less heed to the technical requirements or the correct legal procedures required for content takedown.

Utilization of ‘automated technology’

Another place where the Guidelines assume that all intermediaries operating in India are on the same footing is Rule 3(9). This mandates these entities to proactively monitor for ‘unlawful content’ on their platforms. Aside the unconstitutionality of this provision, this also assumes that all intermediaries would have the requisite resource to actually set up this tool and operate it successfully. YouTube’s ContentID, which began in 2007, has already seen a whopping 100 million dollars investment by 2018.

Funnily enough, ContentID is a tool exclusively dedicated to finding copyright violation of rights-holder, and even then, it has been proven to be not infallible. The Guidelines’ sweeping net of ‘unlawful’ content include far many more categories than mere violations of IP rights, and the framework assumes that intermediaries would be able to set up and run an automated tool that would filter through all these categories of ‘unlawful content’ at one go.

The problems of AI

Aside the implementation-related concerns, there are also technical challenges related with Rule 3(9). Supervised learning systems (like the one envisaged under the Guidelines) use training data sets for pro-active filtering. This means if the system is taught that for ten instances of A being the input, the output would be B, then for the eleventh time, it sees A, it would give the output B. In the lingo of content filtering, the system would be taught, for example, that nudity is bad. The next time the system encounters nudity in a picture, it would automatically flag it as ‘bad’ and violating the community standards.

Except, that is not how it should work. For every post that is under the scrutiny of the platform operators, numerous nuances and contextual cues act as mitigating factors, none of which, at this point, would beunderstandable by a machine.

Additionally, the training data used to feed the system can be biased. A self-driving car who is fed training data from only one region of the country would learn the customs and driving norms of that particular region, and not the patterns that apply across the intended purpose of driving throughout the country.

Lastly, it is not disputed that bias would be completely eliminated in case the content moderation was undertaken by a human. However, the difference between a human moderator and an automated one, would be that there would be a measure of accountability in the first one. The decision of the human moderator can be disputed, and the moderator would have a chance to explain his reasons for the removal. Artificial intelligence (“AI”) is identified by the algorithmic ‘black box’ that processes inputs, and generates usable outputs. Implementing workable accountability standards for this system, including figuring out appeal and grievance redressal mechanisms in cases of dispute, are all problems that the regulator must concern itself with.

In the absence of any clarity or revision, it seems unlikely that the provision would actually ever see full implementation. Neither would the intermediaries know what kind of ‘automated technology’ they are supposed to use for filtering ‘unlawful content’, nor would there be any incentives for them to actually deploy this system effectively for their platforms.

What can be done?

First, more research is needed to understand the effect of compliance timeframes on the accuracy of content takedown. Several jurisdictions are operating now on different timeframes of compliance, and it would be a far more holistic regulation should the government consider the dialogue around each of them and see what it means for India.

Second, it might be useful to consider the concept of an independent regulator as an alternative and as a compromise between pure governmental regulation (which is more or less what the system is) or self-regulation (which the Guidelines, albeit problematically, also espouse through Rule 3(9)).

The UK White Paper on Harms, a piece of important document in the system of liability overhaul, proposes an arms-length regulator who would be responsible for drafting codes of conduct for online companies and responsible for their enforcement. While the exact merits of the system is still up for debate, the concept of having a separate body to oversee, formulate and also possiblyarbitrate disputes regarding content removal, is finding traction in several parallel developments.

One of the Transatlantic Working Group Sessions seem to discuss this idea in terms of having an ‘internet court’ for illegal content regulation. This would have the noted advantage of a) formulating norms of online content in a transparent, public fashion, something previously done behind closed doors of either the government or the tech incumbents and b) having specially trained professionals who would be able to dispose of matters in an expeditious manner.

India is not unfamiliar to the idea of specialized tribunals, or quasi-judicial bodies for dealing with specific challenges. In 2015, for example, the Government of India passed the Commercial Courts Act, by which specific courts were tasked to deal with matters of very large value. This is neither an isolated instance of the government choosing to create new bodies for dealing with a specific problem, nor would it be inimitable in the future.

There is no silver bullet when it comes to moderation of content on the web. However, in light of these parallel convergence of ideas, the appeal of an independent regulatory system as a sane compromise between complete government control and laissez-faireautonomy, is worth considering.

For more details visit https://cis-india.org/internet-governance/blog/cyber-brics-august-12-2019-torsha-sarkar-rethinking-the-intermediary-liability-regime-in-india

Rethinking Privacy: The Link between Florida v. Jardines and the Surveillance of Nature Films

praskrishna — 2014-07-28T05:51:48Z

Bhairav Acharya gave a talk on "Rethinking Privacy" at an event organized by the Indian Institute of Technology, Madras (IIT-M) on July 11, 2014.

In a 2010 article in Continuum: Journal of Media & Cultural Studies, Brett Mills proposed that animals have a right to privacy and that wildlife documentaries, specifically BBC's Nature's Great Events (2009), invaded this right without an examination of animal conservation ethics. In the 2013 Florida v. Jardines decision, the Supreme Court of the United States re-examined the constitutional validity of 'dog sniff laws' that permitted police animals to enter the threshold of private property to conduct 'minimally invasive warant-less searches' and 'Terry stops'; this was the latest in a long line of Fourth Amendment cases that examine the ethics of conserving and protecting public order. I attempt to draw links between the two scenarios that highlight the dissonance between sociological and jurisprudential constructions of privacy.

For more details visit https://cis-india.org/news/rethinking-privacy

Rethinking National Privacy Principles: Evaluating Principles for India's Proposed Data Protection Law

amber — 2017-09-11T02:22:01Z

This report is intended to be the first part in a series of white papers that CIS will publish which seeks to contribute to the discussions around the enactment of a privacy legislation in India. In subsequent pieces we will focus on subjects such as regulatory framework to implement, supervise and enforce privacy principles, and principles to regulate surveillance in India under a privacy law.

Edited by Elonnai Hickok and Vipul Kharbanda

This analysis intends to build on the substantial work done in the formulation of the National Privacy Principles by the Committee of Experts led by Justice AP Shah.1 This brief, hopes to evaluate the National Privacy Principles and the assertion by the Committee that right to privacy be considered a fundamental right under the Indian Constitution. The national privacy principles have been revisited in light of technological developments such as big data, Internet of Things, algorithmic decision making and artificial intelligence which are increasingly playing a greater role in the collection and processing of personal data of individuals, its analysis and decisions taken on the basis of such analysis. The solutions and principles articulated in this report are intended to provide starting points for a meaningful and nuanced discussion on how we need to rethink the privacy principles that should inform the data protection law in India.

Click to read the full blog post

For more details visit https://cis-india.org/internet-governance/blog/rethinking-national-privacy-principles

Rethinking DNA Profiling in India

elonnai — 2012-10-29T08:00:01Z

DNA profile databases can be useful tools in solving crime, but given that the DNA profile of a person can reveal very personal information about the individual, including medical history, family history and so on, a more comprehensive legislation regulating the collection, use, analysis and storage of DNA samples needs included in the draft Human DNA Profiling Bill.

Elonnai Hickok's article was published in Economic & Political Weekly, Vol - XLVII No. 43, October 27, 2012

DNA evidence was first accepted by the courts in India in 1985,[1] and in 2005 the Criminal Code of Procedure was amended to allow for medical practitioners, after authorisation from a police officer who is not below the rank of sub-inspector, to examine a person arrested on the charge of committing an offence and with reasonable grounds that an examination of the individual will bring to light evidence regarding the offence. This can include

"the examination of blood, blood stains, semen, swabs in case of sexual offences, sputum and sweat, hair samples, and finger nail clippings, by the use of modern and scientific techniques including DNA profiling and such other tests which the registered medical practitioner thinks necessary in a particular case."[2]

Though this provision establishes that authorisation is needed for collection of DNA samples, defines who can collect samples, creates permitted circumstances for collection, and lists material that can be collected, among other things, it does not address how the collected DNA evidence should be handled, and what will happen to the evidence after it is collected and analysed. These gaps in the provision indicate the need for a more comprehensive legislation regulating the collection, use, analysis and storage of DNA samples, including for crime-related purposes in India.

The initiative to draft a Bill regulating the use of DNA samples for crime-related reasons began in 2003, when the Department of Biotechnology (DoB) established a committee known as the DNA Profiling Advisory Committee to make recommendations for the drafting of the DNA profiling Bill 2006, which eventually became the Human DNA Profiling Bill 2007.[3] The 2007 draft Bill was prepared by the DoB along with the Centre for DNA Fingerprinting and Diagnostics (CDFD).[4]

The CDFD is an autonomous institution supported by the DoB. In addition to the CDFD, there are multiple Central Forensic Science Laboratories in India under the control of the Ministry of Home Affairs and the Central Bureau of Investigation,[5], along with a number of private labs [6] which analyse DNA samples for crime-related purposes.

In 2007, the draft Human DNA Profiling Bill was made public, but was never introduced in Parliament. In February 2012, a new version of the Bill was leaked. If passed, the Bill will establish state-level DNA databases which will feed into a national-level DNA database, and proposes to regulate the use of DNA for the purposes of

"enhancing protection of people in the society and the administration of justice."[7]

The Bill will also establish a DNA Profiling Board responsible for 24 functions, including specifying the list of instances for human DNA profiling and the sources of collection, enumerating guidelines for storage and destruction of biological samples, and laying down standards and procedures for establishment and functioning of DNA laboratories and DNA Data Banks.[8] The lack of harmonisation and clear policy indicates that there is a need in India for standardising the collection and use of DNA samples. Although DNA evidence can be useful for solving crimes, the current 2012 draft Bill is missing critical safeguards and technical standards essential to preventing the misuse of DNA and protecting individual rights.

Concerns that have been raised with regards to the Bill are both intrinsic, including problems with effectiveness of achieving the set objectives, and extrinsic, including concerns with the fundamental principles of the Bill. For example, the use of DNA material as evidence and the subsequent creation of a DNA database can be useful for solving crimes when the database contains DNA profiles from[9] from DNA samples[10] only from crime scenes, and is restricted to DNA profiles from individuals who might be repeat offenders. If a wide range of DNA profiles are added to the database, the effectiveness of the database decreases, and the likelihood of a false match increases as the ability to correctly identify a criminal depends on the number of crime scene DNA profiles on the database, and the number of false matches that occur is proportional to the number of comparisons made (more comparisons = more false matches).[11] This inverse relationship between the effectiveness of the DNA database and the size of the database was found in the UK when it was proven that the expansion of the UK DNA database did not help to solve more crimes, despite millions of profiles being added to the database.[12]

The current scope of the draft 2012 Bill is not limited to crimes for which samples can be taken and placed in the database. Instead the Bill creates indexes within every databank including: crime scene indexes, suspects index, offender’s index, missing persons index, unknown deceased persons’ index, volunteers’ index, and such other DNA indices as may be specified by regulations made by the Board.[13] How independent each of these indices are, is unclear. For example, the Bill does not specify when a profile is searched for in the database – if all indices are searched, or if only the relevant indices are searched, and the Bill requires that when a DNA profile is added to the databank, it must be compared with all the existing profiles.[14] The Bill also lists a range of offences for which DNA profiling will be applicable and DNA samples collected, and used for the identification of the perpetrator including, unnatural offences, individual identification, issues relating to assisted reproductive technologies, adultery, outraging the modesty of women etc.[15] Though the Bill is not incorrect in its list of offences where DNA profiling could be applicable, it is unclear if DNA profiles from all the listed offenses will be stored on the database. If it is the case that the DNA profiles will be stored, it would make the scope of the database too broad.

Unlike other types of identifiers, such as fingerprints, DNA can reveal very personal information about an individual, including medical history, family history and location.[16] Thus, having a DNA database with a broad scope and adding more DNA profiles onto a database, increases the potential for misuse of information stored on the database, because there is more opportunity for profiling, tracking of individuals, and access to private data. In its current form, the Bill protects against such misuse to a certain extent by limiting the information that will be stored with a DNA profile and in the indices,[17] but the Bill does not make it clear if the DNA profiles of individuals convicted for a crime will be stored and searched independently from other profiles. Additionally, though the Bill limits the use of DNA profiles and DNA samples to identification of perpetrators,[18] it allows for DNA profiles/DNA samples and related information related to be shared for creation and maintenance of a population statistics database that is to be used, as prescribed, for the purpose of identification research, protocol development, or quality control provided that it does not contain any personally identifiable information and does not violate ethical norms.”[19]

An indication of the possibility of how a DNA database could be misused in India can be seen in the CDFD’s stated objectives, where it lists "to create DNA marker databases of different caste populations of India."[20] CDFD appears to be collecting this data by requiring caste and origin of state to be filled in on the identification form that is submitted with any DNA sample.[21] Though an argument could be made that this information could be used for research purposes, there appears to be no framework over the use of this information and this objective. Is the information stored along with the DNA sample? Is it used in criminal cases? Is it revealed during court cases or at other points of time?

Similarly, in the Report of the Working Group for the Eleventh Five Year Plan, it lists the following as a possible use of DNA profiling technology:

"Human population analysis with a view to elicit profiling of different caste populations of India to use them in forensic DNA fingerprinting and develop DNA databases."[22]

This objective is based on the assumption that caste is an immutable genetic trait and seems to ignore the fact that individuals change their caste and that caste is not uniformly passed on in marriage. Furthermore, using caste for forensic purposes and to develop DNA databases could far too easily be abused and result in the profiling of individuals, and identification errors. For example, in 2011 the UK police, in an attempt to catch the night stalker Delroy Grant, used DNA to (incorrectly) predict that he originated from the Winward Islands. The police then used mass DNA screenings of black men. The police initially eliminated Delroy Grant as a suspect because another Delroy Grant was on the DNA database, and the real Delroy Grant was eventually caught when the police pursued more traditional forms of investigation.[23]

Other uses for DNA databases and DNA samples in India have been envisioned over the years. For example, in 2010 the state of Tamil Nadu sought to amend the Prisoners Identification Act 1920 to allow for the establishment of a prisoners’ DNA database – which would require that any prisoner’s DNA be collected and stored.[24] In another example, the home page of BioAxis DNA Research Centre (P) Limited, a private DNA laboratory offering forensic services states,

"In a country like India which is densely populated there is huge requirement for these type of databases which may help in stopping different types of fraud like Ration card fraud, Voter ID Card fraud, Driving license fraud etc. The database may help the Indian police to differentiate the criminals and non criminals."[25] Not only is this statement incorrect in stating that a DNA database will differentiate between criminals and non-criminals, but DNA evidence is not useful in stopping ration card fraud etc. as it would require that DNA be extracted and authenticated for every instance of service. In 2012, the Department of Forensic Medicine and Toxicology at AFMC Pune proposed to establish a DNA data bank containing profiles of armed forces personnel.[26] And in Uttar Pradesh, the government ordered mandatory sampling for DNA fingerprinting of dead bodies.[27] These examples raise important questions about the scope of use, collection and storage of DNA profiles in databases that the Bill is silent on.

The assumption in the Bill that DNA evidence is infallible is another point of contention. The preamble of the Bill states that, "DNA analysis of body substances is a powerful technology that makes it possible to determine whether the source of origin of one body substance is identical to that of another, and further to establish the biological relationship, if any, between two individuals, living or dead with any doubt."[28]

This statement ignores the possibility of false matches, cross-contamination, and laboratory error[29] as DNA evidence is only as infallible as the humans collecting, analysing, and marshalling the evidence. These mistakes are not purely speculative, as cases that have relied on DNA as evidence in India demonstrate that the reliability of DNA evidence is questionable due to collection, analysis, and chain of custody errors. For example, in the Aarushi murder case the forensic expert who testified failed to remember which samples were collected at the scene of the crime[30] in the French diplomat rape case, the DNA report came out with both negative and positive results;[31] and in the Abhishek rape case the DNA sample had to be reanalysed after initial analysis did not prove conclusive.[32] Yet the Bill does not mandate a set of best practices that could help in minimising these errors, such as defining what profiling system will be used nationally, and defining specific security measures that must be taken by DNA laboratories – all of which are currently left to be determined by the DNA board.[33]

The assumption in the preamble that DNA can establish if a relationship exists between two individuals without a doubt is also misleading as it implies that the use of DNA samples and the creation of a database will increase the conviction rate, when in actuality the exact number of accurate convictions resulting purely from DNA evidence is unknown, as is the number of innocent people who are falsely accused of a crime based on DNA evidence in India. This misconception is reflected on the website of the Department of Biotechnology’s information page for CDFD where it states:

"…The DNA fingerprinting service, given the fact that it has been shown to bring about dramatic increase in the conviction rate, will continue to be in much demand. With the crime burden on the society increasing, more and more requests for DNA fingerprinting are naturally anticipated. For example, starting from just a few cases of DNA fingerprinting per month, CDFD is now handling similar number of cases every day."[34]

In addition to the claim that the DNA fingerprinting service has shown a dramatic increase in the conviction rate, is not supported by evidence in this article, according to the CDFD 2010-2011 annual report, the centre analysed DNA from 57 cases of deceased persons, 40 maternity/paternity cases, four rape and murder cases, eight sexual assault cases, and three kidney transplantation cases.[35] This is in comparison to the 2006 – 2007 annual report, which quoted 83 paternity/maternity dispute cases, 68 identification of deceased, 11 cases of sexual assault, eight cases of murder, and two cases of wildlife poaching.[36] From the numbers quoted in the CDFD annual report, it appears that paternity/maternity cases and identification of the deceased are the most frequent types of cases using DNA evidence.

Other concerns with the Bill include access controls to the database and rights of the individual. For example, the Bill does not require that a court order be issued for access to a DNA profile, and instead leaves it in the hand of the DNA bank manager to determine if communication of information relating to a match to a court, tribunal, law enforcement agency, or DNA laboratory is appropriate.[37]

Additionally, the Data Bank Manager is empowered to grant access to any information on the database to any person or class of persons that he/she considers appropriate for the purposes of proper operation and maintenance or for training purposes.[38] The low standards for access that are found in the Bill are worrisome as the possibility for tampering of evidence and analysis is increased.

The Bill is also missing important provisions that would be necessary to protect the rights of the individual. For example, individuals are not permitted a private cause of action for the unlawful collection, use, or retention of DNA, and individuals do not have the right to access their own information stored on the database.[39] These are significant gaps in the proposed legislation as it restricts the rights of the individual.

In conclusion, India could benefit from having a legislation regulating, standardising, and harmonising the use, collection, analysis, and retention of DNA samples for crime-related purposes. The current 2012 draft of the Bill is a step in the right direction, and an improvement from the 2007 DNA Profiling Bill. The 2012 draft draws upon best practices from the US and Canada, but could also benefit from drawing upon best practices from countries like Scotland. Safeguards missing from the current draft that would strengthen the Bill include: limiting the scope of the DNA database to include only samples from a crime scene for serious crimes and not minor offenses, requiring the destruction of DNA samples once a DNA profile is created, clearly defining when a court order is needed to collect DNA samples, defining when consent is required and is not required from the individual for a DNA sample to be taken, and ensuring that the individual has a right of appeal.

[1]. Law Commission of India. Review of the Indian Evidence Act 1872. Pg. 43 Available at: http://lawcommissionofindia.nic.in/reports/185thReport-PartII.pdf. Last accessed: October 9th 2012.
[2]. Section 53. The Criminal Code of Procedure, 1973. Available at: http://www.vakilno1.com/bareacts/crpc/s53.htm. Last accessed October 9th 2012.
[3]. Department of Biotechnology. Ministry of Science & Technology GOI. Annual Report 2009 – 2010. pg. 189. Available at: http://dbtindia.nic.in/annualreports/DBT-An-Re-2009-10.pdf. Last Accessed October 9th 2012.
[4]. Chhibber, M. Govt Crawling on DNA Profiling Bill, CBI urges it to hurry, cites China. The Indian Express. July 12 2010. Available at: http://www.indianexpress.com/news/govt-crawling-on-dna-profiling-bill-cbi-urges-it-to-hurry-cites-china/645247/0. Last accessed: October 9th 2012.
[5]. Perspective Plan for Indian Forensics. Final report 2010. Table 64.1 -64.3 pg. 264-267. Available at: http://mha.nic.in/pdfs/IFS%282010%29-FinalRpt.pdf. Last accessed: October 9th 2012. And CBI Manual. Chapter 27. Available at: http://mha.nic.in/pdfs/IFS%282010%29-FinalRpt.pdf. Last accessed: October 9th 2012.
[6]. For example: International Forensic Sciences, DNA Labs India (DLI), Truth Labs and Bio-Axis DNA Research Centre (P) Limited.
[7]. Draft Human DNA Profiling Bill 2012. Introduction.
[8]. Id. section 12(a-z)
[9]. Id. Definition l. “DNA Profile” means results of analysis of a DNA sample with respect to human identification.
[10]. Id. Definition m. “DNA sample” means biological specimen of any nature that is utilized to conduct CAN analysis, collected in such manner as specified in Part II of the Schedule.
[11]. The UK DNA database and the European Court of Human Rights: Lessons India can learn from UK mistakes. PowerPoint Presentation. Dr. Helen Wallace, Genewatch UK. September 2012.
[12]. Hope, C. Crimes solved by DNA evidence fall despite millions being added to database. The Telegraph. November 12th 2008. Available at: http://www.telegraph.co.uk/news/uknews/law-and-order/3418649/Crimes-solved-by-DNA-evidence-fall-despite-millions-being-added-to-database.html. Last accessed: October 9th 2012
[13]. Draft Human DNA Profiling Bill 2012. Section 32 (4(a-g))
[14]. Id. Section 35
[15]. Id. Schedule: List of applicable instances of Human DNA Profiling and Sources of Collection of Samples for DNA Test.
[16]. Gruber J. Forensic DNA Databases. Council for Responsible Genetics. September 2012. Powerpoint presentation.
[17]. Draft Human DNA Profiling Bill 2012. Section 32 (5)- 6)(a)-(b^[+] . Indices will only contain DNA identification records and analysis prepared by the laboratory and approved by the DNA Board, while profiles in the offenders index will contain only the identity of the person, and other profiles will contain only the case reference number.
[18]. Id. Section 39
[19]. Id. Section 40(c)
[20]. CDFD. Annual Report 2010-2011. Pg19. Available at: http://www.cdfd.org.in/images/AR_2010_11.pdf. Last accessed: October 9th 2012.
[21]. Caste and origin of state is a field of information that is required to be completed when an ‘identification form’ is sent to the CDFD along with a DNA sample for analysis. Form available at: http://www.cdfd.org.in/servicespages/dnafingerprinting.html
[22]. Report of the Working Group for the Eleventh Five Year Plan (2007 – 2012). October 2006. Pg. 152. Section: R&D Relating Services. Available at: http://planningcommission.nic.in/aboutus/committee/wrkgrp11/wg11_subdbt.pdf. Last accessed: October 9th 2012
[23]. Evans. M. Night Stalker: police blunders delayed arrest of Delroy Grant. March 24th 2011. The Telegraph. Available at: http://www.telegraph.co.uk/news/uknews/crime/8397585/Night-Stalker-police-blunders-delayed-arrest-of-Delroy-Grant.html. Last accessed: October 10th 2012.
[24]. Narayan, P. A prisoner DNA database: Tamil Nadu shows the way. May 17th 2012. Available at: http://timesofindia.indiatimes.com/india/A-prisoner-DNA-database-Tamil-Nadu-shows-the-way/iplarticleshow/5938522.cms. Last accessed: October 9th 2012.
[25]. BioAxis DNA Research Centre (P) Limited. Website Available at: http://www.dnares.in/dna-databank-database-of-india.php. Last accessed: October 10th 2012.
[26]. Times of India. AFMC to open DNA profiling centre today. February 2012. Available at:http://articles.timesofindia.indiatimes.com/2012-02-08/pune/31037108_1_dna-profile-dna-fingerprinting-data-bank. Last accessed: October 10th 2012.
[27]. Siddiqui, P. UP makes DNA sampling mandatory with postmortem. Times of India. September 4th 2012. Available at:http://articles.timesofindia.indiatimes.com/2012-09-04/lucknow/33581061_1_dead-bodies-postmortem-house-postmortem-report. Last accessed: October 10th 2012.
[28]. Draft DNA Human Profiling Bill 2012. Introduction
[29]. Council for Responsible Genetics. Overview and Concerns Regarding the Indian Draft DNA Profiling Bill. September 2012. Pg. 2. Available at: http://cis-india.org/internet-governance/indian-draft-dna-profiling-act.pdf/view. Last accessed: October 9th 2012.
[30]. DNA. Aarushi case: Expert forgets samples collected from murder spot. August 28th 2012. Available at: http://www.dnaindia.com/india/report_aarushi-case-expert-forgets-samples-collected-from-murder-spot_1733957. Last accessed: October 10th 2012.
[31]. India Today. Daughter rape case: French diplomat’s DNA test is inconclusive. July 7th 2012. Available at: http://indiatoday.intoday.in/story/french-diplomat-father-rapes-daughter-dna-test-bangalore/1/204270.html. Last accessed: October 10th 2012.
[32]. The Times of India. DNA tests indicate Abhishek raped woman. May 30th 2006. Available at: http://articles.timesofindia.indiatimes.com/2006-05-30/india/27826225_1_abhishek-kasliwal-dna-fingerprinting-dna-tests. Last accessed: October 10th 2012.
[33]. Draft Human DNA Profiling Bill 2012. Section 18-27.
[34]. Department of Biotechnology. DNA Fingerprinting & Diagnostics, Hyderabad. Available at: http://dbtindia.nic.in/uniquepage.asp?id_pk=124. Last accessed: October 10 2012.
[35]. CDFD Annual Report 2010 – 2011.Pg.19. Available at: http://www.cdfd.org.in/images/AR_2010_11.pdf. Last accessed: October 10th 2012.
[36]. CDFD Annual Report 2006-2007.Pg. 13. Available at: http://www.cdfd.org.in/images/AR_2006_07.pdf. Last accessed: October 10th 2012.
[37]. Draft Human DNA Profiling Bill 2012. Section 35
[38]. Id. Section 41.
[39].Council for Responsible Genetics. Overview and Concerns Regarding the Indian Draft DNA Profiling Bill. September 2012. Pg. 9 Available at: http://cis-india.org/internet-governance/indian-draft-dna-profiling-act.pdf/view. Last accessed: October 9th 2012.

For more details visit https://cis-india.org/internet-governance/blog/epw-web-exclusives-oct-27-2012-elonnai-hickok-rethinking-dna-profiling-india

Rethinking Acquisition of Digital Devices by Law Enforcement Agencies

Harikartik Ramesh — 2022-05-02T09:27:54Z

This article has been selected as a part of The Right to Privacy and the Legality of Surveillance series organized in collaboration with the RGNUL Student Research Review (RSRR) Journal.

Read the article originally published in RGNUL Student Research Review (RSRR) Journal

Abstract

The Criminal Procedure Code was created in the 1970s when the concept of the right to privacy was highly unacknowledged. Following the Puttuswamy I (2017) judgement of the Supreme Court affirming the right to privacy, these antiquated codes must be re-evaluated. Today, the police can acquire digital devices through summons and gain direct access to a person’s life, despite the summons mechanism having been intended for targeted, narrow enquiries. Once in possession of a device, the police attempt to circumvent the right against self-incrimination by demanding biometric passwords, arguing that the right does not cover biometric information . However, due to the extent of information available on digital devices, courts ought to be cautious and strive to limit the power of the police to compel such disclosures, taking into consideration the right to privacy judgement.

Keywords: Privacy, Criminal Procedural Law, CrPc, Constitutional Law

Introduction

New challenges confront the Indian criminal investigation framework, particularly in the context of law enforcement agencies (LEAs) acquiring digital devices and their passwords. Criminal procedure codes delimiting police authority and procedures were created before the widespread use of digital devices and are no longer pertinent to the modern age due to the magnitude of information available on a single device. A single device could provide more information to LEAs than a complete search of a person’s home; yet, the acquisition of a digital device is not treated with the severity and caution it deserves. Following the affirmation of the right to privacy in Puttuswamy I (2017), criminal procedure codes must be revamped, taking into consideration that the acquisition of a person’s digital device constitutes a major infringement on their right to privacy.

Acquisition of digital devices by LEAs through summons

Section 91 of the Criminal Procedure Code (CrPc) grants powers to a court or police officer in charge of a police station to compel a person to produce any form of document or ‘thing’ necessary and desirable to a criminal investigation. In Rama Krishna v State, ‘necessary’ and ‘desirable’ have been interpreted as any piece of evidence relevant to the investigation or a link in the chain of evidence. Abhinav Sekhri, a criminal law litigator and writer, has argued that the wide wording of this section allows summons to be directed towards the retrieval of specific digital devices.

As summons are target-specific, the section has minimal safeguards. However, several issues arise in the context of summons regarding digital devices. In the current day, access to a user’s personal device can provide comprehensive insight into their life and personality due to the vast amounts of private and personal information stored on it. In Riley v California, the Supreme Court of the United States (SCOTUS) observed that due to the nature of the content present on digital devices, summons for them are equivalent to a roving search, i.e., demanding the simultaneous production of all contents of the home, bank records, call records, and lockers. The Riley decision correctly highlights the need for courts to recognise that digital devices ought to be treated distinctly compared to other forms of physical evidence due to the repository of information stored on digital devices.

The burden the state must surpass in order to issue summons is low as the relevancy requirement is easily provable. As noted in Riley, police must identify which evidence on a device is relevant. Due to the sheer amount of data on phones, it is very easy for police to claim that there will surely be some form of connection between the content on the device and the case. Due to the wide range of offences available for Indian LEAs to cite, it is easy for them to argue that the content on the device is relevant to any number of possible offences. LEAs rarely face consequences for slamming the accused with a huge roster of charges – even if many of them are baseless – leading to the system being prone to abuse. The Indian Supreme Court in its judgement in Canara Bank noted that the burden of proof must be higher for LEAs when investigations violate the right to privacy. Tarun Krishnakumar notes that the trickle-down effect of Puttuswamy I will lead to new privacy challenges with regards to a summons to appear in court. Puttuswamy I, will provide the bedrock and constitutional framework, within which future challenges to the criminal process will be undertaken. It is important for the court to recognise the transformative potential within the Puttuswamy judgement to help ensure that the right to privacy of citizens is safeguarded. The colonial logic of policing – wherein criminal procedure law was merely a tool to maximise the interest of the state at the cost of the people – must be abandoned. Courts ought to devise a framework under Section 91 to ensure that summons are narrowly framed to target specific information or content within digital devices. Additionally, the digital device must be collected following a judicial authority issuing the summons and not a police authority. Prior judicial warrants will require LEAs to demonstrate their requirement for the digital device; on estimating the impact on privacy, the authority can issue a suitable summons. Currently, the only consideration is if the item will furnish evidence relevant to the investigation; however, judges ought to balance the need for the digital device in the LEA’s investigation with the users’ right to privacy, dignity, and autonomy.

Puttuswamy I provides a triple test encompassing legality, necessity, and proportionality to test privacy claims. Legality requires that the measure be prescribed by law, necessity analyses if it is the least restrictive means being adopted by the state, and proportionality checks if the objective pursued by the measure is proportional to the degree of infringement of the right. The relevance standard, as mentioned before, is inadequate as it does not provide enough safeguards against abuse. The police can issue summons based on the slightest of suspicions and thus get access to a digital device, following which they can conduct a roving enquiry of the device to find evidence of any other offence, unrelated to the original cause of suspicion.

Unilateral police summons of digital devices cannot pass the triple test as it is grossly disproportionate and lacks any form of safeguard against the police. The current system has no mechanism for overseeing the LEAs; as long as LEAs themselves are of the view that they require the device, they can acquire it. In Riley, SCOTUS has already held that warrantless seizure of digital devices constitutes a violation of the right to privacy. India ought to also adopt a requirement of a prior judicial warrant for the procurement of devices by LEAs. A re-imagined criminal process would have to abide by the triple test in particular proportionality wherein the benefit claimed by the state ought not to be disproportionate to the impact on the fundamental right to privacy; and further, a framework must be proposed to provide safeguards against abuse.

Compelling the production of passwords of devices

In police investigations, gaining possession of a physical device is merely the first step in acquiring the data on the device, as the LEAs still require the passcodes needed to unlock the device. LEAs compelling the production of passcodes to gain access to potentially incriminating data raises obvious questions regarding the right against self-incrimination; however, in the context of digital devices, several privacy issues may crop up as well.

In Kathi Kalu Oghad, the SC held that compelling the production of fingerprints of an accused person to compare them with fingerprints discovered by the LEA in the course of their investigation does not violate the right to protection against self-incrimination of the accused. It has been argued that the ratio in the judgement prohibits the compelling of disclosure of passwords and biometrics for unlocking devices because Kathi Kalu Oghad only dealt with the production of fingerprints in order to compare the fingerprints with pre-existing evidence, as opposed to unlocking new evidence by utilising the fingerprint. However, the judgement deals with self-incrimination and does not address any privacy issues.

The right against self-incrimination approach alone may not be enough to resolve all concerns. Firstly, there may be varying levels of protection provided to different forms of password protections on digital devices; text- and pattern-based passcodes are inarguably protected under Art. 20(3) of the Constitution. However, the protection of biometrics-based passcodes relies upon the correct interpretation of the Kathi Kalu Oghad precedent. Secondly, Art. 20(3) only protects the accused in investigations and not when non-accused digital devices are acquired by LEAs and the passcodes of the devices demanded.

Therefore, considering the aforementioned points, it is pertinent to remember that the right against self-incrimination does not exist in a vacuum separate from privacy. It originates from the concept of decisional autonomy – the right of individuals to make decisions about matters intimate to their life without interference from the state and society. Puttuswamy I observed that decisional autonomy is the bedrock of the right to privacy, as privacy allows an individual to make these intimate decisions away from the glare of society and/or the state. This has heightened importance in this context as interference with such autonomy could lead to the person in question facing criminal prosecution. The SC in Selvi v Karnataka and Puttuswamy I has repeatedly affirmed that the right against self-incrimination and the right to privacy are linked concepts, with the court observing that the right to remain silent is an integral aspect of decisional autonomy.

In Virendra Khanna, the Karnataka High Court (HC) dealt with the privacy and self-incrimination concerns caused by LEAs compelling the disclosure of passwords. The HC brushes aside concerns related to privacy by noting that the right to privacy is not absolute and that an exception to the right to privacy is state interest and protection of law and order (para 5.11), and that unlawful disclosure of material to third parties could be an actionable wrong (para 15). The court’s interpretation of privacy effectively provides a free pass for the police to interfere with the right to privacy under the pretext of a criminal investigation. This conception of privacy is inadequate as the issue of proportionality is avoided, and the court does not attempt to ensure that the interference is proportionate with the outcome.

US courts also see the compelling of production of passcodes as an issue of self-incrimination as well as privacy. In its judgement in Application for a Search Warrant, a US court observed that compelling the disclosure of passcodes existed at an intersection of the right to privacy and self-incrimination; the right against self-incrimination serves to protect the privacy interests of suspects.

Disclosure of passwords to digital devices amounts to an intrusion of the privacy of the suspect as the collective contents on the digital device effectively amount to providing LEAs with a method to observe a person’s mind and identity. Police investigative techniques cannot override fundamental rights and must respect the personal autonomy of suspects – particularly, the choice between silence and speech. Through the production of passwords, LEAs can effectively get a snapshot of a suspect’s mind. This is analogous to the polygraph and narco-analysis test struck down as unconstitutional by the SC in Selvi as it violates decisional autonomy.

As Sekhri noted, a criminal process that reflects the aspirations of the Puttuswamy judgement would require LEAs to first explain with reasonable detail the material which they wish to find in the digital devices. Secondly, they must provide a timeline for the investigation to ensure that individuals are not subjected to inexhaustible investigations with police roving through their devices indefinitely. Thirdly, such a criminal process must demand, a higher burden to be discharged from the state if the privacy of the individual is infringed upon. These aspirations should form the bedrock of a system of judicial warrants that LEAs ought to be required to comply with if they wish to compel the disclosure of passwords from individuals. The framework proposed above is similar to the Virendra Khanna guidelines, as they provide a system of checks and balances that ensure that the intrusion on privacy is carried out proportionately; additionally, it would require LEAs to show a real requirement to demand access to the device. The independent eyes of a judicial magistrate provide a mechanism of oversight and a check against abuse of power by LEAs.

Conclusion

The criminal law apparatus is the most coercive power available to the state, and, therefore, privacy rights will become meaningless unless they can withstand it. Several criminal procedures in the country are rooted in colonial statutes, where the rights of the populace being policed were never a consideration; hence, a radical shift is required. However, post-1947 and Puttuswamy, the ignorance and refusal to submit to the rights of the population can no longer be justified and significant reformulation is necessary to guarantee meaningful protections to device owners. There is a need to ensure that the rights of individuals are protected, especially when the motivation for their infringement is the supposed noble intentions of the criminal justice system. Failing to defend the right to privacy in these moments would be an invitation for allowing the power of the state to increase and inevitably become absolute.

For more details visit https://cis-india.org/internet-governance/blog/rethinking-acquisition-of-digital-devices-by-law-enforcement-agencies

Resurrecting the marketplace of ideas

basu — 2019-02-22T02:18:53Z

There is no ‘silver bullet’ for regulating content on the web. It requires a mix of legal and empirical analysis.

The article by Arindrajit Basu was published in Hindu Businessline on February 19, 2019.

A century after the ‘marketplace of ideas’ first found its way into a US Supreme Court judgment through the dissenting opinion of Justice Oliver Wendell Holmes Jr (Abrams v United States, 1919), the oft-cited rationale for free speech is arguably under siege.

The increasing quantity and range of online speech hosted by internet platforms coupled with the shock waves sent by revelations of rampant abuse through the spread of misinformation has lead to a growing inclination among governments across the globe to demand more aggressive intervention by internet platforms in filtering the content they host.

Rule 3(9) of the Draft of the Information Technology [Intermediary Guidelines (Amendment) Rules] 2018 released by the Ministry of Electronics and Information Technology (MeiTy) last December follows the interventionist regulatory footsteps of countries like Germany and France by mandating that platforms use “automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.”

Like its global counterparts, this rule, which serves as a pre-condition for granting immunity to the intermediary from legal claims arising out of user-generated communications, might not only have an undue ‘chilling effect’ on free speech but is also a thoroughly uncooked policy intervention.

Censorship by proxy

Rule 3(9) and its global counterparts might not be in line with the guarantees enmeshed in the right to freedom of speech and expression for three reasons. First, the vague wording of the law and the abstruse guidelines for implementation do not provide clarity, accessibility and predictability — which are key requirements for any law restricting free speech .The NetzDG-the German law, aimed at combating agitation and fake news, has attracted immense criticism from civil society activists and the UN Special Rapporteur David Kaye on similar grounds.

Second, as proved by multiple empirical studies across the globe, including one conducted by CIS on the Indian context, it is likely that legal requirements mandating that private sector actors make determinations on content restrictions can lead to over-compliance as the intermediary would be incentivised to err on the side of removal to avoid expensive litigation.

Finally, by shifting the burden of determining and removing ‘unlawful’ content onto a private actor, the state is effectively engaging in ‘censorship by proxy’. As per Article 12 of the Constitution, whenever a government body performs a ‘public function’, it must comply with all the enshrined fundamental rights.

Any individual has the right to file a writ petition against the state for violation of a fundamental right, including the right to free speech.

However, judicial precedent on the horizontal application of fundamental rights, which might enable an individual to enforce a similar claim against a private actor has not yet been cemented in Indian constitutional jurisprudence.

This means that any individual whose content has been wrongfully removed by the platform may have no recourse in law — either against the state or against the platform.

Algorithmic governmentality

Using automated technologies comes with its own set of technical challenges even though they enable the monitoring of greater swathes of content. The main challenge to automated filtering is the incomplete or inaccurate training data as labelled data sets are expensive to curate and difficult to acquire, particularly for smaller players.

Further, an algorithmically driven solution is an amorphous process.

Through it is hidden layers and without clear oversight and accountability mechanisms, the machine generates an output, which corresponds to assessing the risk value of certain forms of speech, thereby reducing it to quantifiable values — sacrificing inherent facets of dignity such as the speaker’s unique singularities, personal psychological motivations and intentions.

Possible policy prescriptions

The first step towards framing an adequate policy response would be to segregate the content needing moderation based on the reason for them being problematic.

Detecting and removing information that is false might require the crafting of mechanisms that are different from those intended to tackle content that is true but unlawful, such as child pornography.

Any policy prescription needs to be adequately piloted and tested before implementation. It is also likely that the best placed prescription might be a hybrid amalgamation of the methods outlined below.

Second, it is imperative that the nature of intermediaries to which a policy applies are clearly delineated. For example, Whatsapp, which offers end-to-end encrypted services would not be able to filter content in the same way internet platforms like Twitter can.

The first option going forward is user-filtering, which as per a recent paper written by Ivar Hartmann, is a decentralised process, through which the users of an online platform collectively endeavour to regulate the flow of information.

Users collectively agree on a set of standards and general guidelines for filtering. This method combined with an oversight and grievance redressal mechanism to address any potential violation may be a plausible one.

The second model is enhancing the present model of self-regulation. Ghonim and Rashbass recommend that the platform must publish all data related to public posts and the processes followed in a certain post attaining ‘viral’ or ‘trending’ status or conversely, being removed.

This, combined with Application Programme Interfaces (APIs) or ‘Public Interest Algorithms’, which enables the user to keep track of the data-driven process that results in them being exposed to a certain post, might be workable if effective pilots for scaling are devised.

The final model that operates outside the confines of technology are community driven social mechanisms. An example of this is Telengana Police Officer Remi Rajeswari’s efforts to combat fake news in rural areas by using Janapedam — an ancient form of story-telling — to raise awareness about these issues.

Given the complex nature of the legal, social and political questions involved here, the quest for a ‘silver-bullet’ might be counter-productive.

Instead, it is essential for us to take a step back, frame the right questions to understand the intricacies in the problems involved and then, through a mix of empirical and legal analysis, calibrate a set of policy interventions that may work for India today.

For more details visit https://cis-india.org/internet-governance/blog/hindu-businessline-february-19-2019-arindrajit-basu-resurrecting-the-marketplace-of-ideas

Responsible Data Forum: Discussion on the Risks and Mitigations of releasing Data

vanya — 2015-09-06T14:29:14Z

The Responsible Data Forum initiated a discussion on 26^th August 2015 to discuss the risks and mitigations of releasing data.

The discussion was regarding the question of adoption of adequate measures to mitigate risks to people and communities when some data is prepared to be released or for sharing purposes.

The following concerns entailed the discussion:

What is risk- risks in releasing development data and PII
What kinds of risks are there
Risk to whom?
Risks in dealing with PII, discussed by way of several examples
What is missing from the world

The first thing to be done is that if a dataset is made, then you have the responsibility that no harm is caused to the people who are connected to the dataset and a balance must be created between good use of the data on one hand and protecting data subjects, sources and managers on the other.

To answer what is risk, it was defined to be the “probability of something happening multiplied by the resulting cost or benefit if it does” (Oxford English Dictionary). So it is based on cost/benefit, probability, and a subject. For probability, all possible risks must be considered and work in terms of how much harm would happen and how likely that is about to happen. These issues must be considered necessarily.

An example in this context was that of the Syrian government where the bakeries were targeted as the bombers knew where the bakeries are, making them easy targets. It was discussed how in this backdrop of secure data release mechanism, local context is an important issue.

Another example of bad practice was the leak of information in the Ashley Madison case wherein several people have committed suicide.

Kinds of risk:

physical harm:

The next point of discussion was regarding kinds of the physical risks to data subjects when there is release/sharing of data related to them. Some of them were:

i. security issues
ii. hate speech
iii. voter issues
iv. police action

Hence PII goes both ways- where some choose to run the risk of PII being identified; on the other hand some run the risk of being identified as the releaser of information.

Legal harms- to explain what can be legal harms posed in releasing or sharing data, an example was discussed of an image marking exercise of a military camp wherein people joined in, marked military equipment and discovered people who are from that country.
Reputational harm as an organization primarily.
Privacy breach- which can lead to all sorts of harms.

Risk to whom?

Data subjects – this includes:

i. Data collectors
ii. Data processing team
iii. Person releasing the data
iv. Person using the data

Also, the likely hood of risk ranges from low, medium and high. We as a community are at a risk at worse.

PII:

- Any data which can be used to identify any specific individual. Such information does not only include names, addresses or phone numbers but could also be data sets that don’t in themselves identify an individual.

For example, in some places sharing of social security number is required for HIV+ status check-up; hence, one needs to be aware of the environment of data sets that go into it. In another situation where there is a small population and there is a need to identify people of a street, village or town for the purpose of religion, then even this data set can put them to risk.

Hence, awareness with respect to the demographics is important to ascertain how many people reside in that place, be aware of the environment and accordingly decide what data set must be made.

- Another way to mitigate risks at the time of release/sharing of data is partial release only to some groups, like for the purpose of academics or to data subjects.

- Different examples were discussed to identify how release of data irresponsibly has affected the data subjects and there is a need to work to mitigate harms caused in such cases.

Example- in the New York City taxi case data about every taxi ride was released-including pickup and drop locations, times, fares. Here it becomes more problematic if someone is visiting strip clubs, then re-identification takes place and this necessitates protection of people against such insinuation.

This shows how data sets can lead to re-identification, even when it is not required. Hence, the involved actors must understand the responsibilities when engaging in data collection or release and accordingly mitigate the risks so associated.

- A concern was raised over collection and processing of the information of genetic diseases of a small population since practically it is not possible to guarantee that the information of data subjects to whom the data relates will not be released or exposed or it won’t be re-identifiable. Though best efforts would be made by experts, however, realistically, it is not possible to guarantee people that they will not be identified. So the question of informing people of such risks is highly crucial. It is suggested that one way of mitigating risks is involving the people and letting them know. Awareness regarding potential impact by breach of data or identification is very important.

- Another factor for consideration is the context in which the information was collected. The context for collection of data seems to change over a period of time. For example, many human rights funders want information on their websites changed or removed in the backdrop of changing contexts, circumstances and situation. In this case also, the collection and release of data and the risks associated become important due to changing contexts.

What is missing from the world?

Though recognition of risks has been done and is an ongoing process, what is missing from the world are uniform guidelines, rules or law. There are no policies for informed consent or for any means to mitigate risks collectively in a uniform manner. There must be adoption of principles of necessity, proportionality and informed consent.

For more details visit https://cis-india.org/internet-governance/blog/responsible-data-forum

Responsible AI Workshop

Admin — 2019-09-20T14:50:47Z

Sunil Abraham participated in this meeting organized by Facebook on September 17, 2019 in New Delhi.

Click to view the agenda

For more details visit https://cis-india.org/internet-governance/news/responsible-ai-workshop

Responses to Trai’s consultation paper on free data contain some good suggestions

praskrishna — 2016-08-17T03:05:57Z

Trai has announced that it will come up with a final consultation paper on ‘Free Data’, and also a pre-consultation paper on Net Neutrality by the end of this month.

The blog post by Asheeta Regidi was published by FirstPost's Tech 2 on August 15, 2016.

The pre-consultation paper on Free Data (the Consultation Paper), which was issued in May 2016, asked for options where free data could be provided for accessing certain websites or apps without violating the Discriminatory Tariff Regulations issued earlier in February. The objective of the paper is to maximise internet penetration, and make internet available even to the poorest.

The models suggested in the Consultation Paper are a reward of free data for certain internet uses, zero data charges for accessing certain content, and refunding data charges in a manner similar to refund of LPG subsidies. These models are very similar to plans like Facebook’s Free Basics and Airtel Zero, which were banned by the Discriminatory Tariff Regulations.

While it is clear that Trai has no intention of withdrawing the Discriminatory Tariff Regulations, the Consultation Paper does appear to open up the doors to net neutrality violations again. Here’s a look at the comments and counter-comments that have come in response to this paper.

A motorist rides past a hoarding advertising Facebook’s Free Basics. Image: Reuters

Large TSPs and TSP associations want content-based free data schemes
The response of large TSPs like Vodafone, Idea and so on are quite predictable. They, alongwith most of the TSP associations such as ACTO, COAI and AUSPI, are in support of the idea of free access to certain sites. They, in fact, point out the similarities between the proposed models and the similar models brought out by them, such as Airtel’s One Touch Internet and Reliance’s Facebook Tap. They have also asked for a withdrawal of the Discriminatory Tariff Regulations, on the grounds that they hamper the innovation and forbearance capabilities of the TSPs.

They do, however, take issue with the fact that a TSP agnostic platform, or a platform which is completely independent of the TSPs, is to be given the power to decide how the lower prices or discounts are to be provided. They allege that there is nothing to prevent such a platform from acting as a gatekeeper in itself. They argue that TSPs are in a better position to perform this function, since they are subject to strict regulatory and licensing requirements from Trai.

Employees at an outsourcing centre in Bengaluru Image: Reuters

Smaller TSPs and other companies fear net neutrality violations
Smaller TSPs like Atria, Citicom and MTS are against content based free data proposal, mostly on the grounds that the models suggested violate net neutrality. They point out that allowing content based free data in any form will give an unfair advantage to large TSPs and content providers. Smaller companies and start-ups will be left in the lurch since they will not have the financial capabilities to effectively compete with such schemes. These entities also share the fear of the TSPs that there is nothing to stop a TSP agnostic platform from also acting as a gatekeeper.

Commuters with their smartphones in a Mumbai local. Image: Reuters

Some alternative suggestions for free data schemes which do not violate net neutrality
The approach suggested by Trai will, to a large extent, only benefit existing users of the internet, since a basic internet access of some sort is required before the users can enjoy the benefits of a rewards or a refund. Software Freedom Law Centre (SFLC), in its comments, points to research that found that only 12 percent of the users of zero rating services abroad (no data charges for certain websites), started using it because of the zero rating. Clearly, these schemes are not achieving the objective of increasing internet usage, and an alternative solution is required.

Many of the responses came up with alternative suggestions for free data schemes which can increase internet usage without violating net neutrality. Some of these suggestions are listed below:

The Digital Empowerment Foundation suggests the provision of free data quotas or packs, which would give a limited amount of data free of charge to all consumers. Any data usage above the basic pack will be charged at normal rates. It also suggests making such packs mandatory as a part of the TSP licensing terms or alternatively subsidising the cost of these packs through other benefits to the TSPs.
MTS suggests that content providers be allowed free internet access for a limited time or quantity, such as 30 minutes per day, or 100MB per day, to certain groups, like low income groups.
Mozilla and SFLC suggest the ‘equal rating’ system, where a small amount of data per day is made available free of charge to all internet users, over and above whatever other packs they may have purchased.
The Centre for Internet and Society suggests that the government allow TSPs to provide free internet to all, at a lower speed, and in return exempt the TSPs from the USO contributions in their license fees. This will ensure free data to all without differentiating based on content.
SFLC also suggests an increase in free public Wi-Fi hotspots, like the kind being made available in Indian railway stations, to increase internet accessibility without content-based discrimination.
MTNL suggests that if content-based free data is to be allowed, the government should determine what constitutes the basic services to be allowed for free, such as railway booking services, and not leave this to the understanding of the TSPs.
MTS also suggests that content providers be allowed to give data-based rewards for certain activity, such as watching associated advertisements.
Atria suggests that if free data is to be allowed, first establish a negative list of what cannot be done, such as no throttling of speeds.

Anonymous protests against Internet laws in Mumbai. Image: Reuters

First establish ground rules of net neturality
One common aspect of most of the comments to the Consultation Paper was the confusion regarding Trai’s stance on net neutrality. Many entities, including the large TSPs, pointed out the contradiction between this Consultation Paper and the Discriminatory Tariff Regulations.

This paper gives the impression that the Discriminatory Tariff Regulations were issued not to prevent content based discrimination, but to prevent telecom service providers from becoming ‘gatekeepers’. In reality, that is not the main fear of the people, but the fear that net neutrality will be affected. The culprits might be anyone, whether it is the TSP, the content provider or the TSP agnostic platform suggested by Trai. It needs to modify its approach, and first lay down the fundamental rules on net neutrality. Any other regulations must first comply with these rules.

While the motives of Trai are laudible, it is hoped that Trai will look into the several suggestions made that will achieve the dual targets of maximum internet penetration as well as securing net neutrality.

For more details visit https://cis-india.org/internet-governance/news/first-post-tech-2-august-15-2016-asheeta-regidi-responses-to-trai-consultation-paper-on-free-data-contain-some-good-suggestions

Response to the Pegasus Questionnaire issued by the SC Technical Committee

Anamika Kundu, Digvijay, Arindrajit Basu, Shweta Mohandas and Pallavi Bedi — 2022-04-13T14:45:41Z

On March 25, 2022, the Supreme Court appointed Technical Committee constituted to examine the allegations of alleged unauthorised surveillance using the Pegasus software released a questionnaire seeking responses and comments from the general public.

The questionnaire had 11 questions and the responses had to be submitted through an online form- which was available here. The last date for submitting the response was March 31, 2022. CIS had submitted the following responses to the questions in the questionnaire. Access the Response to the Questionnaire

For more details visit https://cis-india.org/internet-governance/blog/response-to-pegasus-questionnaire-issued-by-sc-technical-committee

Response to the Draft of The Information Technology [Intermediary Guidelines (Amendment) Rules] 2018

Gurshabad Grover, Elonnai Hickok, Arindrajit Basu, Akriti — 2019-02-07T08:06:41Z

In this response, we aim to examine whether the draft rules meet tests of constitutionality and whether they are consistent with the parent Act. We also examine potential harms that may arise from the Rules as they are currently framed and make recommendations to the draft rules that we hope will help the Government meet its objectives while remaining situated within the constitutional ambit.

This document presents the Centre for Internet & Society (CIS) response to the Ministry of Electronics and Information Technology’s invitation to comment and suggest changes to the draft of The Information Technology [Intermediary Guidelines (Amendment) Rules] 2018 (hereinafter referred to as the “draft rules”) published on December 24, 2018. CIS is grateful for the opportunity to put forth its views and comments. This response was sent on the January 31, 2019.

In this response, we aim to examine whether the draft rules meet tests of constitutionality and whether they are consistent with the parent Act. We also examine potential harms that may arise from the Rules as they are currently framed and make recommendations to the draft rules that we hope will help the Government meet its objectives while remaining situated within the constitutional ambit.

The response can be accessed here.

For more details visit https://cis-india.org/internet-governance/blog/response-to-the-draft-of-the-information-technology-intermediary-guidelines-amendment-rules-2018

We are anonymous, we are legion

Revisiting Aadhaar: Law, Tech and Beyond

Revenge Porn Laws across the World

1. Europe

United Kingdom

2. United States of America

3. Australia

4. Asia and Rest of the World

Revealed: Bangalore’s Basic Instincts

Instant attraction

True love waits?

Masti after marriage?

Unhappy about gays

Live-in is in

Pure emotions

One wild night

The work-shift rift

Social network gets a poke

Porn supremacy

Rethinking the Internet: The Way Forward

Overview

Agenda Day One: Thursday, March 22, 2013

Agenda Day Two: Friday, March 23, 2013

Currently confirmed to participate now include:

Rethinking the intermediary liability regime in India

Introduction

Broad, thematic concerns with the Rules

A uniform mechanism of compliance

Timelines

Utilization of ‘automated technology’

The problems of AI

What can be done?

Rethinking Privacy: The Link between Florida v. Jardines and the Surveillance of Nature Films

Rethinking National Privacy Principles: Evaluating Principles for India's Proposed Data Protection Law

Rethinking DNA Profiling in India

Rethinking Acquisition of Digital Devices by Law Enforcement Agencies

Resurrecting the marketplace of ideas

Censorship by proxy

Algorithmic governmentality

Possible policy prescriptions

Responsible Data Forum: Discussion on the Risks and Mitigations of releasing Data

Responsible AI Workshop

Responses to Trai’s consultation paper on free data contain some good suggestions

Response to the Pegasus Questionnaire issued by the SC Technical Committee

Response to the Draft of The Information Technology [Intermediary Guidelines (Amendment) Rules] 2018