Centre for Internet and Society

India UK Legal Regulatory Approaches

Admin — 2017-11-14T15:25:20Z

For more details visit https://cis-india.org/internet-governance/files/india-uk-legal-regulatory-approaches.pdf

India To Let Private Companies Access Citizens’ Biometric Data

praskrishna — 2017-02-27T15:09:16Z

India, home to the world’s largest national biometric registry, plans to begin sharing citizens’ data with the country’s private companies and startups.

The blog post by Joshua Kopstein was published by Vocativ on February 21, 2017. Sunil Abraham was quoted.

The government-backed program, called “India Stack,” will allow the second most populous country on Earth to share nearly all of its 1.3 billion citizens’ fingerprints, iris scans, and more, potentially creating unprecedented security and privacy risks in the name of convenience and digital commerce.

India Stack will open up the country’s troves of biometric data to Indian software developers, health care providers, and any other business interested in using the government’s identification records in their apps and services. The Indian government hopes the move will spur innovation, jumpstarting its effort to create a centralized system of digital commerce where citizens can purchase goods, apply for health insurance, or even qualify for a loan using the biometric sensors on their smartphones.

Opponents, however, warn that the sharing scheme opens a Pandora’s box of security and privacy problems, dramatically increasing the likelihood of data breaches and abuse.

“It’s the worst time for privacy policy in the country,” Sunil Abraham, the executive director of the Bangalore-based Centre for Internet and Society, told the Wall Street Journal. “We are very caught up in technological exuberance. Techno-utopians are ruling the roost.”

The dangers aren’t just hypothetical. In 2015, an unprecedented breach at the U.S. Office of Personnel Management allowed hackers to steal the fingerprints of 5.6 million federal employees. Researchers have found that stolen fingerprints can be used to commit fraud and identity theft, and even replicated and used to unlock smartphones and other personal devices. Worst of all, unlike passwords and social security numbers, biometric identifiers like fingerprints can never be changed, meaning that any breach is virtually guaranteed to have long-term consequences.

The India Stack program is the latest in several recent schemes to push the country toward a fully-digitized and cashless economy. As of December 2016, the Unique Identification Authority of India had registered more than 91% of the population into a centralized system called Aadhaar, which integrates with banks and allows citizens to complete transactions and access government services using their fingerprints. The country has also temporarily withdrawn its higher-denomination bank notes from circulation in an effort to bolster digital payment systems.

“While the efforts of the government are commendable, the efficacy of these programs in the absence of sufficient infrastructure for security raises various concerns,” the Centre For Internet and Society wrote in a paper outlining the privacy risks of India’s digital identity system. “Increased awareness among citizens and stronger security measures by the governments are necessary to combat the cogent threats to data privacy arising out of the increasing rate of cyberattacks.”

India’s program has already gone far beyond other countries’ biometric data collection schemes, which have mostly been limited to passports and border control. But law enforcement officials’ smaller, more piecemeal efforts to collect biometric information have also raised alarm over their potential for abuse. Thanks to the cooperation of 16 state DMVs, one in two Americans currently has their photo registered to a law enforcement face recognition database – regardless of whether they’ve been charged or even suspected of a crime. Local police in several U.S. states have also begun collecting iris scans and DNA swabs from people randomly stopped on the street, in some cases specifically targeting African American children.

For more details visit https://cis-india.org/internet-governance/news/vocativ-joshua-kopstein-india-private-companies-citizens-biometric-data

India Subject to NSA Dragnet Surveillance! No Longer a Hypothesis — It is Now Officially Confirmed

maria — 2013-11-06T10:20:46Z

As of last week, it is officially confirmed that the metadata of everyone´s communications is under the NSA´s microscope. In fact, the leaked data shows that India is one of the countries which is under NSA surveillance the most!

This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC. This blog was cross-posted in Medianama on 24th June 2013.

¨Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”, the democratic senator, Ron Wyden, asked James Clapper, the director of national intelligence a few months ago. “No sir”, replied Clapper.

True, the National Security Agency (NSA) does not collect data on millions of Americans. Instead, it collects data on billions of Americans, Indians, Egyptians, Iranians, Pakistanis and others all around the world.

Leaked NSA surveillance

Verizon Court Order

Recently, the Guardian released a top secret order of the secret Foreign Intelligence Surveillance Court (FISA) requiring Verizon on an “ongoing, daily basis” to hand over information to the NSA on all telephone calls in its systems, both within the US and between the US and other countries. Verizon is one of America's largest telecoms providers and under a top secret court order issued on 25 April 2013, the communications records of millions of US citizens are being collected indiscriminately and in bulk supposedly until 19 July 2013. In other words, data collection has nothing to do with whether an individual has been involved in a criminal or terrorist activity or not. Literally everyone is potentially subject to the same type of surveillance.

USA Today reported in 2006 that the NSA had been secretly collecting the phone call records of millions of Americans from various telecom providers. However, the April 25 top secret order is proof that the Obama administration is continuing the data mining programme begun by the Bush administration in the aftermath of the 09/11 terrorist attacks. While content data may not be collected, this dragnet surveillance includes metadata such as the numbers of both parties on a call, location data, call duration, unique identifiers, the International Mobile Subscriber Identity (IMSI) number and the time and duration of all calls.

Content data may not be collected, but metadata can also be adequate to discover an individual's network of associations and communications patterns. Privacy and human rights concerns rise from the fact that the collection of metadata can result in a highly invasive form of surveillance of citizens´ communications and lives. Metadata records can enable the US government to know the identity of every person with whom an individual communicates electronically, as well as the time, duration and location of the communication. In other words, metadata is aggregate data and it is enough to spy on citizens and to potentially violate their right to privacy and other human rights.

PRISM

Recently, a secret NSA surveillance programme, code-named PRISM, was leaked by The Washington Post. Apparently, not only is the NSA gaining access to the meta data of all phone calls through the Verizon court order, but it is also tapping directly into the servers of nine leading Internet companies: Microsoft, Skype, Google, Facebook, YouTube, Yahoo, PalTalk, AOL and Apple. However, following these allegations, Google, Microsoft and Facebook recently asked the U.S. government to allow them to disclose the security requests they receive for handing over user data. It remains unclear to what extent the U.S. government is tapping into these servers.

Yet it appears that the PRISM online surveillance programme enables the NSA to extract personal material, such as audio and video chats, photographs, emails and documents. The Guardian reported that PRISM appears to allow GCHQ, Britain's equivalent of the NSA, to secretly gather intelligence from the same internet companies. Following allegations that GCHQ tried to circumvent UK law by using the PRISM computer network in the US, the British foreign secretary, William Hague, stated that it is “fanciful nonsense” to suggest that GCHQ would work with an agency in another country to circumvent the law. Most notably, William Hague emphasized that reports that GCHQ are gathering intelligence from photos and online sites should not concern people who have nothing to hide! However, this implies that everyone is guilty until proven innocent...when actually, democracy mandates the opposite.

James R. Clapper, the US Director of National Intelligence, stated:

“Information collected under this program is among the most important and valuable foreign intelligence information we collect, and is used to protect our nation from a wide variety of threats. The unauthorized disclosure of information about this important and entirely legal program is reprehensible and risks important protections for the security of Americans.”

So essentially, Clapper stated that in the name of US national security, the personal data of billions of citizens around the world is being collected. By having access to data stored in the servers of some of the biggest Internet companies in the world, the NSA ultimately has access to the private data of almost all the Internet users in the world.

Boundless Informant

And once the NSA has access to tons of data through the Verizon court order and the PRISM surveillance programme, how does it create patterns of intelligence and generally mine huge volumes of data?

The Guardian released top secret documents about the NSA data mining tool, called Boundless Informant; this tool is used to detail and map by country the volumes of information collected from telephone and computer networks. The focus of the Boundless Informant is to count and categorise the records of communication, known as metadata, and to record and analyse where its intelligence comes from. One of the leaked documents states that the tool is designed to give NSA officials answers to questions like: “What type of coverage do we have on country X”. According to the Boundless Informant documents, the NSA has been collecting 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013. During the same month, 97 billion pieces of intelligence from computer networks were collected worldwide.

The following “global heat map” reveals how much data is being collected by the NSA from around the world:

The colour scheme of the above map ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance). India is notably orange and is thus subject to some of the highest levels of surveillance by the NSA in the world.

During a mere 30-day period, the largest amount of intelligence was gathered from Iran with more than 14 billion reports, while Pakistan, Jordan and Egypt were next in line in terms of intelligence gathering. Unfortunately, India ranks 5th worldwide in terms of intelligence gathering by the NSA. According to the map above, 6.3 billion pieces of intelligence were collected from India by the NSA from February to March 2013. In other words, India is currently one of the top countries worldwide which is under the US microscope, with 15% of all information being tapped by the NSA coming from India during February-March 2013.

Edward Snowden is the 29-year-old man behind the NSA leaks...who is responsible for one of the most important leaks in US (and one may argue, global) history.

So what does this all mean for India?

In his keynote speech at the 29th Chaos Communications Congress, Jacob Appelbaum stated that surveillance should be an issue which concerns “everyone´s department”, especially in light of the NSA spying on citizens all over the world. True, the U.S. appears to have a history in spying on civilians, and the Corona, Argon, and Lanyard satellites used by the U.S. for photographic surveillance from the late 1950s is proof of that. But how does all this affect India?

By tapping into the servers of some of the biggest Internet companies in the world, such as Google, Facebook and Microsoft, the NSA does not only gain access to the data of American users, but also to that of Indian users. In fact, the “global heat map” of the controversial Boundless Informant data mining tool clearly shows that India ranked 5th worldwide in terms of intelligence gathering, which means that not only is the NSA spying on Indians, but that it is also spying on India more than most countries in the world. Why is that a problem?

India has no privacy law. India lacks privacy legislation which could safeguard citizens from potential abuse by different types of surveillance. But the worst part is that, even if India did have privacy laws, that would still not prevent the NSA from tapping into Indians´ data through the servers of Internet companies, such as Google. Moreover, the fact that India lacks a Privacy Commissioner means that the country lacks an expert authority who could address data breaches.

Recent reports that the NSA is tapping into these servers ultimately means that the U.S. government has access to the data of Indian internet users. However, it remains unclear how the U.S. government is handling Indian data, which other third parties may have access to it, how long it is being retained for, whether it is being shared with other third parties or to what extent U.S. intelligence agencies can predict the behaviour of Indian internet users through pattern matching and data mining.

Many questions remain vague, but one thing is clear: through the NSA´s total surveillance programme, the U.S. government can potentially control the data of billions of internet users around the world, and with this control arises the possibility of oppression. It´s not just about the U.S. government having access to Indians´ data, because access can lead to control and according to security expert, Bruce Schneier:

“Our data reflects our lives...and those who control our data, control our lives”.

How are Indians supposed to control their data, and thus their lives, when it is being stored in foreign servers and the U.S. has the “right” to tap into that data? The NSA leaks mark a significant point in our history, not only because they are resulting in corporations seeking data request transparency, but also because they are unveiling a major global issue: surveillance is a fact and can no longer can be denied. The massive, indiscriminate collection of Indians´ data, without their prior knowledge or consent, and without the provision of guarantees in regards to how such data is being handled, poses major threats to their right to privacy and other human rights. The potential for abuse is real, especially since the larger the database, the larger the probability for error. Mining more data does not necessarily increase security; on the contrary, it increases the potential for abuse, especially since technology is not infallible and data trails are not always accurate.

What does this mean? Well, probably the best case scenario is that an individual is targeted. The worst case scenario is that an individual is imprisoned (or maybe even murdered - remember the drones?) because his or her data “says” that he or she is guilty. Is that the type of world we want to live in?

What can we do now?

Let´s start from the basics. India needs privacy legislation. India needs privacy legislation now. India needs privacy legislation now, more than ever.

Privacy legislation would regulate the collection, access to, sharing of, retention and disclosure of all personal data within India. Such legislation could also regulate surveillance and the interception of communications, in compliance with the right to privacy and other human rights. A Privacy Commissioner would also be established through privacy legislation, and this expert authority would be responsible for overseeing the enforcement of the Privacy Act and addressing data breaches. But clearly, privacy legislation is not enough. The various privacy laws of European countries have not prevented the NSA from tapping into the servers of some of the biggest Internet companies in the world and from gaining access to the data of millions of citizens around the world. Yet, privacy legislation in India should be a basic prerequisite to ensure that data is not breached within India and by those who may potentially gain access to Indian national databases.

As a next- but immediate- step, the Indian government should demand answers from the NSA to the following questions:

What type of data is collected from India and which parties have access to it?
How long is such data retained for? Can the retention period be renewed and if so, for how long?
Is data collected on Indian internet users shared with third parties? If so, which third parties can gain access to this data and under what conditions? Is a judicial warrant required?

In addition to the above questions, the Indian government should also request all other information relating to Indians´ data collected through the PRISM programme, as well as proceed with a dialogue on the matter. Governments are obliged to protect their citizens from the abuse of their human rights, especially in cases when such abuse may occur from foreign agencies. Thus, the Indian government should ensure that the future secret collection of Indians´ data is prevented and that Internet companies are transparent and accountable in regards to who has access to their servers.

On an individual level, Indians can protect their data by using encryption, such as GPG encryption for their emails and OTR encryption for instant messaging. Tor is free software and an open network which enables online anonymity by bouncing communications around a distributed network of relays run by volunteers all around the world. Tor is originally short for “The Onion Router” and “onion routing” refers to the layers of encryption used. In particular, data is encrypted and re-encrypted multiple times and is sent to randomly selected Tor relays. Each relay decrypts a “layer” of encryption to reveal it only to the next relay in the circuit and the final relay decrypts the last “layer” of encryption. Essentially, Tor reduces the possibility of original data being understood in transit and conceals the routing of it.

To avoid surveillance, the use of HTTPS-Everywhere in the Tor Browser is recommended, as well as the use of combinations of additional software, such as TorBirdy and Enigmail, OTR and Diaspora. Tor hidden services are communication endpoints that are resistant to both metadata analysis and surveillance, which is why they are highly recommended in light of the NSA´s surveillance. An XMPP client that ships with an XMPP server and a Tor hidden service is a good example of how to avoid surveillance.

Protecting our data is more important now than ever. Why? Because global, indiscriminate, mass data collection is no longer a hypothesis: it´s a fact. And why is it vital to protect our data? Because if we don´t, we are ultimately sleepwalking into our control and oppression where basic human rights, such as freedom, would be a myth of the past.

The principles formulated by the Electronic Frontier Foundation and Privacy International on communication surveillance should be taken into consideration by governments and law enforcement agencies around the world. In short, these principles are:

Legality: Limitations to the right to privacy must be prescribed by law
Legitimate purpose: Access to communications or communications metadata should be restricted to authorised public authorities for investigative purposes and in pursuit of a legitimate purpose
Necessity: Access to communications or communications metadata by authorised public authorities should be restricted to strictly and demonstrably necessary cases
Adequacy: Public authorities should be restricted from adopting or implementing measures that allow access to communications or communications metadata that is not appropriate for fulfillment of the legitimate purpose
Competent authority: Authorities must be competent when making determinations relating to communications or communications metadata
Proportionality: Public authorities should only order the preservation and access to specifically identified, targeted communications or communications metadata on a case-by-case basis, under a specified legal basis
Due process: Governments must respect and guarantee an individual's human rights, that may interference with such rights must be authorised in law, and that the lawful procedure that governs how the government can interfere with those rights is properly enumerated and available to the public
User notification: Service providers should notify a user that a public authority has requested his or her communications or communications metadata with enough time and information about the request so that a user may challenge the request
Transparency about use of government surveillance: The access capabilities of public authorities and the process for access should be prescribed by law and should be transparent to the public
Oversight: An independent oversight mechanism should be established to ensure transparency of lawful access requests
Integrity of communications and systems: Service providers are responsible for the secure transmission and retention of communications data or communications metadata
Safeguards for international cooperation: Mutual legal assistance processes between countries and how they are used should be clearly documented and open to the public
Safeguards against illegitimate access: Governments should ensure that authorities and organisations who initiate, or are complicit in, unnecessary, disproportionate or extra-legal interception or access are subject to sufficient and significant dissuasive penalties, including protection and rewards for whistleblowers, and that individuals affected by such activities are able to access avenues for redress
Cost of surveillance: The financial cost of providing access to user data should be borne by the public authority undertaking the investigation

Applying these above principles is a prerequisite, but may not be enough. Now is the time to resist unlawful and non-transparent surveillance. Now is the time for everyone to fight for their right to be free.

Is a world without freedom worth living in?

For more details visit https://cis-india.org/internet-governance/blog/india-subject-to-nsa-dragnet-surveillance

India Should Watch Its Internet Watchmen

praskrishna — 2011-05-06T05:08:05Z

The month after terrorists attacked Mumbai in 2008, India's government initiated legislation enabling it to eavesdrop on electronic communication and block websites on grounds of national security. There was no public debate before the bill in question was introduced, and hardly any debate inside parliament itself before it passed in 2009. In the law, there were no guidelines about the extent to which an individual's right to privacy would be breached. And there was certainly no mention, and therefore, reassurance, that due process would be followed when it came to restricting access to websites. This article by Rahul Bhatia was published in the Wall Street Journal on March 28, 2011.

It's taken about two years for the first signs of misuse to show up. And there may be many more, as the government uses vague discretion instead of firm rules to police India's Internet. Various groups can exploit these discretionary powers to their own ends.

Earlier this month, the Indian Computer Emergency Response Team (CERT-In), the body appointed by the government to protect India's information infrastructure, blocked a text-message provider that sends out advertisements in bulk over mobile phone. It also blocked Typepad.com, a publishing platform used frequently by bloggers. Both restrictions have now been lifted.

Most contentiously, a Delhi court ordered CERT-In to block access to Zone-H.org, an Italian security giant that acts as a repository of hacked websites—that is, it collects screen grabs of sites that are infiltrated, which later proves valuable for studying the cyber crime in question. A representative of this website accused an Indian cyber security firm, E2 Labs, of using Zone-H's logo and images to promote its own cyber security school courses. E2 Labs dragged Zone-H to court in 2009 and, on grounds of defamation, had Zone-H's website blocked. What muddies the waters is that E2 Labs claims to work for the government.

Nobody knows what threat, if any, these websites posed to national security. Users who tried accessing them simply received a one-line message from their service providers that the sites had been blocked due to "instructions from the Department of Telecom." That message later disappeared, replaced by the standard error message: "Page Not Found."

Many bloggers immediately started comparing this case to the situation they found themselves in 2006, when the government banned Blogspot.com right after Mumbai's suburban train system was hit by bomb blasts. The Department of Telecom then did not offer an official reason, leaving people guessing that this was some kind of response to that terrorist attack.

That's happening again. The guidelines under which CERT-In operates say that all information related to website blocking is classified. Moreover, its mandate does not include communicating with the public. Which is why everyone is in the dark. Nobody even knows how widespread the blockade is. There's no hint of the process involved. There's no course for redress for those who own the affected sites.

Inquiries from journalists about the Department of Telecom's method of functioning have gone unanswered. When cornered by the press this month, India's Information Technology minister Kapil Sibal, who oversees this department, passed responsibility to the ministry of home affairs, which manages the nation's internal security.

Perhaps there are legitimate reasons for blocking these websites. India has faced its share of terrorist attacks that have, in the last decade, begun to affect the country's urban centers. Terrorists have gotten more sophisticated. The 2008 Mumbai assault especially put pressure on security personnel to be electronically vigilant, because the terrorists used satellite phones and internet technology to communicate. Since then, the government has ramped up its scrutiny of the Internet, including getting into a high-profile dispute last year with Blackberry-maker Research in Motion. Blogs are fair game, too, seeing as how terrorist groups have been known to use them for recruiting and communication. But if there are good reasons this time for blocking the sites in question, they're unknown and unexplained.

That lack of explanation is cause for alarm. First, there's the impact on businesses. Intermediary guidelines proposed by the Department of Information Technology put the onus on service providers to remove any material that, in addition to endangering national security, "causes inconvenience or annoyance," is "grossly offensive or menacing in nature," or "belongs to another person." These open-ended guidelines mean service providers have to spend a good chunk of their time dealing with government officials to determine, say, what is offensive.

The larger impact is on the rule of law. The clumsiness with which New Delhi has blocked these sites undermines any legitimacy the laws have. Lawyers I've spoken with already say that the guidelines, which are open to wide interpretation, violate the country's constitution.

This legal debacle has implications beyond any immediate security concerns. Despite being a democracy with a vigorous free press, India can't afford to take freedom of speech for granted. The concern here is that a statute intended to protect the country from terrorism may also give new legal cover to people trying to restrict speech for other reasons.

Already, thanks in part to the lack of political support for free speech, varied groups hijack cracks or loopholes in the legal framework to their populist ends. For instance, a colonial-era law against religious insults was used in 2007 to appease Hindu nationalists who wanted the government to punish Muslim painter M.F. Hussain for depicting "Mother India" in the nude. That case suggests that the new ill-considered and badly implemented rules for online policing could be exploited by political or business interests.

India undoubtedly faces a serious terrorism problem. But New Delhi needs to defend itself through laws that don't end up impinging on free speech in damaging, undemocratic ways.

Mr. Bhatia is a writer with Open Magazine in Mumbai.

Read the original story here

For more details visit https://cis-india.org/news/internet-watchmen

India seeks a tighter grip on social media

praskrishna — 2012-08-25T03:02:35Z

India, with the world's third largest number of Facebook users, is clamping down on social media after recent posting of inflammatory videos on Web sites.

Published in United Press International on August 24, 2012. Pranesh Prakash is quoted.

But the United States urged New Delhi to find the right balance between freedom of speech and the need to maintain law and order, a report by The Times of India said.

The government's move to block sites it deems unacceptable comes after doctored videos showing apparent violence against Muslims in Assam created violent panic.

While officials say they believe the videos originated on Pakistani blogs, the issue highlighted the uneasy relationship between freedom of speech on the Internet and the government's need to damp down inter-ethnic tensions.

Union Home Secretary R.K. Singh said New Delhi will be raising the issue with Pakistani officials.

"I am sure they (Pakistan) will deny it but we have fairly accurate technical evidence to show that the images originated and were circulated from their territory," he said.

Last week Indian federal and state ministers as well as police authorities watched closely as Assamese Muslims living and working in Bangalore engulfed the train station seeking train ticket home after rumors of the Web site information swept through their community.

Rail authorities and train companies in Bangalore, in the southwest state of Karnataka, put on extra trains to Assam in the northeast to cope with the influx of people who said they feared an outbreak of ethnic violence.

Twitter promised to cooperate with the government after the Prime Minister's Office complained to it about objectionable content on six accounts resembling the PMO's official account, a Press Trust of India report said.

Twitter said it was "actively reviewing" the request and will seek information from the Ministry of Communication and IT "to locate the unlawful content and the specific unlawful tweet," the PTI report said.

Facebook said it will comply with requests from Indian authorities but only where posts broke its existing rules that apply in all countries, a report by the BBC said.

"We have received requests from Indian authorities and agencies and are working through those requests and responding to the agencies," Facebook said. "Content or individuals can be removed from Facebook for a variety of reasons including issuing direct calls for violence or perpetuating hate speech."

At stake for many Internet service providers, site developers and proxy servers is a slice of one of the world's potentially most lucrative advertising markets.

A report by Businessweek in May said India will have more users of Facebook -- which opened an office in India in 2010 -- than any other country by 2015.

India has around 46,300,000 Facebook users,Socialbakers, a social media analytics firm in London, says. This makes India the third-biggest Facebook market behind second-place Brazil with just more than 48 million users and first-place United States with nearly 157 million.

The growth of users in India is around 22 percent a month and will match the United States by the end of 2014, each having around 175 million users, Socialbakers said.

However, the United States has voiced concern that India may overstep a censorship mark in its attempt to stamp out offensive Web sites.

State Department spokeswoman Victoria Nuland said Washington has been monitoring the situation of Assamese Indians flooding back to Assam from southern India because of concerns about their personal safety.

The U.S. government is "going to obviously watch and see how that process goes forward."

"We are always on the side of full freedom of the Internet," Nuland said in a report by The Times of India.

"But as the Indian government continues to investigate these instances and preserve security, we also always urge the government to maintain its own commitment to human rights, fundamental freedoms, rule of law."

Nuland also said the U.S. government maintained "open lines to our own companies in India, as we do around the world, and we are obviously open to consultation with them if they need it from us."

The weight of the law may be against most of Internet intermediaries, Pranesh Prakash, a lawyer at the Bangalore-based Center for Internet and Society, said.

"The rules are very onerous on intermediaries, since they require them to act within 36 hours to disable access to any information that they receive a complaint about," Prakash wrote in an article The Indian Express newspaper in May 2011.

Any "affected person" according to technology laws can complain about issues including defamation, blasphemy, trademark infringement, threatening the integrity of India, disparaging speech or the blanket "in violation of any law."

It isn't mandatory to give the violator an opportunity to be heard before taking down their content.

"Since intermediaries would lose protection from the law if they didn't take down content, they have no incentives to uphold freedom of speech," Prakash said.

"They instead have been provided incentives to take down all content about which they receive complaints without a considered evaluation of the content."

For more details visit https://cis-india.org/news/www-upi-com-aug-24-2012-india-seeks-a-tighter-grip-on-social-media

India Round-table ICMEC Background Note

praskrishna — 2016-10-05T15:04:37Z

For more details visit https://cis-india.org/internet-governance/files/india-round-table-icmec-background-note.pdf

India No Haven For Net Freedom But It Did Not Oppose UN Move on Internet Rights

praskrishna — 2016-07-09T02:25:51Z

India hasn’t had the best record when it comes to Internet rights. The country regularly carries out Internet shutdowns under flimsy pretexts, is still fumbling when it comes to the drafting of a comprehensive privacy bill, and most recently came out with a geospatial information regulation bill that would establish ownership over all forms of location data.

The article by Anuj Srinivas was published in the Wire on July 6, 2016.

So, last week, when the United Nations Human Rights Council (UNHRC) passed a resolution on the “promotion, protection and enjoyment of human rights on the Internet”, it wasn’t surprising to see the wave of media criticism of the amendments that were proposed by countries such as China and Russia – and which were supported by India.

South Africa’s Mail & Guardian ran a story headlined “South Africa votes with China, Russia and India against Internet freedoms in UN resolution”. Private Internet Access’s headline was “These 17 Countries Don’t Believe that Freedom of Expression on the Internet is a Human Right”. Popular tech website The Verge noted that the resolution was opposed “by a minority of authoritarian regimes including Russia, China and Saudi Arabia, as well as democracies like South Africa and India. These nations called for the UN to delete a passage in the resolution that ‘condemns unequivocally measures to intentionally prevent or disrupt access to our dissemination of information online’.”

The Verge‘s report was followed up by a number of Indian publications including IndiaToday and Medianama – the latter incorrectly stating that the UNHRC resolution “recognised Internet usage as a basic human right – as well a host of other global publications.

The facts
There were two fundamental mistakes with some of these reports. Firstly, the resolution was adopted without vote (with oral revision) as noted by the UNHRC. Therefore, while there were a number of countries which co-sponsored the resolution and many that didn’t, it is completely wrong to state that India – as the Mail & Guardian reported – or any other country, voted against the resolution.

Secondly, as noted by the Centre for Internet and Society, none of the four amendments supported by India called for the deletion of a passage that condemned the prevention or disruption of Internet access and online information dissemination. Although it may fit neatly within India’s history of issuing Internet block orders, no country was opposed to this paragraph at the UNHRC forum (although many countries including India flout this clause in spirit back at home). No such amendment was proposed.

What then were these four amendments, which Article 19, an organisation that advocates freedom of expression, statedwould “substantially weaken the resolution”? Out of the four amendments (referred to as L85-88 in the UNHRC resolution), the first amendment (L85) – which sought to include a reference to fighting against the exploitation of children online – was withdrawn by Russia before it was considered by member states.

The other three amendments, while not completely endorsed by the countries that co-sponsored the resolution, do carry a certain level of nuance. Only one of the amendments (L86) can truly be described as diluting language regarding freedom of expression online, although this could have been potentially a result of procedural politics.

L88: Including Reference to Hate Speech
This amendment – proposed by Belarus, China, Iran and the Russian Federation – asks to introduce a new paragraph that states:

“Expresses its concern at the use of the Internet and information and communications technology to disseminate ideas based on racial superiority or hatred, and incitement to racial discrimination, xenophobia and related intolerance.”

Article 19 says of this amendment that it would “undermine the intended focus of the draft resolution on protecting human rights online, in particular freedom of expression..” While it is true that a few paragraphs of the resolution’s preamble include a reference to hate speech, it is difficult to see what harm this amendment would have brought in and even more difficult to accept that it would dilute the focus of the overall resolution.

Using the Internet and other online media technologies for incitement and as a means of propagating intolerance and xenophobia is a very real problem in India and other Asian countries, the most notable example of which was the role that social media played in the exodus of north-east Indian migrants from Bangalore four years ago. While shutdowns are obviously not the best way of dealing with this, it is important to acknowledge the role of the Internet as a medium in this aspect. In sum, this amendment certainly would not have diluted the resolution’s aim of promoting freedom of expression online.

L87: Human-Rights Approach
The second amendment replaces the term “human rights-based approach” with “comprehensive and integrated approach” in two paragraphs on expanding Internet access:

PP17: Stressing the importance of applying a comprehensive and integrated (human rights-based approach) in providing and expanding access to the Internet and for the Internet to be open, accessible and nurtured by multistakeholder participation,

OP5: Affirms also the importance of applying a comprehensive and integrated (human rights-based approach) in providing and in expanding access to Internet and requests all States to make efforts to bridge the many forms of digital divides..

This amendment was a little trickier. According to people involved in the country stakeholder discussions, whom The Wirespoke with, the aversion to a ‘human-rights’ approach towards expanding Internet access came as a result of China and Russia playing procedural politics. The language that was proposed in the amendment – “comprehensive and integrated” – while certainly not the strongest possible language that could have been used, would not have legally diluted the proposal to expand Internet access while maintaining an open and multistakeholder approach towards Internet governance.

Stepping back, what would a human rights-based approach in expanding Internet access look like? Would it include legitimising the act of zero-rating and the approval of schemes such as Facebook’s Free Basics? Both of which, incidentally, have been banned in India. While the proposed amendment certainly does not speak well of the motivations of China, Russia and India, the term is also vague enough that its mere removal doesn’t indicate a lack of support towards Internet freedom.

L88 – Right to privacy and removal of UDHR reference
This amendment, proposed by China and the Russian Federation, was more straightforward. In two paragraphs, it sought to add the specific term ‘right to privacy’, while in another paragraph it proposed removing reference to language from, and articles in, the Universal Declaration of Human Rights. Had the amendment been passed, the changes in the following paragraphs would have been made:

PP7: Noting that the exercise of human rights, in particular the right to freedom of expression and the right to privacy, on the Internet is an issue of increasing interest and importance as the rapid pace of technological development enables individuals all over the world to use new information and communication technologies,

OP15: Decides to continue its consideration of the promotion, protection and enjoyment of human rights, including the right to freedom of expression and the right to privacy, on the Internet and other information and communication technology, as well as of how the Internet can be an important tool for fostering citizen and civil society participation, for the realisation of development in every community and for exercising human rights, in accordance with its programme of work.

OP1: Affirms that the same rights that people have offline must also be protected online, in particular freedom of expression ~~which is applicable regardless of frontiers and through any media of one’s choice~~, and the right to privacy in accordance with articles 17 and 19 of the ~~Universal Declaration of Human Rights and the~~ International Covenant on Civil and Political Rights;

On one hand, this amendment would have added specific reference to the right to privacy. That specific term doesn’t appear in the draft resolution, although there are a few references to privacy in general in the resolution’s preamble.

However, the addition of a ‘right to privacy’ is coupled with a watering down of clear references to the protection of freedom of expression. Cynical observers would rightly note that China and Russia are probably less concerned with online privacy and more irked with the clear support of freedom of expression “regardless of frontiers” and “in accordance with the Universal Declaration of Human Rights”; which is probably why this particular proposed amendment combined both issues to improve its chances of passing. While there is little doubt that this amendment would have diluted the resolution’s focus on protecting freedom of expression, the alternative phrasing also doesn’t create legal loopholes that renders it useless. Moreover, it still contains reference to the International Covenant on Civil and Political Rights, especially Article 19, which goes beyond Article 19 of the UDHR .

India, a guardian?
It would be naive and wrong to take a strong position either way. To state that the amendments supported by India are all antithetical to the spirit of the UNHRC resolution, as some have done, is simply incorrect. On the other hand, this doesn’t mean India, and even less, China and Russia, are guardians of Internet freedom.

The UNHRC resolution in its entirety is a fine document. While non-binding, it provides a foundation for claiming that the same rights people have offline “must also be protected online”. Other crucial sections state that governments “should ensure accountability for all human rights violations and abuses committed against persons for exercising their human rights online”, while condemning “measures to intentionally prevent or disrupt access to or dissemination of information online”.

While the amendments India supported may not wholly oppose this resolution, it is also true that successive Indian governments also do not have an admirable track-record of upholding the resolution’s aims. Freedom for online speech had to be reclaimed in the form of court judgements, with the current government still supporting regulations that would allow it clamp down on online freedom of expression. In certain states within the country, Internet shutdowns happen without public explanations or justifiable reasoning. Over the last four years, for instance, Jammu and Kashmir has lost 18 days of Internet access. While it may not have wholly opposed the UNHRC resolution, the country still has a ways to go in terms of Internet freedom.

For more details visit https://cis-india.org/internet-governance/news/the-week-anuj-srinivas-july-6-2016-india-no-haven-for-net-freedom-but-did-not-oppose-un-move-on-internet-rights

India launches crackdown on online porn

pranesh — 2015-08-05T01:21:12Z

India has launched a crackdown on internet pornography, banning access to more than 800 adult websites, including Playboy and Pornhub.

The article by James Crabtree published in Financial Times on August 3, 2015 quotes Pranesh Prakash.

The restrictions followed a ruling from India’s telecoms ministry ordering internet service providers, including international telecoms groups operating in the country such as the UK’s Vodafone, to block 857 such sites.

Prime Minister Narendra Modi’s government provided no public justification for the unexpected ban when it came into effect at the weekend. However, on Monday India’s telecoms ministry said that the order, issued under India’s Information Technology Act, had been prompted by comments made by a supreme court judge during a hearing in July.

The ministry said that the restrictions were temporary and did not amount to a “blanket” ban, arguing that internet users running virtual private networks, which can be used to access blocked sites, could still view the material. “It isn’t that they are being banned lock, stock and barrel,” the ministry said. “The justice noted that free and open access to these websites.... should be controlled, but these sites will continue to be available through the mechanism of a VPN.”

The crackdown is set to raise fresh concerns about sudden and sweeping legal restrictions in India, after the introduction of a ban on the sale of beef earlier this year in the western state of Maharashtra, a move that was supported by Mr Modi’s government. The ruling also drew criticism from legal experts following broader concerns about a recent rise in poorly-targeted internet rules, including some restrictions on global social media sites such as Facebook and Twitter.

Pranesh Prakash of the Bangalore-based Centre for Internet and Society think-tank questioned the basis of the ruling, describing it as a further example of a “clumsy” approach to online regulation.

“There is no proper justification that they have given for banning all porn, rather than child porn or revenge porn or something like that,” he said. “The reaction is heavy handed, and has been done under the cloak of secrecy.” The remarks by a judge cited by India’s government as a rationale for the ban were a comment made in court rather than a legal ruling, Mr Prakash added, casting further doubt on the basis for the restrictions.

India’s mix of strict regulation and conservative public morals mean explicit sexual content is almost unheard of in mainstream media, where Bollywood films seldom featuring more than a chaste on-screen embrace.However India’s fast-growing internet population of about 300m is now both the world’s second largest after China, and an increasingly important sources for traffic for global pornographic websites.

Pornhub, which is the world’s 66th most visited website according to ranking service Alexa, said Indians were the fourth largest national users of its content during 2014.

For more details visit https://cis-india.org/internet-governance/news/financial-times-james-crabtree-august-3-2015-india-launches-crackdown-on-online-porn

India is building a biometric database for 1.3 billion people — and enrollment is mandatory

praskrishna — 2017-05-12T16:22:35Z

Inside the buzzing enrollment agency, young professionals wearing slim-fitting jeans and lanyards around their necks tapped away at keyboards and fiddled with fingerprint scanning devices as they helped build the biggest and most ambitious biometric database ever conceived.

The article by Shashank Bengali was published in the Los Angeles Times on May 12, 2017.

Into the office stepped Vimal Gawde, an impoverished 75-year-old widow dressed in a floral print sari. She had come to secure her ticket to India’s digital future — to enroll in the identity program, called Aadhaar, or “foundation,” that aims to record the fingerprints and irises of all 1.3 billion Indian residents.

Nearly 9 out of 10 Indians have registered, each assigned a unique 12-digit number that serves as a digital identity that can be verified with the scan of a thumb or an eye. But Gawde came to the enrollment office less out of excitement than desperation: If she didn’t get a number, she worried that she wouldn’t be able to eat.

Designed as a showcase of India’s technological prowess — offering identity proof to the poor and reducing waste in welfare programs — Aadhaar’s grand promises have been muddied by controversy as the government makes enrollment mandatory for a growing number of essential services.

Indians now need an Aadhaar number to pay taxes, collect pensions and obtain certain welfare benefits. The rapid expansion of a program that was originally described as voluntary has sparked criticism that India is vacuuming up citizens’ personal information with few privacy safeguards and creating hardship for the very people the initiative was supposed to help.

Like many Indians living in poverty, Gawde uses a ration card to purchase her monthly allotment of subsidized rice and cooking gas. But the shopkeeper told her that starting next month, he would sell to her only if she produced an Aadhaar number.

She had visited the enrollment agency three times but had yet to be approved, for reasons she did not understand. (Enrollment agents would not comment on individual cases.)

Reaching into her canvas bag, Gawde pulled out the familiar panoply of documents — ration card, voter card, electricity bill, income tax ID — that Indians use to navigate a dizzying bureaucracy. Aadhaar, she was told, would supplant all these papers.

But she had to get the number first.

“I’m nervous,” Gawde said outside the enrollment office on a sweltering morning. “I first applied three years ago and submitted all my documents, but didn’t follow up. Now that it’s becoming compulsory, I’m doing everything I can to get it.”

Indian Prime Minister Narendra Modi, who had criticized Aadhaar as a “political gimmick” before he took office, has embraced the futuristic idea of an all-in-one digital identity. His party pushed through a law last year that paved the way for a dramatic expansion of Aadhaar, allowing government entities and private businesses wide latitude to access the database, which collects not just people’s names and birth dates but also phone numbers, email addresses and other information.

Soon, as more private companies use the database, it could become difficult to open a bank account, get a new cellphone number or buy plane or train tickets without being enrolled.

Supporters say the program, which has cost about $1 billion to implement, will save multiples of that by curbing tax evasion and ensuring that welfare subsidies are not stolen by middlemen.

“Aadhaar was always meant to be an instrument of inclusion,” Nandan Nilekani, a tech billionaire and the program’s first chairman, said in an interview. “I’m really happy that the current government is completely endorsing Aadhaar and using it for a wide variety of services that will transform governance.”

Nilekani calls Aadhaar “hugely empowering” for the poor, but not long ago even he argued that enrollment should remain optional so that no Indians were prevented from accessing essential services. India’s Supreme Court agreed, ruling in 2015 that the government could not require Aadhaar for any benefit to which a person was otherwise entitled, as long as they could prove their identity by some other means.

Yet the court has stayed silent as Aadhaar creeps into every facet of Indian life, even for children.

A 12-year-old girl named Saiba is a case in point. After the girl’s grandmother passed away in their family’s ancestral village in northern India, Saiba’s mother moved her and her four siblings to a crowded neighborhood on the rough fringes of New Delhi, near a car parts market thick with the smell of grease.

When Saiba’s mother, Rani, went to the local school in April to register her for the sixth grade, administrators turned her down, saying every student must have an Aadhaar number.

But to get a number, a child usually needs a birth certificate — and like one-quarter of children born in this country, Saiba and her siblings did not have them because their village did not routinely register births.

Sitting with her mother in the cramped offices of the local advocacy group Pardarshita, above a noisy street lined with vegetable sellers, the girl puffed her round cheeks in an expression of helplessness.

“I don’t know anything about this,” said Saiba, who, like many Indians, has only one name. “I just want to go to school.”

Rakesh Thakur, a board member of Pardarshita, is trying to obtain Aadhaar numbers for dozens of children barred from Delhi schools. He called the policy “a clear violation” by the municipal government of both the Supreme Court order and India’s Right to Education Act, which guarantees every child younger than 14 free schooling.

A Twitter account called “Rethink Aadhaar” logs new instances almost daily of Indians who have suffered because scanners couldn’t read their fingerprints or because of errors in the database.

In Jawhar, a forested zone about 60 miles north of Mumbai, administrators have told local tribal communities that they will soon use Aadhaar to distribute welfare rations and school lunches. But the area lies outside cellphone range, leading residents to wonder how scanners will connect to the Internet to verify their identities.

“The idea of Aadhaar and the technology may be good, but do we have the infrastructure to make it mandatory?” said Vivek Pandit, a former lawmaker who runs a nonprofit group in the area. “The law is city-centric, and it would only lead to the social exclusion of rural India.”

This month lawyers opposing Aadhaar argued before the Supreme Court that the government could not force Indians to share their biometric data. Atty. Gen. Mukul Rohatgi countered that Indians had no constitutional right to privacy and could not claim an “absolute right” over their bodies.

Without privacy protections, activists worry that as Aadhaar numbers are linked to more and more services, intelligence agencies could use the database to more easily track Indians’ calls, travels and purchases.

“It’s become very clear that this is not a project about the poor,” said Usha Ramanathan, a lawyer and anti-Aadhaar activist. “The government’s ambitions have gotten greater over time.”

This month, the Center for Internet and Society, a New Delhi think tank, reported that federal and state agencies had published up to 135 million Aadhaar numbers — some including sensitive information such as a person’s caste and religion, or details of pension payments — on unsecured websites accessible through just a few clicks.

It’s become very clear that this is not a project about the poor. — Usha Ramanathan, a lawyer and anti-Aadhaar activist

Pranesh Prakash, the center’s policy director, said that when Indian authorities can’t even keep Aadhaar numbers private, as the law requires, it suggests the entire database is vulnerable — particularly after sensitive information involving 22 million Americans was exposed when federal databases were hacked in 2015.

“When these kinds of leaks are happening, it’s rather foolhardy to maintain a database of 1.2 billion people’s biometrics, because once this gets breached, it becomes completely unusable,” Prakash said.

“If your PIN number or password leaks, you can change it. You can’t change your fingerprints.”

Praveen Chakravarty, a former investment banker who worked with Nilekani to launch Aadhaar, believes the lack of safeguards undermines the project’s ideals of efficiency and empowerment. He said many Indians were right to worry that Modi’s government, which has cracked down on political activists and nonprofit groups it opposes, could use Aadhaar to snoop on citizens.

“Maybe Aadhaar didn’t need to be this big,” Chakravarty said, adding that the government could simply have worked to fix inefficiencies in individual welfare programs.

“People could ask, ‘Did we need this at all?’” he said. “It’s a good question.”

For Gawde, the widow, Aadhaar remained an idea of the future. She left the enrollment agency that day empty-handed, told by a young employee that her number had not been assigned. But she retained hope that the new ID would make life easier.

“We are just poor people,” she said. “We have to trust what the government tells us.”

For more details visit https://cis-india.org/internet-governance/news/los-angeles-times-shashank-bengali-may-12-2017-india-is-building-a-biometric-database-for-1.3-billion-people-and-enrollment-is-mandatory

India High Court: No Takedown Requests On Social Sites Without Court, Gov't Order

praskrishna — 2015-04-03T06:18:52Z

Indian police will no longer be able to threaten Internet users and online intermediaries with jail merely on the basis of a complaint that they have posted “offensive” posts online.

The blog post by Madhur Singh was published in Bloomberg BNA on March 25, 2015. Geetha Hariharan gave her inputs.

Following a landmark judgment by the Supreme Court of India March 24, law enforcement agencies will be able to take action in such cases only after an order has been obtained from a court or the government (Singhal v.Union of India, India Sup. Ct., 3/24/15).

The court struck down in its entirety Section 66A of the Information Technology Act, which authorized criminal penalties for sending “offensive” messages through electronic communication services. Opponents of the measure said the section defined “offensive” very vaguely and broadly, and that cases of arrest under the section frequently made headlines.

Freedom of speech activists and Internet-based businesses welcomed the judgment as a boost for civil liberties, freedom of speech and a conducive business environment for an entire gamut of online businesses.

The judgment is good news for intermediaries such as Facebook Inc. and the India-based review site MouthShut.com, both of which have been repeatedly inundated with takedown notices based on complaints against “offensive” posts.

Offensive Posts Were Actionable Under Section 66A

Section 66A, added to the Information Technology Act of 2000 through an amendment in February 2009, prescribed imprisonment of up to three years and a fine for anyone who sends via a computer resource or communication device:

(a) any information that is grossly offensive or has menacing character;
(b) any information which he knows to be false, but for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will, persistently by making use of such computer resource or a communication device; or
(c) any electronic mail or electronic mail message for the purpose of causing annoyance or inconvenience or to deceive or to mislead the addressee or recipient about the origin of such messages.

A supporting Section 79(3)(b) stated that “upon receiving actual knowledge, or on being notified by the appropriate government or its agency that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawful act,” the intermediary would have to “expeditiously remove or disable access to that material or that resource.”

Together, these sections put ordinary Internet users at risk for arrest for simply posting online and obligated intermediaries such as Twitter Inc., Facebook, MouthShut.com and others to take down content simply pursuant to a complaint.

Earlier this month, Facebook revealed statistics indicating that India is second on its global list of governments demanding takedowns.

Court Removes Intermediaries' Discretion

Shwetasree Majumder, partner at Fidus Law Chambers, told Bloomberg BNA March 25 that after this decision, any blocking of content can now only take place via a reasoned order after complying with several procedural safeguards, including a hearing to the originator and intermediary either by the designated
officer or pursuant to an order passed by a competent court.

“So intermediaries like Google, Facebook etc. are no longer required to judge as to whether the take down notices received by them contain legitimate requests or not,” she wrote in an e-mail. “As an acknowledgement that a true intermediary should not concern itself with the merits of the content posted by third parties, the court takes away the intermediary's discretion as to what content must remain and what must go.”

Geetha Hariharan, program officer at the Centre for Internet and Society, told Bloomberg BNA that after “reading down” Section 79, the Supreme Court “has relieved the intermediary of its responsibility to judge the lawfulness of content. Now, the intermediary will lose immunity under Section 79(3)(b) (and be liable
to prosecution or penalty) only if it does not take content down after receiving ‘actual knowledge of a court order or government notification' requiring takedown of content.”

Prior to the judgment, an intermediary was required to judge whether a takedown notice concerned unlawful content on its website, which would constitute “actual knowledge” under the section. If the intermediary made an affirmative determination, it was required to take the content down or lose immunity under Section 79(3)(b).

Supreme Court Strikes Down 66A

Momentum against Section 66A built up over the last three years, particularly after law student Shreya Singhal filed a challenge in the Supreme Court after two Mumbai women were arrested and put in jail for 10 days in 2012 for Facebook posts against a shutdown of Mumbai city following a politician's death.

A Supreme Court bench comprising Justices Jasti Chelameswar and Rohinton F. Nariman heard ten such cases together, and ruled March 24 that Section 66A was unconstitutional as it directly affected the right of the public to know. Holding that Section 66A was “open ended, undefined, and vague” so that “virtually any opinion on any subject would be covered by it, as any serious opinion dissenting with the mores of the day would be caught within its net,” the court struck it down in its entirety.

The court said that Rule 3(4) of the Intermediaries (Guidelines) Rules, 2011, which pertains to an intermediary disabling access to material that is “known” to be violative of Rule 3(2), needed to be read down in the same manner as Section 79(3)(b).

The court, however, upheld Section 69A of the Information Technology Act, which gives the government the power to block web content if doing so is in the interest of the sovereignty, integrity or security of India.

Impact on Intermediary Liability

Overall, Majumder said that intermediary liability now stands significantly watered down. One particular case this might impact is the currently pending Super Cassettes India Ltd. v MySpace Inc. case before the Division Bench of the Delhi High Court, which is considering the validity of the high threshold of intermediary liability prescribed by a single judge in copyright infringement cases.

Hariharan wrote in an e-mail that while intermediaries such as Internet service providers (ISPs) or content hosts may “choose” to take down content when they receive a private takedown notice, they don't “need” to do so to remain immune under Section 79(3)(b) or Rule 3(4) of the Intermediaries Guidelines.

“This reduces uncertainty in intermediary liability in India. It will also hopefully keep intermediaries from taking down content in an overbroad manner to escape liability,” Hariharan said, adding that the government nevertheless continues to have the ability to criminalize online acts. For instance, Sections 66B
to 67B of the IT Act define and criminalize different online conduct. Additionally, sections of the Indian Penal Code that criminalize speech acts (e.g., Sections 295A and 153A for incitement; Section 292 for obscenity) have also been applied to online acts in the past.

The Internet & Mobile Association of India said in a statement on its website March 24 that the judgment will mark a new phase for the growth and evolution of the Internet in India. While Internet users will no longer fear illegal censorship or harassment, it said that “online businesses, ranging from established international companies to small Indian startups, will be able to take advantage of a more conducive business environment.”

The IAMAI added that the judgment will be especially helpful to smaller companies such as Mouthshut.com that will “now not be harassed by the frivolous and mal-intentioned notices of take down.”

For more details visit https://cis-india.org/internet-governance/news/bloomberg-bna-march-25-2015-madhur-singh-india-high-court-no-takedown-requests-on-social-sites-without-court-govt-order

India encryption policy draft faces backlash

praskrishna — 2015-09-22T01:59:44Z

The department of information technology is facing a backlash from industry experts, Internet watchers and netizens on its draft of the National Encryption Policy that it recently made public.

The article by Moulishree Srivastava was published in Livemint on September 22, 2015. Pranesh Prakash gave inputs.

While the draft policy aims to enable a secure environment for both information and transactions in cyberspace for individuals, businesses and government, experts are concerned over privacy and outdated standards prescribed in the policy, among other things.

The policy puts the onus to produce encrypted information when demanded by government agencies on Indian citizens as well as on all the online service providers including instant messaging and e-commerce services that use encryption technology (to convert plain information to an unreadable format).

The department put the policy online late last week and it came on the radar of industry watchers and experts over the weekend. The policy is open for comments from the public till 16 October.

The policy, in its current form, is poorly drafted and the measures listed in it make Indian information systems vulnerable to cyber attacks, experts say.

For instance, the policy has mandated the use of specific standards and algorithms for encryption.

Encryption can be compared to the process of translating information in one language into a foreign language.

“Specifying certain algorithms to be used for encryption, and restricting the key sizes is same as saying that you are only allowed to communicate using a language from a given set of government-specified languages and no other language can be used,” said Pranesh Prakash, policy director at the Centre for Internet and Society.

However, the ones mentioned in the draft policy are outdated and unsafe to use, experts say. Another thing that weakens the security considerably is the req-uirement for businesses and citizens to keep the information (that was encrypted and sent over) for 90 days, in case law en-forcement agencies demand it. But that also means that for those 90 days, cyber criminals, too, can access it, warn experts.

Another big gap in the policy is that it leaves out “sensitive departments/agencies of the government designated for performing sensitive and strategic roles”, said Prakash.

“When the policy states its mission to be the enhancing of confidentiality of information and of security of critical networks by laying out information security best practices, how does it make any sense to keep sensitive or strategic government department and agencies outside its purview?” he asked. “After all, these are the organizations that most need to be kept secure to enhance national cybersecurity.”

The draft is also ambiguous on which online services—be it shopping online or accessing email—people can use (in compliance with the law) and which online service providers will have to be registered with the government.

The policy states that “service providers located within and outside India, using encryption technology for providing any type of services in India, must enter into an agreement with the government for providing such services in India”. Users can only use the services that are registered with the government.

“This is the first time when users are actually being told what are the things they can and cannot do,” said Prakash.

“The government must take note that the knowledge and expertise of common citizens may be inadequate to understand the nuances of encryption,” said cyber law expert Na Vijayashankar on his blog. “For example, if a citizen uses a service available on the Internet which uses, say, a higher level of encryption than what is appro-ved, then this policy may make him liable for the violation.”

The problem is enhanced because all online services use some encryption technology. This means that practically all online activity will fall under this new policy.

For instance, companies like Apple or Microsoft use encryption technologies at various levels of their operating systems; e-commerce services like Flipkart, Amazon and Snapdeal; web browsers like Mozilla Firefox and Google Chrome and mail services like Gmail, Yahoo and Rediff may be required to register with the government. The only way they may escape this requirement is if there is an exemption for products that are in use at a large scale. Network security service providers like Cisco Inc. will also need to comply. (Cisco declined to respond to a query.) Snapdeal said it is still examining the draft policy, while Amazon, Google, Microsoft did not reply to emails sent by Mint. Yahoo said its spokesperson was unavailable.

One clause that is drawing a lot of ire from industry veterans and technology enthusiasts requires individual users and businesses to store all information that was sent in an encrypted form for 90 days from the date of transaction. The users would also be required to reproduce the plain text and the encrypted text, if demanded by law enforcement agencies.

The draft policy also overlooks the privacy concerns of citizens and businesses. “It is clearly a violation of freedom of speech. A large part of the policy states how the government can interfere with users, like, by demanding their private messages. The policy is anti-privacy law,” said Prakash. “Privacy and security go hand in hand. So, as this policy weakens the security of the information, it puts the privacy at greater risk.”

For more details visit https://cis-india.org/internet-governance/news/livemint-moulishree-srivastava-september-22-2015-india-encryption-policy-draft-faces-backlash

India blocks access to 857 porn sites

pranesh — 2015-08-05T01:31:32Z

India has blocked free access to 857 porn sites in what it says is a move to prevent children from accessing them.

The story was published by BBC on August 3, 2015. Pranesh Prakash gave his inputs.

Adults will still be able to access the sites using virtual private networks (VPNs) or proxy servers. In July, the Supreme Court expressed its unhappiness over the government's inability to block sites, especially those featuring child pornography.

Telecom companies have said they will not be able to enforce the "ban" immediately.

"We have to block each site one by one and it will take a few days for all service providers to block all the sites," an unnamed telecom company executive told The Times of India newspaper.

A senior official, who preferred to remained unnamed, told the BBC Hindi that India's department of telecommunications had "advised" telecom operators and Internet service providers to "control free and open access" to 857 porn sites.

"There is no total ban. This was done in the backdrop of Supreme Court's observation on children having free access to porn sites. The idea is also to protect India's cultural fabric. This will not prevent adults from visiting porn sites," the official said.

In July, the top court had observed that it was not for the court to order a ban on porn sites.

"It is an issue for the government to deal with. Can we pass an interim order directing blocking of all adult websites? And let us keep in mind the possible contention of a person who could ask what crime have I committed by browsing adult websites in private within the four walls of my house. Could he not argue about his right to freedom to do something within the four walls of his house without violating any law?," the court said.

According to statistics released by adult site Pornhub, India was its fourth largest source of traffic in 2014, behind the US, UK and Canada. Pranesh Prakash of the Bangalore based Centre for Internet and Society said the directive to block the 857 sites was "the largest single order of its kind" in India.

"The government's reasoning that it is not a ban because adults can still access the porn sites is ridiculous," he told the BBC. The move has caused a great deal of comment on Indian social media networks, with many prominent personalities coming forward to condemn it.

Popular author Chetan Bhagat, writer and commentator Nilanjana Roy, politician Milind Deora and director Ram Gopal Varma have all added their voices to the debate.

For more details visit https://cis-india.org/internet-governance/news/bbc-news-august-3-2015-india-blocks-access-to-857-porn-sites

India bans Facebook’s ‘free’ Internet for the poor

praskrishna — 2016-02-10T02:53:49Z

India’s telecom regulator said Monday that service providers cannot charge discriminatory prices for Internet services, a blow to Facebook’s global effort to provide low-cost Internet to developing countries.

The article by Annie Gowen was published in Washington Post on February 8, 2016. Sunil Abraham gave inputs. The article was also mirrored by NDTV.

Facebook’s “Free Basics” program provides a pared-down version of Facebook and weather and job listings to some 15 million mobile-phone users in 37 countries around the world.

When it debuted in India in April, however, Free Basics immediately ran afoul of Internet activists who said it violated the principle of “net neutrality,” which holds that consumers should be able to access the entire Internet unfettered by price or speed.

On Monday, the Telecom Regulatory Authority of India agreed, prohibiting data service providers from offering or charging different prices for data — even if it’s free. The Free Basics program has run into trouble elsewhere in the world recently — with Egypt banning it and Google clarifying that it pulled out of the application during a testing phase in Zambia.

In a statement, Facebook said that while the company was “disappointed with the outcome, we will continue our efforts to eliminate barriers and give the unconnected an easier path to the Internet.”

In an interview before the ruling, Chris Daniels, Facebook’s vice president for Internet.org — the umbrella organization of the global effort — said India’s negative reaction has been “unique versus other markets we’ve seen. We’ve been welcomed with open arms in many countries.”

Facebook chief executive Mark Zuckerberg launched the program to great fanfare in 2013, partnering with other international tech firms on a mission to connect the 4 billion people in the world without Internet access — which he says is a basic human right.

India has 300 million mobile Internet users but still has close to 1 billion people without proper Internet access. But it is second only to the United States in number of Facebook users, with 130 million, with vast expansion potential as Facebook works to increase its user base beyond the developed world.

Yet the Free Basics program was controversial from the start in India, where critics accused Facebook of creating a “walled garden” for poor users that allowed them access to only a portion of the web that Facebook controlled.

Dozens of well-known tech entrepreneurs, university professors and tech industry groups spoke out against it, saying that the curated app, with its handpicked weather, job and other listings, put India’s scrappy start-ups and software developers at a disadvantage.

On Monday, Vijay Shekhar Sharma, the founder and creator of India’s payment application PayTM, applauded the regulator’s move.

He had been among the program’s fiercest critics, dubbing Free Basics “poor Internet for poor people” and comparing Facebook’s actions to that of British colonialists and their East India Co.

“India, Do u buy into this baby internet?” Sharma tweeted in December. “The East India company came with similar ‘charity’ to Indians a few years back!”

“In a country like India that’s just taking off, it’s important that there is an equal playground for every app developer,” he said in an interview.

In December, India’s regulator put out a position paper on differential pricing and asked for public comment on whether such programs were fair.

In response, Facebook launched a public relations blitz, with television and newspaper advertisements, billboards and an opinion piece by Zuckerberg in the Times of India in which he argued against criticism that the social-media giant was providing the service simply to expand its user base.

Facebook also engineered a prompt to users that sent “robo” letters of support for Free Basics to India’s telecommunications regulator. The regulator, flooded with form letters, was not amused.

Facebook’s behavior may not have helped its cause, some analysts said.

“Facebook went overboard with its propaganda [and] convinced ‘the powers that be’ that it cannot be trusted with mature stewardship of our information society,” said Sunil Abraham of the Center for Internet and Society in Bangalore.

Yet David Kirkpatrick, the author of “The Facebook Effect,” says that Zuckerberg is determined to see the program succeed.

“Facebook is relentless,” he said. “Zuckerberg has said from the beginning his goal is to make the world more open and connected. And that’s a phrase he continues to repeat 10 years later.”

The regulator had asked Facebook, and its local telecom partner, Reliance Communications, to suspend Free Basics’ operations during the public comment period. But the social-media giant and its partner appeared to flout the suspension order, with the program continuing to be operational on Reliance SIM cards.

A spokesman for Reliance earlier said that the applications was in “testing mode” and that it was not commercially promoting the product.

The regulatory body said Monday that anybody violating the order in the future will be subject to a fine of about $735 a day. It will return to review the policy in two years to see if it is effective.

For more details visit https://cis-india.org/internet-governance/news/washington-post-annie-gowen-february-8-2016-india-bans-facebooks-free-internet-for-the-poor

India and Regional Mega-Trade Agreements

praskrishna — 2016-07-30T12:59:56Z

Anubha Sinha was invited by the Observer Research Foundation for a panel discussion on "India and Regional Mega-Trade Agreements" with Ambassador Robert Holleyman, Deputy US Trade Representative and Ambassador Shyam Saran, Chairman, Research and Information System for Developing Countries on July 25, 2016 at ORF Conference Hall in New Delhi.

The discussion comes at a critical time for digital trade in Asia, with the recent conclusion of the Trans-Pacific Partnership and the continent's emergence as a major contributor the global digital economy.

The growth of the digital economy has spurred new concerns about global tax regimes, and the negotiation of trade terms - including non-tariff barriers and the alignment of policies - even as intellectual property rights are redefined and e-commerce changes industry practices. The backdrop to these developments is the rapid and unpredictable advance of technology, which has prompted the need for adaptive policies. The Digital 2 Dozen, the US tenets for unrestricted commerce and an open internet, is attached for your reference.

For more details visit https://cis-india.org/a2k/news/india-and-regional-mega-trade-agreements

India and France to Digitise Manuscripts, Artworks & Archives

praskrishna — 2015-12-15T08:15:15Z

The Indian and French governments have signed a memorandum of understanding (MoU) which will assist in technical knowledge sharing, competency, skill building and cultural exchange between the two countries, as per a PIB release.

This was published by Medianama on October 29, 2015. CIS memorandum of understanding (MoU) with Goa University was mentioned.

The MoU will assist a program on digitisation of old manuscripts and documents, which began in France 7 years ago. The Ministry of Culture will benefit from this and build a national virtual library in India, which will store and share manuscripts, archives and artworks. This library will also link and share all knowledge resources from various Indian and French government institutes and organisations.

The French government is also keen on sorting and deciphering its collection of thousands of Indian documents in Sanskrit, Tamil and other Indian languages with the help of the Indian government, which also incidentally includes correspondence between Rabindranath Tagore and French scholar Sylvan Levin.

NMM digitised over 30 lakh manuscripts last year
In March, we reported that the 12 year old government body National Mission for Manuscripts (NMM) had digitised over thirty lakh manuscripts and 18,588,390 pages in all as of 31 December 2014. Mahesh Sharma, Union Minister of State for Culture, Tourism & Civil Aviation said that the National Archives of India (NAI) was set to digitise another 1,100,000 historic records.

Previous digitisation initiatives:

In November 2014, around 55 books written by the Indian author and activist Niranjana in Kannada would be digitized and made available on Kannada Wikisource, allowing Kannada speakers to access these books easily.
In October 2014, the Ministry of Culture launched a national portal for museums. Collections in all museums under its control and those under the Archaeological Survey of India (ASI) will be digitized and presented on this portal.
In July 2014, the Department of Biotechnology and Department of Science and Technology released the draft of Open Access Policy under the Ministry of Science and Technology.
In September 2013, Goa University entered into a 3 year MoU with the Centre for Internet and Society for building the Konkani Wikipedia.
In June 2013, Tata Communications Media Services planned to digitize documents of historical and cultural significance such as films and documentaries from the archives of Doordarshan and Films Division of India which go back to 1947 including speeches of India’s first Prime Minister Jawaharlal Nehru and other leaders.
In May 2013, Punjabi Sahitya Akademi Reference Lab scanned and saved around 1,000 manuscripts, stone-printed scripts, poetry books on computer hard discs, adding that the digitized editions will be available across the globe through the internet.

Check out our digitisation and government coverage.

For more details visit https://cis-india.org/openness/news/medianama-sneha-johari-october-29-2015-india-and-france-to-digitise-manuscripts-artworks-and-archives