Centre for Internet and Society

Easing the US-India divergence on data localisation

Shashidhar KJ and Kashish Parpiani — 2019-07-30T01:40:24Z

Addition of data localisation to the basket of persisting trade issues warrants greater compartmentalisation and consultative approaches to US-India ties.

The article by Shashidhar KJ and Kashish Parpiani was published by Observer Research Foundation on July 22, 2019.

The Reserve Bank of India’s (RBI) finally clarified its position eight months after it issued the controversial April 2018 circular mandating the storage of all payment data of Indians in the country and allowing the central bank “unfettered access”. The circular particularly aimed at US-based companies such as Mastercard, Visa, American Express, PayPal, Facebook and Google, as they scrambled to comply. The clarification was a welcome relief for companies seeking guidance on how to comply, what kind of data needs to be stored in India, and if the payment companies needed to move their processing infrastructure. Note, the RBI has yet to issue a formal directive with these clarifications.

Meanwhile, media reports have indicated that Facebook-owned WhatsApp would obey the RBI norm as it looks to kick off its payments business. This runs counter to what Facebook CEO Mark Zuckerberg had told investors in April:

“You should expect that we won’t store sensitive data in countries where it might be improperly accessed because of weak rule of law or governments that can forcibly get access to your data.”

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

This has revealed yet another faultline in the persisting trade issues between the US and India.

India is still debating passing a Personal Data Protection legislation, and as such, India doesn’t have any legal safeguards protecting users’ data.

Indian data rights vs. American IPR protectionism

New Delhi has started to assert its right over its citizens’ data as India’s footprint on the Internet increases. Moreover, without clear guidance from Personal Data Protection legislation, there has been a glut of policy prescriptions from sector regulators. The Centre for Internet and Society published a paper in which it chronicles 10 policy measures for both ‘soft’ and ‘hard’ data localisation across health, telecommunications, e-commerce, insurance and others. These measures range from storing copies of specific data, local content production requirements, or imposing conditions on cross-border data transfers that act as a localisation mandate.

This oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip. For example, one of the reasons for insisting on localisation is security, but even if companies localise data, there is no framework to access this data by the local security apparatus.

India’s policy thinking on the matter often begins with the idea: ‘data is the new oil.’ The thinking is that data generated by Indians should be viewed as a natural resource that must be protected by the state through localisation. This notion is problematic. Data, unlike oil, which is found in limited quantities, has different properties. Newer ideas of regulation must be thought of and that’s where Indian policy makers have not been accommodative.

Oversupply of policy prescriptions is leading to blurring of jurisdictions. Often, the policy measures given have many a slip between the cup and the lip.

A gripe that US-based companies mention is that there is a distinctive domestic tilt and that company representatives have turned away from consultations as they do not serve the “national interests.” This was best exemplified in October 2018 when a closed-door discussion between the RBI and the US-India Strategic Partnership Forum (USISPF representing the interests of US companies) broke downand the latter accused the RBI of having a bias. During the discussions, the RBI placed a lot of emphasis on the inputs from iSPIRT (Indian Software Product Industry Roundtable), an Indian think tank which has been advocating for data protectionism.

The aforementioned sentiment has been carried over to international summits. At the recently concluded G20 summit, India boycotted the Osaka Track on the digital economy as it felt that it would undermine multilateral consensus-based decisions on trade and deny policy space for digital industrialisation. The Osaka Track pushed hard for the creation of laws which would allow data flows between countries and the removal of data localisation.

India’s foreign secretary, Vijay Gokhale, mentioned that data is a new form of wealth and wanted latitude on domestic rule-making on data. And in the age of digital commerce, this may signify a broader trend of a developed-developing nations’ impasse. The tussle has now moved beyond the security angle with the United States enacting the Clarifying Lawful Overseas Use of Data (CLOUD) Act for security agencies to procure data stored in servers regardless of whether in the US or foreign soil. With monetisation now at the core of the dispute, the discussed divergences on data localisation tie into the US’ broader, long-standing issues pertaining to US-India bilateral trade.

Divergence on data localisation issue crosses path with trade tensions

The 2019 National Trade Estimate (NTE) by the Office of the United States Trade Representative (USTR) focuses on reducing “barriers to digital trade.” Taking a tone of American stewardship on open liberal market economics, it notes:

“When governments impose unnecessary barriers to cross-border data flows or discriminate against foreign digital services, local firms are often hurt the most, as they cannot take advantage of cross-border digital services that facilitate global competitiveness.”

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

President Trump’s ‘America First’ worldview in many ways upended conventional tenets of US foreign policy. But on some fronts, it has presented opportunities for marginal establishment agendas. For instance, Trump’s heightened focus on ties with Israel and the US’ Sunni allies in the Middle East, complements the realisation of neoconservatives’ penchant for regime change in Iran.

At a time when the Trump administration has sought to re-calibrate America’s trade relationships via the adoption of punitive sanctions that run counter to the fundamentals of the liberal world order, the aforementioned American concern for the competitiveness of foreign nation’s local firms may seem like sardonic preaching.

On Trump’s fixation with recalibrating US trade relationships on “fair and reciprocal” footing, the American trade establishment successfully addressed US’ belated concerns over absence of digital trade rules in case of the North American Free Trade Agreement (NAFTA) with Canada and Mexico. Similarly, the emerging divergences over data localisation with India are subsumed under the ongoing — albeit repeatedly stalled, US-India trade negotiations.

Hence, the NTE underscores India’s decision with regards to payment service suppliers to be part of trade barriers hampering digital commerce and US-India trade at-large.

Fixing the strained Carter mantra via compartmentalisation and consultation

India has approached trade talks from the standpoint of addressing the Trumpian aberration of the US pushing for reduction of its trade deficits with other countries. Whereas, USTR negotiators have approached negotiations with India with regards to, what they view as longstanding issues in bilateral trade, such as market access for dairy products and price caps on medical equipment.

In the past, those outstanding issues were downplayed in view of the promising long-term trajectory of US-India strategic ties. The same has come to be known as the understated dictum of the Carter mantra — named after former US Secretary of Defense Ashton Carter and architect of the US-India Defense Technology and Trade Initiative. The approach encompassed the US to focus on harnessing strategic ties and not let differences on other fronts like trade to crowd out minimal-yet-positive developments.

In recent times, that dictum has come under strain as trade tensions have resurfaced. Cases in-point being, the Trump administration’s recent revocation of India’s designation as a “beneficiary developing country” under its Generalised System of Preferences programme, and India’s imposition of retaliatory tariffs on 28 US products.

The US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels.

Furthermore, ahead of Secretary of State Mike Pompeo’s visit to New Delhi last month, the Trump administration reportedly mulled capping the issuance of H1B visas to about 15 percent for any country that “does data localisation.” It bore ominous prospects for India’s $150 billion IT sector as 70 percent of the 85,000 H1B visas issued every year go to Indians. With regards to the broader trajectory of US-India ties, the report came to be seen as another blow to the Carter mantra’s prescription for compartmentalisation of issues from promising aspects of the bilateral relationship.

Both sides however, have attempted to temper tensions, and keep the Carter mantra in place with the continued focus on evolving strategic ties — with continued impetus on US-India defence trade and force interoperability agreements.

More importantly, there seems to be an overt attempt to reinstitute a sense of compartmentalisation. For instance, Secretary Pompeo, during his visit to New Delhi eased fears by denouncing reports about the US considering H1B visa caps. Whereas, India, too, has sought to institute a sense of compartmentalisation with Commerce Minister Piyush Goyal announcing that the contentious data protection issue will be kept out of the e-commerce policy draft, and will be dealt with by the IT ministry instead.

Lastly, the US-India dynamic is graduating from the erstwhile top-heavy approach based on the personal relations developed between head of states, to an institutionalised format of consultative platforms on varied bureaucratic, legislative, military, and even public-private partnership levels. Examples of which include, the US-India 2+2 consultative platform between foreign and defense portfolio chiefs, and the India-US Strategic Energy Partnership working groups between India’s Petroleum Minister and US Energy Secretary. The upcoming editions of these forums are set to be critical in addressing outstanding issues in the strategic realm, like India’s purchase of the Russian S-400 systems inviting the prospect of American CAATSA sanctions, and India’s push for a gas-based economy in light of reduced oil purchases from Iran following recent tensions between Washington and Tehran.

Similarly, on easing the hardening American and Indian stances on data localisation, in addition to compartmentalisation, a consultative approach must be explored. Towards that end, the India-US Commercial Dialogue and India-US CEO Forum could serve as appropriate starting points for a joint working group involving a diverse set of stakeholders from the public and private realm.

For more details visit https://cis-india.org/internet-governance/news/observer-research-foundation-shashidhar-kj-and-kashish-parpiani-july-22-2019-easing-the-us-india-divergence-on-data-localisation

E-Governance, Identity & Privacy

praskrishna — 2012-09-26T06:17:03Z

This chapter will look at different legislations, projects, and policies pertaining to e-governance and identity that India has put in place, and examine both the strengths and the weaknesses of these, through the lense of privacy.

For more details visit https://cis-india.org/internet-governance/e-governance-identity-privacy.pdf

E-Governance Interoperability Framework — Meeting in Iraq

praskrishna — 2011-08-18T05:04:49Z

A meeting to create a plan of action for the development of e-Governance Interoperability Framework (e-GIF) in Iraq and include formulation of an e-GIF policy and technical document within the larger framework of public sector modernization, was held from 25 to 27 January 2011. Sunil Abraham was the main resource person for this meeting.

Mr. Abdul Kareem Al-Samaraii, Minister of Science and Technology and Mr. Peter Bachelor, Deputy Country Director, UNDP gave the opening remarks.

E-GIF Meeting Agenda, ERBIL, 25-27 January 2011

Tuesday 25/1/2011
	08:30 – 09:00 Opening Remarks H.E. Mr Abdul Kareem Al-Samaraii, Minister of Science and Technology Mr. Peter Bachelor/ Deputy Country Director, UNDP 09:00 – 10:00 e-GIF overview Introducing the GIF: Benefits of Interoperability for e-Governance GIF Context GIF Technical Content: Standard Categorisation How we can Develop Effective GIF Policy Document and GIF Action Plan: Presentation on GIF templates (GIF text and action Plan) that required to be filled by the end of the workshop 10:00 – 10:30 Coffee Break 10:30 – 12:00 Survey and base-line for Map of existing and proposed e-governance and ICT4D projects. User Interface and accessibility Storage and database schema Multi-modal input and output Access control and security Network schema Document flow and work-flow Discussion on specific challenges and opportunities faced when attempting interoperability. 12:00 – 13:30 Discussion on the co-existence of the GIF with existing/proposed laws and policies E-governance and ICT4D Copyright Patents (software only) FOSS/Open Standards/Open Content/Open Data Privacy and Data Protection Right to Information/Freedom of Information/Access to Information/Public Information 13:30 – 14:30 Lunch Break 14:30 – 16:00 Discussion on definition of “Open Standards” Existing definitions of Open Standards RAND, FRAND and Royalty Free De Facto and De Jure Standards Standards Setting Organisations Governance of Standards Single Standard vs. Multiple Standards Relationship between FOSS and Open Standards Review of international best practice European Union US Brazil Russia India Indonesia China 16:00 – 16:15 Coffee Break 16.15 - 17.45 Discussion on degree of openness Hardware/Software/File Formats Maturity of the standard Adoption in Iraq Policy Objectives of the GIF Neutral playing-field / vendor independence Obsolescence Data convergence Cost-reduction Domestic ICT industry
Wednesday 26/1/2011
	08:30 – 10:00 Discussion on Organisational Architecture to Interoperability: Enterprise Architecture Service Oriented Architecture Example on Germany’s Slandered and Architecture of E-Government Application (SAGA) that contain both the architecture and standard for interoperability / or any other relevant example 10.00 - 10.30 Coffee Break 10.30 - 13.00 Governance of the Government Interoperability Framework: Creating the GIF Organisational Structure: Authority/Agency/Ministerial Committee/Adjunct to the President/Prime Minister's office. Light vs. Heavy regulation: Broad principles vs. Lists approach [Inclusion lists, exclusion lists, least common denominator approach] Exemptions and Limitation: Reactive vs. proactive. Formal vs. informal. Versioning: Mechanism and time-frame for revising the GIF. Pre-determined Monitoring of Compliance: Agency responsible and protocol to be observed. Random vs. blanket approach. Sanctions: Design of remedies and punitive measures to discourage non-compliance. Incentives: Design of awards and prizes for those who comply first, most, at the least-cost, etc. Documentation and Public Consultation: How will the process of developing, implementing and monitoring the GIF incorporate public consultation and be documented. Capacity Building 13.00 - 14.00 Lunch Break 14.00 - 15.30 Discussion on specific standards for the GIF [categorization based on Indian GIF] with a focus on current problem areas (G2G, G2B) Presentation And Archival Domain Data Integration Domain Data Interchange Domain 15.30 - 15.45 Coffee Break 15.45 - 17.15 Discussion on specific standards for the GIF [categorization based on Indian GIF] with a focus on (G2C) and local Governorates and emerging areas Presentation And Archival Domain Data Integration Domain Data Interchange Domain
Thursday 27/1/2011	08.30 - 11.30 Unplanned time for collaborative work on the text of the GIF Draft of E-GIF Action Plan and Working Groups 11.30 - 12.00 Coffee Break 12.00 - 14.00 Review on e-governance plan of action Out of GIF scope 14.00 - 14.30 Workshop Closing Session and Looking Forward

For more details visit https://cis-india.org/openness/blog-old/e-gif-iraq-meeting

E-commerce_submission_by_CIS.pdf

karan — 2019-04-10T11:34:32Z

For more details visit https://cis-india.org/internet-governance/resources/e-commerce_submission_by_cis.pdf-2

E-Commerce Submission

karan — 2019-04-01T11:54:45Z

For more details visit https://cis-india.org/internet-governance/resources/e-commerce-submission

e - DIRAP Google+ Hangout: Open Government

Christine Apikul — 2013-09-18T10:43:30Z

The e-DIRAP Hangout on Open Government was held on Thursday, 25 July 2013. It brought together nine professionals from Australia, India, Indonesia, Japan, Malaysia and the Philippines to discuss the wide spectrum of issues surrounding open government.

See the original published in Digital Review Asia here

The idea of open government has been around for hundreds of years but the contemporary use of the term is influenced by the rapid advancement of ICTs and by the open source movement. "Just as open source software allows users to change and contribute to the source code of their software, open government now means government where citizens not only have access to information, documents and proceedings, but can also become participants in a meaningful way."[1] There is now increasing pressure for governments to be more open with their digital documents and processes, and to interact with citizens.

To assess whether your government is open, a good starting point is the Open Government Partnership minimum eligibility criteria that has four key areas:[2]

Fiscal transparency related to open budget system
Access to information, e.g. an access to information law that guarantees the public’s right to information and access to government data.
Disclosures related to elected or senior public officials, e.g. public disclosure of their income and assets.
Citizen engagement.

The panelists discussed open government initiatives in their respective countries, the challenges they face, and open source tools for open government.

Open Government Initiatives

India
The Government of India has decided to use royalty free open standards for all e-government data. The government has also shortlisted a number of open standards. India’s data portal, data.gov.in was recently launched and the number of datasets has been increasing. In January 2013 there were 89 datasets and in half a year,this has increased to over 3,000 datasets. Forty-five government departments are involved in this initiative and six apps have been created. The Planning Commission recently had a hackathon participated by about 1,900 people.

Indonesia
Indonesia is one of the founding governments of the Open Government Partnership.[3] along with the Philippines and six other countries. The emphasis of open government in Indonesia is not only the "supply side" (i.e. government providing access to data and information). It is also looking at generating demand for open government by empowering citizens to access and analyse data and information, voice their concerns and advocate for openness in government. To empower citizens, the Government of Indonesia has a number of projects such as "Satu Layanan"[4] or "One Service", a web portal where citizens can find government information and services; “One Map”, to promote collaboration between different government ministries and agencies, and also civil society in integrating datasets; and "Lapor"[5] that allow citizens to report wrongdoings in public services using SMS, Twitter or through the website.

According to a research study conducted by the World Wide Web Foundation,[6] the Government of Indonesia is working on making public data available. Public data includes social - economic data, development data and census data held by the National Statistic Bureau, as well as information on how the data is obtained and measured.

The research report also found that that there is a low demand from civil society and citizens for open government and open data. Moreover, cooperation between civil society and government in the implementation of open government is not strong enough. Several donors in Indonesia have provided support to develop the capacity of civil society groups that are part of the Steering Committee of the Open Government Partnership. Hivos’ Southeast Asia Technology and Transparency Initiative[7] is working with both civil society and government in Indonesia and the Philippines to promote transparency and accountability in public institutions.

Japan
In Japan, the major focus is in the creation and launch of the open data portal this year. How much impact it will make and how it can be measured is a concern, and this is a worldwide challenge.

Malaysia
The Sinar Project[8] in Malaysia promotes transparency, governance and citizen involvement, and uses open source technology to make information accessible to Malaysian citizens. The project has learned that for countries with poor democracy like Malaysia, basic information about government is available but not easily accessible to the public. The government is not familiar with interacting with citizens especially online. Unlike places with advanced statistics and open data, open government in Malaysia is at a nascent stage and is about having information about government representatives online and what bills are being passed in parliament.

Philippines
In the Philippines, President Aquino announced that the Freedom of Information Bill will be a priority bill for Congress this year, but citizens are cynical about the passing of this bill because it has been under consideration for three years. The Office of the President has received support from the World Bank last year for an Open Data Project using CKAN and the open data portal will be at http://data.gov.ph. The Philippine Government Interoperability Framework was convened last week.

PhilHealth or the Philippine Health Insurance Corporation[9] attempted to open up data, however even though there was political will to open up data, this was insufficient. A clear policy framework and change management (particularly, removing the fear of openness among employees) was needed.

Moreover, PhilHealth did not have the capacity and competency to ensure that the health data released, that includes diagnosis and treatment procedures, will not be reverse engineered to identify people. Health data is particularly sensitive due to the social stigma of certain health disorders, for example, those with tuberculosis may be assumed to have HIV/AIDS. When data is opened up, there are security and privacy implications. Developing countries need help and it is important to work together to come up with policies, protocols and algorithms to protect the health privacy of citizens.

Melbourne, Australia
In Melbourne, Australia, local government efforts to engage with citizens more fully through online and offline platforms include experimenting with wiki-based policy development, smart cities initiatives and digital strategies. Through conversations with policymakers, some key themes were identified. First, openness is not the same as participation, and encouraging effective participation is a challenge. Public spaces need to be “programmed” to support participation, and opening up data is not sufficient. It is necessary to develop strategies for outreach to a diverse group and encourage substantive participation particularly from those who are not online and not as competent in data management.

Secondly, because many telecommunications platforms that make data available are privately owned, there is a tension between commercial interest for secrecy and public demand to make data open. It is also a challenge for government to engage with citizens over an infrastructure that is privately owned, e.g. Facebook, Twitter and Google that place constraints on how citizens can be engaged.

Malaysia, Singapore and Thailand with high levels of digital broadband penetration and online users are not part of the Open Government Partnership despite the fact that most of the government departments and data are online. This is because these countries do not meet the minimum eligibility criteria for Open Government Partnership. For instance, they do not have freedom of the press and without it media and civil society cannot make use of the data for reporting for fear of prosecution.

There is also a lack of political will to disclose assets of public officials and procurement decisions.

Challenges
Open data is often associated with open government, but opening up data does not make a government open. Making data open has a set of challenges, but open government also has an important civil society component to create demand for open government and make meaningful use of the open data. There is also a private sector component that needs to be considered, particularly related to the mechanisms public participation over privately owned telecommunications infrastructure.

Challenges are faced at both the supply and demand sides. From the government side, many countries do not have the capacity to interact effectively with citizens. From the citizens’ side, many countries face the low demand for open government. Yet, in the case of Malaysia, even if public demand for open government is high, the missing component is a strong and large enough civil society base that can handle and analyse data independently and question policy. Dealing with the demand when data is open is another challenge. The challenges of opening up data If the original data is not digitized, how do we ensure that it becomes part of open data as defined by the Open Knowledge Foundation.[10] For countries such as Iraq that are simultaneously introducing e-government systems and open government, implementation is hampered by the lack of e-government data standards for specific domains such as human resources management or financial management.

Privacy

Privacy is one of the biggest concerns that the open data and open government movements faces.

Lack of exposure to privacy issues: Some open data activists are not aware that privacy should be an exception in disclosure requirement of government open data policies. If no public interest is served through disclosing personal information then there is no need to infringe upon the rights of individuals.

Privacy only for the individual: There is often a western notion of what constitutes privacy in which people worry about privacy infringement only at the level of the individual. But in India, if the open dataset showed HIV/AIDS prevalence at the village level that could result in stigma and discrimination of particular villages. The privacy problem exists not only at the individual level, but also at the level of family, community and geographical unit.

Underestimating re-identification research: Today we deal with the privacy challenge by using techniques like anonymization and obfuscation, but the problem is that re-identification research is getting more sophisticated and the more datasets that people have access to and are able to overlay upon one another, the more likely it is to re-identify anonymous or obfuscated data. This is an issue that the open data movement should take seriously.

Conflict with the transparency movement: The open data movement has not fully adopted principles from the transparency movement. This can be clearly seen in some countries where freedom of information activists are being killed or assaulted, but open data activists are usually safe because they are focused on analyzing the data that the governments have opened up. The provision of large quantities of data by government may be a distraction strategy that takes away what is important for civil society and democracy. Moreover, open data should not be the means to legitimize and increase the levels of surveillance occurring at the bottom of the pyramid. Instead, we need to encourage more eyes to watch the top of the pyramid because single actions there can have dramatic consequences for public interest.

For public participation in local government, FixMyStreet[11] is an open source software first developed by MySociety in the UK that allows the public to report on issues on a map. MySociety has also developed a number of other tools to help with government’s engagement with citizens.

OpenSpending[12] is used to visualize budget data and how tax money is being spent. This is a useful tool for transparency developed by the Open Knowledge Foundation.

CKAN[13] is an open source data portal platform that many countries have used for their open data portal. This is also an Open Knowledge Foundation project.

The Sunlight Foundation[14] and Code for America[15] are organizations that develop a number of open source tools that can be re-used and adapted by countries in Asia and the Pacific.

A free de-identification software for automated location and removal of protected health information in free text from medical records has been developed by PhysioNet.[16]

The Strategic Alliance Against Impoverishment (SAPA) provides poverty data on their website and maps the location of their projects.[17]

Final Words for the Way Forward

Make open government an election issue and elect officials that are open.

Demands for engagement may conflict with political goals of representatives in terms of the election cycle. Perhaps these open government issues need a third space to insulate them from political forces.

For people interested in implementing technical solutions, it is important to also look into non-technical issues raised by the Open Government Partnership and the Declaration on Parliamentary Openness.[18]

Make data available based on the needs of citizens and provide a platform for citizens’ feedback to inform the kinds of data to open up.

Open government should be relevant to citizens and result in improving the welfare of citizens.

Improve citizens’ data literacy and use open data in decision-making.

Openness is only a means and in the end we need governments that are accountable, that protect the public interest, that protect the weakest members of society, and they are not automatically guaranteed through open government. We should not fetishize the means and forget the ends.

At the top we need political leadership with strong inclination and will, and on the ground we need close coordination between civil society and government so that government does understand what is needed and sense what impact they can make by opening themselves up to their society or to their own operations. In the long term the key is how much the government can transform itself in terms of its own operations, and how much data they can produce in a reusable format and how much data they can use from other agencies to improve their operations.

The core of open government is about partnership between government, civil society and the private sector, and this is not easy.

Panelists

Danny Butt, Research Fellow in Participatory Public Space, University of Melbourne, Australia
Sunil Abraham, Executive Director, Centre for Internet and Society, India
Venkatesh Hariharan, Director, Knowledge Commons, India (previously, Head of Public Policy at Google India)
Maryati Abdullah, National Coordinator, Publish What You Pay, Indonesia (also Steering Committee Member of Open Government Partnership)
Yanuar Nugroho, Director and Expert Adviser to the Head of the President's Delivery Unit for Development Monitoring and Oversight (UKP4), Indonesia – to be confirmed
Tomoaki Watanabe, Executive Research Fellow, Centre for Global Communications, International University of Japan (also Executive Director of Common Sphere - the host of Creative Commons Japan, and Co-founder of Open Knowledge Foundation Japan)
Shita Laksmi, Program Manager, Southeast Asia Technology and Transparency Initiative, Hivos Regional Office Southeast Asia
Alvin B. Marcelo, Co-chair, Asia eHealth Information Network

Moderator: Khairil Yusof, Co-founder, Sinar Project, Malaysia (also e-DIRAP team member)

e-DIRAP Hangout Coordinator: Christine Apikul

[1]. See 20 Basics of Open Government, http://basics.open4m.org/

[2]. http://www.opengovpartnership.org/eligibility

[3]. http://www.opengovpartnership.org

[4]. http://satulayanan.net

[5]. http://lapor.ukp.go.id; See also http://www.techinasia.com/lapor-deeper-indonesias-newest-anticorruption-weapon/

[6]. “Even though the Law on Freedom of Information has been in place for five years and while some ministries and agencies have made data available online, it is often difficult to obtain and make use of the data due to bureaucratic procedures, charging requirements, copyright restrictions or a general reluctance to provide access to government data to external users.” World Wide Web Foundation, Open Government Data: Readiness Assessment Indonesia, 28 June 2013, http://www.webfoundation.org/2013/06/new-research-open-data-in-indonesia/

[7]. http://seatti.org

[8]. http://sinarproject.org

[9]. http://www.philhealth.gov.ph

[10]. http://okfn.org/opendata/

[11]. http://www.fixmystreet.com

[12]. http://openspending.org

[13]. http://ckan.org

[14]. http://sunlightfoundation.com/tools

[15]. http://codeforamerica.org/apps/

[16]. http://www.physionet.org/physiotools/deid/

[17]. http://www.sapa.or.id/

[18]. http://www.openingparliament.org/declaration

For more details visit https://cis-india.org/openness/blog-old/digital-review-asia-pacific-christine-apikul-e-dirap-google-hangout-open-government

DSCI Best Practices Meet 2013

kovey — 2013-07-26T08:18:01Z

The DSCI Best Practices Meet 2013 was organized on July 12, 2013 at Hyatt Regency, Anna Salai in Chennai. Kovey Coles attended the meet and shares a summary of the happenings in this blog post.

This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC

Last year’s annual Best Practices Meet, sponsored by the Data Security Council of India (DSCI), was held in here in Bangalore, and featured CIS associates as panelists for an agenda focused mostly around mobility in technology. This year, the event was continued in nearby Chennai, where many of India’s top stakeholders in Cyber Security came together at the Hyatt hotel to discuss the modern cyber security landscape. Several of the key points of the day emphasized how the industry realm needed to be especially keen on Cyber Security today. Early speakers explained how many Cyber-Attacks occur as opportunistic attacks on financial institutions, and that these breaches often take months to be discovered, with the discovery usually being made by a third-party. For those reasons, it was repeatedly mentioned throughout the day that modern entities must anticipate attacks as inevitable, and prepare themselves to be able to respond and successfully bounce-back.

Several panelists of the event expanded upon the evolving challenges facing industries, and explained why service based industry continually grows more susceptible to Cyber-Attack. There were representatives from Microsoft, Flextronics, MyEasyDoc, and others, who explained how technological demands of modern consumers resulted inadvertently in weaker security. For example, with customers expecting real-time access to data rather than periodic data reports, i.e financial data reports, industries must now keep their data open, which weakens database security. Overall, the primary challenge faced by the industry was effectively summarized by Microsoft India CSO Ganapathi Subramaniam, stating that within web services, “Security and usability are inversely proportional.” Essentially, the more convenient a product, the less secure its infrastructure.

Despite discussion of the difficulties facing modern producers and consumers, there were undoubtedly highlights of optimism at the conference. A presentation by event sponsor Juniper Networks shed light on practices which combat Cyber-Attackers, including rerouting perceived Distributed Denial of Service (DDoS) attacks and finger-printing suspected hackers through a series of characteristics rather than just IP addresses (these characteristics include browser version, fonts, Add-Ons, time zone, and more). Notably, there was a call for cooperation on all fronts in combatting Cyber-crime, for public-private partnerships (PPP), and many citizens stood and spoke on the behalf of civil society’s incorporation in the process as well. One speaker, Retired Brig. Abhimanyu Ghosh admirably tore down sector divisions in the face of Cyber-Security threats, saying “We all want to secure ourselves. It is not a question of industry versus government, government versus industry. Government needs industry, and industry needs government.”

Finally, a few speakers used their opportunity at the conference to highlight issues related to rights and responsibilities of both citizens and government in internet. Nikhil Moro, a scholar at the Hindu Center for Politics and Public Policy, spoke at length about the urgent condition of laws which undermine freedom of speech and freedom of expression in India, especially within while online. His talk, which occurred near the end of the event, stirred the crowd to discussion, and helped remind the attendees of the comprehensiveness of issues which demand attention in the realm of a growing internet presence.

For more details visit https://cis-india.org/internet-governance/blog/dsci-bpm-2013-conference-notes

Drawing maps for change

radha — 2011-04-04T06:49:53Z

Digital maps can hold immense academic value – an article by Deepa Kurup, The Hindu, 3rd Jan, 2010.

BANGALORE: The mash-up story is an old but compelling one, particularly when used for advocacy as in Tunisia where exile Sami Ben Gharbiais used a GoogleMaps mash-up to paint a different kind of landscape.
So random net surfers were startled to find the Tunisian map dotted with a string of prisoner’s names, their biographies, and videos of their family members telling the story of the human rights situation in the country.
Closer home, rights activist K. Ramnarayan is trying to do something similar. Using GPS and simple mapping technologies, Mr. Ramnarayan maps the location and extent of damage that will be created by proposed hydro-electric projects in Uttarakhand.

“We knew that many projects were announced. But it was only when we began mapping, we found that the 550-odd projects were concentrated in three valleys, and could potentially ruin all the State’s rivers,” he says.

Detailed perspectives

Mr. Ramnarayan believes that mapping technology can provide detailed perspectives, enable analysis — GPS devices are easy to use and collated data can be simply added as layers to existing maps — and create better awareness by sharing data online. Using the more accurate GIS mapping can also hold immense academic value.

It is this potential that “Maps for Change,” a collaborative project hosted by Bangalore-based Centre for Internet and Society (CIS) and Tactical Tech, endeavours to tap into. Anja Kovacs, a CIS fellow, believes maps are powerful, as they provide the larger picture. For instance, she says, news reports lead one to believe that protests against SEZs are isolated today. Now, put all those protests on a map, and you get the real picture! “Maps for Change” participants are involved in a slew of fascinating projects such as mapping land acquisition patterns in Bangalore, tribal displacement issues and dissident sexualities in Delhi.

Layer of information

So mapping is not a complex cartographer’s job anymore. With cheaper and more efficient GPS devices, in the market and on your cellphones, anybody can map. Pradeep B.V. of MapUnity.org, a site that lets you create your own map, says that ‘neogeographers’ are redefining online maps.

Neogeographers use available online maps such as Google MyMaps or Open Street Maps to add layers of information to a typical mashup.

GIS adds that critical layer of accuracy, and is essential in remote areas which are not mapped by these services. So you collect data (typically latitude, longitude and altitude information), mark your points of interest and upload this on a map, Mr. Pradeep explains.

Using attributes these simple maps can be used, accurately, to tell a story and document several layers of information.

Tracking changes
Say you wish to record access to health facilities in a backward district. A GPS device helps you collate info and create a ‘schema’ of data that can be uploaded directly to any mashup. Open source tools such as JUMP or UDIG can help you work easily with GIS datasets. The map can be interactive, you can track changes and can be as dynamic as you want it to be — for instance, you upload videos of health care facilities or highlight patches of social exclusion.

Link to the original article

For more details visit https://cis-india.org/news/drawing-maps-for-change

Draft Rules and Manila Principles

Akriti Bopanna and Gayatri Puthran — 2019-10-13T05:45:08Z

For more details visit https://cis-india.org/internet-governance/files/draft-rules-and-manila-principles-1

Draft Roundtable Report on AI and Banking

Shweta Mohandas — 2018-03-11T14:56:31Z

For more details visit https://cis-india.org/internet-governance/files/draft-roundtable-report-on-ai-and-banking

Draft Law Would Prohibit Showing ‘Disputed Areas’ on Maps of India

subha — 2016-05-15T13:05:41Z

Maps that label geographic areas of conflict as “disputed” territories in India could put one behind bars for seven years with 1B Indian Rupees (US$15M) penalty if a recently proposed bill becomes law.

The article was published in Global Voices on May 11, 2016.

The controversial bill, also known as Geospatial Information Regulation Bill 2016 would make it illegal to “depict, disseminate, publish or distribute any wrong or false topographic information of India including international boundaries through internet platforms or online services or in any electronic or physical form.”

If approved, it could put large corporations like Google (with its Google map), free and open source projects like Wikipedia and Open Street Map, and several other organizations in trouble for showing areas of conflict as disputed. Pakistan-Occupied Kashmir (PoK) and Arunachal Pradesh near the China border are two well-known examples of such areas.

The Indian government ruled by Bharatiya Janata Party (BJP) under the leadership of Prime Minister Narendra Modi has been quite critical of the depiction of the PoK and China border in Arunachal Pradesh.

If passed in the parliament as law, it could prevent Indians and foreigners, government employees and people traveling in ships and aircrafts that are registered in India, to acquire geospatial imagery or data. To acquire such data, one needs to obtain permissions from the security vetting authority.

In recent years, the Indian government has targeted numerous foreign publications including Al Jazeera for showing distorted maps of India that excluded parts of the state of Jammu and Kashmir and even another state Arunachal Pradesh. While the bill does not explicitly mention these efforts, it seems to fall in line with these previous attempts to control the free flow of geospatial information.

A news article about the proposed bill published on the portal MediaNama explains how the potential law could affect map portals like Open Street Map and Google Maps, taxi, e-commerce and public safety sites and many other services that allow marking and sharing coordinates. “Most digital photographs contain location meta-data, and by sharing your photos online, you’re adding to a repository of data related to man-made phenomenon,” suggests the same article. Open data advocates also have published list of 25 different services, seven major news portals, and 14 nonprofits that would be affected if the bill is approved.

The Open Data community of India also has come up with a campaign “SaveTheMap” to draft a request to the government to not pass the bill. The draft request states:

Request for comments / suggestions on draft “The Geospatial Information Regulation Bill, 2016” To regulate the acquisition, dissemination, publication and distribution of geospatial information of India which is likely to affect the security, sovereignty and integrity of India, a draft “The Geospatial Information Regulation Bill, 2016” has been prepared. Copy of the draft “The Geospatial Information Regulation Bill, 2016” is attached herewith for comments/suggestions. The comments/suggestions on the draft Bill may be forwarded to the Joint Secretary (Internal Security-I), Ministry of Home Affairs, North Block, New Delhi at email id: jsis@nic.in within 30 days.

There has been a lot of discussion with hashtag #GeoSpatialBill and humorous comments on social media:

Many have already started tweeting with the hashtag #savethemap:

Twitter user Prasanto Roy explained the implications of geospatial bill for various companies including Google, Uber and Open street maps:

Here's what other experts have to say:

Arup. R writes in Geospatial World:

This Act needs to be dropped. In its attempt to cover all bases it has been made so broadband and all encompassing that it may actually impede the progress of work on Geospatial systems and therefore on key Government programmes and projects. The Act does not take into account the fact that with the advent of the Cloud, Data as a Service, Software as a Service and Platform as a Service there is no need for ‘persons’ to possess data. They can just access data, do their work and retain only the final results. This Act does not, in fact cannot, even begin to comprehend the paradigm shift in geospatial technologies which makes it a non-starter.

India does need a Geospatial Information Act, but it has to be an enabling and encouraging Act that makes for faster and better implementation of programmes, not a regressive and punitive Act as the proposed one.

Devdutta Tengshe writes about the overreaching ambit of Geospatial bill on Medium:

Worst of all, it (the bill) is trying to implement Security by Obscurity, which is expecting the country to become secure by hiding information from its citizens. This is dangerous, because the real mischief creators, be they terrorists, Foreign government agencies, or domestic criminals, will most likely have access to kind of data from foreign sources, and will not even think about getting permits and licenses from these Indian Authorities.

Cyber law expert Pavan Duggal told The Wire:

The draft legislation has the intrinsic problem that it has been given extra-territorial applicability in terms of jurisdiction. It is applicable to any person anywhere in the world. We have historically seen that such jurisdiction does not work well in practical terms. What if global players do not want to take your licence or subject themselves to your jurisdiction?

Duggal further spoke about how the law could impact the growth of e-commerce and m-commerce in India.

Under this law, Google Maps will be illegal without a licence, which means that all mobile or e-commerce applications working on Google Maps will also become illegal. The licence will also only be applicable to the concerned person. So if I am a taxi aggregator like Ola or Uber, I will have to get a separate licence over and above what Google Map has.

Indian Express calls the Geospatial bill a death note for Cartography:

The draft Geospatial Information Regulation Bill of 2016 is so perfectly ridiculous that one can only hope that it falls off the map before it can be tabled in the House. Publishers the world over have learned, to their bewildered amusement, that India censors maps of itself. Now, to strike fear into their anti-national gizzards, the government has invoked an official map censor, a babu-led organisation whose prior permission will be required to publish geospatial information, which is newspeak for maps. Failure to correctly depict the borders of India could attract a fine of up to Rs 100 crore, before the poor offending bozo is dragged away to the cooler for seven years. With this draft, the government has embarked on a journey without maps, which must rapidly become directionless.

Not the first time around?

Meanwhile, this clearly isn't the first time that services such as Google Maps have come under the federal scanner in India. In 2014, India's prime investigation agency Central Bureau of Investigation (CBI) had launched a probe into Google Maps’ irregularities in Mapathon 2013 and had accused the company of running the competition without procuring proper governmental permissions. But the agency had called off the case citing lack of ‘adequate evidence to corroborate the allegations’.

For more details visit https://cis-india.org/a2k/blogs/draft-law-would-prohibit-showing-2018disputed-areas2019-on-maps-of-india

Draft International Principles on Communications Surveillance and Human Rights

elonnai — 2013-07-12T15:55:45Z

These principles were developed by Privacy International and the Electronic Frontier Foundation and seek to define an international standard for the surveillance of communications. The Centre for Internet and Society has been contributing feedback to the principles.

The principles are still in draft form. The most recent version can be accessed here. This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC.

Our goal is that these principles will provide civil society groups, industry, and governments with a framework against which we can evaluate whether current or proposed surveillance laws and practices are consistent with human rights. We are concerned that governments are failing to develop legal frameworks to adhere to international human rights and adequately protect communications privacy, particularly in light of innovations in surveillance laws and techniques.

These principles are the outcome of a consultation with experts from civil society groups and industry across the world. It began with a meeting in Brussels in October 2012 to address shared concerns relating to the global expansion of government access to communications. Since the Brussels meeting we have conducted further consultations with international experts in communications surveillance law, policy and technology.[1]

We are now launching a global consultation on these principles. Please send us comments and suggestions by January 3rd 2013, by emailing rights (at) eff (dot) org.

Preamble
Privacy is a fundamental human right, and is central to the maintenance of democratic societies. It is essential to human dignity and it reinforces other rights, such as freedom of expression and association, and is recognised under international human rights law.[2] Activities that infringe on the right to privacy, including the surveillance of personal communications by public authorities, can only be justified where they are necessary for a legitimate aim, strictly proportionate, and prescribed by law.[3]

Before public adoption of the Internet, well-established legal principles and logistical burdens inherent in monitoring communications generally limited access to personal communications by public authorities. In recent decades, those logistical barriers to mass surveillance have decreased significantly. The explosion of digital communications content and information about communications, or “communications metadata”, the falling cost of storing and mining large sets of data, and the commitment of personal content to third party service providers make surveillance possible at an unprecedented scale.[4]

While it is universally accepted that access to communications content must only occur in exceptional situations, the frequency with which public authorities are seeking access to information about an individual’s communications or use of electronic devices is rising dramatically—without adequate scrutiny. [5] When accessed and analysed, communications metadata may create a profile of an individual's private life, including medical conditions, political and religious viewpoints, interactions and interests, disclosing even greater detail than would be discernible from the content of a communication alone. [6] Despite this, legislative and policy instruments often afford communications metadata a lower level of protection and do not place sufficient restrictions on how they can be subsequently used by agencies, including how they are data-mined, shared, and retained.

It is therefore necessary that governments, international organisations, civil society and private service providers articulate principles establishing the minimum necessary level of protection for digital communications and communications metadata (collectively "information") to match the goals articulated in international instruments on human rights— including a democratic society governed by the rule of law. The purpose of these principles is to:

Provide guidance for legislative changes and advancements related to communications and communications metadata to ensure that pervasive use of modern communications technology does not result in an erosion of privacy.
Establish appropriate safeguards to regulate access by public authorities (government agencies, departments, intelligence services or law enforcement agencies) to communications and communications metadata about an individual’s use of an electronic service or communication media.

We call on governments to establish stronger protections as required by their constitutions and human rights obligations, or as they recognize that technological changes or other factors require increased protection.

These principles focus primarily on rights to be asserted against state surveillance activities. We note that governments are required not only to respect human rights in their own conduct, but to protect and promote the human rights of individuals in general.[7] Companies are required to follow data protection rules and yet are also compelled to respond to lawful requests. Like other initiatives,[8] we hope to provide some clarity by providing the below principles on how state surveillance laws must protect human rights.

The Principles

Legality: Any limitation to the right to privacy must be prescribed by law. Neither the Executive nor the Judiciary may adopt or implement a measure that interferes with the right to privacy without a previous act by the Legislature that results from a comprehensive and participatory process. Given the rate of technological change, laws enabling limitations on the right to privacy should be subject to periodic review by means of a participatory legislative or regulatory process

Legitimate Purpose: Laws should only allow access to communications or communications metadata by authorised public authorities for investigative purposes and in pursuit of a legitimate purpose, consistent with a free and democratic society.

Necessity: Laws allowing access to communications or communications metadata by authorised public authorities should limit such access to that which is strictly and demonstrably necessary, in the sense that an overwhelmingly positive justification exists, and justifiable in a democratic society in order for the authority to pursue its legitimate purposes, and which the authority would otherwise be unable to pursue. The onus of establishing this justification, in judicial as well as in legislative processes, is on the government.

Adequacy: Public authorities should restrain themselves from adopting or implementing any measure of intrusion allowing access to communications or communications metadata that is not appropriate for fulfillment of the legitimate purpose that justified establishing that measure.

Competent Authority: Authorities capable of making determinations relating to communications or communications metadata must be competent and must act with independence and have adequate resources in exercising the functions assigned to them.

Proportionality: Public authorities should only order the preservation and access to specifically identified, targeted communications or communications metadata on a case-by-case basis, under a specified legal basis. Competent authorities must ensure that all formal requirements are fulfilled and must determine the validity of each specific attempt to access or receive communications or communications metadata, and that each attempt is proportionate in relation to the specific purposes of the case at hand. Communications and communications metadata are inherently sensitive and their acquisition should be regarded as highly intrusive. As such, requests should at a minimum establish a) that there is a very high degree of probability that a serious crime has been or will be committed; b) and that evidence of such a crime would be found by accessing the communications or communications metadata sought; c) other less invasive investigative techniques have been exhausted; and d) that a plan to ensure that the information collected will be only that information reasonably related to the crime and that any excess information collected will be promptly destroyed or returned. Neither the scope of information types, the number or type of persons whose information is sought, the amount of data sought, the retention of that data held by the authorities, nor the level of secrecy afforded to the request should go beyond what is demonstrably necessary to achieve a specific investigation.

Due process: Due process requires that governments must respect and guarantee an individual’s human rights, that any interference with such rights must be authorised in law, and that the lawful procedure that governs how the government can interfere with those rights is properly enumerated and available to the general public.[9]While criminal investigations and other considerations of public security and safety may warrant limited access to information by public authorities, the granting of such access must be subject to guarantees of procedural fairness. Every request for access should be subject to prior authorisation by a competent authority, except when there is imminent risk of danger to human life. [10]

User notification: Notwithstanding the notification and transparency requirements that governments should bear, service providers should notify a user that a public authority has requested his or her communications or communications metadata with enough time and information about the request so that a user may challenge the request. In specific cases where the public authority wishes to delay the notification of the affected user or in an emergency situation where sufficient time may not be reasonable, the authority should be obliged to demonstrate that such notification would jeopardize the course of investigation to the competent judicial authority reviewing the request. In such cases, it is the responsibility of the public authority to notify the individual affected and the service provider as soon as the risk is lifted or after the conclusion of the investigation, whichever is sooner.

Transparency about use of government surveillance: The access capabilities of public authorities and the process for access should be prescribed by law and should be transparent to the public. The government and service providers should provide the maximum possible transparency about the access by public authorities without imperiling ongoing investigations, and with enough information so that individuals have sufficient knowledge to fully comprehend the scope and nature of the law, and when relevant, challenge it. Service providers must also publish the procedure they apply to deal with data requests from public authorities.

Oversight: An independent oversight mechanism should be established to ensure transparency of lawful access requests. This mechanism should have the authority to access information about public authorities' actions, including, where appropriate, access to secret or classified information, to assess whether public authorities are making legitimate use of their lawful capabilities, and to publish regular reports and data relevant to lawful access. This is in addition to any oversight already provided through another branch of government such as parliament or a judicial authority. This mechanism must provide – at a minimum – aggregate information on the number of requests, the number of requests that were rejected, and a specification of the number of requests per service provider and per type of crime. [11]

Integrity of communications and systems: It is the responsibility of service providers to transmit and store communications and communications metadata securely and to a degree that is minimally necessary for operation. It is essential that new communications technologies incorporate security and privacy in the design phases. In order, in part, to ensure the integrity of the service providers’ systems, and in recognition of the fact that compromising security for government purposes almost always compromises security more generally, governments shall not compel service providers to build surveillance or monitoring capability into their systems. Nor shall governments require that these systems be designed to collect or retain particular information purely for law enforcement or surveillance purposes. Moreover, a priori data retention or collection should never be required of service providers and orders for communications and communications metadata preservation must be decided on a case-by-case basis. Finally, present capabilities should be subject to audit by an independent public oversight body.

Safeguards for international cooperation: In response to changes in the flows of information and the technologies and services that are now used to communicate, governments may have to work across borders to fight crime. Mutual legal assistance treaties (MLATs) should ensure that, where the laws of more than one state could apply to communications and communications metadata, the higher/highest of the available standards should be applied to the data. Mutual legal assistance processes and how they are used should also be clearly documented and open to the public. The processes should distinguish between when law enforcement agencies can collaborate for purposes of intelligence as opposed to sharing actual evidence. Moreover, governments cannot use international cooperation as a means to surveil people in ways that would be unlawful under their own laws. States must verify that the data collected or supplied, and the mode of analysis under MLAT, is in fact limited to what is permitted. In the absence of an MLAT, service providers should not respond to requests of the government of a particular country requesting information of users if the requests do not include the same safeguards as providers would require from domestic authorities, and the safeguards do not match these principles.

Safeguards against illegitimate access: To protect individuals against unwarranted attempts to access communications and communications metadata, governments should ensure that those authorities and organisations who initiate, or are complicit in, unnecessary, disproportionate or extra-legal interception or access are subject to sufficient and significant dissuasive penalties, including protection and rewards for whistleblowers, and that individuals affected by such activities are able to access avenues for redress. Any information obtained in a manner that is inconsistent with these principles is inadmissible as evidence in any proceeding, as is any evidence derivative of such information.

Cost of surveillance: The financial cost of providing access to user data should be borne by the public authority undertaking the investigation. Financial constraints place an institutional check on the overuse of orders, but the payments should not exceed the service provider’s actual costs for reviewing and responding to orders, as such would provide a perverse financial incentive in opposition to user’s rights.

Signatories

Organisations

Article 19 (International)
Bits of Freedom (Netherlands)
Center for Internet & Society India (CIS India)
Derechos Digitales (Chile)
Electronic Frontier Foundation (International)
Privacy International (International)
Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (Canada)
Statewatch (UK)

Individuals

Renata Avila, human rights lawyer (Guatemala)

Footnotes

[1]For more information about the background to these principles and the process undertaken, see https://www.privacyinternational.org/blog/towards-international-principles-on-communications-surveillance
[2]Universal Declaration of Human Rights Article 12, United Nations Convention on Migrant Workers Article 14, UN Convention of the Protection of the Child Article 16, International Covenant on Civil and Political Rights, International Covenant on Civil and Political Rights Article 17; regional conventions including Article 10 of the African Charter on the Rights and Welfare of the Child, Article 11 of the American Convention on Human Rights, Article 4 of the African Union Principles on Freedom of Expression, Article 5 of the American Declaration of the Rights and Duties of Man, Article 21 of the Arab Charter on Human Rights, and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; Johannesburg Principles on National Security, Free Expression and Access to Information, Camden Principles on Freedom of Expression and Equality.
[3]Martin Scheinin, “Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism,” p11, available at http://www2.ohchr.org/english/issues/terrorism/rapporteur/docs/A_HRC_13_37_AEV.pdf. See also General Comments No. 27, Adopted by The Human Rights Committee Under Article 40, Paragraph 4, Of The International Covenant On Civil And Political Rights, CCPR/C/21/Rev.1/Add.9, November 2, 1999, available at http://www.unhchr.ch/tbs/doc.nsf/0/6c76e1b8ee1710e380256824005a10a9?Opendocument.
[4]Communications metadata may include information about our identities (subscriber information, device information), interests, including medical conditions, political and religious viewpoints (websites visited, books and other materials read, watched or listened to, searches conducted, resources used), interactions (origins and destinations of communications, people interacted with, friends, family, acquaintances), location (places and times, proximities to others); in sum, logs of nearly every action in modern life, our mental states, interests, intentions, and our innermost thoughts.
[5]For example, in the United Kingdom alone, there are now approximately 500,000 requests for communications metadata every year, currently under a self-authorising regime for law enforcement agencies, who are able to authorise their own requests for access to information held by service providers. Meanwhile, data provided by Google’s Transparency reports shows that requests for user data from the U.S. alone rose from 8888 in 2010 to 12,271 in 2011.
[6]See as examples, a review of Sandy Petland’s work, ‘Reality Mining’, in MIT’s Technology Review, 2008, available at http://www2.technologyreview.com/article/409598/tr10-reality-mining/ and also see Alberto Escudero-Pascual and Gus Hosein, ‘Questioning lawful access to traffic data’, Communications of the ACM, Volume 47 Issue 3, March 2004, pages 77 - 82.
[7]Report of the UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, May 16 2011, available at http://www2.ohchr.org/english/bodies/hrcouncil/docs/17session/a.hrc.17.27_en.pdf
[8]The Global Network Initiative establishes standards to help the ICT sector protect the privacy and free expression of their users. See http://www.globalnetworkinitiative.org/
[9]As defined by international and regional conventions mentioned above.
[10]Where judicial review is waived in such emergency cases, a warrant must be retroactively sought within 24 hours.
[11]One example of such a report is the US Wiretap report, published by the US Court service. Unfortunately this applies only to interception of communications, and not to access to communications metadata. See http://www.uscourts.gov/Statistics/WiretapReports/WiretapReport2011.aspx. The UK Interception of Communications Commissioner publishes a report that includes some aggregate data but it is does not provide sufficient data to scrutinise the types of requests, the extent of each access request, the purpose of the requests, and the scrutiny applied to them. See http://www.intelligencecommissioners.com/sections.asp?sectionID=2&type=top.

For more details visit https://cis-india.org/internet-governance/blog/draft-intl-principles-on-communications-surveillance-and-human-rights

Draft Digital Communications Policy

Gurshabad Grover — 2018-06-07T02:02:29Z

For more details visit https://cis-india.org/internet-governance/files/draft-digital-communications-policy

Draft Annual Report (2010-11)

praskrishna — 2014-10-21T23:55:55Z

This is the draft of the 2010-11 Annual Report.

For more details visit https://cis-india.org/about/reports/annual-report-2010-2011.pdf

DP Compendium

Admin — 2018-05-31T16:00:24Z

For more details visit https://cis-india.org/internet-governance/files/dp-compendium