We are anonymous, we are legion

Why the Madras HC case on WhatsApp traceability could have wider ramifications

Haripirya Suresh — 2019-08-09T13:58:46Z

While traceability will make law enforcement easier, it could also undermine voices of dissent, say experts.

The article by Haripriya Suresh was published in the News Minute on August 8, 2019. Pranav Manjesh Bidare was quoted.

One of the strengths of the messaging service used by 400 million Indians, WhatsApp, is the end-to-end encryption it offers, which means that only the sender and receiver can view the messages. However, there is a possibility that this may change, with the Madras High Court taking up the issue of traceability of messages.

Two petitions filed in the Madras High Court in July last year by animal welfare activists Antony Rubin and Janani Krishnamurthy, called for Aadhaar or any government-authorised identity proof to be mandatory for any email or social media accounts and utility accounts (such as Ola and Uber). A division bench of the court comprising Justices S Manikumar and Subramonium Prasad expanded the scope of the petition to include curbing of cybercrime and intermediary liability. At a hearing in June, the High Court reportedly said: “Aadhaar is a government accord used only for social welfare schemes. You cannot have the government linking it with social media.” However, the court is looking at the traceability of messages, which experts argue could affect WhatsApp and other big players and have larger ramifications.

Pranav Bidare, a policy officer with the Centre for Internet and Society, says that at present, bringing traceability into the picture will make law enforcement easier, but take away the benefits of end-to-end encryption, which are based on privacy.

“The benefits of whatever tool we're trying to improve has to be weighed in comparison to the potential wrongs that could happen. In this case, when WhatsApp messages have the possibility of not being end-to-end encrypted, the fact that you will be able to trace forwards could mean that you could create a situation where people are afraid to send messages or forward things for fear of action being taken against them. There are two things — fear of spreading problematic material because one is afraid that action will be taken against them, but also fear of spreading material that could put you in a potential situation of danger,” he says.

The Madras High Court asked IIT Madras Prof V Kamakoti, who is also a member of the National Security Advisory Board (NSAB), to submit a report on the feasibility of messages on WhatsApp being traced. In late July, he informed the court that it was possible to trace the original sender of messages on social media platforms, including Facebook and WhatsApp. He suggested that an information tag must be added to the message that was originally sent, so when it is eventually forwarded, the original person’s information details would be attached along with it. Another feature he suggested was that some messages be flagged as messages that cannot be forwarded.

Pranav says that he would favour features to tackle fake news, which is the system of making some messages un-forwardable. “I don't see a free speech problem there. I see a problem in adding actual traceability where if you make people liable for messages that they have been sending, then there is a thin line between curbing fake news, and curtailing free speech,” he adds. To tackle this, Pranav says that design changes are the way to go.

‘Could undermine voices of dissent’

The Internet Freedom Foundation (IFF) filed to be an intervenor in the case, which the High Court accepted. An intervention allows the applicant to address the court on a specific matter but is not a party in the case.

Speaking to TNM, Apar Gupta, the Executive Director of IFF, says that while it may not be best to speculate, the stakes in this case are significant and can have wide ramifications “because it wouldn’t be limited to a WhatsApp only”.

“It could extend to any form of encryption deployed in a messaging system, which could potentially mean that even smaller uses of it, and could creep into other areas where encryption is utilised to maintain confidentiality. For instance, in areas such as business and trade secrets, encryption is used widely to ensure trade secrets do not leak out,” he says.

Apar says that it could remove anonymity, which was a point raised by the Tamil Nadu government for traceability. “It could undermine voices of dissent, people who speak up against instances of abuse and harassment online, and also for addressing issues. One very good instance of this was the MeToo accounts put out by several women in India, quite often not under their name because they fear reprisals from men who have done these criminal acts,” he adds.

Once the Madras High Court widened the scope of the petition, Google, Facebook and Twitter have all been impleaded in the case.

Apar agrees that traceability is a debate which is merited, even if it is limited by the court to only WhatsApp. “It could stretch beyond the big players because it’s not limited to them, and it will eventually apply to functionality as opposed to size,” he adds.

This isn’t the first time that the government has gone after social media platforms, and WhatsApp in particular, over encryption and lack of sharing data with law enforcement. Minister of Electronics and IT Ravi Shankar Prasad met with WhatsApp’s global head Will Cathcart late last month after which he said that the company was told that traceability shall be their job and they need to find the mechanism to do so.

“But in the event that the WhatsApp platform is thought to be abused by rogue, terrorist, extremist elements, by repeating some kind of recirculation of messages, then there must be a mechanism whereby those can be traced to enforce appropriate law and order, and safety and security of the country,” Ravi Shankar Prasad then said, according to Medianama.

According to Buzzfeed News, WhatsApp, in a submission to the court, said: “Journalists could be at risk of retaliation for investigating issues that may be unpopular, civil or political activists could be at risk of retaliation for discussing certain right and criticizing or advocating for politicians or political, and personal information like sexual orientation, health, religious affiliation, Aadhaar, and financial information could be at risk of becoming publicly exposed.”

For more details visit https://cis-india.org/internet-governance/news/the-news-minute-haripriya-suresh-august-8-2019-why-madras-hc-case-on-whatsapp-traceability-could-have-wider-ramifications

Why the lack of understanding about the Blue Whale Challenge poses a bigger threat?

Admin — 2018-01-03T01:52:34Z

On 30 August, Vignesh A, a 19-year-old college student from Madurai committed suicide. Indications of self-harm on his body swaying investigating agencies to suspect that the suicide was related to the Blue Whale challenge-an online game which involves completing 50 tasks or challenges dictated by a remote 'handler' which ultimately leads to ending their own life.

The blog post by Anusha Ravi was published by Oneindia.com on September 6, 2017.

Though investigating agencies in India are yet to determine the exact cause of Vignesh's fateful decision, the lack of understanding may have caused the former to pass it off as related to the sinister challenge, online experts and child psychologists say.

The game believed to have its origins in Russia (originally known as Siniy Kit-Blue Whale in English) is suspected to have claimed the lives of many youngsters globally and spreading fast in the virtual space. But experts say that misinformation on the challenge is spreading faster.

The information or lack of it

Experts point out to a recent incident. On Monday, the Tamil Nadu government told the Madras High Court that "Blue Whale Challenge cannot be downloaded since all links to the game were blocked." "First of all, one does not require a 'link' to play the Blue Whale game. It can be played on any communication medium, say Whatsapp, Telegram, Facebook messenger, Skype, word of mouth for all you know," said Udbhav Tiwari, a researcher and Policy Officer at The Centre for Internet and Society-a research and advocacy group. He believes that it is virtually impossible to identify or block the game.

Blue whale challenge: Rescued victim tells what it is, calls it mental torture | Oneindia News

The first possible reference to the game was in Russia after a mother investigated her 12-year-old daughter's online activity after she killed herself around mid last year, Bloomberg reported on 25 April. But references to "death groups" was a fact established by a local journalist, later examined and results shared by multiple groups to determine and create awareness to avert further tragedies. A suicide in Mumbai believed to be the first in India, purportedly a Blue Whale Challenge victim in Andheri is still under investigation.

The game itself

According to experts, youngsters who join certain online groups which may have bearing to the game, are spotted by 'curators'. They are first vetted, made to share personal information and later handed over 50 tasks which include waking up at early in the morning (some research says 4.20 am), watching horror movies alone, listening to deep breathing sounds and causing bodily harm like making cuts and incisions initially. Online resources indicate that the challenge is to isolate the individual and making them susceptible for more sinister tasks ahead. Those seeking to back out are coerced into continuing with threats of uploading personal information on the deep web. At a later stage, there is a possibility of meeting with another participant to remove any doubts about continuing the game.

Netting the big fish

States like Tamil Nadu, Kerala, West Bengal among others have issued advisories to parents, teachers and students on how to identify and whom to consult when you notice any of the behavioural changes among children. Anitha Desai, a child psychologist based in Bengaluru says that being able to identify the behavioural change is one of the key aspects to avert a tragedy. "Seclusion, lack of interaction with family and friends, thoughts of running away from home and death, variation in eating and sleeping patterns, moodiness, lack of concentration, dipping interest in studies and falling grades are all the signs of a depressed child," she specifies. But she clarifies that only by indulging the child can the parent or guardian know the cause of the depression, not assuming. While there have been several cases of 'death groups', 'death games' and 'suicide challenges' internationally, all of them, much like the Indian context, are conjectures, experts say.

With only online information, multiple theories explaining various possibilities and versions, there exists very little verified information about the existence of such sinister games or challenges. News reports of such games and its consequences are also likely to mislead or make believe the possible existence of such challenges. Few of us knew Vignesh. But only this teenager, with his whole life ahead of him, took this extreme step. The least we can do is educate ourselves.

For more details visit https://cis-india.org/internet-governance/news/one-india-anusha-ravi-september-6-2017-why-the-lack-of-understanding-about-the-blue-whale-challenge-poses-a-bigger-threat

Why the Internet is Making India Furious

praskrishna — 2016-02-28T03:01:59Z

The Centre for Internet and Society (CIS) in Bangalore is a kind of hacker club for wonks and lawyers obsessed with issues of digital rights and global development. Not exactly the mainstream kids’ lunch table. But the Center was brought into sudden relief this week, thanks to … Mark Zuckerberg.

Read Sanjena Sathian's blog post published by Ozy on February 19, 2016

In a splashy bit of news, India’s telecom authority rejected a program called Free Basics, which the Facebook team had been promoting as a way to get free Internet to the masses. (Here on the subcontinent, more than 300 million people use the Internet — but that’s only about a quarter of the population.) The idea: Facebook would allow free access to a handful of websites (the “basics”) to everyone; users would pay for further content. The objections: On the dramatic end came comparisons to colonialism; on the wonkier, objections based on the principles of net neutrality, or the idea that all Internet content should be treated the same. The threat the critics saw in Free Basics was that of the Web as a two-lane highway — the free stuff for the poor folks, and the good stuff for those who can afford it.

Mumbai-based Sanjena Sathian spoke to CIS cofounder and policy director Pranesh Prakash about the changing landscape of web rights that led up to the news.

OZY:

Tell us what you’re thinking in the wake of India’s decision.

Pranesh Prakash:

The order seemed to fix the issue with a sledgehammer rather than a scalpel. It over-regulates and bans things that are beneficial along with that that aren’t. They should have aimed for discriminatory pricing, but they’ve instead eliminated all differential pricing, even when it’s not discriminatory.

What should come next, in my opinion — it is imperative to ensure that governmental resources are used to provide free access to the Internet. If you’ve taken away something that could have helped and said no, no, no, it’s not good for you, then you are under an obligation to provide a replacement.

OZY:

How do you think the larger political conversations going on in India right now seep into the debates about digital rights?

PP:

Many people think the largest divider is between those who are from a developing country or a developed country. I think the larger divide is between those who are politically skeptical of states — more libertarian — versus those who are more trusting of states and see states as having a role to play in Internet governance. How you think the poor in India should get Internet — should that be provided by government or by market mechanisms — well, your political philosophies will play a role. In India, one tends to find fewer free-market fundamentalists than one would meet in, say, San Francisco.

OZY:

I think, increasingly, post-Snowden in particular, people think of digital rights as human rights. Where do you see things going wrong on a rights front here in India?

PP:

Oh, wow … so many ways. In India we have a situation where, right now, more than 3,000 websites were blocked by the government, but no one knows what these sites are. No one knows whether they were blocked through mechanisms that ensure accountability. There is no transparency around any of these. And this is just the visible tip of the iceberg. And how do I know this? I sent a right-to-information request to the government and they gave me this answer. But beyond this, they put in place a few years ago a law which allows for websites and any kind of web content to be censored by anyone. And all they have to do is send a request to any “intermediary,” which could be anything from your ISP to your web host to your DNS provider.

OZY:

Wait, so what does that mean? I get annoyed at a site — where do I go to lodge my complaint?

PP:

All these websites are required by the law to appoint a particular person as a “grievance redressal officer.”

OZY:

What a title!

PP:

Yes … and there are more than 40 grounds for grievances that have been listed in the law, including things such as “causing harm to minors” and certain speech being “disparaging.” Now, I engage in disparaging speech at least 12 times a day. And that’s perfectly legal under Indian law!

OZY:

Eep. Any good news, though?

PP:

A case went all the way up to the Supreme Court, [involving a young woman named] Shreya Singhal. There was a section 66A, quite an odious provision, that allowed for any kind of “offensive” or “annoying” speech to cause that person to be put in prison for up to three years.

Two teenage girls in Maharashtra, upon the death of a politician, put out a comment on social media. The death had caused a bandh, a curfew of sorts in Mumbai, and done not officially by the government but by political party workers. One girl said on Facebook, sure, go ahead, respect this politician, but why inconvenience so many citizens? Her friend liked this. And a case was launched against them. Similarly, some cartoons by an anticorruption activist were challenged and he was imprisoned briefly and released on bail.

OZY:

It’s always the cartoonists.…

PP:

Yes, and one professor in Calcutta — for forwarding a cartoon, he was placed under this law too. Many cases of perfectly fine political speech were made illegal thanks to this law. Eventually, though, in a landmark decision, the Supreme Court struck down this law, and this is the first time in almost three decades that the Supreme Court has struck off an entire law for being unconstitutional.

But, yes. Mostly? It’s not been pretty.

For more details visit https://cis-india.org/internet-governance/news/ozy-february-19-2016-sanjena-sathian-why-internet-is-making-india-furious

Why the DNA Bill is open to misuse: Sunil Abraham

sunil — 2015-09-13T08:37:44Z

The Human DNA Profiling Bill, the law that regulates the collection, storage and use of the human genetic code, has attracted some strong criticism from civil liberties groups including the Bengaluru-based Centre for Internet and Society (CIS) which had participated in the expert committee for DNA profiling constituted by the Department of Biotechnology in 2012.

CIS circulated a detailed dissent note earlier this year on the draft of the Bill. As the government gets ready to table the Bill in Parliament, CIS Executive Director Sunil Abraham tells Kanika Datta why the provisions of the Bill are open to misuse and invasion of privacy. Edited excerpts:

Why does Centre for Internet and Society reject using DNA analysis for non-forensic use as set out in the Human DNA Profiling Bill in its current form? What are the possible risks involved here?

The problem here is that the introduction to the Bill talks of DNA matches "without a doubt". But the way we understand it, biometric technology depends on approximate matching and not discrete matching. Unlike, say, the technology used for matching digital signatures, machines for matching DNA, fingerprints or the iris specify a false positive ratio when they leave the factory - that's what created the controversy in the O J Simpson trial, for example. This means you have to be very conservative in populating the database. For a given false positive ratio - the larger the database the greater the incidence of mistaken identification. That is why we think that for purposes other than forensic use, it would be better to create other databases.

Let me clear: we are not Luddites but neither are we naïve techno-enthusiasts. After all, the Innocence Project in the US has managed to overturn the convictions of many people who were held guilty through DNA evidence. But it is a myth that the more sophisticated the technology the more secure and accurate it is. In fact, the reverse is often true. For instance, the voter machines we use in India are primitive technology but they are much harder to compromise compared to the voting machines used in the US. Given all this, we believe that there should be "process fixes", such as sending DNA collected from a crime scene to two laboratories as a check and balance against the fallibility of human beings and machines.

CIS made the point that the powers of the DNA Board are too wide. In what possible way could these powers be misused since the Board is to be an independent authority?

When this exercise was started, the DNA Board had 26 functions. We proposed that this be cut this down to ten, which was accepted by a sub-committee. But when the final Bill came back it rejected the consensus view and restored the 26 functions, including things like "raising the general awareness". All this detracts from the Board's primary role and efficiency and expands its discretionary powers. It is true that a good regulator needs some amount of discretion but this should be a limited discretion within a tightly defined scope -- this is true for any regulator, not just the DNA Board.

The provision that no civil suit can be entertained on any matter on which the DNA Board is empowered under the Act looks excessive. Is there any precedent that explains why this provision was introduced? What kind of oversight and checks and balances are there in other jurisdictions that could be incorporated in the Indian law?

I can understand the logic here; the government is trying to ensure that the regulator has final say. After all, if you look at telecom, the decisions of the TDSAT (Telecom Dispute Settlement & Appellate Tribunal) can be appealed in the High Court and the Supreme Court. But eliminating judicial appeal as this Bill has state amounts to a violation of classic regulatory design by circumventing the appellate process. Ideally, we need a tripartite separation of law in which the executive frames policies, the DNA board implements them and the courts adjudicate upon them.

You have said the term "DNA Analysis" has not been defined. Could you explain the possible risks of the absence of a definition?

DNA analysis is of many types and some of them allow you to get to know a person quite intimately in terms of their medical history, genetic traits and so on. But forensic analysis looks at a limited set of markers which are essentially privacy-protecting and from which no genetic traits can be determined. You can't, for instance, do a study on the genetic make-up of criminals from this analysis. Now, if this Bill is around law enforcement - which we know is the policy intention - then the DNA analysis should be limited to those markers. That would reduce the chances of abuse.

You have also criticised the low standards of information disclosure and suggest the issue should be vested in an independent third party rather than the DNA Bank Manager. Could you explain how this would help?

In information and technology and telecom there is an executive authorisation mechanism in place for information sharing that requires the home secretary's permission for non-emergency situations and the head of the police station in the case of an emergency. We want a similar authorisation process - say, a judge and an established paper trail so that there are proper checks and balances. When personal information is involved, even the DNA Board is not well placed because its members are scientists whereas disclosure of personal information is a question of the law.

You have said the Bill has not been brought in line with the nine national privacy principles set out by an expert committee in 2012. Shouldn't a privacy law precede the passing of the DNA Bill in any case?

It's not a chicken-and-egg situation, but the point to consider is that the world is moving towards European data protection principles, and something like 100 countries have adopted it. If we in India want to trade in European personal information (via our BPO and outsourcing businesses) we must have a law that is adequate from the data protection perspective. This means, among other things, mandating that anyone whose DNA profile is accessed receives a notice to this effect, for instance. We know that the Department of Personnel and Training has incorporated the principles set out in the Justice Shah report in the privacy Bill two years ago but we haven't heard anything about it since. If and when this Bill is enacted, it will have overriding powers over a host of laws. But where the DNA Bill is concerned, there is no reason for it not to take cognisance of a later law.

What has been the government's reaction to this dissent note?

No reaction!

For more details visit https://cis-india.org/internet-governance/news/business-standard-kanika-datta-august-1-2015-why-the-dna-bill-is-open-to-misuse-sunil-abraham

Why should you keep a close eye on the net neutrality debate in the US

Admin — 2017-11-25T15:33:32Z

As the United State's FCC Chairman Ajit Pai gears up to repeal the net neutrality laws put in place in 2015, India should sit up and take note.

The blog post by Subhrojit Mallick was published by Digit on November 24, 2017.

Back in 2014, a group of Redditors started debating net neutrality in India after Airtel announced it would charge extra for Voice Over IP (VoIP) services like Skype. Soon, that snowballed into a nation-wide campaign with over a million internet users participating. Things didn’t help when Facebook too wanted to provide a bunch of internet services for free in India through its Internet.org or Free Basics initiative. However, a year-long discussion and public outrage against the two, led the Telecom Regulatory Authority of India (TRAI) to rule in favour of net neutrality and stop both Airtel and Facebook in their tracks of violating a free and open internet.

Fast forward three years down the line and America, the birthplace of the internet, is struggling with the problem of internet freedom. The Federal Communications Commission (FCC) under the Donald Trump Administration led by Chairman Ajit Pai submitted a final draft proposal yesterday to repeal the existing net neutrality laws put in force by the Obama administration in 2015. The draft proposal will be voted upon by FCC by the end of the year and considering the FCC has a Republican majority under Ajit Pai, the proposal is likely to pass.

The draft removes almost every net neutrality rule from 2015, making ISPs the gatekeepers of the internet. It states internet providers will have the freedom to implement fast and slow speed lanes, prioritise traffic and block apps and services. The only rule they have to follow -- publicly disclose when they are doing any of the things stated above.

Executive director of the Centre for Internet and Society, Sunil Abraham elaborated on what's on Pai's mind.

"Ajit Pai's ideology is pro-market. He believes the market will sort all problems out. According to Pai, the magic of competition will eliminate all the harms emerging from net neutrality violation," he said.

"Pai has said, you do what you want to do, but you have to disclose that to the public. You can block, throttle, have fast lanes, prioritise traffic, have discriminatory pricing, but you disclose them. If the customer doesn't like it, he can swith to another network. Pai believes the transparency requirements will allow the magic of the market to diminish and eliminate harm. His regulation of net neutrality is transparency," Abraham further added.

However, such a move will have drastic effects on the free flow of internet traffic. Telecom companies and ISPs can handpick services by charging customers to access some sites or by slowing down the speeds of others. For instance, ISPs can make consumers pay more to watch high-quality content on Netflix.

With net neutrality rules repealed, the internet will become a pay-to-play service. It will essentially divide the internet into fast and slow lanes. One will be a speedy service that could be priced higher and another, much slower and cheaper. While big players like Amazon, Facebook, Google, Netflix and the likes can easily pay the higher fees and stay unfettered, newcomers and smaller players will have it tough. Although, the move will lead to cuts in profits for everyone. A higher price to consumers will eat into the user base of these companies, while startups and new voices in the media will find entry and success prohibitive.

Although it’s true that no single ISP in the US has the entire market to itself and the market is indeed divided into a handful of players, they do operate in a de facto monopolised way. How? ISPs in the US have sliced up the entire country into areas such that users in a particular area have only one choice of service provider. That essentially leaves users at the mercy of whatever Comcast or Spectrum is offering (or not offering).

By putting the net neutrality rules in place in 2015, the US had ensured these ISPs won’t do anything grossly uncompetitive. The current rules make broadband in the country a public utility, same as electricity. And now, Ajit Pai-led FCC is about to repeal those very rules that kept them grounded.

Will the FCC ruling make apps and services expensive in other countries?

While Pai’s jurisdiction does not extend beyond the United States, his tirades against a free internet will most definitely have rippling effects across the world. More importantly, it will raise the cost of operations of companies like Netflix and Amazon who will have to hire legal experts and lobbyists to negotiate deals with service providers. That extra cost will be burdened on the US consumers of course, but since they have a large international presence, it is likely that the extra cost will trickle down to users outside the US as well.

And that’s not just the streaming companies. All the tech giants hail from the US and it is only logical that a rise in their costs of operation will have an impact on their global operations.

Although, if the level playing field in the US is disrupted, companies will look for greener pastures and if that means moving out of the US to other countries, it could happen.

How will FCC’s decision impact India?

While US is grappling with such a reality, Indians fought against it and won. Or did they? Last year, after Airtel and Facebook were asked to drop their plans for differential pricing, TRAI released a paper on net neutrality and differential pricing to finalise its views on the matter. The regulatory body released a 14-question long consultation paper seeking comments on internet traffic management from the public.

“Increasingly, concerns have been raised globally relating to discriminatory treatment of Internet traffic by access providers. These concerns relating to nondiscriminatory access have become the centre of a global policy debate. The purpose of this second stage of consultation is to proceed towards the formulation of final views on policy or regulatory interventions, where required, on the subject of NN,” the paper read.

“Net Neutrality being repealed in the US will hurt innovation in that country, and will lead to a consolidation of power with those Internet companies which have the money to partner with US carriers. This hurts Indian product startups, because it means that their apps may not be as easily available to users in the US. The Internet is one world, and we need the same Internet to be available everywhere, across the world: one Internet for the entire world,” Nikhil Pahwa, Co-Founder of Internet Freedom Foundation told Digit.

That means, essentially, the debate on net neutrality is not over in India. In fact, both RS Sharma, the Chairman of TRAI and FCC’s Ajit Pai agree on the need to bridge the digital divide. Both are exploring ways to keep the internet open while providing access to the unconnected. Thankfully, both differs on the approach to meet that goal.

Pai believes the internet should be left unregulated despite the “hypothetical harms” to the consumer. He thinks the current rules were put in place to avoid theoretical harms which were not based on hard evidence. Pai claims there should be evidence-based regulation of the internet.

Sharma, in contrast, disagrees on an evidence-based approach.

“The TRAI's view of Net Neutrality has so far been diametrically opposite to Ajit Pai's FCC, and with good reason. Net Neutrality ensures that all ISPs and telecom operators act as exchanges of data between users, and do not discriminate on the basis of the type or source of that data. This allows for permission-less innovation on the Internet, which has given us the Internet that we have today,” Pahwa added.

Will India’s stance on net neutrality change after the FCC’s decision?

Rajan Mathews, Director General of Cellular Operators Association of India believes the FCC’s decision will no doubt have some impact on the path India takes.

“I think the policymakers will look at the decision the US makes. They had taken their decision as a point of reference before and the FCC’s ruling is too large an issue to not look at it. Both the DoT (Department of Telecom) and TRAI will have to reevaluate their approach in the context of the what happens in the US,” he said.

“Net neutrality approach in both countries is still in flux and India is going to tread lightly on net neutrality issues,” he added. As per Mathews, in India, the situation is different from the US where a handful of telecom companies and ISPs wield control of the entire country. In India, there is a licensed environment which provides a minimal standard of net neutrality, which is applied across the board and everybody who is providing a similar service is made to follow similar guidelines.

However, Mathews did attribute India’s efforts to enforce net neutrality to the United States’ efforts to place the rules in the first place in 2015 under the Obama administration, when internet was deemed as a public utility, same as electricity or telephone.

“Net neutrality in India emerged from the US definition. Now that they are going to repeal it, people in India who were looking at the US as a model will evaluate the implications of the move,” Mathews elaborated.

The US is looking to implement an ex-post approach to regulating the internet wherein the ISPs and telcos will adopt a free market approach and will only be investigated if they violate a rule. India, Mathews says, is adopting an ex-ante approach where there will be some commonly accepted criteria of net neutrality, but operators will have the ability to manage their traffic to ensure quality of service.

Minister of Information and Broadcasting, Ravi Shankar Prasad also helped alleviate fears of India following suit. During the Global Summit for Cyberspace Security held yesterday, he said, "The citizens' right of accessing the internet is "non-negotiable" and the government will not allow any company to restrict people's entry to the worldwide web."

Prime Minister Narendra Modi also came in support of net neutrality in India. He tweeted, "The internet, by nature, is inclusive and not exclusive. It offers equity of access and equality of opportunity."

Pahwa, who fought hard against Airtel and Facebook to ensure the internet remains neutral, was confident the decision won’t affect India’s stance on net neutrality. However, he is apprehensive that Indian telecom companies might borrow a leaf from their US counterparts and lobby hard to repeal the rules.

“I don't think the FCC decision affects the Indian regulation in any way, because the Indian regulator TRAI has already established strong and well rooted principles for Net Neutrality regulations in India. The only thing that worries me is that Indian telecom operators will use the developments in the US to push back against Net Neutrality with renewed vigour,” he said.

So, on the face of it, while India is well insulated from the catastrophe the United States has embarked upon, it is important to watch what the US is doing closely and make sure we don’t repeat their mistakes here.

For more details visit https://cis-india.org/internet-governance/news/digit-subhrojit-mallick-november-24-2017-why-should-you-keep-a-close-eye-on-net-neutrality-debate-in-us

Why Presumption of Renewal is Unsuitable for the Current Registry Market Structure

Padma Venkataraman — 2017-10-31T02:53:26Z

With the recent and much protested renewal of the .net legacy Top-Level-Domain (TLD), the question of the appropriate method of renewal has again come to the forefront. While this seems relatively uncontroversial to most, Padma Venkataraman, a law student and intern at CIS looks at presumptive renewal through a critical lens.

With the recent renewal of the .net legacy Top-Level-Domain (TLD), the question of the appropriate method of renewal is worth reconsidering. When we talk about presumption of renewal for registry agreements, it means that the agreement has a reasonable renewal expectancy at the end of its contractual term. According to the current base registry agreement, it shall be renewed for 10-year periods, upon expiry of the initial (and successive) term, unless the operator commits a fundamental and material breach of the operator’s covenants or breach of its payment obligations to ICANN.

Download the entire blog post here

For more details visit https://cis-india.org/internet-governance/blog/why-presumption-of-renewal-is-unsuitable-for-the-current-registry-market-structure

Why NPCI and Facebook need urgent regulatory attention

sunil — 2018-06-12T02:07:42Z

The world’s oldest networked infrastructure, money, is increasingly dematerialising and fusing with the world’s latest networked infrastructure, the Internet.

The article was published in the Economic Times on June 10, 2018.

As the network effects compound, disruptive acceleration hurtle us towards financial utopia, or dystopia. Our fate depends on what we get right and what we get wrong with the law, code and architecture, and the market.

The Internet, unfortunately, has completely transformed from how it was first architected. From a federated, generative network based on free software and open standards, into a centralised, environment with an increasing dependency on proprietary technologies.

In countries like Myanmar, some citizens misconstrue a single social media website, Facebook, for the internet, according to LirneAsia research. India is another market where Facebook could still get its brand mistaken for access itself by some users coming online. This is Facebook put so many resources into the battle over Basics, in the run-up to India’s network neutrality regulation. an odd corporation.

On hand, its business model is what some term surveillance capitalism. On the other hand, by acquiring WhatsApp and by keeping end-toend (E2E) encryption “on”, it has ensured that one and a half billion users can concretely exercise their right to privacy. At the time of the acquisition, WhatsApp founders believed Facebook’s promise that it would never compromise on their high standards of privacy and security. But 18 months later, Facebook started harvesting data and diluting E2E.

In April this year, my colleague Ayush Rathi and I wrote in Asia Times that WhatsApp no longer deletes multimedia on download but continues to store it on its servers. Theoretically, using the very same mechanism, Facebook could also be retaining encrypted text messages and comprehensive metadata from WhatsApp users indefinitely without making this obvious.

My friend, Srikanth Lakshmanan, founder of the CashlessConsumer collective, is a keen observer of this space. He says in India, “we are seeing an increasing push towards a bank-led model, thanks to National Payments Corporation of India (NPCI) and its control over Unified Payments Interface (UPI), which is also known as the cashless layer of the India Stack.”

NPCI is best understood as a shape shifter. Arundhati Ramanathan puts it best when she says “depending on the time and context, NPCI is a competitor. It is a platform. It is a regulator. It is an industry association. It is a profitable non-profit. It is a rule maker. It is a judge. It is a bystander.”

This results in UPI becoming, what Lakshmanan calls, a NPCI-club-good rather than a new generation digital public good. He also points out that NPCI has an additional challenge of opacity — “it doesn’t provide any metrics on transaction failures, and being a private body, is not subject to proactive or reactive disclosure requirements under the RTI.”

Technically, he says, UPI increases fragility in our financial ecosystem since it “is a centralised data maximisation network where NPCI will always have the superset of data.” Given that NPCI has opted for a bank-led model in India, it is very unlikely that Facebook able to leverage its monopoly the social media market duopoly it shares with in the digital advertising market to become a digital payments monopoly.

However, NCPI and Facebook both share the following traits — one, an insatiable appetite for personal information; two, a fetish for hypercentralisation; three, a marginal commitment to transparency, and four, poor track record as a custodian of consumer trust. The marriage between these like-minded entities has already had a dubious beginning.

Previously, every financial technology wanting direct access to the NPCI infrastructure had to have a tie-up with a bank. But for Facebook and Google, as they are large players, it was decided to introduce a multi-bank model. This was definitely the right thing to do from a competition perspective. But, unfortunately, the marriage between the banks and the internet giant was arranged by NPCI in an opaque process and WhatsApp was exempted from the full NPCI certification process for its beta launch.

Both NPCI and Facebook need urgent regulatory attention. A modern data protection law and a more proactive competition regulator is required for Facebook. The NPCI will hopefully also be subjected to the upcoming data protection law. But it also requires a range of design, policy and governance fixes to ensure greater privacy and security via data minimisation and decentralisation; greater accountability and transparency to the public; separation of powers for better governance and open access policies to prevent anti-competitive behaviour.

For more details visit https://cis-india.org/internet-governance/blog/economic-times-june-10-2018-sunil-abraham-why-npci-and-facebook-need-urgent-regulatory-attention

Why is the UIDAI cracking down on individuals that hoard Aadhaar data?

praskrishna — 2016-04-17T16:16:26Z

Private firms' offer to print Aadhaar details on plastic card a breach of law.

The article by Alnoor Peermohamed was published by Business Standard on April 13, 2016. Sunil Abraham was quoted.

The billion-strong citizen identification system, Aadhaar, has given rise to businesses keen on illegal harnessing of this private data, say the authorities.

Outfits are offering services to print the Aadhaar details on plastic cards, something the Union information technology ministry warned against on Monday. These entities charge anywhere between Rs 50 and Rs 600, and are listed on e-commerce websites, apart from own online presence.

Under the Aadhaar law, collecting and storing of the data by private companies without the user’s consent is a crime. Monday’s warning from the ministry to e-commerce marketplaces such as Amazon, Flipkart and eBay to disallow merchants from collecting and printing such details was a result of this.

This newspaper could not find any listings of Aadhaar printing services on Flipkart but there was one on Amazon (taken down) and no less than five such listings on eBay.

PrintMyAadhaar is one of the more well organised outfits operating in this space. “Get your E-Aadhaar printed on a PVC card for easier handling,” reads their website. Users are prompted to fill their Aadhaar details on the website, pay Rs 50 and have the card sent to their houses. PrintMyAadhaar even offers discounts for bulk orders.

“Collecting such information or unauthorised printing of an Aadhaar card or aiding such persons in any manner may amount to a criminal offence, punishable with imprisonment under the Indian Penal Code and also Chapter VI of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016,” read the statement from the ministry.

Currently, Aadhaar stores a person’s name, date of birth, sex and address, apart from their biometric data.

While the biometric data isn’t available to these PDF printing shops, the rest of the information is, according to Srikanth Nadhamuni, chief executive officer of Khosla Labs and a former head of technology at the Unique Identification Authority of India. However, collecting this data poses no security risk to the Aadhaar infrastructure, he added.

“Allowing somebody to accumulate large amounts of data from Aadhaar users in general is not a good practice. We should ensure that the Aadhaar details of people remain private and it should only be up to the discretion of the end-user to share this,” said Nadhamuni.

Some security experts say Aadhaar does pose a security risk, as it makes available an individual's details in the public domain. Several institutions are treating Aadhaar just like any other proof of identity.

“Transactions that should have been conducted using biometric authentication are being conducted just by presentation of paper documents. What is happening most commonly is that people are giving a printout or photocopy of their Aadhaar acknowledgement as their proof of identity to get a SIM card. The risk here is that somebody can get a mobile number against your name,” said Sunil Abraham, executive director of the non-profit Centre for Internet and Society.

He says the other technical issue with Aadhaar is the lack of a smart card that stores a person’s information, as in a digital signature. Due to the lack of this, people don’t know what information to keep private and what to make public. Conventional security techniques would have had a person keeping their PIN private (as with a bank account). If this personal PIN would have been saved on a smart card, which users wouldn’t have had much to worry about.

“In the case of Aadhaar, the authentication factor and the identification factor are in the public domain, because many people might have your UID number and people release their biometric data everywhere. Due to this broken technological solution, we are now through policy putting band-aids, saying people should not disclose their UID number unnecessarily,” added Abraham.

For more details visit https://cis-india.org/internet-governance/news/business-standard-alnoor-peermohamed-april-13-2016-why-is-uidai-cracking-down-on-individuals-that-hoard-aadhaar-data

Why Indians are turning down Facebook's free internet

praskrishna — 2016-01-17T16:25:10Z

Imagine a billion of the world’s poorest gaining overnight access to health information, education, and professional help — for free. Add to this one rich man who wants to make that dream a reality.

The article by Nimisha Jaiswal was published in the Global Post on January 13, 2016. Sunil Abraham was quoted.

That’s the invitation that Facebook has sent to India. Many there, however, are rejecting such benevolence.

Facebook has introduced its Free Basics project in 36 countries. The company claims that the app acts as a stepping-stone to the internet for those who are otherwise without access, by providing them with a few essential sites — or “basics” — to get started.

“We know that when people have access to the internet they also get access to jobs, education, healthcare, communication… We know that for India to make progress, more than 1 billion people need to be connected to the internet,” wrote Facebook CEO Mark Zuckerberg in a recent op-ed for a major Indian newspaper. “Free Basics is a bridge to the full internet and digital equality.”

However, net neutrality researchers and activists in India define it quite differently.

“Free Basics is a zero-rated walled garden that gives users a tiny subset of the world wide web,” Sunil Abraham, executive director of the Bengaluru-based Centre for Internet and Society, told GlobalPost.

The Free Basics app is part of Facebook’s Internet.org, a “zero-rating” internet service that provides limited access for no charge to the consumer. The original Internet.org was heavily criticized in India for violating net neutrality, the principle that all content on the web should be accessible to consumers at the same speed, without discrimination by providers.

Last spring, as part of a homegrown Save The Internet movement, over 1 million people wrote to the Telecom Regulatory Authority of India (TRAI) to protest services that disrupt net neutrality by providing only a small fraction of the internet to their users.

India’s Department of Telecommunications has already recommended that such platforms be disallowed. Before it makes its own recommendations this month, the TRAI asked concerned citizens for another round of input on zero-rating apps. The criticism has been so loud that, at the end of December, Free Basics’ local telecom partner was ordered to take the service down until a decision is reached.

Though Free Basics does not require payment from the websites it shares, Facebook’s competitors are unlikely to participate and provide user data to their rivals. And while there are currently no advertisements on Free Basics, Facebook reserves the right to introduce them in the future to garner revenue from their “walled-in” clients.

According to Abraham, such a platform harms free speech, privacy, innovation and diversity by adding another layer of surveillance and “censoring” the internet.

Mahesh Murthy, a venture capitalist who is part of India’s Save The Internet movement, puts it more bluntly.

“What Facebook wants is our less fortunate brothers and sisters should be able to poke each other and play Candy Crush, but not be able to look up a fact on Google, or learn something on Khan Academy, or sell their produce on a commodity market, or even search for a job on [Indian recruitment website] Naukri,” said Murthy.

Zuckerberg and Facebook’s India team have vigorously rebutted net neutrality activists in India, including Murthy, challenging their criticism of Free Basics and accusing activists of deliberately trying to prevent the masses from gaining internet access.

“Critics of the program continue to spread false claims — even if that means leaving behind a billion people,” wrote Zuckerberg in his Times of India op-ed.

According to Abraham, this is a misleading assertion. “They are falsely framing the debate, they are making it look like we have only two choices,” he told GlobalPost. “The choice is not between less people on the internet and unregulated [Free Basics].”

Several alternatives are being proposed. Abraham does not advocate a complete ban on Free Basics, instead suggesting a “leaky” walled garden where users would be given 100 MB of full internet access for every 100 MB of Free Basics consumed.

The Save the Internet campaign, however, wants Free Basics barred altogether. It proposes returning to previously implemented schemes like providing data on the purchase of a phone, or letting users access the full internet after watching an ad. The Universal Service Obligation Fund, set up by the Department of Telecommunications to provide affordable communication technology in rural areas, could also be used to finance free data packs.

While Facebook could potentially contribute to such funds to promote its connectivity goals, the millions of dollars it has spent loudly defending Free Basics in India suggest that the company is deeply attached to its own scheme.

Facebook has claimed that “more than four in five Indians support Free Basics,” according to a survey that it paid for. Indian users of the social network have received notifications encouraging them to send a template letter to the regulator in support of Free Basics. Even users in the US were “accidentally” notified to add their backing to the Indian campaign.

Some of the company's critics suggest that it is driven less by philanthropy, more by guaranteeing itself a stream of new users.

Murthy points out that a large number of the world’s population not yet on the internet are in India and China — and Facebook is banned in China. “So who becomes essential to Mark Zuckerberg’s balance sheet? Enter us Indians.”

While Indian activists agree that connectivity is an important goal, they insist that Free Basics in its current form is not the solution or even the only option right now. All it does is whets the appetite of the consumer, according to Abraham.

“You can compare Free Basics to when you go through the mall: You see the people selling cookies, and the aroma fills the whole mall,” he said. “That’s what Free Basics does — it gets you interested in the cookie. But it doesn’t solve the affordability question.”

For more details visit https://cis-india.org/internet-governance/news/global-post-nimisha-jaiswal-why-indians-are-turning-down-facebook-free-internet

Why India’s attempt to police digital maps and satellite images is a ‘dumb’ idea

praskrishna — 2016-05-08T13:05:48Z

Are we back to the license raj?

The story was published by the News Minute on May 6, 2016. Pranesh Prakash gave inputs.

In a move which is receiving widespread criticism from technology and policy experts, the Indian government has proposed the Geospatial Information Regulation Bill that seeks to regulate the use of ‘geospatial information’ of India. Any violation of the proposed act could attract a penalty of up to 7 years in prison and Rs. 1 crore in fines, and the extreme punishments proposed have also been criticised.

So what is Geospatial information?

Geospatial Information has been defined in the act as

any imagery or data acquired through space or aerial platforms such as satellites, aircrafts, airships, balloons, unmanned aerial - vehicles or graphical or digital data depicting natural or man-made physical features, phenomenon or boundaries of the earth or any information including surveys, charts, maps and terrestrial photos.

To put it simply, any imagery of anything on earth (in India) recorded using machines in the sky will be under the purview of the law.

The law forbids any ‘incorrect representation' of the Indian map. For instance, not showing Pakistan Occupied Kashmir as a part of India will now be illegal and attract a fine and jail-term.

Here’s what the draft bill says,

"No person shall depict, disseminate, publish or distribute any wrong or false topographic information of India, including international boundaries through Internet platforms or online services or in any electronic or physical form."

And further states,

"Whoever acquires any geospatial information of India in contravention of the law shall be punished with a fine ranging from Rs 1 crore to Rs 100 crore and/or imprisonment for a period up to seven years."

And it doesn’t end here.

In what is reminiscent of India’s license raj era, the law also mandates that any person or institution acquiring or disseminating any geospatial imagery will have to first seek permission and license from a government authority. So Google Maps, Wikipedia, OpenStreetMap and others can operate in India only with a specific license from the Indian government.

The government authority will also run “sensitivity checks” on the imagery to protect India’s security and sovereignty.

Technology and policy experts are openly gunning for the bill and are holding no punches back.

“This proposed bill is as dumb as the draft encryption bill of last year which would have made WhatsApp illegal. It is unenforceable and will only serve to make India look like a backward, despotic country,” says Kiran Jonalgadda, founder of HasGeek and a social technologist.

Pranesh Prakash, Director of the Centre for Internet and Society, is of the view that this bill goes against the philosophy of Digital India and is regressive in nature. “It bears semblance to the conditions that prevailed in the License Raj. The bill is a clear over-reaction to legitimate security concerns. The government ought to encourage open mapping and should have limited the security restrictions to a set of officially declared security installations across India,” he says.

While the government's motive may be in the best interest of maintaining national security in order to prevent the misuse of sensitive data, such stringent measures may hinder the operations of navigation services and other applications that rely on geospatial information, and it will be the smaller players who will be affected the most. “Every map maker has to create different maps for different countries and hope they're not shown in the wrong country. Google Maps can afford to do this. OpenStreetMap and Wikipedia cannot. They will effectively become illegal,” adds Jonalgadda.

These stringent rules are not entirely unexpected and the government has cracked down on institutions in the past for ‘wrong’ geographical depiction of India.

The government had taken harsh rebuke against Twitter earlier this year for showing parts of Jammu and Kashmir in Pakistan and China. In another such instance, Al Jazeera was banned from broadcasting by the Information and Broadcasting Ministry because of repeatedly using a wrong map of India and was accused of cartographic aggression. The RSS too carried an inaccurate map of India (without some parts of Jammu and Kashmir) in its mouthpiece, Organiser and later apologised for its inadvertent error.

Nikhil Pahwa of Medianama has an exhaustive explanation and critique of the bill, and tells you how you and your businesses will be affected if the law is enacted. Read his piece here.

Here are his final comments from his piece, and they are pretty scathing.

This looks like a policy made for policing Google maps that has ended up throwing out the baby with the bathwater.

The people involved in drafting this have absolutely no clue about how users and businesses use geospatial data to make users lives easier, and how integral it is to every day life. Data is changing and increasing every single minute, and it is impossible to police it.

Collection and dissemination of realtime data and its utility is what makes location information useful and special. This kills realtime information.

It looks at location information from the myopic viewpoint of businesses and platforms, and ignores crowdsourced information, and indeed, independent crowdsourced maps.

A separate policy regarding just security establishments and their removal from mapping information, as well as the depiction of national boundaries of India was all that is needed.

It’s hypocritical of a government that promised “maximum governance, miminum governance” to try and enforce a License-raj.

Interestingly, even as the government wishes to impose punitive measures on erring private bodies, government organisations will not be regulated by the Geospatial Information Regulation Bill.

For more details visit https://cis-india.org/internet-governance/news/the-newsminute-may-6-2016-why-indias-attempt-to-polic-digital-maps-and-satellite-images-is-a-dumb-idea

Why India snubbed Facebook's free Internet offer

praskrishna — 2016-02-27T07:49:08Z

The social media giant wanted to give the people of India free access to a chunk of the Internet, but the people weren't interested.

The blog post by Daniel Van Boom was published by Cnet on February 26, 2016. Sunil Abraham was quoted.

Mark Zuckerberg's ambitious mission to provide free Internet access to rural India was rejected by the people it was intended to help long before the country's regulators banned it earlier this month.

Around the country, farmers, labourers and office workers scorned Facebook's offer. Called Free Basics, it provided only limited access to the Internet through a suite of websites and services that, unsurprisingly, included Facebook. They felt the limited service didn't follow the open nature of the Internet, where all sites and online destinations should be equally accessible, so they organized real-world protests and an online Save The Internet campaign, with the message that Zuckerberg's efforts weren't welcome.

You might think people would jump at the opportunity to access Facebook for free, especially since more than a billion people use the social network every day. But it's that hitch -- that they can't access everything else -- which is precisely the problem, said Sunil Abraham, the executive director of the Centre for Internet and Society India. "Even if somebody spends 90 percent of their time on Facebook, that 10 percent is equally as important."

Indian regulators sided with popular opinion and cut off Free Basics in the world's second-most populous country on February 8. The ruling by the Telecom Regulatory Authority of India (TRAI) forbids all zero-rating plans, meaning anyone offering customers free access to only a limited set of services of sites are banned. It was championed as a victory for Net neutrality, the principle that everyone should have equal access to all content on the Internet.

The decision was undoubtedly a blow for Facebook, which says it wants to connect the billions of have-nots around the world to the Internet through the program. While more than half the world's online population uses Facebook each month, the company's efforts to connect with the developing world -- with Free Basics also being available in over 30 other countries, such as Kenya and Iraq -- could be a boon for business.

"[The Internet] must remain neutral for everyone, individuals and businesses alike. Everyone must have equal access to it," said Rajesh Sawhney, a Mumbai-based tech entrepreneur, in support of TRAI's decision to reject Free Basics. He believes the zero-rating scheme can be misused by telcos and other companies to create divisive ecosystems, where certain brands or companies are included and others aren't.

The package wasn't without its supporters though, with some being disappointed with the government's intervention in the marketplace.

"It is generally assumed that there is something sinister behind violations of Net neutrality...but that is not always true," says software engineer Shashank Mehra. "ISPs trying to match consumer demand isn't something sinister, it is a market process."

The social media giant further defends itself by pointing out that Free Basics is open to any and all developers, including competitors Twitter and Google, as long as they meet the program's technical standards. This evidently wasn't enough to convince much of India.

The problem persists

Facebook disputes claims that its interest in India is commercial, saying its efforts are humanitarian. In speeches over the past few months, Zuckerberg has painted Internet access as a tool for global good. "The research has shown on this that for every 10 people who get access to the internet, about one person gets a new job, and about one person gets lifted out of poverty," he said at a Townhall Q&A in Delhi last October. "Connecting things in India is one of the most important things we can do in the world."

Zuckerberg appears to have taken the loss in stride. During a keynote address at the Mobile World Conference in Barcelona earlier this week, he admitted to being disappointed by the ruling, but added, "We are going to focus on different programs [in India]...we want to work with all the operators there." A Facebook spokesperson said the company "will continue our efforts to eliminate barriers and give the unconnected an easier path to the Internet and the opportunity it brings."

Those ideals could certainly help in India, where around 68 percent of its population -- about 880 million people -- live in rural conditions or poverty. The promise of free access to health, education, local and national news through an Internet connection could potentially improve quality of live. So what's the problem?

The service providers would also be granting free Facebook.

Peggy Wolff, a volunteer coordinator at education NGO Isha Vidhya, says Facebook is just the latest in a long line of international companies hoping to crack rural India, where the bulk of the country's poor live.

While admitting that low cost or free Internet is imperative in rural areas, that "smart villages" are needed to help ease the human burden on India's increasingly overcrowded cities, she says, "Free basics is just a bit suspicious to most people. There's just too much vested interest."

"The big question." Sawhney says, "is how do we give fast and free Internet to a large section of society in India?"

There are alternatives. United States-based Jana, for instance, developed an Android app called mCent that allows its growing userbase of 30 million to earn data by downloading and using certain apps or watching advertisements from sponsors. Unlike Free Basics, that data can be expended on any online destination.

Jana's CEO Nathan Eagle, like Zuckerberg, says his mission is to bring Internet connectivity to the next billion people. "Today, Internet connectivity in emerging markets is much more an issue of affordability, rather than access," he explains. "1.3 billion people in emerging markets now have Android phones...it's the cost of data that is prohibitive."

For more details visit https://cis-india.org/internet-governance/news/why-india-snubbed-facebooks-free-internet-offer

Why having more CCTV cameras does not translate to crime prevention

manasa — 2019-09-25T02:13:28Z

Can technology substitute addressing social, psychological, economic and other individual factors that largely lead to criminality? And what are the perils of over-reliance on technology to fight crime?

The article by Manasa Rao published by the News Minute quotes Pranav M. Bidare of CIS.

In August, a couple from Tamil Nadu’s Tirunelveli district made national headlines for their bravery. True to the Tamil adage ‘vallavanukku pullum aayudham’ (for the strong man, even a blade of grass is a weapon), when thieves entered their home, they fought them with chairs, slippers and even a bucket. Despite being armed with sickles, the masked miscreants fled the scene unable to match the counter-attack mounted by 70-year-old Shanmugavel and 65-year-old Senthamarai. The incident was caught on CCTV camera and the couple, whose video quickly went viral, was celebrated for their valour and made for the perfect social media feel-good story. However, as the news cycle was focused on them, senior police officers from the state and many commentators pointed to the importance of the CCTV camera footage. After all, the whole world watched their courage thanks to the CCTV camera affixed on the couple's front yard.

Since 2017, the Tamil Nadu Police has been aggressively pushing for citizens to install CCTV cameras. A techno-futuristic awareness campaign video released last year even roped in popular Kollywood star Vikram to help the police force. “If there are CCTV cameras, crimes are prevented, evidenced and importantly, it provides evidence in court. So, each of us will compulsorily fix a CCTV camera wherever we are,” says Vikram. In a bold declaration, the motto of the campaign affirms, “With CCTV everywhere, Tamil Nadu has become a place without crime.” At the end of the video Vikram suggests Big Brother is watching, stating, “Everything. Everywhere. We're watching.”

But do more CCTV cameras necessarily translate to crime prevention and deterrence? Can technology substitute addressing social, psychological, economic and other individual factors that largely lead to criminality? And what are the perils of over-reliance on technology to fight crime?

What the numbers say

A study released in August by tech research group Comparitech ranked Chennai as 32nd out of 50 of the most surveilled cities in the world. The research group, with the use of government reports, police websites and news articles, puts the total number of cameras in the city at 50,000. With a 2016 estimated population of 1.07 crore in Chennai, that is 4.67 cameras per 1,000 people.

With the help of Numbeo, a crowd-sourced database of perceived crime rates, the study puts Chennai’s crime index at 40.39. On a scale of 0 to 100, this is an estimation of overall level of crime in a given city. This score means Chennai’s crime index is ranked ‘moderate’. Similarly, on a 100 point scale, the city's safety index— quite the opposite of crime index— is at 59.61. The higher the safety index, the safer a city is considered to be.

The two other Indian cities on the list of 50 are New Delhi ranked No. 20 with 1,79,000 cameras for 1.86 crore people (9.62 cameras per 1,000 people) and Lucknow ranked at No. 40 with 9,300 cameras for 35.89 lakh people (2.59 cameras per 1,000 people). The capital's crime index is at 58.77 while its safety index is 41.23. The UP city on the other hand has a crime index of 45.30 and a safety index of 54.70.

Stating that the higher number of cameras ‘just barely correlates’ with a higher safety index and lower crime index, the study concludes, “Broadly speaking, more cameras doesn’t necessarily result in people feeling safer.” While the presence of CCTV cameras may not inherently be bad, experts say that they cannot become a substitute for tackling crime and its causes which transcend the realm of technology. These involve tailored and specific approaches which stem from community building.

The infallible CCTV myth

Pranav MB, policy officer at the Centre for Internet and Society in Bengaluru observes that in the long run, over-reliance on CCTV cameras would merely propel criminals to innovate, as opposed to helping deter the crime from taking place. He says, “While it seems intuitive that the presence of a CCTV camera will have a deterring effect on criminal activity, numerous studies over the past decade have concluded that this is not really the case. The idea of a deterring effect also relies on the assumption that the actors are making educated intelligent choices about their future, which is often not the case with persons that commit criminal acts. So the deterring effect of CCTV cameras is not likely to be much more than the already deterring effect that exists because of criminal law and law enforcement.”

Busting the myth that CCTV cameras are foolproof, Pranav adds that public infrastructure as simple as a streetlight could aid in safer neighbourhoods. “The fact remains, however, that if you are not using advanced technology, a simple mask will render you unidentifiable by most basic CCTV cameras. As more advanced and more expensive technology is used, you are only necessitating the need for innovation among criminals to identify new loopholes that they can exploit in the technology. This is not an argument that generally holds against the use of technology, but in the case of CCTV cameras, it has been seen that simple street lights much better serve the goal of deterrence of crimes,” he says.

However, cops disagree with the findings. One IPS officer who works with the police’s Law and Order department in Chennai tells TNM that the presence of CCTV cameras has helped them nab a range of criminals from chain-snatchers to stalkers who have hacked women to death. Praising the use of facial recognition software like FaceTagr that was introduced a few years ago, the officer says, “CCTV cameras have a dissuading effect on criminals. At the very least they serve as a warning but in most cases, we can easily match them to criminals on our existing local, station-wise database. Especially when it comes to areas like T Nagar, Purasawalkam or other crime-prone suburbs, CCTV cameras are an invaluable tool for law enforcement.”

“Even in cases of sexual abuse, street harassment or trafficking, private CCTV cameras have been helpful. Shop owners or residents have come forward with the footage in public interest,” he says, admitting that the Centre’s release of the long-pending National Crime Records Bureau (NCRB) statistics could show a correlation between the push to install CCTVs and crime rates.

With a lack of NCRB data, there are no statistical answers to whether indeed installation of CCTV cameras has helped lowering of crime rates. However, as per one report in The Hindu, the police report a 30% drop in the crime rate in the city following the installation of CCTV cameras. According to their estimate for chain snatching alone, the city police claims that the number of cases have dropped from 792 in 2012 to 538 following the installation of CCTV cameras in 2018.

Over-reliance on technology

Agreeing that law enforcement must be cautious while employing technology to solve crimes, Dr M Priyamvadha, associate professor at the Department of Criminology, University of Madras says her detailed interviews with over 200 incarcerated burglars across Tamil Nadu reveal that they are always on the lookout for a CCTV camera. “They simply use a jammer worth Rs 2,000 (a handy device that disrupts the signal range of a camera) to skirt the presence of a CCTV camera,” she reports. However, the professor cautions that one must not over-sell the capabilities of a CCTV camera in crime prevention.

“We must remember that CCTV cameras don't deter all crimes. If there is family or domestic violence, there won't be a CCTV camera inside the four walls of a house to reveal it. For burglaries, robberies and such offences, you can rely on CCTV cameras. How far it helps is a question mark. You can neither completely say it prevents crime nor that it is a waste,” she says.

The professor points out that even when deploying CCTV cameras across the city, law enforcement does not account for wear and tear and maintenance which forms an important part of monitoring security.

Echoing the sentiment, Pranav says that CCTV cameras primarily serve as sources of electronic evidence in criminal cases. “Their deterring effect has repeatedly been observed to not balance out the costs of installing and running them.”

Privacy, data protection concerns

Chennai-based independent tech researcher Srikanth points to the inherent surveillance dangers thanks to the centralised way in which the city police collects the CCTV data. “There is something concerning especially about Chennai City Traffic Police and other various city police’s approach to CCTV. The fundamental shift is that, at least in the city, these cameras are connected to the police control room. So data gets centrally collated. When centralization kicks in, power abuse isn't far away. This way it is far easier for police to destroy evidence,” he alleges.

Srikanth also points out, “CCTVs (especially connected ones) are usually funded by residents and/or merchants who spend their money in putting up the infrastructure, but freely give away the data to the police (often in good faith). There is no oversight on usage, storage, retention of this data and by sheer monopoly on law and order, the police is able to connect a vast number of private CCTVs on to its network.”

Significantly, he expresses concerns about there being no laws that govern the usage of CCTV footage by the police. “Even if one gives into the legitimate state aim to control crime, even if one can argue violation of privacy is proportional, there is no law around use of CCTV by police, let alone using them in investigations. That the state engages with private vendors (such as FaceTagr) and many others also provides these service providers access to data,” he explains.

Pranav also warns, “Furthermore, CCTV cameras also result in compromising the privacy of individuals, and if implemented by the state (as in the case of law enforcement), creates added surveillance risks. Compounding on this is the issue of the recorded video footage, which if stored/transmitted/managed in an non-secure manner creates data protection risks as well. This is especially true in India, where it is difficult to obtain the required infrastructure and expertise in running an effective and secure CCTV camera system.”

'Technology cannot replace interpersonal relationships'

Advising pragmatic thinking when it comes to crime prevention, professor Priyamvadha says that technology should complement what she calls the ‘human touch'. Junking the ‘holistic’ one-size-fits-all approach that is often paraded as a solution, the criminologist says that each crime requires a tailored method of tackling it. “For each and every crime, there is a different strategy. There maybe crimes committed by juveniles, crimes committed against women. For example, if female foeticide is rampant in a village, it is important to understand the village, the preferences of the people there and the caste practices present among them,” she observes.

While technology often allows law enforcement to cover more ground in cases of limited manpower, there’s also a chance the cameras could be seen as a substitute for forging interpersonal relationships between police and the people they seek to protect. “With quick transferring of cops nowadays, the local police station doesn’t have an understanding of the ongoings. Interpersonal relationships are more important than technological advances,” she notes.

For more details visit https://cis-india.org/internet-governance/news/the-news-minute-september-3-2019-manasa-rao-why-having-more-cctv-cameras-does-not-translate-to-crime-prevention

Why having more CCTV cameras does not translate to crime prevention

Manasa Rao — 2019-12-05T23:26:25Z

The article by Manasa Rao was published the News Minute on September 3, 2019. Pranav M. Bidare was quoted.

What the numbers say

The infallible CCTV myth

Over-reliance on technology

Privacy, data protection concerns

'Technology cannot replace interpersonal relationships'

For more details visit https://cis-india.org/internet-governance/news/why-having-more-cctv-cameras-does-not-translate-to-crime-prevention

Why Geospatial Bill is draconian and how it will hurt startups

praskrishna — 2016-07-02T04:57:35Z

Last week, the Indian government rejected Google’s plans to map Indian cities, tourist spots and mountain ranges, using the 360-degree panoramic Google Street View feature.

The article was published in Indian Express on June 13, 2016

Last week, the Indian government rejected Google’s plans to map Indian cities, tourist spots and mountain ranges, using the 360-degree panoramic Google Street View feature. The government officials cited “national security” as a reason for not granting permission to Google. It is expected that the Google’s Street View permission would be relooked at, once the draft Geospatial Information Regulation Bill, 2016, is enforced as law. Many however feel that this draft bill is draconian and will have serious repercussions on the startup ecosystem.

The Geospatial Bill seeks to make creating, accessing and distribution or sharing of map related information, illegal and that every company will have to take prior permission and license from the government for the same. Wayback in 2011, Google had announced the introduction of Street View for Bangalore, on Google Maps. But the project ran into trouble with Bangalore Police stopping Street View cars from plying in the city, citing security reasons.

Google Street View, launched in 2007, is popular in San Francisco, Las Vegas, Denver, New York and Miami, which allows users to navigate virtual streets from photographs gathered from directional cameras on special vehicles. While the service has been hugely successful it has caused problems of privacy in some countries.

In 2010 almost 250,000 Germans told Google to blur pictures of their homes on the Street View service, while Czech government also banned Google from taking any new photos for the service. In Switzerland, the matter went to the court and it was accepted that Google would be obliged to pixelate 99% of images to blur faces, vehicle registrations and that it would not be filming certain sensitive places such as schools, prisons and shelter homes.

This adds to the list of recent controversies on Google Earth, and the draft Geospatial Information Regulation Bill, on adoption of mapping technology in India. Commenting on the development, Sumandro Chattapadhyay, research director at the Centre for Internet and Society said, the key country where the Google Street View faced legal challenge, and was fined too, is Germany. This legal challenge, however, was not based on the concern for national security but on that for the privacy of the citizens. However, it was eventually allowed to roll out Street View in Germany provided that it asks for consent from the house owners before images of any house.”

“One of the crucial concerns with the draft Geospatial Information Regulation Bill remains its vast scope of application. Not only initiatives like Google Street View may be regulated under it (for capturing geo-referenced imagery from the street level) but absolutely any mobile application that requires the user’s geo-location (either automatically detected, or manually entered by the user) would be within the purview of this Bill. This evidently creates a great pressure upon the entire ICT-enable product and service sector in India,” Chattapadhyay added.

This would mean that, any company, particularly the new age startups, those in the food tech, fintech and e-commerce space, which uses geo-location to identify the customer location to either deliver goods, food products, or the likes of Ola and Uber which uses maps to pickup and drop customers, will have to obtain license from the government.

Raman Shukla, director—strategy and product, Medikoe, said, “At Medikoe we are helping users to locate the nearest healthcare service provider with the available technologies. Google Maps is one of key feature our company banks on. Though we understand the country’s security concerns, the draft bill, if implemented, would be a violation of independent internet. We believe that a much better solution can be identified to solve security concerns.”

Venu Kondur, founder of LOBB, the online truck booking platform said, “Geostatial data is a very important data for our business. Customers booking truck through LOBB platform get real-time track & trace facility. Our customers rely heavily on this data for their day-day activity. Startups like us depend largely on maps data for real-time tracking of consignment. Lot of our business intelligence data is drawn out of it.”

In case, if the draft gets implemented, many startups will be forced to change the business model and while it will also increase the product delivery time. A group of 15 volunteers created a SaveTheMap.in portal to educate the readers about the draft bill and also give complete information on how the bill have an impact on the citizen and users of certain application. Sajjad Anwar one of the volunteer, said, through the portal about 1700 mails have been sent to the ministry of home affairs airing their view on why they do not support the draft Bill.

Comparing with other countries, Chattapadhyay further said, “At first, other countries deal with the question of display of security establishments in publicly available maps through direct interactions with large mapping companies, and does not turn this into a financial and political burden for the entire economy. Secondly, it is the concern about privacy of the citizens that should frame the Indian government’s response to products and services like Google Street View, and not concerns regarding national security.”

What the draft bill says

No person shall, in any manner, make use of, disseminate, publish or distribute any geospatial information of India, outside India, without prior permission from the security vetting authority under the Central government.

Penalty

Whoever acquires any geospatial information of India in contravention to the rules, shall be punished with a fine ranging from Rs 1 crore to Rs 100 crore and /or imprisonment for a period upto seven years.

Application for license

Every person who has already acquired any geospatial imagery or data of any part of India either through space or aerial platforms such as satellite, aircrafts, airships, balloons, unmanned aerial vehicles or terrestrial vehicles shall within one year from the commencement of this Act, make an application along with requisite fees to the security vetting authority.

For more details visit https://cis-india.org/internet-governance/news/financial-express-prabhu-mallikarjunan-june-13-2016-why-geospatial-bill-is-draconian-and-how-it-will-hurt-startups

Why experts are worried about Aadhaar-based authentication

praskrishna — 2016-08-07T02:16:29Z

As private companies are increasingly using Aadhaar data, is the privacy and security of personal data really at risk? What do those defending Aadhaar have to say?

The post was published in Citizen Matters on August 2, 2016. Amber Sinha was quoted.

The Unique Identification numbers of Aadhaar card holders are being extensively used by government and private agencies for authentication purposes, as we have already seen in an earlier article.

There are 246 registered Authentication User Agencies in India, both government and private, which are helping organisations and individuals in executing the authentication process. In simple terms, they help the organisation that has placed the authentication request, to confirm the identity of a person during hiring, lending loans or while implementing welfare schemes.

But all does not seem well with the Aadhaar authentication process. Concerns have been raised about the privacy and security aspects and, loopholes in the law.

The amended Aadhaar Bill (now, Aadhaar Act) has a clause that allows the UIDAI to respond to any authentication query “with a positive, negative or any other appropriate response.” This move has drawn a lot of criticism from the activist fraternity. They have questioned the government on framing an Act that places the security and privacy of individual citizens at risk.

Even before the Bill was passed, legal scholar Usha Ramanathan had, in an article published in Scroll.in, expressed concern over private agencies using the Aadhaar database for authenticating the identity of an individual.

“Very little was heard about the interest private companies would have in this information data base. It is not until the 2016 Bill was introduced in Lok Sabha that we were told, expressly, that just about any person or company may draw on the Aadhaar system for its purposes. There are no qualifications or limits on who may use it and why. It depends on the willingness of the Unique Identification Authority of India, which is undertaking the project, to let them become a part of the Aadhaar system,” she wrote.

What’s crucial in the entire process is how the government is allowing private players to use Aadhaar-based information, putting the privacy of Aadhaar-holders at stake. The government is technically allowed to share the Aadhaar information with other agencies, only if the holder has given consent to sharing his information, during enrollment.

The guidelines for recording Aadhaar demographic data states: “Ask resident’s consent to whether it is alright with the resident if the information captured is shared with other organisations for the purpose of welfare services including financial services. Select appropriate circle to capture residents response as - Yes/No.”

In 2011, Citizen Matters had published a report on how people wanting to register for Aadhaar were not asked if they would agree to share their personal information. Citizens seemingly were unaware of the provision for sharing information with a third party and data operators had reportedly not asked them for their consent before marking ‘yes’ for the consent option.

There remains a regulatory vacuum

In less than four months of the enactment of the Aadhaar Act, the number of private agencies using Aadhaar database for identity authentication too has grown long. Amber Sinha, Programme Officer at the Center for Internet and Society expresses concern over the privacy implications that a project of this magnitude would lead to.

“The original idea of Aadhaar was to use it for providing services under welfare schemes. But the Aadhaar Act lets private agencies avail the Aadhaar authentication service. The scope of the Act itself doesn’t envisage sharing the data with private parties, but if any third party wants to authenticate the identity of an individual, they can use the UIDAI repository for the purpose,” he points out.

In the process, Amber says, the CIDR has to send a reply in ‘yes’ or ‘no’ format, for any request seeking to confirm the identity of an individual. The new legislation gives scope for the authorities to respond to a query with a positive, negative or any other appropriate response.

“The Aadhaar enrollment information includes demographic and biometric details. So at this stage, we do not know what that “other appropriate response” stands for. Further, while there are requirements to take the data subject’s consent under the Act, there is lack of clarity on the oversight mechanisms and control mechanisms in place when a private party collects information for authentication. The UIDAI is yet to frame the rules and the rules will probably determine this. Until the rules are framed, some of the issues will exist in regulatory vacuum,” Amber observes.

Under the current circumstances, Amber says, the responsible thing to do for UIDAI is not to make such services available until the rules are framed.

But why has the Authority then started the authentication process even before the rules have been framed? Assistant Director General of the Authentication and Application Division of UIDAI, Ajai Chandra says the rules when framed will have retrospective effect, from the date the Act was enacted.

Activists have also questioned the UIDAI for allowing private agencies to use and authenticate Aadhaar data, when the Supreme Court has restricted the use of Aadhaar. In its last order dated 15 October 2015, the Apex Court allowed the government to use Aadhaar in implementing selective welfare schemes such as PDS, LPG distribution, MGNREGS, pension schemes, PMJDY and EPFO. It makes no mention about the UIDAI using the Aadhaar data repository to provide services to private agencies.

“When the Supreme Court has restricted the use of Aadhaar number to a few specific government programmes only, how can UIDAI allow the data to be used for any other programmes, let alone by private agencies?” Amber asks.

In a very brief conversation, Reena Saha, Additional DG, UIDAI told Citizen Matters that UIDAI was acting as per the Supreme Court’s order dated October 15th. “We aren’t sharing the data with private agencies,” she said.

‘Authentication happening only with consent’

Srikanth Nadhamuni, CEO of Khosla Labs - a registered Authentication User Agency, who was also the Head of Technologies at UIDAI, rejects the accusations on the security aspect, saying that the authentication system is completely secure and foolproof.

“We have made a secure system so that there is no man in the middle taking the biometric information. The biometric information shared on the application is encrypted and neither the AUA nor the Authentication Service Agency (an intermediary between the AUA and the CIDR) can open it. Both the AUA and ASA will sign on the packet and forward it to the data repository as it is. There is no way that we can figure out what is inside the packet. Once the request reaches the data repository, they will unlock the signatures, run the authentication and reply in ‘yes’ or ‘no’ or with an error code,” Srikanth explains.

ADG Chandra says that at present the CIDR is replying to authentication requests in an “yes/no” format. “We aren’t sharing the data with any agencies. Upon receiving the request for authentication, be it demographic, biometric or one time pin (OTP), a notification is sent to the registered mobile / email address of the Aadhaar holder,” he says. So if the Aadhaar holder has changed the address, phone number, email ID etc after Aadhaar enrollment, he/she should update the data with UIDAI by placing a request online or through post. This will avoid any confusion that may occur during the authentication.

Ajai Chandra further clarifies, “the private agencies seeking authentication (the Authentication User Agency) are not given direct access to the database. On receiving the request, the intermediary Authentication Service Agencies first examine the format of the authentication request. The request is forwarded to the CIDR only if it complies with the format.”

Apart from authentication, the eKYC (Know Your Customer) option also allows companies to retrieve eKYC data of the Aadhaar holder. This data includes photo, name, address, gender and date of birth (excludes mobile number and email ID). But in this case too, “eKYC data can be retrieved only with the consent of the Aadhaar card holder, the person has to be adequately informed about the retrieval and the data cannot be shared with a third party,” says Chandra.

Though Aadhaar Act allows the UIDAI to perform authentication of Aadhaar number, subject to the requesting entity paying the fee, UIDAI at present is providing the service free of cost. “We will provide free service till December 2016 and may levy the fee thereafter,” the ADG says.

For more details visit https://cis-india.org/internet-governance/news/bangalore-citizen-matters-august-2-2016-akshatha-why-experts-are-worried-about-aadhaar-based-authentication