Centre for Internet and Society

Indian surveillance laws & practices far worse than US

pranesh — 2013-07-12T11:09:39Z

Explosive would be just the word to describe the revelations by National Security Agency (NSA) whistleblower Edward Snowden.

Pranesh Prakash's column was published in the Economic Times on June 13, 2013. This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC.

Now, with the American Civil Liberties Union suing the Obama administration over the NSA surveillance programme, more fireworks could be in store. Snowden's expose provides proof of what many working in the field of privacy have long known. The leaks show the NSA (through the FBI) has got a secret court order requiring telecom provider Verizon to hand over "metadata", i.e., non-content data like phone numbers and call durations, relating to millions of US customers (known as dragnet or mass surveillance); that the NSA has a tool called Prism through which it queries at least nine American companies (including Google and Facebook); and that it also has a tool called Boundless Informant (a screenshot of which revealed that, in February 2013, the NSA collected 12.61 billion pieces of metadata from India).

Nothing Quite Private

The outrage in the US has to do with the fact that much of the data the NSA has been granted access to by the court relates to communications between US citizens, something the NSA is not authorised to gain access to. What should be of concern to Indians is that the US government refuses to acknowledge non-Americans as people who also have a fundamental right to privacy, if not under US law, then at least under international laws like the Universal Declaration of Human Rights and the ICCPR.

US companies such as Facebook and Google have had a deleterious effect on privacy. In 2004, there was a public outcry when Gmail announced it was using an algorithm to read through your emails to serve you advertisements. Facebook and Google collect massive amounts of data about you and websites you visit, and by doing so, they make themselves targets for governments wishing to snoop on you, legally or not.

Worse, Indian-Style

That said, Google and Twitter have at least challenged a few of the secretive National Security Letters requiring them to hand over data to the FBI, and have won. Yahoo India has challenged the authority of the Controller of Certifying Authorities, a technical functionary under the IT Act, to ask for user data, and the case is still going on.

To the best of my knowledge, no Indian web company has ever challenged the government in court over a privacy-related matter. Actually, Indian law is far worse than American law on these matters. In the US, the NSA needed a court order to get the Verizon data. In India, the licences under which telecom companies operate require them to provide this. No need for messy court processes.

The law we currently have â€” sections 69 and 69B of the Information Technology Act â€” is far worse than the surveillance law the British imposed on us. Even that lax law has not been followed by our intelligence agencies.

Keeping it Safe

Recent reports reveal India's secretive National Technical Research Organisation (NTRO) â€” created under an executive order and not accountable to Parliament â€” often goes beyond its mandate and, in 2006-07, tried to crack into Google and Skype servers, but failed. It succeeded in cracking Rediffmail and Sify servers, and more recently was accused by the Department of Electronics and IT in a report on unauthorised access to government officials' mails.

While the government argues systems like the Telephone Call Interception System (TCIS), the Central Monitoring System (CMS) and the National Intelligence Grid (Natgrid) will introduce restrictions on misuse of surveillance data, it is a flawed claim. Mass surveillance only increases the size of the haystack, which doesn't help in finding the needle. Targeted surveillance, when necessary and proportional, is required. And no such systems should be introduced without public debate and a legal regime in place for public and parliamentary accountability.

The government should also encourage the usage of end-to-end encryption, ensuring Indian citizens' data remains safe even if stored on foreign servers. Merely requiring those servers to be located in India will not help, since that information is still accessible to American agencies if it is not encrypted. Also, the currently lax Indian laws will also apply, degrading users' privacy even more.

Indians need to be aware they have virtually no privacy when communicating online unless they take proactive measures. Free or open-source software and technologies like Open-PGP can make emails secure, Off-The-Record can secure instant messages, TextSecure for SMSes, and Tor can anonymise internet traffic.

http://cis-india.org/internet-governance/blog/economic-times-june-13-2013-pranesh-prakash-indian-surveillance-laws-and-practices-far-worse-than-us

For more details visit https://cis-india.org/internet-governance/blog/economic-times-june-13-2013-pranesh-prakash-indian-surveillance-laws-and-practices-far-worse-than-us

Indian super-cops now patrol the www highway

praskrishna — 2011-08-19T06:48:48Z

There's discontent brewing in the Indian cyberspace. And it has to do with the government blocking content that it deems "objectionable". What has raised hackles of Internet freedom activists is a new set of rules that allow Internet service providers (ISPs) and blogging sites to remove "objectionable" content from the Web.

This Wednesday, in a written reply, minister of state for information and technology Sachin Pilot told the Lok Sabha that the recently notified rules under the IT Act to regulate the use of Internet, "don't give any power to the government to regulate the content"? Pilot added that the rules did not raise issues "pertaining to privacy and violation of freedom of speech and expression."

Are the rules likely to affect you and I? They may have already begun do so. Last fortnight, when surfers went on to popular file-sharing sites to download clips of a new Bollywood release, what they got instead was a screen with the message: This site has been blocked as per instructions of the Department of Telecom.

The fine print

The new rules demand that the intermediary notify users not to publish or use information that is derogatory, abusive, insulting or which violates intellectual property rights or impacts the sovereignty of the nation. In a country that has 81 million Internet users, this can never be easy.

The rules put the onus of intercepting, blocking and removing objectionable content on intermediaries — telecom service providers, search engines, social networking sites and online payment sites — turning them into super-cops of the Web. "Although the Act is an improvement on the previous one, the rules put too much onus on intermediaries," says Dr Subo Ray, President, Internet and Mobile Association of India (IAMAI). "The intermediaries have become the judge, the jury and the executioner," says Ray.

In a nation where social mores are in a flux, interpretation of what is objectionable under the new rules is wide and subjective, says technology lawyer Rodney D Ryder. "Content deemed 'disparaging', 'harassing', 'blasphemous' or 'hateful' can be blocked. But who will decide what is disparaging?"

The worst bit about such censorship, says Nikhil Pahwa, editor of Medianama, a portal that discusses issues related to digital media, is its opacity. "It is a distress signal for civil liberties and India's version of Egypt's kill-switch. With the UID, the government would know who I am. With the help of telecom operators, they can track me within 50 metres and with my mobile number, snoop in on my conversations. On top of that, do we need Internet rules that don't have a provision of appeal?"

Ryder concurs: "The regulations do not even provide a way for content producers to defend their work or appeal a decision to remove content. This is against the principles of natural justice."

The rules are a case of deceptive legislative drafting says cyber lawyer Pawan Duggal, chairman of Assocham's cyber law committee. "The provisions hide more than what they disclose. Cosmetically, the new rules says that if you are an intermediary, then you shall not be liable for any third-party data, information or communication link made available or hosted by you. Provided, and this is crucial, you follow a number of stringent conditions."

Duggal says many intermediaries in India are not aware of these conditions. "An intermediary will not be liable for any third-party data made available or hosted by it, provided it complies with the law, exercises due diligence, does not abet, conspire or play an active role in a criminal activity and further, provided that once it is notified of any offending activity, removes or disables access of the said offending content expeditiously. If it fails to fulfil one of the conditions, it is open to criminal exposure and civil exposure upto unlimited damages by way of compensation."

Is it gagging net freedom?

In China and Saudi Arabia, governments routinely censor content and redirect search requests to error pages. In Vietnam, bloggers who criticise the government are sometimes arrested. And in Cuba, there is talk of creating "a national Internet". Still, any talk of comparing India with these restrictive regimes is alarmist and stupid, says Ray of IAMAI.

But over the past few years, the government has been gradually building censorship muscle over the Internet, say activists. In 2006, it blocked Typepad, the blog hosting service and a bulk SMS site.

A right to information plea filed by the Bangalore-based Centre for Internet and Society reveals the government blocked 11 sites between 2008 and 2011 (see box). These range from sites hosting the predictable girl wallpapers and Kamasutra to blogs discussing the freedom of speech.

Yet, in his written reply to the Lok Sabha, Pilot insisted that the rules "do not give any power to the government to regulate the content".

If this sparks any discontent in you about privacy, freedom of speech and civil liberties, think twice before sharing the content on the Internet.

This article by Aasheesh Sharma was published in the Hindustan Times on August 6, 2011. The original can be read here.

For more details visit https://cis-india.org/news/indian-super-cops-patrol-www-highway

Indian Privacy Code

Admin — 2018-07-20T13:54:35Z

For more details visit https://cis-india.org/internet-governance/files/indian-privacy-code

Indian language localization community meets in New Delhi

praskrishna — 2016-10-03T13:26:31Z

Localization is one of the less glamorous aspects of computing. Despite the fact that less than 6% of the world speaks English, a majority of projects don't feel inclined to accommodate the rest of the population. One of the primary reasons for sticking to English is the steep learning curve and the lack of standardization in various aspects of the localization process.

The post by Mayank Sharma was published by Opensource.com on October 3, 2016. Dr. U.B. Pavanaja was quoted.

The FUEL Project organized the GILT conference in New Delhi, India September 24-25 to highlight and address these issues. The annual event showcases the efforts of language technology organizations and volunteer communities, but this year's also gave a platform for non-technical users to voice their concerns. The Indic computing developers were joined by academics, reporters, language researchers, publishers, and entrepreneurs who rely on localization tools to connect and interact with audiences in the various regional languages in India. The brainstorming between the two groups, both on and off the stage, was one of the highlights of the conference.

Focus on standardization

Another recurring theme discussed in detail at the conference was the need for standardization. The FUEL Project spearheads standardization efforts with its terminology management system to preserve consistency across translations. The project also created translation style guides for various languages, including Spanish, German, French, Scottish Gaelic, and several Indian languages. In addition to these guides, the project is also working on a couple of tools to help maintain the accuracy of the translations. One that caught the attention of the translators at the conference is the Unicode Text Rendering Reference System (UTRRS). It's a web app that lets you enter a character, word, or phrase and then compares it to a reference image generated by a text rendering engine.

The current state of localization

The conference began with an inaugural address by the keynote speakers. Rajesh Ranjan, who heads the FUEL Project and is currently the open source community manager at the Indian Government's National eGovernance Division (NeGD), kicked things off by talking about the evolution of the 8-year-old project. There was also an enlightening address by Jeff Beatty, who heads localization efforts at Mozilla. He talked about the role of his alma mater, the University of Limerick, in the initiation and growth of multilingual computing. Later, Vinay Thakur, director of project development at NeGD, discussed the Indian Government's increased interest in localization and listed the various initiatives currently underway.

This was also reiterated by Mahesh Kulkarni, assistant director at CDAC's GIST research labs. He talked about the scale of the government's plan for making all its official websites available in all the officially recognized 22 Indian languages.

Addressing problems

Kulkarni also chaired a panel discussion later in the day. The panel members talked about the issues plaguing the localization community and what it would take to solve them. Sudhanwa Jogalekar, a well-respected contributor to Indic computing, suggested that translators should get ISO certified as a first step toward standardization. Jogalekar pointed to the ISO 7001:2015 standard, which certifies conformity in translation services. Another panel member, Prabhat Ranjan, executive director of the technology think tank TIFAC, talked about the stress on translation in the Vision 2035 document recently released by the Indian Prime Minister Narendra Modi. Ranjan's team found English to Hindi translation easier when documents are first translated into another Indian language. Based on this experience, Ranjan bounced the idea of agreeing on a meta language to ease the translation process.

A chat with the Document Foundation

The conference also had a video conference session by the Document Foundation's Italo Vignoli about LibreOffice. While the talk was fairly overview-ish the Q&A generated some valuable suggestions that Vignoli promised to take up with the LibreOffice developers. One of the concerns raised by Pavanaja U.B. was that localizing the office suite was a cumbersome process, as it involved recompiling the entire application. Pavanaja, who is well-known in the localization community for creating the Kannada version of the Logo programming language, requested Vignoli ask LibreOffice developers to brainstorm a less tedious process for the localizers. Later in the day, Pavanaja also talked about his experience localizing Wikipedia in Kannada and Tulu languages.

Unicode

^{Karunakar G demos an in-development spell checker for the Hindi language. Photo by Mayank Sharma. CC-BY 3.0.}

The second day began with a session on the evolution and current status of the Unicode standard. It was delivered by Karunakar G, one of the stalwarts of the Indic localization community. A longtime localization developer, Karunakar also demoed the support for Indian languages in LibreOffice. He highlighted a few missing features, such as the lack of an Indic thesaurus and autocorrect functionality.

Sailfish OS

Karunakar was followed by Raju Vindane, who introduced the audience to the Sailfish OS. He also demoed the only Sailfish OS phone available in the Indian market, the Intex Aqua, which retails for about $90. Vindane mentioned that while the community is encouraged to contribute and improve the Indic translations to the Sailfish OS project, these wouldn't be included in the Indian phone, as Intex does its translations in-house.

Other highlights

^{Ryan Northey asks the community to explore the use of XLIFF (XML Localization Interchange File Format). Photo by Mayank Sharma. CC-BY 3.0.}

The day also had introductory presentations by Ryan Northey, lead developer at Translate House, and Satdeep Gill from the WikiTongues project. Northey mentioned that there's been a disconnect between software development and localization, and that going forward localization should become a part of the software development cycle.

In addition to the scheduled sessions, there were several fruitful discussions during lunch and tea breaks. The presentation-free exchange of gray matter between the stalwarts and the young padawans were a delight to witness. The 2016 edition of the GILT conference helped bring together longtime developers and experts from the government with niche communities and individuals working on different aspects of localization in various parts of the country. The conference ended with the participants hoping that the Government's increased focus on localization would translate into a considerable leap in the quality and quantity of localized content and localization tools.

For more details visit https://cis-india.org/openness/news/open-source-mayank-sharma-october-3-2016-indian-language-localization-community-meets-in-new-delhi

Indian Intermediary Liability Regime

Admin — 2018-05-20T15:03:25Z

For more details visit https://cis-india.org/internet-governance/files/indian-intermediary-liability-regime

Indian Govt looks to provide free access to publicly-funded research works

praskrishna — 2014-07-28T05:34:37Z

Sunil Abraham gave his inputs to the blog entry published in Medianama on July 23, 2014.

Department of Biotechnology (DBT) and Department of Science and Technology (DST), under the Ministry of Science and Technology recently released (pdf) the draft of what is termed as Open Access Policy and has invited comments from the public until July 25, reports The Times of India. Comments can be submitted to madhan@dbt.nic.in.

The objective of this policy is to provide unrestricted access to research work funded by the departments. The draft states that since all funds disbursed by DBT and DST are public funds, it is important that the information and knowledge generated through the use of these funds are made publicly available as soon as possible.

As per the draft, DBT/DST will be creating a central repository wherein grantees can either publish their papers in an open-access journal or post the final accepted manuscript to an online repository. This includes papers funded by the two departments in 2012-13 as well as review articles invited by DBT/DST or author initiated that received funding from these departments.

The draft suggests that the full text of the research paper and metadata of all research projects fully or partially funded by DBT/DST or the projects that utilised infrastructure built with the support of DBT/DST will have to be made publicly available, failing which they wouldn’t be considered for future grants or fellowship opportunities among others.

The department believes that providing free access to these publications through gratis open access repository will enable increasing the distribution of these publications and will ensure that these research can be read and built upon.

Copyright of research papers: The draft also sheds light on copyright issues. It states that research work produced by a scientist as an employee of a government body or private institution the copyright would remain with the respective government body or private institution. However, following the final acceptance of the paper by any journal, it has to be deposited in an open access repository within a period of one week.

The author of the research paper will retain the right to reproduce, distribute, publicly perform, and publicly display the article in any medium for non-commercial purposes. They can also prepare derivative works from the article, and authorise others to make any non-commercial use of the article with credit.

Implications: This is a godsend for students, teachers and institutions that don’t have the means to purchase expensive academic journals. Sunil Abraham, executive director of Centre for Internet and Society (CIS) told TOI that the idea is that taxpayers shouldn’t pay twice to access research funded by taxpayers’ money.

Earlier developments in Open Data

In August 2013 the Department of School Education and Literacy, Ministry of Human Resource Development, the Central Institute of Educational Technology (CIET), and National Council of Educational Research and Training (NCERT) had launched an initiative called National Repository of Open Educational Resources (NROER). The objective was to provide free educational resources to school students under the Creative Common license.

The Union Cabinet had cleared the DST formulated National Data Sharing and Accessibility Policy (NPDSA) back in February 2012. NPDSA was supposed to increase accessibility and ease sharing of non-sensitive data amongst the registered users and their availability for scientific, economic and social developmental purposes. However, very little has been reported on how NPDSA was utilised since then.

Click to read the article published in Medianama here.

For more details visit https://cis-india.org/news/medianama-july-23-2014-riddhi-mukherjee-indian-govt-looks-to-provide-free-access-to-public-funded-research-works

Indian Government Quietly Brings In Its 'Central Monitoring System': Total Surveillance Of All Telecommunications

praskrishna — 2013-07-02T09:12:49Z

There's a worrying trend around the world for governments to extend online surveillance capabilities to encompass all citizens -- often justified with the usual excuse of combatting terrorism and/or child pornography.

The blog post was published in tech dirt on June 8, 2013. Pranesh Prakash is quoted.

The latest to join this unhappy club is India, which has put in place what sounds like a massively intrusive system, as this article from The Times of India makes clear:

The government last month quietly began rolling out a project that gives it access to everything that happens over India's telecommunications network -- online activities, phone calls, text messages and even social media conversations. Called the Central Monitoring System, it will be the single window from where government arms such as the National Investigation Agency or the tax authorities will be able to monitor every byte of communication.

This project has been under development for two years, but in almost total secrecy:

"In the absence of a strong privacy law that promotes transparency about surveillance and thus allows us to judge the utility of the surveillance, this kind of development is very worrisome," warned Pranesh Prakash, director of policy at the Centre for Internet and Society. "Further, this has been done with neither public nor parliamentary dialogue, making the government unaccountable to its citizens."

That combination of total surveillance and zero transparency is a dangerous one, providing the perfect tool for monitoring and controlling political and social dissent. If India wishes to maintain its claim to be "the world's largest democracy", its government would do well to introduce some safeguards against abuse of the new system, such as strong privacy laws, as well as engaging the Indian public in an open debate about what exactly such extraordinary surveillance powers might be used for.

For more details visit https://cis-india.org/news/tech-dirt-june-8-2013-indian-govt-quietly-brings-central-monitoring-system

Indian activists slam FCC decision to ditch net neutrality

Admin — 2017-12-18T15:27:04Z

Indian net neutrality activists are assured the ongoing net neutrality tussle in the US will have no impact on India.

The article by Kul Bhushan was published in the Hindustan Times on November 23, 2017.

Net neutrality is in the news again. This time it is because the US’ Federal Communications Commission (FCC) has decided to formally scrap existing protections that are meant to keep access to internet equitable.

India had its own tryst with the idea of net neutrality after it blocked the zero-rating programmes by social networking giant Facebook — which proposed to rollout the Internet.org or Free Basics project in February last year.

A powerful social media campaign made Facebook back down and the Telecom Regulatory Authority of India (TRAI) to announce that ‘differential pricing’ — a practice where some services or sites are priced in a special manner — will no longer be allowed.

Some people who were at the forefront of the net neutrality campaign in here almost three years ago have expressed their displeasure over the FCC’s move.

“I think the approach the FCC is taking is flawed. Spectrum is a public resource and it needs to be spent on maximisation of public good. That public good, and the utility of the Internet is based on the freedom that people have to create new apps and services, without needing permission from ISPs, or the fear that ISPs might discriminate against them or favour their competitors. This is what net neutrality enables,” said Nikhil Pahwa, founder of publication Medianama and one of the activists.

“By going against Net Neutrality, FCC chairman Ajit Pai is attacking the core of what makes the Internet tick. We didn’t let that happen in India, and instead, focused on increasing competition between ISPs and telecom operators, because of which we’ve see broadband prices drop, quality of service improve, a tremendous growth in Internet users in India. For this, we owe a great debt to all those who supported Net Neutrality, especially the TRAI,” he added.

Apar Gupta, who is closely associated with the ‘Save the Internet’ initiative and is the co-founder of Internet Freedom Foundation, said, “FCC’s move to take back the internet order is a huge setback to the global campaign to ensure open internet because it undermines the net neutrality.”

“I don’t think the development should impact the regulatory process in India considering TRAI’s strong support for net neutrality. I hope that TRAI comes out with a comprehensive network neutrality regulation in the future,” he responded when asked about the possible impact on India of the FCC move.

Sunil Abraham, executive director of Bangalore-based research organisation Centre for Internet and Society, said there should be no impact on India from the FCC move.

He also slammed FCC chief Pai’s attempt to change the existing net neutrality rules. “What Ajit Pai is trying to do he’s not saying he will not regulate. He is saying when companies violate net neutrality principles they should be transparent about it. He hopes the magic of market competition will help resolve the problem,” he said

“Pai’s approach to the net neutrality might work in a market where there is a lot of competition. In the US, there is no competition and that in case damage will be immediate,” he added.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-kul-bhushan-november-23-2017-indian-activists-slam-fcc-decision-to-ditch-net-neutrality

India’s vanishing fingerprints put UID in question

praskrishna — 2011-10-26T10:05:13Z

A curious situation has come to light at the UID (unique identity) enrolment centres. Call it the phenomenon of vanishing fingerprints. You see, our unique fingerprints don’t necessarily last a lifetime and they can be damaged or destroyed and, in some cases, even non-existent. And that is not the best scenario for the first-of-its-kind project that endeavours to create a unique identity for India’s billion-plus population based on fingerprints and iris scans (or biometric data).

To find out more, Firstpost visited five UID centres in the North West district, which incidentally has the highest enrolments (619,571 and counting) among Delhi’s nine districts since the show hit the road in February 2011, and one centre in North Delhi.

The officials at the Unique Identification Authority of India (UIDAI) will tell you that there is no overemphasising the importance of the quality of biometric data to the success of the super ambitious UID, now known as Aadhar project. If the quality of a person’s biometric data is poor, it automatically compromises the authentication of that data by him when he wants to access a service based on his UID.

So what happens when the data – fingerprints, for instance – are inherently unreliable on account of various biological and socio-economic reasons, some of which are especially relevant to the Indian context.

The UIDAI’s Committee on Biometrics in a December 2009 was rather forthright about its reservations on the fingerprint reliability. Titled Biometrics Design Standards For UID Applications (page 4, para 4), it stated, "….two factors however, raise uncertainty about the accuracy that can be achieved through fingerprints. First, retaining efficacy while scaling the database size from fifty million to a billion has not been adequately analysed. Second, fingerprint quality, the most important variable for determining de-duplication accuracy, has not been studied in depth in the Indian context." (Emphasis added).

The findings on the ground were revelatory. Operators and technical experts at the UID enrolment centres confirmed to Firstpost that they routinely came across cases where fingerprints had been damaged/destroyed/underdeveloped. And such cases, they said, were more common among senior citizens, those involved in manual labour (who handle rough objects, for instance) and children (mostly below 10 years of age).

Here is an example that Firstpost observed.

Batuli, 72, arrived at around noon at the Basti Vikas Kendra, now also a UID centre, in Mangol Puri to get herself a ‘smart card’ everyone has been talking about. (The 'Aadhar' brand name hasn’t caught on in these parts of Delhi, with everyone insisting on calling it the 'smart card'.)

The helpful operator with the fancy gadgets helps Batuli to her seat. After her photo is taken, Batuli is asked to place four fingers — one hand at a time — on a green-lit device. Right hand, then left hand.

She is, however, asked to repeat the exercise a second time for the left hand. The operator explains. "In some case, we have to scan the fingerprints and Iris multiple times. If it doesn’t pass the required quality percentage of 70 per cent (the quality is indicated in percentage terms on the computer screen that is connected to the fingerprint machine, see pic), we repeat the exercise up to four times."

Batuli’s hands are then wiped using a cloth and placed back on the device. The exercise is repeated a fourth and final time. But still the same result. 'Fail', declares the reading on the operator’s computer.

An operator at the next station, says, "In the case of senior citizens, Iris scans also sometime fail. It registers weakly when the retina is damaged."

(Enrolment centres are run by private companies on contracts given by registrars chosen by the UIDAI. Strategic Outsourcing is one such company and it runs many of centres in the North West and South West districts of Delhi.)

The project coordinator of the UID enrolment centre working out of the Destitute Welfare Trust, an NGO in Sultanpuri, too, confirmed that he was aware of the problem of damaged fingerprints and the challenge it posed in getting good quality fingerprint data.

"The hands of children are very soft and in some cases fingerprints are not yet fully developed. Also, children tend to have sweaty hands and this can interfere with the quality of fingerprints. Extremely dry hands also pose problems. We have to often, wipe the hands or provide lotion to improve the quality of fingerprints," said a technical expert working with Strategic Outsourcing.

While the number of attempts, as prescribed by the UIDAI, to get a stronger finger print when the result reads 'fail' is four, operators report that sometimes attempts go up to 10 to 15. (The machine picks up the strongest impression of the attempts made). They say they didn’t anticipate such a problem and it was only when they started enrolments in January that they were confronted with such a scenario. “Now, of course, everybody knows about it."

'Everybody' implies those who are directly involved in collecting biometric data. An operator from another private company Smartchip working in a JJ (slum) colony in the North Delhi district of Model town, revealed similar problems on being probed. "A fingerprint strength of 70 percent or more is pass. About 10 per cent of the cases we get every day register the 'fail' reading. What can we do? In the case of stone cutters, for instance, the fingers are completely smooth, the fingerprints are completely wiped out."

So what are the implications of poor quality fingerprints for the UID project? The UIDAI admitted that it could provide challenges to authentication.

In an email response to Firstpost, Sujata Chaturvedi, UIDAI’s Deputy Director General for the Delhi region said, "It could provide some challenges in de-duplication although that has been mitigated to a large extent by the decision of the UIDAI to go in for iris an additional de-duplication factor… Also to be noted is the fact that normally not all fingers are equally de-graded. So UIDAI is evolving a protocol to inform the residents about their good quality fingerprints as part of the Aadhaar letter so that they are aware of the finger to use for authentication."

But not everyone is convinced. Sunil Abraham is the executive director of Centre for Internet and Society (CIS), which has written seven open letters to the Standing Committee on the Finance Branch (before which is the National Identification Authority of India Bill, 2010) asking the committee to consider their research on the UID project and change aspects of the Bill and the project.

The seventh letter sent last week, says Abraham, provides statistical analysis that demonstrates how the UID will never be able to create a unique database.

"In CIS’s seventh open letter to the finance committee, statistical analysis reveals that UIDAI tender specification is 1,000 times less accurate than it should be to have a reasonable chance of building a truly unique database. This analysis depends on high quality biometrics. With poor biometric quality the problem of de-duplication is compounded."

When UIDAI was asked what the percentage of the population enrolled (all India and Delhi) had recorded below-standard fingerprint quality, no specific data was forthcoming.

Chaturvedi wrote, "Currently the population with very poor quality fingerprints is a very small percentage. It must also be remembered that this population is scattered all over the country."

In India, even a small percentage translates to millions of people. "Small percentage could mean absolutely anything. Why can’t they be more specific? One percent in the Indian context is 12 million people," said Abraham.

On how the UIDAI was dealing with challenge of poor fingerprint quality, Chaturvedi said, "Even amongst the populace that has damaged/destroyed/underdeveloped fingerprints, chances are very high that they would have at least one good fingerprint that could be used for authentication. Second, UIDAI is also starting to actively develop iris authentication ecosystem. Fingerprint authentication and iris authentication could supplement each other to ensure a universal coverage."

She added that Aadhaar authentication will supplement and work in conjunction with existing authentication systems to strengthen the overall authentication rather than replace completely the existing authentication systems.

That begs the question, as Abraham puts it, "If the UIDAI is not going to replace existing forms of authentication it is not clear why the government is spending all this money on unproven biometric technology."

Chaturvedi, however, maintained that the initial PoC (proof of concept) study that was taken up in Andhra Pradesh, Karnataka and Jharkhand collected about 60,000 enrolments indicated that the biometric accuracy levels necessary for de-duplication of all residents of India are achievable.

"The PoC results also indicated the time needed for capture of biometrics in typical rural conditions is small enough to support large scale enrolment. Over and above the initial PoC, the UIDAI has currently completed over 5 crore enrolments for which Aadhaars have been generated. This experience reinforces the initial PoC results that the de-duplication accuracy is sufficient and sustainable to enrol the rest of the population."

The original article is written by Pallavi Polanki. It was published in Firstpost on October 24, 2011 and can be read here.

For more details visit https://cis-india.org/news/vanishing-fingerprints-put-uid-in-question

India’s top science institution is trying hard to fix its “manel” problem

Admin — 2019-08-19T13:58:51Z

B Chagun Basha is a science, technology and innovation policy fellow at Bengaluru’s Indian Institute of Science’s (IISc) Centre for Policy Research established by the department of science & technology (DST-CPR).

The blog post was published in Quartz India on August 16, 2019. Sunil Abraham was quoted. This piece was originally published on Connect under the headline, “We Learned (The Hard Way) Not to Have Manels.”

While organising an event at IISc, he and his colleagues realised they hadn’t paid much thought to gender inclusivity until it was explicitly pointed out to them that there were no women in their event. That sparked some introspection, as well as actions to ensure that this wasn’t repeated. In this interview, he talks about the incident and important lessons from it.

How did you first hear of the term manel?

It was when I was organising my first event of an academic nature. Every year, DST-CPR marks International Open Access Week by planning activities for the entire week, and having a panel discussion is a major part of it. We bring in experts to sensitise people about topics related to open access and how we can incorporate it in our institute through a bottom-up approach.

In October 2017, when International Open Access Week came round, we collaborated with six other groups to organise it. We had a poster competition, a panel discussion, and a few other activities like engaging with the student community about open access and how they could play a role in promoting it.

A week before the panel discussion was scheduled, we had confirmed the participation of all our speakers—five male speakers and one female speaker. The female speaker had not been included out of a conscious effort to ensure gender diversity—she happened to be on the list of names we came up with, we had written to all of them, and they had agreed to come. But a few days before the panel discussion, we received an email from her saying that she would not be able to join us.

We didn’t think it was a big deal. Instead of six participants we would have five, one of whom would be the moderator. Sunil Abraham of the Centre for Internet and Society (CIS) had already confirmed that he would be the moderator. He sent us an email asking for details of the panelists, so that he could communicate with them and plan and structure the discussion. But when we sent him the details, he immediately got back to us saying that he wouldn’t be able to participate in this panel discussion.

I was a little shocked—you can replace a panelist at the last minute, but finding a new moderator to curate a discussion is harder as doing so requires in-depth knowledge of this space and familiarity with open access policies at different levels. I asked Sunil what had happened—why did he have to pull out? He said that CIS had a written policy that was followed strictly: members could not participate in “manels”—a word I was hearing for the very first time. I didn’t even catch it properly when we spoke on the phone. Then he explained to me that if there was a panel on which there were only men and no women panelists—which are called “manels”—then people from his organisation avoided them completely.

What happened next?

I realised that as an organiser of an event, I wasn’t even thinking about being inclusive.

I realised that as an organiser of an event, I wasn’t even thinking about being inclusive. So we requested Sunil to suggest names of women speakers whom we could approach. I realise now that it was not a good thing to do—when somebody points out that there are no women on your panel, and for those reasons they are not going to participate, you should try harder to rectify this at your end, and not dump the responsibility for this on the person who pointed it out in the first place.

We should have put in genuine effort from our end to learn more about other women in the field whom we could approach for the panel. But at the time Sunil generously agreed and gave us a list with 12 names. We contacted all of them: two people responded, one of whom—Padmini Ray Murray, who was a faculty member at the Srishti Institute of Art, Design and Technology—happened to be in Bengaluru and agreed to participate at short notice. We were really thankful for that.

The panel discussion went off smoothly, and at the end we gave a vote of thanks, where we acknowledged our goof-up, thanked Sunil for bringing it to our notice, and we promised the audience sitting in Faculty Hall, which included the Director of NCBS and the Deputy Director of IISc, that we wouldn’t run any more manels. We said we would consciously include more women in all events we organised from then on—not just panel discussions but talks, workshops and so on. That’s more or less an official decision we took for CPR.

Did you feel like you were being put on the spot at the time?

We would often ask our superiors to suggest names for events or scout for people on our own, but actively thinking about including people of all genders was something we never really did. Now it feels like something that is really important.

And an interesting thing happened after the vote of thanks that year: other people who had been in the audience and worked in other institutes or other departments at IISc came up to talk to us during the tea break. Like us, previously they thought it wasn’t important to think about who was being invited as panelists, but they began to see it was important too.

Has that changed how you planned subsequent events?

Two months after that panel discussion, we organised a workshop. On the final day of the workshop, we presented information on how many male and female participants applied, and how many of each we selected (women formed a little over 50% of those selected). That was our indirect way of letting people know that we took gender into consideration during our selection process.

In October 2018, when International Open Access Week came around again, we organised a panel discussion as well as an event called the Global Equity Forum for librarians, because they play a key role in making open access a reality at the institutional level. We consciously included women for both events, and not just because they were women. We realised that if you put in a little effort, you can easily find competent people of all genders without having to select people only for representation’s sake.

What about the people you mentioned earlier, who came up after the panel to ask you about including more women—do you know if they ever followed up on it?

Since the 2017 panel, others have made an effort to have equal numbers on men and women in panels too. It’s been like a chain reaction—some of those who attended our panel discussion took notice and kept it in mind when they organised events themselves. For now, though, ensuring gender diversity has depended on the efforts of the individual organisers. What happens when they leave and others take their place?

I think we need to put forth a policy at an IISc-wide level for events organised on campus so that we can ensure balanced representation of women—not just on stage, but among participants of events like seminars and workshops as well. Leaving it up to personal decisions means that it may not be a sustained process, and that’s why we need to work towards having it as a departmental policy or as an institutional policy. Of course we need to push for this as individuals, but we also need the leadership on board in order for this to materialise.

Ensuring equal representation for men and women in public events may seem like a small issue, but it drives bigger issues.

Ensuring equal representation for men and women in public events may seem like a small issue, but it drives bigger issues. Everybody is supportive of gender equality and inclusion of women at some abstract level, but if we really want that to happen, it has to start at small levels and at different stages. That’s a key thing we learned from organising the 2017 panel—that it had to start with us. Inclusion in panel discussions and events is just one of the stages at which it can happen.

In an academic set-up, dialogue is one way of engaging with a larger audience. You also have events, exams, student participation, and many other such avenues at which it happens, right? We have to address inclusion at all levels. If we have a policy about gender inclusion in events on campus, it could pave the way for policies on gender inclusion in other areas like intake of students, picking members of faculty, picking members of decision-making committees, and so on.

We have to start somewhere, and we can’t rely on easy excuses not to act. It’s a fundamental issue that really needs to be addressed—and maybe then it will become the norm, and open our eyes to the need for other kinds of inclusion as well.

For more details visit https://cis-india.org/openness/news/quartz-india-august-16-2019-india-s-top-science-institution-is-trying-hard-to-fix-its-manel-problem

India’s Role in Global Cyber Policy Formulation

basu — 2019-11-13T14:13:33Z

The past year has seen vigorous activity on the domestic cyber policy front in India. On key issues—including intermediary liability, data localization and e-commerce—the government has rolled out a patchwork of regulatory policies, resulting in battle lines being drawn by governments, industry and civil society actors both in India and across the globe.

The article by Arindrajit Basu was published in Lawfare on November 7, 2019. The article was reviewed and edited by Elonnai Hickok and Justin Sherman.

The onslaught of recent developments demonstrates how India can shape cyber policy debates. Among emerging economies, India is uniquely positioned to exercise leverage over multinational tech companies due to its sheer population size, combined with a rapid surge in users coming online and the country’s large gross domestic product. India occupies a key seat at the data governance table alongside other players like the EU, China, Russia and the United States — a position the country should use to promote its interests and those of other similarly placed emerging economies.

For many years, the Indian population has served as an economic resource for foreign, largely U.S.-based tech giants. Now, however, India is moving toward a regulatory strategy that reduces the autonomy of these companies in order to pivot away from a system that recently has been termed “data colonialism”—in which Western technologies use data-driven revenue bolstered by information extracted from consumers in the Global South to consolidate their global market power. The policy thinking underpinning India’s new grand vision still has some gaps, however.

Data Localization

Starting with a circular from the Reserve Bank of India in April 2018, the Indian government has introduced a range of policy instruments mandating “data localization”—that is, requiring that certain kinds of data must be stored in servers located physically within India. A snapshot of these policies is summarized in the table below.

(Source here. Design credit: Saumyaa Naidu)

While there are a number of reasons for this maneuver, two in particular are in line with India’s broader vision of data sovereignty—broadly defined as the sovereign right of nations to govern data within their territory and/or jurisdiction in order to support their national interest for the welfare of their citizens. First, there is an incentive to keep data within India’s jurisdiction because of the cumbersome process through which Indian law enforcement agencies must go during criminal investigations in order to access data stored in the U.S. Second, data localization undercuts the extractive economic models used by U.S. companies operating in India by which the data generated by Indian citizens is collected in India, stored in data centers located largely in the U.S., and processed and analyzed to derive commercially valuable insights.

Both foreign players and smaller Indian private-sector actors were against this move. A study on the issue that I co-authored earlier this year with Elonnai Hickok and Aditya Chawla found that one of the reasons for this resistance involved the high costs of setting up the data centers that are needed to comply with the requirement. President Trump echoed this sentiment when he explicitly opposed data localization during a meeting with Prime Minister Narendra Modi on the sidelines of the G-20 in June 2019.

At the same time, large Indian players such as Reliance and Paytm and Chinese companies like AliBaba and Xilink were in favor of localization—possibly because these companies could absorb the costs of setting up storage facilities while benefiting from the fixed costs imposed on foreign competition. In fact, some companies, such as AliBaba, have already set up storage facilities in India.

As my co-authors and I noted, data localization comes with various risks, both diplomatically and politically. So far, the issue has caused friction in U.S.-India trade relations. For example, before Secretary of State Mike Pompeo's trip to New Delhi in June, the Trump administration reportedly contemplated limiting H-1B visas for any country that implements a localization requirement. Further, on his trips to New Delhi, Commerce Secretary Wilbur Ross has regularly argued that data localization restrictions are a barrier to U.S. companies and stressed the need to eliminate such barriers. Further, data localization poses several technical challenges as well as security risks. Mirroring data across multiple locations, as India’s Draft Personal Data Protection Bill mandates, increases the number of physical data centers that need to be protected and thereby the number of vulnerable points that malicious actors can attack.

Recently, the Indian media have reported disagreements between policymakers over data localization, along with speculation that the data storage requirement in the Draft Personal Data Protection Bill could be limited only to critical data—a term not defined in the bill itself—or be left to sectoral regulators, officials from individual government departments.

Our paper recommended a dual approach. In our view, data localization policy should include mandatory localization for critical sectors such as defense or payments data, while also adopting “conditional” localization for all other data. Under conditional localization, data should only be transferred to countries that (a) agree to share the personal data of Indian citizens with law enforcement authorities based on Indian criminal procedure laws (examples of such a mechanism may be an executive data-sharing agreement under the CLOUD Act) and (b) have equivalent privacy and security safeguards. This approach would be in line with India’s overarching vision of data sovereignty and the goal of standing up to the hegemony of big tech and of U.S. internet regulations, while avoiding undue collateral damage to India’s global alliances.

Intermediary Liability

In line with the goal of ensuring that big tech is answerable to the rule of law, the Indian government has also sought to regulate the adverse social impacts of some speech hosted by platforms. Rule 3(9) of the Draft of the Information Technology Intermediaries Guidelines (Amendment) Rules, 2018, released by the Ministry of Electronics and Information Technology in December 2019, takes up the interventionist mission of laws like the NetzDg in Germany. The regulation would mandate that platforms use “automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.” These regulations have prompted concerns from both the private sector and civil society groups that claim the proposal fails to address constitutional concerns about algorithmic discrimination, excessive censorship and inappropriate delegation of legislative powers under Indian law. Further, some observers object that the guidelines adopt a “one-size-fits-all” approach to classifying intermediaries that does not differentiate between platforms that thrive on end-to-end encryption like WhatsApp and public platforms like Facebook.

In many ways, these guidelines—likely to be notified (as an amendment to the Information Technology Act) as early as January 2020—put the cart before the horse. Before devising regulatory models appropriate for India’s geographic scale and population, it is first necessary to conduct empirical research about the vectors through which misinformation spreads in India and how misinformation impacts different social, economic and linguistic communities, along with pilot programs for potential solutions to the misinformation problem. And it is imperative that these measures be brought in line with constitutional requirements.

Community Data and “Data as a Public Good”

Another important question involves the precise meaning of “data” itself—an issue on which various policy documents have failed to deliver a consistent stance.

The first conceptualization of “community data” appears in both the Srikrishna Committee Report that accompanied the Draft Personal Data Protection Bill in 2018 and the draft e-commerce policy. However, neither policy provides clarity on the concept of data.

When defining community data, the Srikrishna Report endorses a collective protection of privacy as protecting an identifiable community that has contributed to community data. According to the Srikrishna Report, receiving collective protection requires the fulfillment of three key aspects. First, the data belong to an identifiable community. Second, the individuals in the community consent to being a part of the community. And third, the community as a whole consents to its data being treated as community data.

The draft e-commerce policy reconceptualizes the notion of community data as “societal commons” or a “national resource,” where the undefined ‘community” has rights to access data but the government has overriding control to utilize the data for welfare purposes. Unlike the Srikrishna Report, the draft e-commerce policy does not outline the key aspects of community data. This approach fails to demarcate a clear line between personal and nonpersonal data or to specify any practical guidelines or restrictions on how the government can use community data. For this reason, implementation of this policy could pose a threat to the right to privacy that the Indian Supreme Court recognized as a fundamental right in 2017.

The second idea is that of “data as a public good.” This is described in Chapter 4 of the 2019 Economic Survey Report—a document published by the Ministry of Finance along with the Annual Financial Budget. The report explicitly states that any data governance framework needs to be deferential to privacy norms and the soon-to-be-enacted privacy law. The report further states that “personal data” of an individual in the custody of a government is a “public good” once the datasets are anonymized.

However, the report’s recommendation of setting up a government database that links several individual databases together leads to the “triangulation” problem, in which individuals can be identified by matching different datasets together. The report further suggests that the same data can be sold to private firms (though it is unclear whether this includes foreign or domestic firms). This directly contradicts the characterization of a “public good”—which, by definition, must be n onexcludable and nonrivalrous—and is also at odds with the government’s vision of reining in big tech. The government has set up an expert committee to look into the scope of nonpersonal data, and the results of the committee’s deliberations are likely to influence the shape that India’s data governance framework takes across multiple policy instruments.

There is obviously a need to reassess and reevaluate the range of governance efforts and gambits that have emerged in the past year. With domestic cyber policy formulation pivots reaching a crescendo, we must consider how domestic cyber policy efforts can influence India’s approach to global debates in this space.

India’s Contribution to Global Cyber Policy Debates

As the largest democracy in the world, India is undoubtedly a key “digital decider” in shaping the future of the internet. Multilateral cyber policy formulation efforts remain polarized. The U.S. and its European allies continue to advocate for a free, rules-based conception of cyberspace with limited governmental interference. China and Russia, along with their Shanghai Cooperation Organisation allies, are pushing for a tightly regulated internet in which each state has the right to manage and define its “network frontiers” through domestic regulation free from external interference. To some degree, India is already influencing debate over the internet through its various domestic cyber policy movements. However, its participation in international debates has been lacking the vigor or coherence needed to clearly articulate India’s national interests and take up a global leadership role.

In shaping its contributions to global cyber policy formulation, India should focus its efforts on three key places: (a) internet governance forums that deliberate the governance of the technical architecture of the internet such as domain names, (b) cyber norms formulation processes that seek to establish norms to foster responsible behavior in cyberspace by states and nonstate actors in cyberspace, and (3) global debates on trade and cross-border data flows that seek to conceptualize the future of global digital trade relationships. As I discuss below, there are key divisions in Indian policy in each of these forums. To realize its grand vision in the digital sphere, India needs to do much more to make its presence felt.

Internet Governance Forums

India’s stance on a variety of issues at internet governance forums has been inconsistent, switching repeatedly between multilateral and multistakeholder visions for internet governance. A core reason for this uncertainty is the participation of multiple Indian government ministries, which often disagree with each other. At global internet governance forums, India has been represented either by the Department of Electronics and Information Technology (now renamed to Ministry of Electronics and Information Technoloft or the Department of Telecommunications (under the Ministry of Communications and Information Technology) or by the Ministry of External Affairs (MEA).

As my colleagues have documented in a detailed paper, India has been vocal in global internet governance debates at forums including the International Telecommunications Union, the Internet Governance Forum and the U.N. General Assembly. However, the Indian stance on multistakeholderism has been complex, with the MEA advocating for a multilateral stance while the other departments switched between multistakeholderism and “nuanced multilateralism”—which calls for multistakeholder participation in policy formulation but multilateral implementation. The paper also argues that there has been a decline recently in the vigor of Indian participation at forums such as the 2018 meeting of the Working Group on Enhanced Co-operation (WGEC 2.0), due to key personnel changes. For example, B.N. Reddy, who was a skilled and experienced negotiator for the MEA in previous forums, was transferred to another position before WGEC 2.0, and the delegation that attended the meeting did not make its presence felt as strongly or skillfully.

Cyber Norms for Responsible State Behavior in Cyberspace

With the exception of two broad and unoriginal statements at the 70th and 71st sessions of the U.N. General Assembly, India has yet to make public its position on the multilateral debate on the proliferation of norms for responsible state behavior in cyberspace. During the substantive session of the Open-Ended Working Group held in September, India largely reaffirmed points made by other states, rather than carving out a new or original approach. The silence and ambiguity is surprising, as India has been represented on four of the five Groups of Governmental Experts (GGEs) set up thus far and has also been inducted into the 2019-2021 GGE that is set to revamp the global cyber norms process. (Due to the GGE’s rotational membership policy, India was not a member of the fourth GGE that submitted its report in 2015.)

However, before becoming an evangelist of any particular norms, India has some homework to do domestically. It has yet to advance a clear, coherent and detailed public stance outlining its views on the application of international law to cyberspace. This public stance is necessary for two reasons. First, a well-reasoned statement that explains India’s stance on core security issues—such as the applicability of self-defense, countermeasures and international humanitarian law—would show India’s appetite for offensive and defensive strategies for external adversaries and allies alike. This would serve as the edifice of a potentially credible cyber deterrence strategy. Second, developing a public stance would help India to take advantage of the economic, demographic and political leverage that it holds and to assume a leadership role in discussions. The U.K., France, Germany, Estonia, Cuba (backed by China and Russia) and the U.S. have all made their positions publicly known with varying degrees of detail.

Data Transfers

Unlike in other forums, Indian policy has been clearer in the cross-border data transfer debate. This is a foreign policy extension of India’s emphasis on localization and data sovereignty in domestic policy instruments. At the G-20 Summit in Osaka, India and the rest of the BRICS group (Brazil, Russia, China and South Africa) stressed the role that data play in economic development for emerging economies and reemphasized the need for data sovereignty. India did not sign the Osaka Declaration on the Digital Economy that kickstarted the “Osaka Track”—a process whereby the 78 signatories agreed to participate in global policy discussions on international rule-making for e-commerce at the World Trade Organization (WTO). This was a continuation of India’s sustained efforts opposing the e-commerce moratorium at the WTO.

The importance of cross-border data flows in spurring the global economy found its way into the Final G-20 Leaders Declaration—which India signed. Foreign Secretary Vijay Gokhale argued that international rule-making on data transfers should not take place in plurilateral forums outside the WTO. Gokhale claimed that limiting the debate to the WTO would ensure that emerging economies have a say in the framing of the rules. The clarity expressed by the Indian delegation at the G-20 should be a model for more confident Indian leadership in this global cyber policy development space.

Looking Forward

India is no newcomer to the idea of normative leadership. To overcome material shortcomings in the nation’s early years, Jawaharlal Nehru, the first Indian prime minister, engineered a normative pivot in world affairs by championing the sovereignty of countries that had gained independence from colonial rule. In the years immediately after independence, the Indian foreign policy establishment sought to break the hegemony of the United States and the Soviet Union by advancing a foreign policy rooted in what came to be known as “nonalignment.”

Making sound contributions to foreign policy in cyberspace requires a variety of experts—international lawyers, computer scientists, geopolitical strategists and human rights advocates. Indian civil society and academia are brimming with tech policy enthusiasts from a variety of backgrounds who could add in-depth substance to the government’s cyber vision. Such engagement has begun to some extent at the domestic level: Most government policies are now opened up to consultation with stakeholders Yet there is still room for greater transparency in this process.

India's cyber vision is worth fighting for. The continued monetization of data dividends by foreign big tech at the expense of India’s socioeconomic development needs to be countered. This can be accomplished by predictable and coherent policymaking that balances economic growth and innovation with the fundamental rights and values enshrined in the Indian Constitution, including the right to equality, freedom of speech and expression, and the right to life. But inherent contradictions in the conceptualization of personal data, delays in tabling the Personal Data Protection Bill, and uncertain or rushed approaches in several other regulatory policies are all fettering the realization of this vision. On core geopolitical issues, there exists an opportunity to set the rule-shaping agenda to favor India’s sovereign interests. With global cyber policy formulation in a state of flux, India has the economic, demographic and intellectual leverage to have a substantial impact on the debate and recraft the narrative in favor of the rapidly emerging Global South.

For more details visit https://cis-india.org/internet-governance/blog/lawfare-arindrajit-basu-november-7-2019-indias-role-in-global-cyber-policy-formulation

India’s record on internet shutdown gets bleaker; now blocked in 2 NE states

Admin — 2019-12-15T05:51:20Z

India reported over 100 internet shutdown in 2018, according to an annual study of Freedom House, a US-based non-profit research organization.

The article was published in the Hindustan Times on December 11, 2019. Pranesh Prakash was quoted.

The internet shutdown on Tuesday in Arunachal Pradesh and Tripura amid spiraling protests against the Citizenship (Amendment) Bill in the Northeast is the latest in a series of such shutdowns across India, which topped the list of countries that resorted to such measures in 2018.

India reported over 100 internet shutdown in 2018, according to an annual study of Freedom House, a US-based non-profit research organization. The study on the internet and digital media freedom was conducted in over 65 countries, which cover 87% of the world’s internet users

Police and administrative authorities have cited protests and other security reasons to routinely snap the internet in India.

The Centre promulgated the Temporary Suspension of Telecom Services (Public Emergency or Public Safety) Rules, 2017, under the Indian Telegraph Act, 1885, in August 2017 for legal sanction to the shutdowns.

As per the rules, Union home ministry secretary or secretaries of state home departments can order temporary suspension of the internet. An internet suspension order has to be taken up for review within five days.

Prior to 2017, authorities could shut down the internet under Section 144 of the Code of Criminal Procedure (CrPC), which empowers an executive magistrate to prohibit an assembly of over four people.

Section 5 (2) of the Telegraph Act, 1855, allowed the government to prevent transmission of any telegraphic message during a public emergency or in the interest of public safety.

The Kashmir Valley has remained under an internet shutdown since August 4. The shutdown was imposed hours ahead of the nullification of the Constitution’s Article 370 that gave Jammu and Kashmir special status.

Internet and phone lines were snapped ahead of Republic Day celebrations in 2010 in one of the first reported shutdowns in the Valley. Kashmir also holds the record for the longest shutdown when the internet was snapped for 133 days after the killing of Hizbul Mujahideen militant Burhan Wani in July 2016. The current shutdown, with 122 days and counting, is the second-longest.

The 100-day blackout in Darjeeling during the Gorkha agitation in 2016 is the third-longest internet shutdown in India.

Ahead of the verdict in the Ram Janmabhoomi-Babri Masjid title suit last month, the internet was shut down in parts of Maharashtra, Rajasthan, Haryana and Uttar Pradesh. The internet was shut down for three days in Gujarat during the agitation for a quota in jobs and educational institutes for the Patidar community in 2015.

As per the Software Freedom Law Centre, which provides free legal services to protect Free and Open Source Software, the total number of shutdowns in Indian since 2012 is more than 359. As per the tracker -- internetshutdowns.in -- which records such instances from newspaper clippings -- there have been 89 internet shutdowns in 2019, 134 in 2018, and 79 in 2017.

“As a part of this project, we track incidents of Internet shutdowns across India in an attempt to draw attention to the troubling trend of disconnecting access to Internet services, for reasons ranging from curbing unrest to preventing cheating in an examination,” it states as part of its purpose.

In September this year, the Kerala High Court held that access to the internet is a fundamental right. According to Pranesh Prakash of the Centre for Internet Society, the shutdowns are largely unlawful.

“David Kaye, the UN special rapporteur on the right to freedom of opinion and expression, has condemned the shutdowns and noted that the principles of proportionality and necessity should be adhered to in case of shutdowns. Yet, there have been several instances where lives have been lost in Kashmir due to the lockdown,” he said.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-december-11-2019-indias-record-on-internet-shutdown-gets-bleaker

India’s net neutrality debate is unique and complex

praskrishna — 2015-12-30T16:38:45Z

Connectivity to millions in India is main issue

The article by Pratap Vikram Singh was published in Governance Now on December 14, 2015.

The net neutrality debate has perplexed layman and policy experts alike. For a developing country like India, where a majority of the population doesn’t have access to internet, whether government should stick to the core principles or should it allow flexibility in network management practices to operators is still not clear yet. Whether India should go for an overarching, prophylactic regulation (ex ante), prohibiting any kind of zero rating, or should it adopt evidence-based, contextual regulation (ex post facto)? Whether zero rating should be allowed and if allowed then on what conditions? This is what experts from telecom industry and civil society deliberated in a round table on network neutrality jointly organised by Observer Research Foundation and Centre for Internet and Society on Saturday.

Neutrality refers to open and non-discriminatory nature of internet; information (or say data packets) has always flown freely on the network. Facebook, Google and many other internet businesses have emerged as a result of free and non discriminatory nature of internet.

Warning against taking a 'doctrinaire' approach to net neutrality, a telecom industry expert said that regulators must have flexibility to respond to market demand in the telecom industry. Adding that Indian market is unique with more than seven-ten telecom operators providing internet facility, the expert said that net neutrality will play differently in developing countries.

He said if implemented properly, the zero-rating approach or sponsored content followed by TSPs, “can be one of the ways to scale up internet access” to the unconnected regions.

Another industry expert said that the regulations on network neutrality has to be contextualized in terms of geography. He criticized the ‘savetheinternet’ movement, which galvanised support of one million internet users in favour of strict neutrality, for preventing one billion people from accessing ‘free’ internet. He said that telecom operators’ revenue from zero rating plans is less than one percent.

He was also against bringing net neutrality under the purview of competition commission of India. He said that there are already several laws related to consumer protection, information technology and monopoly to deal with situations arising out of neutrality issue.

An internet freedom activist said that zero rating can be allowed under stringent conditions of transparency, non-exclusivity and reasonability. He said that one way of setting the neutrality debate would be to allow zero rating with an amount of equal rating. This means that telecom players can offer toll free access to certain websites but they would also have to provide free 100 Mb or 200 Mb data connectivity within which a user can access any website or app for free.

“Countries like the US can afford to debate on net neutrality as almost 90 percent of their population are connected to internet. Here (in India) we should first worry about providing internet access to our people,” an ORF researcher said, speaking on the sidelines of the roundtable discussion.

The neutrality debate is getting momentum again with TRAI’s consultation paper being released on December 9. In its second paper, TRAI suggested, “that TSPs could provide initial data consumption for free, without limiting it to any particular content. Current examples of this approach include allowing free browsing or discounted tariffs for specified time windows, or giving away a certain amount of data for free.”

The regulator also called for regulation that “must seek a balance between ensuring wider access to the internet,” and in the manner that does not allow discrimination in charging tariffs from the users consuming varied content. The regulator has asked all stakeholders in telecom industry to come up with alternative methods in order to provide free access of internet to the consumers, and keep competition and innovation in the market intact.

For more details visit https://cis-india.org/internet-governance/news/india2019s-net-neutrality-debate-is-unique-and-complex

India’s largest bank SBI leaked account data on millions of customers

Admin — 2019-02-01T15:13:15Z

India’s largest bank has secured an unprotected server that allowed anyone to access financial information on millions of its customers, like bank balances and recent transactions.

The blog post by Zack Whittaker was published Tech Crunch on January 30, 2019. Karan Saini was quoted.

The server, hosted in a regional Mumbai-based data center, stored two months of data from SBI Quick, a text message and call-based system used to request basic information about their bank accounts by customers of the government-owned State Bank of India (SBI), the largest bank in the country and a highly ranked company in the Fortune 500.

But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers’ information.

It’s not known for how long the server was open, but long enough for it to be discovered by a security researcher, who told TechCrunch of the leak, but did not want to be named for the story.

SBI Quick allows SBI’s banking customers to text the bank, or make a missed call, to retrieve information back by text message about their finances and accounts. It’s ideal for millions of the banking giant’s customers who don’t use smartphones or have limited data service. By using predefined keywords, like “BAL” for a customer’s current balance, the service recognizes the customer’s registered phone number and will send back the current amount in that customer’s bank account. The system can also be used to send back the last five transactions, block an ATM card and make inquiries about home or car loans.

It was the back-end text message system that was exposed, TechCrunch can confirm, storing millions of text messages each day.

A redacted example of some of the banking and credit information found in the database (Image: TechCrunch)

The passwordless database allowed us to see all of the text messages going to customers in real time, including their phone numbers, bank balances and recent transactions. The database also contained the customer’s partial bank account number. Some would say when a check had been cashed, and many of the bank’s sent messages included a link to download SBI’s YONO app for internet banking.

The bank sent out close to three million text messages on Monday alone.

The database also had daily archives of millions of text messages each, going back to December, allowing anyone with access a detailed view into millions of customers’ finances.

We verified the data by asking India-based security researcher Karan Saini to send a text message to the system. Within seconds, we found his phone number in the database, including the text message he received back.

“The data available could potentially be used to profile and target individuals that are known to have high account balances,” said Saini in a message to TechCrunch. Saini previously found a data leak in India’s Aadhaar, the country’s national identity database, and a two-factor bypass bug in Uber’s ridesharing app.

Saini said that knowing a phone number “could be used to aid social engineering attacks — which is one of the most common attack vectors in the country with regard to financial fraud,” he said.

SBI claims more than 500 million customers across the glob,e with 740 million accounts.

Just days earlier, SBI accused Aadhaar’s authority, UIDAI, of mishandling citizen data that allowed fake Aadhaar identity cards to be created, despite numerous security lapses and misuse of the system. UIDAI denied the report, saying there was “no security breach” of its system. (UIDAI often uses the term “fake news” to describe coverage it doesn’t like.)

TechCrunch reached out to SBI and India’s National Critical Information Infrastructure Protection Centre, which receives vulnerability reports for the banking sector. The database was secured overnight.

Despite several emails, SBI did not comment prior to publication.

For more details visit https://cis-india.org/internet-governance/news/tech-crunch-zak-whittaker-january-30-2019-indias-largest-bank-sbi-leaked-account-data-on-millions-of-customers

India’s internet missionaries: The women Google is relying on to spread its Next Billion message

Admin — 2017-11-23T02:33:35Z

Google’s internet saathis have brought 11.5 million women in 105,000 villages online. But there’s a catch: the women are taught to use only Google products.

The article by Sunny Sen was published by Livemint on November 21, 2017.

Until Google came calling at Khaula, one of the nearly 100,000 villages in Uttar Pradesh, early in 2016, few among the womenfolk there had heard about the internet. A few had seen their men watching videos on smartphones, but none had accessed the internet on her own.

Now, more than 1,100 women in Khaula and neighbouring villages know how to access the internet and regularly log in. They teach their children, they teach themselves new skills, they look up fixes to niggling medical problems, and watch YouTube videos.

Khaula is ground zero for an ambitious Google initiative called Next Billion to spread use of the internet in developing economies. The initiative rides on the shoulders of women—internet saathis, who have been roped in to carry the “here’s how to access the internet” message across India. The success or failure of the saathis (saathi means friend in Hindi) in the internet literacy project will make or break the programme.

India, whose over 400 million data consumers make it the No. 2 market by internet users, only behind China, is the top focus country in the Next Billion programme. The project also covers Brazil, Indonesia, Nigeria, and parts of Africa.

The internet saathi programme, run by Google along with Tata Trusts is designed in such a way that two-three women in a village are handpicked and trained to use the internet. They, then, further train thousands of village women—not men—on how to access it. This design is with good reason: less than one-third of internet users in India are women and the number is far lower in its villages, explained Rajan Anandan, Google’s vice president for Southeast Asia and India, in a Mint newspaper article in April.

Neetu’s story

Four years ago, Neetu Bhagour, now 22, had made news in the village when she won a state-level wrestling event and was selected at the national level. But, she never made it to the nationals. “My parents didn’t allow me to… girls in our villages are not allowed to play much,” Bhagour said, her disappointment showing in her smile.

After leaving wrestling, she decided to pursue studies. The college was far away from the village and she didn’t attend every day, yet completed her graduation in science earlier this year—one of the few to do so in Khaula.

It was on one of the days she was home, bunking college, that her uncle told her that if she had time, she could teach village women how to access the internet. That was about one-and-a-half years ago.

“I had only seen my brother using (the internet). He had an Android phone, but he would never let us use it,” Bhagour said. “I decided to learn how to use the internet. People from Google trained us for three-four days… That was the first time I used the internet.”

Google gave her a Lava smartphone and a Celkon tablet—both entry-level brands—to use and train other village women. The cost of the two devices was around Rs11,000, a price that the women of Khaula would perhaps never be able to afford. The trainers also get an umbrella and 2GB of monthly data for each device—all provided by Google.

Till now Google has spent about Rs50 crore on training 35,000 saathis. That’s a tab of between Rs14,000 and Rs15,000 per saathi which includes the Rs11,000 spent on the devices, umbrella and data.

It was not easy for Bhagour to convince women in her village that learning to access the internet would be useful. Often they would scoff at her: “We don’t need it.” She stayed persistent. “It’s okay if you don’t need the internet, but teach it to your children,” she told them. “Use Google to know anything in this world.”

Next billion

Bhagour is one of the 35,000 internet saathis in India Google is backing. And, in a move atypical of the search giant, it is pouring crores of rupees training them. “Tata Trusts are equally funding the initiative for us. Google brings in the devices, the data, and the technical know-how of training the saathis. And Tata Trusts are managing the on-ground implementation, the saathi stipend,” said Neha Barjatya, head of ads marketing & digitizing initiatives, Google India.

The saathis are trained on how the web works, especially how to use various Google products such as Chrome, Search, YouTube, and PlayStore. They are not trained to use any other product, not Facebook or WhatsApp.

Since the beginning of the internet saathis project in 2015, Google has covered 105,000 villages in 12 states and taught 11.5 million women how to use the internet—making it the biggest project by Google under its Next Billion initiative and perhaps the single largest such outreach programme anywhere in the world.

Google wants to take the programme to 300,000 villages. “These women discover the internet (through Google and its products), and eventually discover how to use the internet for their needs,” said Barjatya.

Internet hard-sell

It wasn’t easy for Bhagour or any of the other saathis, initially.

Deepa Rajput of Dehtora village (near Khaula) is a Ph.D in Hindi. She teaches at the Shree Jagdamba Degree College in Agra. She was introduced to the internet saathi initiative by a friend of her husband’s. “Our family is one of the progressive ones in the village, so it was easy to convince my in-laws,” said Rajput.

But when she went out to teach, it was a problem. At the start, women didn’t allow her to take their picture, which is needed to enrol them in the programme. Some even refused to fill the enrolment form.

Rajput’s pitch was simple, yet compelling. “Google pe saara vishwa ka jankari prapt kar sakte hai… Agar aapka bhains bimar ho jata hai toh aap uske karan dekh sakte hai (You can find the entire world’s information on Google… If your buffalo falls sick, you find the reasons there),” she told the village women.

Most women liked the idea but they had to take the permission of their in-laws and husbands. “Women are weak… their survival depends on how much their husbands provide,” Rajput said.

When Google first went to a few villages in 2013, it started by training women directly for three-four hours. This was done at a school or the village community centre. It didn’t work out. The turnout was dismal. Folks at Google knew that they had to fix it if they had to expand beyond towns.

A pilot was done in a village near the Maheshwar town in Madhya Pradesh. Google piloted something called the internet cart, like an ice cream cart, which had internet-enabled tablets. Google-contracted agents would go from village to village, home to home, with these carts and teach the village women how to use the internet.

But, even that wasn’t enough. Google realized that it was important to stay in the village for a long period of time and keep training the women. That’s when the internet saathi concept was born.

The other problem was that women didn’t have devices to access the internet on. So Google gave them devices and free data. In 2015, Google and Tata Trusts started identifying trainers. Initially, Google also provided the saathis with a cycle in 1,500 villages, but stopped it as the women preferred walking.

Changing lives

For many of these beneficiaries, the internet is the only form of empowerment. For Deepmala, a primary school teacher in Atus village not far from Khaula, the internet helps her children learn English. “Children often ask things we don’t know… I have started using Google to explain things to children,” she said.

Deepmala’s first acquaintance with the internet was when she enrolled to become a saathi. She has trained 1,500 women since then. It wasn’t easy to convince her husband to allow her to learn how to use the internet but his mother stepped in. “My mother-in-law allowed me to learn… she used to go with me for the training,” she said.

For all the world that the internet has opened up for her, some centuries-old habits haven’t changed. Deepmala doesn’t know much about her husband’s work or what he earns. All she knows is that her husband works in a shoe factory near Agra. Without her mother-in-law’s backing, Deepmala said, she wouldn’t have been able to become a saathi.

When she showed the village women the internet, they were initially afraid to use it. There are a lot of myths about the ills of the internet in the villages. Rightly so, as often boys and men in the villages click pictures of girls and upload them to porn sites.

Women are shy and shun anything that may intrude on their privacy. It is in such a context that the world of information—access to Bollywood, culture, lifestyle, pornography, information, email, voice calling, and dozens of applications—suddenly opened up to them.

The saathis need to have a minimum education of up to Class VIII and should be comfortable with English. But there are no restrictions on the saathis to pick educated women. Many of their students don’t know how to read or write. For them, Deepa Rajput of Dehtora village said, Google voice commands are the easiest way to search the internet. “Women are seeing videos condemning domestic violence and oppression of women… That is a big change,” she said.

Making money

Deepmala, the school teacher saathi, taught women to search for mehendi designs and facial makeup on Google and YouTube. “Some of them have even started searching new salwar and blouse designs… The women tailors make more money for these designs,” she said.

Some women have started charging Rs50 for drawing mehendi designs. Others have started using the internet to look for agriculture and health-related information.

There are other avenues of making money, too. Deepmala and few of the women she trained landed a contract from research firm Nielsen to do a survey of the villages and the shops, for which they were paid. A list of 96 shops was given to them with a list of 80 questions. “The form was on the internet, we surveyed these villages and filled the form. It was about things like what products are sold, which shops have shut down, updating contact information…,” said Deepmala.

Monica Sisodiya from Barhan village has trained 2,000 women, most of them who are young. After being trained by Monica, two of them opened a beauty parlour. “She gets customers from 10-12 villages because of the new ways she has introduced,” said Monica, who wanted to study law in Agra, but couldn’t because her family wouldn’t allow her to go to the city. She is now pursuing a nursing course at Maa Bhagwati College, 7km from her home.

Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Others like Babita Singh are evidence that the lack of information access is not a problem of the poor alone. Babita, 20, whose father is an intelligence officer with the Uttar Pradesh police, lives in a house that is prosperous by Dehtora standards. Her house has four CCTV cameras monitoring the front and rear of the building. The images are captured on a 42-inch LED television on the living room wall.

Yet, Babita used the internet for the first time only four months ago after getting trained by Deepa. Babita refers to the Chrome browser as ‘kromee’. She said she uses the internet to fill forms for banking entrance exams. At leisure, she browses designs of cushion covers and sweaters and tries out new food recipes that she pulls up from the Net.

Babita’s neighbour, Malti Rajput, teaches in a school for the mentally challenged in a nearby village. She isn’t well off and got her first phone from Google.

“We have started using the internet in our schools to teach the children dance steps… They also see craft designs. We sell some of these products to raise some money for the children,” said Malti.

It’s business, of course

For Google, this is not any corporate social responsibility activity. It is about getting every individual in India online. “This is not a social initiative for us. It is very much a business or marketing objective,” said Barjatya.

Getting more people to use the internet lies at the heart of Google’s business. Google makes most of its revenue by serving digital ads. As more people join the internet and as more of them use the worldwide web, Google can negotiate with brands to get a higher share of the digital advertizing wallet.

Barjatya said Google does not measure what it is getting back from the initiative. “It’s very much to get these women online and the rest will follow,” she said. “We are only seeing how many villages and how many women are coming online, and how does it tie back into our Next Billion initiative.”

But experts say Google alone can’t change rural India. “Google is probably worried that rural India might end up like Myanmar where most users stay within Facebook and do not explore the rest of the internet,” said Sunil Abraham, executive director of Bengaluru-based research organization Centre for Internet and Society.

Click here for enlarge

Moving the needle

All the saathis FactorDaily spoke with said that at their training sessions they are taught only how to use Google products, apart from handling the hardware. Those, too, only on Android phones. No Facebook, no WhatsApp, no Snapchat, no Twitter, no Paytm, no Flipkart...

“This is a smart business decision for Google but it does not really bridge the digital divide. We need all stakeholders, including Google to work together to reduce the cost of hardware and connectivity,” Abraham said.

Still, a Google-commissioned study by research firm Ipsos suggests that the internet giant has made some headway in rural India. Here are some pointers from the study:

■ 90% of women who have attended the training have a better understanding of the internet

■ 25% of women continue to use the internet (Gujarat is the highest at 35%)

■ 7% of women trained under the program feel that their social standing has improved

■ 33% trained women think that their economic condition has improved by learning new skills

■ 1% increase in village income in instances where training was conducted

Even though most of the women are not taught to use Facebook and WhatsApp, most of them eventually get on to social media. This is little consolation for Facebook, which has failed to mainstream itself in rural India the way Google has.

While Google gets a large number of the first-time users, some of the women have also started buying things online. Mamta Mahour of Bijpuri village bought earphones and books from Amazon and a saree from Voonik. The products are delivered at one of the shops in the village and Mamta collects it from there.

Some of the households have also started disconnecting their cable connections, said Mamta. Her’s and Deepmala’s houses are two, for instance. Deepmala watches ‘Piya Albela’ and ‘Big Boss’ on YouTube. “We can watch it anytime. There is so much (power) load-shedding that you can’t watch an entire episode on television… that’s not the case on YouTube,” she said.

Slow going

Mamta has taken a Reliance Jio connection. She watches her shows on JioTV and YouTube. “JioTV is free. I don’t see the need of having a cable connection at home. Rather I would use that money to recharge my phone,” she said.

Still, the going is grindingly slow. While Google has been successful in teaching women in these villages to use the internet, three out of four stop using the internet after the training.

When the saathi project started, internet penetration in villages was about 10%, said Barjatya. A recent report by industry lobby Internet and Mobile Association of India and market researcher Kantar IMRB shows that it has gone up to 17%.

Barjatya said Google spent a lot of time understanding the needs of the rural India. These 11.5 million women trained by Google have at least been introduced to the internet. “Over time we have seen that they have found value in going and buying a smartphone,” Barjatya is optimistic.

The data story in India is changing, especially after the launch of Reliance Jio. Google is already in talks with Reliance Jio to provide 4GB of 4G data at Rs149 a month to the saathis. Right now it is 2GB of 2G data.

The feedback from the saathis, meanwhile, is that the training module needs to change: the time is too short to train someone who had never used the internet, according to them. The saathis were given the target of training 250 women in a week, based on which they would receive a stipend from Tata Trust. It varies between Rs4 and Rs8 for each woman trained.

Barjatya said the target has been brought down to 100 women a month.

Changing data story

While Google has set up a call centre to check how many beneficiaries use the internet after training, there is no way it can ensure that women continue to use it. Call centre agents make random calls to check if the training is sufficient and if they are using the internet. Google might also contemplate returning to the same village to train more women.

Also, very few women own devices in male-dominated rural Indian society. “We haven’t really got into creating access beyond spreading awareness. However, yes, this is something we are open to and can consider. But right now it is just the literacy part,” Barjatya said, talking about subsidising mobile phones for women in villages.

In the next two years, Google will need more devices and more data. For its target of covering 300,000 villages, it will need an army of about 100,000 saathis— nearly a 10-fold jump.

Meanwhile, back at Khaula, Bhagour, the former wrestler, has started studying for the entrance test to join Delhi police. YouTube, she said, is handy for her studies. She is learning tricks to solve math problems quicker. Something else happened on Dhanteras, the festival to worship wealth, that made Bhagour proud.

“I got Rs4,211 for training the women. I got the money on the day of Dhanteras,” she said. “I gave the money to my father to get the house painted.”

This story has been published in association with FactorDaily.

For more details visit https://cis-india.org/internet-governance/news/sunny-sen-livemint-november-23-2017-indias-internet-missionaries