Centre for Internet and Society

Aadhaar seeding: benefits and concerns

Admin — 2017-11-23T02:02:45Z

Products and services such as bank accounts, life insurance policies and phone connections have to be linked with Aadhaar. But is this of any real help?

The article by Shaikh Zoaib Saleem was published by Livemint on November 14, 2017.

The government has made it mandatory for consumers to link many important services with Aadhaar. You too may be getting frequent reminders to link your banks account, mutual fund and mobile number with Aadhaar. Recently, the Reserve Bank of India also clarified that it is mandatory to link bank accounts with Aadhaar.

The latest addition to this list are insurance policies. In a circular, the Insurance Regulatory and Development Authority of India (Irdai) has stated that linking of Aadhaar number to insurance policies is mandatory under the Prevention of Money-laundering (Maintenance of Records) Second Amendment Rules, 2017.

The issue is being discussed intensively, with the Supreme Court taking a decision in favour of linking Aadhaar biometrics and the number with a host of services. Several petitions have been filed challenging not just the linking of these services with Aadhaar but also the validity of Aadhaar itself. We spoke to people who support and those who oppose this linking, to understand how either case impacts consumers.

The benefits

According to the Unique Identification Authority of India (UIDAI), government schemes are asking for Aadhaar as it helps to clean out duplications and fakes, and provides accurate data to enable implementation of direct benefit programmes. “Use of Aadhaar reduces the cost of identifying persons and provides increased transparency to the government in implementation of its schemes,” the Authority states under frequently asked questions on its website (read more at: https://uidai.gov.in/your-aadhaar/help/faqs.html) So, when you link your bank account with your Aadhaar, government benefits such as subsidy on LPG cylinders is credited directly to that account. The FAQs, however, do not elaborate how such linking helps an individual who does not get, or does not wish to get, such subsidies. In a tweet, UIDAI had said that verifying a bank account using Aadhaar adds an additional layer of security.

Nakul Saxena, a former banker who now works on policy advocacy at the software think tank iSpirt Foundation, said that linking of Aadhaar with these services will help eradicate fake accounts, fake insurance policies and unauthorised mobile connections. “It is possible that there are many accounts in the system that have been opened using such documents and copied signatures and even the banks may not be aware of it. Some people may not even be aware that an account exists in their name. These accounts need to be verified using Aadhaar now,” he said.

The government claims to have removed millions of fake beneficiaries for government benefits by Aadhaar linking. As reported by Mint in May 2017, over 23 million fake ration cards have been scrapped, potentially saving the government Rs14,000 crore in food subsidy every year. Another Mint report in August says, three states discovered that about 2,72,000 fake students were availing the mid-day meal (MDM) scheme.

However, those who are against linking Aadhaar disagree with these arguments. “Initially, Aadhaar was about delivery of services. But linking everybody’s phone number and bank account is not about that anymore. The real question is, what purpose this linking serves. If the intention is to update the databases, then there can be other means to update those,” said Rahul Narayan, a Supreme Court advocate who is among the lawyers representing petitioners who have challenged Aadhaar linking in court.

The concerns

The fundamental objection to this linking of services is that all information on an individual will be available at a single place, which could make surveillance easier and also increase the risks if this information is hacked. “As of now, your bank knows something about you, your insurance company knows something and your mobile phone company knows something about you. Each of these are different silos of information. When these converge, which is then accessible to a single person, that person knows almost everything about you,” said Narayan.

Moreover, a user’s Aadhaar number and fingerprint are permanent identifiers, and at least the Aadhaar number has been compromised for over 130 million citizens, as per a study by Centre for Internet & Society, said Nikhil Pahwa, co-founder of the SaveTheInternet.in (https://internetfreedom.in) campaign for net neutrality in India. “This leaves the users vulnerable to social hacks, some of which we have already been reading about in the news. To forcefully and mandatorily link Aadhaar to bank accounts means that their finances are at risk,” he said.

Saxena said the data leaks that have been highlighted have been typically about demographic details such as name, date of birth and address “which have been commonly available so far.” However, given the heightened sensitivities in this digital age, customers must ask their service providers to not publish such details, nor provide this information freely, he added.

Grievance redressal and data privacy

Another major concern is the absence of a clear redressal mechanisms for consumers in case of a data leak, misuse or hack. “When things go wrong, consumers need to have access to a proper complaints mechanism. In the case of Aadhaar, such access is to be provided through the establishment of ‘contact centres’ under the Regulation 32 of the UIDAI Enrolment and Update Regulations. To the best of our knowledge, not much beyond Regulation 32 has yet been specified by the UIDAI,” said Renuka Sane, associate professor at the National Institute of Public Finance and Policy, who has worked on data privacy and security issues.

Apart from this, Section 47 of the Aadhaar Act stipulates that only UIDAI or its authorised officers can file a criminal complaint for violations of the Act, she added.

“The UIDAI has been given complete discretion in determining if and when to file a criminal complaint for violations of the Act, and an individual aggrieved by actions of a third person is left to rely upon the bonafide actions of the UIDAI,” Sane added. The government is also working towards a data privacy legislation, that is needed to give citizens protection against misuse of their data, and them having some control over who gets their data, how it is used, and where it can be shared. “However, a data privacy legislation and mechanism will not ensure that data remains secure and protected, and that processes are followed. The Act disallowing people from sharing Aadhaar numbers did not prevent government departments from publishing details online,” said Pahwa. He also said that systems can get hacked, which could include the Aadhaar database, the parallel Aadhaar databases with state governments, or eKYC databases held with banks and telecom operators.

Saxena said the UIDAI has clarified that biometric information is not stored with user agencies, and stored biometrics can't be used for Aadhaar authentication or eKYC. “Hence, customers can be assured when using Aadhaar and biometrics with authorized entities,” he said. “The data privacy law will address data privacy and protection in all digital systems, not just Aadhaar. It will equally apply to social media and mobile apps. It should also go into the aspect of ‘right to be forgotten’,” said Saxena.

Pahwa, however, insists that the least that should be done is to give citizens the right to not link their Aadhaar and use other IDs for authentication, plus the ability to change their ID number if the system gets compromised.

What you should do

For now, the deadlines for linking bank accounts with Aadhaar is 31 December 2017, and for mobile phones it is 7 February 2018. In its latest hearing on the matter, the Supreme Court has directed service providers to mention these deadlines in their reminders. “Right now, regardless of what they say, nobody is going to shut down your bank account or disconnect your mobile connection, at least till the deadline. There are several petitions being heard in the Supreme Court. The matter is supposed to be taken up by the Supreme Court in the last week of November. The final word from the court is yet to come and it is quite possible that at least the deadlines gets extended,” said Narayan.

If you have already linked these services with Aadhaar, you are in no trouble. But if you are having second thoughts, the linking cannot be undone. If you are concerned about safety or other aspects, you can wait to get more clarity from the Supreme Court.

For more details visit https://cis-india.org/internet-governance/news/shaikh-zoaib-saleem-livemint-november-14-2017-aadhaar-seeding-benefits-and-concerns

Breach Notifications

Admin — 2017-11-14T15:31:38Z

For more details visit https://cis-india.org/internet-governance/files/breach-notifications.pdf

India UK Legal Regulatory Approaches

Admin — 2017-11-14T15:25:20Z

For more details visit https://cis-india.org/internet-governance/files/india-uk-legal-regulatory-approaches.pdf

Submission to TRAI (November 6, 2017)

Admin — 2017-11-08T01:08:37Z

For more details visit https://cis-india.org/telecom/files/submission-to-trai-november-6-2017

October 2017 Newsletter

praskrishna — 2018-01-10T00:53:03Z

October 2017 Newsletter

Dear readers,

Previous issues of the newsletters can be accessed here.

Highlights
CIS submitted its comments on mobile accessibility guidelines to the Ministry of Electronics & IT, Govt. of India. Between 1 to 16 September, an online discussion took place on the creation of social media guidelines and strategy for Telugu Wikimedia handles online. Manasa Rao captured the developments in a blog post. Padma Venkataraman in a blog entry chronologically mapped CIS’ efforts at enhancing financial transparency and accountability at ICANN, while providing an outline of what remains to be done. Shyam Ponappa's article on NPAs and structural issues was published in the Business Standard on October 5, 2017.

Highlights

CIS submitted its comments on mobile accessibility guidelines to the Ministry of Electronics & IT, Govt. of India.
Between 1 to 16 September, an online discussion took place on the creation of social media guidelines and strategy for Telugu Wikimedia handles online. Manasa Rao captured the developments in a blog post.
Padma Venkataraman in a blog entry chronologically mapped CIS’ efforts at enhancing financial transparency and accountability at ICANN, while providing an outline of what remains to be done.
Shyam Ponappa's article on NPAs and structural issues was published in the Business Standard on October 5, 2017.

CIS in the News:

Attempted data breach of UIDAI, RBI, ISRO and Flipkart is worrisome (DailyO, October 4, 2017).
Sex, drugs and the dark web (Hindu; October 7, 2017).
Ahead of data protection law roll out, experts caution that it shouldn't limit collection and use of data (First Post; October 12, 2017).
#NAMAprivacy: The economics and business models of IoT and other issues (Medianama; October 18, 2017).
#NAMAprivacy: Data standards for IoT and home automation systems (Medianama; October 18, 2017).
Majority of top politicians' Twitter followers fake: audit (Furquan Moharkan; Deccan Herald; October 24, 2017).
Awards for those working on employment opportunities for disabled (Eastern Mirror; October 24, 2017).
Nibbling away into your bank account, salami attackers cart away a fortune (New Indian Express; October 25, 2017).
Nirmita Narasimhan wins the 18th NCPEDP-Mindtree Helen Keller Award 2017! (National Centre for Promotion of Employment for Disabled People; October 31, 2017).

-----------------------------------
Access to Knowledge
-----------------------------------
Our Access to Knowledge programme currently consists of two projects. The Pervasive Technologies project, conducted under a grant from the International Development Research Centre (IDRC), aims to conduct research on the complex interplay between low-cost pervasive technologies and intellectual property, in order to encourage the proliferation and development of such technologies as a social good. The Wikipedia project, which is under a grant from the Wikimedia Foundation, is for the growth of Indic language communities and projects by designing community collaborations and partnerships that recruit and cultivate new editors and explore innovative approaches to building projects.

►Wikipedia

Blog Entries

Odia Wikisource Turns 3 (Manasa Rao; October 22, 2017).
Wikimedia Workshop at Ismailsaheb Mulla Law College, Satara (Subodh Kulkarni; October 24, 2017).
Marathi Wikipedia Edit-a-thon at Dalit Mahila Vikas Mandal, Satara (Subodh Kulkarni; October 24, 2017).
Marathi Wikipedia Workshop at MGM Trust's College of Journalism and Mass Communication, Aurangabad (Subodh Kulkarni; October 24, 2017).
Orientation Program at Kannada University, Hampi (A. Gopalakrishna; October 24, 2017).
Marathi Wikipedia Workshop at Solapur University (Subodh Kulkarni; October 24, 2017).
Discussion on Creation of Social Media Guidelines & Strategy for Telugu Wikimedia (Manasa Rao; October 24, 2017).

►Openness

Our work in the Openness programme focuses on open data, especially open government data, open access, open education resources, open knowledge in Indic languages, open media, and open technologies and standards - hardware and software. We approach openness as a cross-cutting principle for knowledge production and distribution, and not as a thing-in-itself.

-----------------------------------

Internet Governance
-----------------------------------

As part of its research on privacy and free speech, CIS is engaged with two different projects. The first one (under a grant from Privacy International and IDRC) is on surveillance and freedom of expression (SAFEGUARDS). The second one (under a grant from MacArthur Foundation) is on restrictions that the Indian government has placed on freedom of expression online.

►Freedom of Expression

ICANN’s Problems with Accountability and the .WEB Controversy (Padma Venkataraman; October 24, 2017).
Why Presumption of Renewal is Unsuitable for the Current Registry Market Structure (Padma Venkataraman; October 29, 2017).
CIS’ Efforts Towards Greater Financial Disclosure by ICANN (Padma Venkataraman; October 29, 2017).

►Cyber Security

Participation in Event

CyFy 2017 (Organized by Observer Research Foundation; New Delhi; October 2 - 4, 2017). Sunil Abraham was a speaker.

►Privacy

Blog Entry

GDPR and India: A Comparative Analysis (Aditi Chaturvedi; October 17, 2017).

Participation in Event

Securing The Digital Payments Ecosystem (Organized by NITI Aayog; October 9, 2017).

►Big Data

Blog Entry

Revisiting Per Se vs Rule of Reason in Light of the Intel Conditional Rebate Case (Shruthi Anand; October 4, 2017).

Event Organized

Emerging Issues in the Internet of Things (CIS, Bengaluru; October 23, 2017). Andrew Rens gave a talk.

-----------------------------------

Telecom
-----------------------------------
CIS is involved in promoting access and accessibility to telecommunications services and resources, and has provided inputs to ongoing policy discussions and consultation papers published by TRAI. It has prepared reports on unlicensed spectrum and accessibility of mobile phones for persons with disabilities and also works with the USOF to include funding projects for persons with disabilities in its mandate:

Article

NPAs & Structural Issues (Shyam Ponappa; Business Standard; October 4, 2017).

-----------------------------------
Researchers at Work
-----------------------------------
The Researchers at Work (RAW) programme is an interdisciplinary research initiative driven by an emerging need to understand the reconfigurations of social practices and structures through the Internet and digital media technologies, and vice versa. It aims to produce local and contextual accounts of interactions, negotiations, and resolutions between the Internet, and socio-material and geo-political processes:

Articles

Digital Native: There is no spoon, There is no privacy (Nishant Shah; October 9, 2017).
Digital Native: Finger on the buzzer (Nishant Shah; October 22, 2017).

-----------------------------------
About CIS
-----------------------------------

The Centre for Internet and Society (CIS) is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. The areas of focus include digital accessibility for persons with disabilities, access to knowledge, intellectual property rights, openness (including open data, free and open source software, open standards, open access, open educational resources, and open video), internet governance, telecommunication reform, digital privacy, and cyber-security. The academic research at CIS seeks to understand the reconfigurations of social and cultural processes and structures as mediated through the internet and digital media technologies.

► Follow us elsewhere

Twitter: http://twitter.com/cis_india
Twitter - Access to Knowledge: https://twitter.com/CISA2K
Twitter - Information Policy: https://twitter.com/CIS_InfoPolicy
Facebook - Access to Knowledge: https://www.facebook.com/cisa2k
E-Mail - Access to Knowledge: a2k@cis-india.org
E-Mail - Researchers at Work: raw@cis-india.org
List - Researchers at Work: https://lists.ghserv.net/mailman/listinfo/researchers

► Support Us

Please help us defend consumer and citizen rights on the Internet! Write a cheque in favour of 'The Centre for Internet and Society' and mail it to us at No. 194, 2nd 'C' Cross, Domlur, 2nd Stage, Bengaluru - 5600 71.

► Request for Collaboration

We invite researchers, practitioners, artists, and theoreticians, both organisationally and as individuals, to engage with us on topics related internet and society, and improve our collective understanding of this field. To discuss such possibilities, please write to Sunil Abraham, Executive Director, at sunil@cis-india.org (for policy research), or Sumandro Chattapadhyay, Research Director, at sumandro@cis-india.org (for academic research), with an indication of the form and the content of the collaboration you might be interested in. To discuss collaborations on Indic language Wikipedia projects, write to Tanveer Hasan, Programme Officer, at tanveer@cis-india.org.

CIS is grateful to its primary donor the Kusuma Trust founded by Anurag Dikshit and Soma Pujari, philanthropists of Indian origin for its core funding and support for most of its projects. CIS is also grateful to its other donors, Wikimedia Foundation, Ford Foundation, Privacy International, UK, Hans Foundation, MacArthur Foundation, and IDRC for funding its various projects.

For more details visit https://cis-india.org/about/newsletters/october-2017-newsletter

Ahead of data protection law roll out, experts caution that it shouldn't limit collection and use of data

Admin — 2018-01-02T15:20:48Z

With India planning to roll out a new data protection regime following the landmark Supreme Court judgment upholding right to privacy as fundamental right, experts have cautioned that the new law should not limit collection and use of data.

The article was published by First Post on October 12, 2017. Sunil Abraham was quoted.

"The new data protection law should have data-driven innovation at its core," said Kamlesh Bajaj, Founder-CEO, Data Security Council of India (DSCI).

"It should not limit data collection and use, but limit harm to citizens," Bajaj added at a seminar on "Data Protection and Privacy" organised by non-profit industry body Internet and Mobile Association of India (IAMAI).

In a major boost to individual freedom, the Supreme Court in August declared that right to privacy was a fundamental right and protected as an intrinsic part of life and personal liberty and freedoms guaranteed by the Constitution.

"The Supreme Court judgment calls for production of a new law," said Sunil Abraham, Executive Director of Bangaluru-based research organisation, Centre for Internet and Society (CIS).

The experts noted that the Supreme Court judgment remains meaningless for digital Indians without a proper data protection law in place as all other existing laws, such as the Information Technology Act, 2000, do not adequately address the question of right to privacy.

Recognising the importance of data protection and keeping personal data of citizens secure and protected, the Ministry of Electronics and Information Technology (MeitY) on 31 July, constituted a Committee of Experts under the chairmanship of its former judge Justice BN Srikrishna to study and identify key data protection issues and recommend methods for addressing them. The committee will also suggest a draft Data Protection Bill.

"While the regulator should be given tools to make companies behave better, it should not start with harsh punitive actions," Abraham noted, adding that big fines could challenge the very logic of regulation.

In a question to whether a robust data protection regime should come in conflict with issue such as national security, he said that lawmakers should find a way to maximise both imperatives.

"Surveillance is like salt in cooking. It is necessary, but in limited quantity," he added.

Participating in a chat with Google's Public Policy Director Chetan Krishnaswamy at the event, MP Rajeev Chandrasekhar, however, said that regulation should start with the process of data collection itself and consumers cannot be expected to demonstrate harm or inappropriate use of their data to enjoy the right to privacy.

"It should not be a free run for companies to mine consumer data," the independent Rajya Sabha member said.

He emphasised that the process of formulating a data protection law is as important as the law itself and all stakeholders should be able to openly put forward their views and apprehensions and it is only with such a consultative process that the opportunities for the technology space can be safeguarded.

For more details visit https://cis-india.org/internet-governance/news/first-post-october-12-2017-ahead-of-data-protection-law-roll-out-experts-caution-that-it-shouldnt-limit-collection-and-use-of-data

Sex, drugs and the dark web

Admin — 2018-01-02T16:13:14Z

Blend anonymity and bitcoins for a ‘guaranteed safe’ cocktail of terrifying potential.

The article was published in the Hindu on October 7, 2017.

It’s hardly a secret that marijuana’s quite easy to get nowadays. Cigarette shop owners, paanwaalas, and otherwise innocuous dealers of innocuous goods hide their stash just out of sight of the unaware. Rustom Juneja is just another marijuana-smoking adult in one of India’s biggest cities. He used to get his ‘stuff’ from local dealers. Till he “got bored of Indian produce,” as he says. So, in 2015, he decided to go to the dark web.

“I brought strains of marijuana from the U.S. and Canada, from a marketplace on the dark web,” Juneja says. The packages were shipped from their respective countries, they traversed borders, bypassed stringent security and checks, crossed continents, and landed at Juneja’s doorstep.

That is the dark web for you. Completely unpoliced, willing users can find anything, from the aforementioned marijuana, to “hard” drugs, to military grade-weaponry and even sex workers. All delivered to your doorstep just like books or designer watches from Amazon, Flipkart, or Snapdeal. And yes, some even offer cash-on-delivery. Returns might not be as simple, though.

Earlier this year, a group of students were arrested in Hyderabad on charges of purchasing LSD (also called ‘acid’) on the dark web. But they weren’t arrested because they had made the transaction on the dark web; they were arrested because the purchase and/ or use of LSD is illegal under Indian law (Narcotic Drugs and Psychotropic Substances Act, 1985).

In India, transactions on the dark web belong to a legal grey area. More importantly, the transactions here are mostly untraceable.

So, just what is the dark web?

Shadow world

The world wide web is a Brobdingnagian mass of data, parts of which are ‘indexed’ so that they may be found by users through search engines (Google, Bing, etc). The parts of the web that aren’t indexed, and therefore available for public access, are known as the ‘deep web’. This was the part initially known as the dark web, with the ‘dark’ being more an allusion to being kept away from the light of regular access than its now more nefarious association. While it’s near impossible to put a number to it, unofficial estimates mostly concur that the vast majority of the web is unindexed.

Then, in the early 2000s, programmers began developing techniques that would be able to offer anonymous access to these hidden bits of the web. In 2002, the U.S. Naval Laboratory released one of the earliest versions of The Onion Router (TOR), a software that would allow anonymous communication between American intelligence agents and operatives on foreign soil.

This didn’t go quite according to plan, though. Tor was soon appropriated by cyberpunks, who began using the protocol to give access to websites that would host, share, and trade illicit goods. Today, the dark web is a sub-section of the deep web, accessed using specialised software like Tor that ensures absolute anonymity.

The onion protocol

“If you want to track anything on the Internet, it can happen at three levels — the level of the person who sends a request, at the level of the person responding to this request, or it can happen in between these two ends,” says Udbhav Tiwari, Policy Officer at the Centre for Internet and Society.

“Because of this structure, it is easy to track actions and resources across the Internet, using the same terminology that makes it so easy to index and search. So, people began thinking this might become a problem.”

Most of us have heard of the Hyper Text Transfer Protocol Secure or HTTPS, a protocol that ensures that information is encrypted and secure the moment it leaves a computer till the time it reaches a destination computer. But this protocol only protects one of the three levels on which information might be tracked. The dark web is built to ensure that the remaining levels are also protected and kept anonymous.

“The reason it’s called the ‘onion’ protocol is because there are bits of information that are encrypted over and over again. So, when something leaves one computer, it is encrypted with a layer, then it hits another computer and is encrypted with another layer, and it hits another computer, where it is encrypted yet again. When this information returns, each layer is peeled off, so that you get the information you requested, with none of the encryption,” Tiwari says.

This kind of encryption makes it borderline impossible to figure out who is communicating with who and what they are talking about, unless the physical machines at either end are compromised, or a vulnerability on these machines is exploited by setting up a fake website on the Internet — a technique the FBI uses to track child pornography.

And what does it all mean? A level of guaranteed secrecy with terrifying potential. A 2015 study found that light drugs were the most traded commodity on the dark web, and that as much as 26% of its content could be classified as ‘child exploitation’.

A 2016 study found that almost 57% of live websites on the dark web hosted illicit material. The ease of access and the minimal chances of being caught has meant a steady rise in the use of the dark web and the murk it peddles.

It’s a market where both buyer and vendor are rated, like Uber. This establishes trust, and authenticates the veracity of a potential transaction. Thus, for instance, buyers are obviously more inclined to buy an assault rifle from a highly-rated seller. And you will be sold grenades only if your ratings assure the vendor you’ll fulfil your end of the transaction.

Once a transaction is finalised, the payment is held ‘in escrow’ — a third party arbitration system which ensures the buyer is paid only after they have met their end of the bargain. The third parties also arbitrate in the event of a dispute.

As easy as pie

Juneja bought marijuana three times, all from the same vendor, but only two shipments reached him. The third time, the parcel never landed, but the arbiters decided in favour of the vendor because he had a much better rating and Juneja lost his money.

With no proper method to find out whether the vendor has shipped a product or the buyer has received it, this adjudication is seen as the best stop-gap arrangement. For Juneja, as for many others, the loss was a deal breaker, and he didn’t go back to the dark web.

When the first two shipments did arrive though, they came with absolute swagger and nonchalance. “The product was sealed and flattened out, as if it were a magazine or postcard.” It does say something of international security that it can’t differentiate between a shipment of The New Yorker and marijuana.

Dark web transactions were initially carried out using legal state-issued currencies. However, the simplicity of tracking online transactions made with property monitored by the government led to the rise of cryptocurrencies — digital or virtual currency that uses cryptographic techniques for security and which would be beyond state control. Besides the need to go underground, there was a political angle.

“These people see money as a state incursion into private affairs,” says Jyotirmoy Bhattacharya, economics professor at Delhi’s Ambedkar University.

The first, and still most popular, cryptocurrency was released in 2009 — bitcoin. Created by an unknown person or group of people, going only by the pseudonym Satashi Nakamoto, bitcoin was intended as a ‘peer-to-peer electronic cash system’, which would be completely decentralised, with no central server or state authority. This meant that the value and proliferation of bitcoin would be determined by its creators and users.

The idea of a virtual currency has been around since before Nakamoto, but a large problem was in limiting creation and supply. Bitcoin was the first to solve this problem. “Bitcoin uses a technique known as the ‘proof-of-work’ (POW). So, to create a new set of this currency, you have to spend some amount of computational resources. This limits how much currency you can generate, thus ensuring that the currency has a value,” says Bhattacharya.

What is bitcoin?

“A bitcoin is simply a solution to a puzzle. If there are a set of puzzles that are a part of the bitcoin protocol, one bitcoin is simply one of the solved puzzles of that set, along with a digital signature of who solved the puzzle,” says Bhattacharya. A public ledger tracks the ownership of bitcoins, which ensures that the same one is not used again by the same person.

“Since there is no central authority, your transaction has to match the globally agreed ledger.” To ensure that ownership of bitcoin is legitimate, every transaction is published in the ledger, thus creating a ‘chain of transactions’ known as a blockchain.

Over the past few years, the value of bitcoin has skyrocketed, so much so that people have begun investing in it, as an asset. When bitcoin was first used as tender in early 2010, it was valued at around $0.003. For a brief while in August, one bitcoin was valued at $4,500, a record high.

In the everyday world of eggs and bread, though, bitcoin has limited use. It is still unrecognised by several nations, and deemed illegal in many others. It’s in the dark web that it finds its most votaries. While it would be flippant to suggest that bitcoin is used on the dark web solely for illicit uses, it is difficult to deny its origins for that purpose, and its continuing use there.

Bedavyasa Mohanty, an Associate Fellow at Observer Research Foundation Cyber Initiative, says that there are Indian users transacting on the dark web using bitcoin and claims that this number is only likely to increase as accessibility increases. “Bitcoin cannot be tracked,” says Mohanty. “With the ledger and the blockchain, you can trace the trail of a certain bitcoin, but it is anonymised. You can’t point out who owns that bitcoin.”

This, in effect, means an entirely anonymous transaction may be made on the dark web for any number of illegal goods or services using a currency that leaves a trail which goes nowhere and leaves no fingerprints. This, in a nutshell, is the danger when bitcoin combines with the dark web.

Several users I spoke to either claimed that fears about the dark web were mostly unfounded, or that the freedom it offered was an essential facet of the Internet. But it can’t be denied that the sheer possibility that somebody can deal in child porn or hard drugs or deadly weapons right under the nose of the law is a terrifying one.

From the perspective of Indian law enforcement, given the technical knowhow they have to track down owners and users of bitcoins, the chances of discovery are minimal, says Mohanty. The currency uses a system of public and private ‘keys’, ensuring that an intercepted bitcoin transmission is useless without those keys. To top it, India does not have any clear laws to regulate cryptocurrencies.

“For India to regulate cryptocurrencies, it would need to legally recognise their existence,” says Mohanty. “And if you do recognise them, what do you treat them as? As a security? Or as a currency that can be traded openly, and so on. That’s part of the reason why the Reserve Bank hasn’t formally recognised cryptocurrencies.”

Flagging illegal trades

Bitcoin exchanges in India insist that they follow strict guidelines and e-KYC (Know Your Customer) rules, ensuring that the identity of every customer on the exchange is verified. “If somebody tries to use a bitcoin from Zebpay or any other recognised exchange, they will definitely be tracked down,” says Saurabh Agrawal, co-founder of Zebpay, one of India’s largest bitcoin exchanges.

“We use strong software; if any of our users use bitcoins for illegal purposes, we close their accounts. We’ve done this in the past and will do so in future as well.” He claims their software maintains a list of web addresses deemed ‘red alert’ sites, and the moment a bitcoin is sent to such a site, the transaction is flagged.

Others are less positive. “While we can track whether a transaction is made through illegal routes, to some extent it’s true that we cannot track all transactions in real time as this takes a large amount of data,” says Sathvik Vishwanath, CEO, Unocoin.

“But if someone is trying to buy or sell from illegal marketplaces, we have a mechanism where we can — and do — stop it.” Given that customers are KYC-verified, “they don’t try to indulge in malicious activities,” he says.

Pan to Rustom Juneja. Juneja made three transactions in 2015, using bitcoins purchased entirely legally from an exchange. “You have to create an account on any of the markets online, and transfer your bitcoins to that account,” Juneja informs me. His account too was KYC-verified, and they had all his details — PAN number, Aadhar, and so on. He had no clue then that the exchanges had tracking methods. “Look, if these actually worked, there’s no way we wouldn’t have been caught,” he says.

Part of the problem, of course, is that Indian law does not recognise the dark web as a separate entity from the ‘surface’ web; there are no special laws for it. Yet, even if laws were put in place, there are few ways in which states can monitor or block the use of the dark web owing to a host of technical and legal reasons.

“A sense of urgency [regarding the dark web], especially relating to the use of bitcoin for illicit activities, hasn’t been instilled in the government yet,” says Mohanty. “What they are worried about is terrorism, and the use of anonymous technologies and chatrooms for radicalisation, terror planning, or buying and selling weapons.”

Juneja is one of a few thousand active Indian users on the dark web. Nothing stops them from buying a strain of marijuana from Canada. But nothing stops them from buying a Kalashnikov either.

Sunny side up

The dark web isn’t necessarily only a marketplace for all of the world’s nefarious practices. The very anonymity and shrouds that the dark web offers can be used for general practices by users looking merely for privacy.

Aritra Ghosh, a Ph.D student of Computational Astrophysics at Yale University says, “(The dark web is) possibly the only way to do something in “secret” away from any kind of surveillance. Onion routing still hasn’t been broken. So, it can play a substantial role in movements against companies, governments and so on.”

And this is a quality that many frequenters of the dark web swear by. Even the ability to use anonymous messenger service with a near-complete guarantee of not being ‘watched’ drives a lot of people here.

Akarsh Pandit, 24, says unrestricted access to many resources including books and documents is an area of huge potential. “Another significant pro is the avoidance of national firewalls that exist in some countries. Moreover, you gain access to unindexed search results,” he says.

For more details visit https://cis-india.org/internet-governance/news/the-hindu-saurya-sengupta-sex-drugs-and-the-dark-web

CyFy 2017

Admin — 2017-11-26T09:36:25Z

CyFy is a conference on internet governance and cyber security organised by the Observer Research Foundation (ORF) in New Delhi between 2 and 4 October 2017. Sunil Abraham was a speaker.

Sunil Abraham was a speaker on a panel titled "Security Through Identity?" on the 4 October 2017 and chaired an invite only session titled "Encryption: The End of Surveillance?" on the 3rd of October, 2017. Saikat Dutta and Udbhav Tiwari also participated in the encryption session. Saikat was a speaker in a session titled "Digital Vulnerabilities: Capacity Building for Tackling Cyber Crime" on 3 October 2017. Udbhav Tiwari chaired a session titled "Dangerous Disclosures: Cyber Security Incident Reporting" on 4 October 2017.

Conference agenda here

For more details visit https://cis-india.org/internet-governance/news/cy-fy-2017

Emerging Issues in the Internet of Things

Admin — 2017-10-03T01:53:25Z

Andrew Rens will give a talk about research that he is doing at the Internet Governance Lab on October 23, 2017 at the Centre for Internet & Society in Bengaluru.

It seems almost anything can be connected to the Internet: 3D printers, cars, traffic lights and even toasters. This proliferation of Internet enabled devices, the Internet of Things (IoT), raises a cloud of complex problems, of ownership and control, privacy and surveillance, ubiquity and network fragility. IoT doesn't just promise efficiency; cheap sensors and printers might put scientific research and customized manufacturing in the hands of millions more people. The governance of the IoT, exhibits the same super complexity as Internet governance generally; with multiple sites of governance and actors operating across legal borders. Legal regulation, standards and the architecture of technology determine how the IoT is configured and how it will be reconfigured in response to these problems. Where is the technology governance of the IoT currently taking shape? What forces will likely bear on the governance of the IoT? What role will permissionless innovation play, and what its limits? How will intellectual property laws complicate the IoT?"

The event, overall, is expected to be a thought provoking one for discussion on things related to IoT.

For more details visit https://cis-india.org/internet-governance/events/emerging-issues-in-the-internet-of-things

The Fundamental Right to Privacy: Part III SCOPE

amber — 2017-10-02T04:14:00Z

This is the third paper in a series on the recent judgment on the right to privacy by the nine judge constitution bench of the Supreme Court in a reference matter in Puttaswamy and others v. Union of India. The first two papers on the Sources and Structure of the constitutional right to privacy are available here, and here, respectively. While the previous papers dealt with the sources in the Constitution and the interpretive tools used by the bench to locate the right to privacy as a constitutional right, as well as the structure of the right with its various dimensions, this paper will look at the judgment for guidance on principles to determine what the scope of the right of privacy may be.

For more details visit https://cis-india.org/internet-governance/the200b-200bfundamental200b-200bright200b-200bto200b-200bprivacy-200b-200bpart200b-200biii-scope

September 2017 Newsletter

Admin — 2017-11-21T15:19:25Z

Dear readers,

Previous issues of the newsletters can be accessed here.

Highlights
CIS filed a request under the Right to Information Act in March 2016 as part of research for the paper: Patent Working Requirements and Complex Products: An Empirical Assessment of India's Form 27 Practice and Compliance (July 2017). Rohini Lakshané has captured the developments in a blog post. Last month’s judgment by the nine judge referral bench was an emphatic endorsement of the the constitutional right to privacy. Amber Sinha has dissected the various aspects of the right to privacy as put forth by the nine judge constitutional bench in the Puttaswamy matter. The papers on fundamental right to privacy can be accessed here. With offline as the theme of the third Internet Researchers' Conference (IRC18), CIS has invited teams of two or more members to submit sessions proposals by Sunday, October 22, 2017. The conference is expected to be held in Himachal Pradesh during February 22-24, 2018. The venue and dates will be confirmed soon. Anonymity-based internet apps like Sarahah may not be as vicious for those surrounded by the comfort of social status. If your experience of Sarahah has been positive, it might be good to reflect on your own cultural and social capital, wrote Nishant Shah in an article in the Indian Express, dated September 10, 2017.

CIS in the news:

Privacy is now a right in India. Here's what that means for the tech industry (Rishi Iyengar; CNN Tech; August 29, 2017).
Russian social network VKontakte temporarily blocked in India for Blue Whale threat (Kim Arora; The Times of India; September 12, 2017).

►Pervasive Technologies

RTI request to Indian Patents Office for Form 27 (Statement of Working of patents), March 2016 (Rohini Lakshané; September 9, 2017).
RTI request to Indian Patents Office for Form 27 (Statement of Working of patents), 2015 (Rohini Lakshané; September 9, 2017).

►Openness

Participation in Event

Praja - Enhancing Democracy Through Access to Open Data: What Are the Roles of Government and Civil Society? (Organized by Praja; September 8, 2017; New Delhi). Sumandro Chattapadhyay was a speaker.

-----------------------------------

Internet Governance
-----------------------------------

►Privacy

Blog Entries

Rethinking National Privacy Principles: Evaluating Principles for India's Proposed Data Protection Law (Amber Sinha; September 11, 2017).
The Fundamental Right to Privacy: An Analysis (Amber Sinha; September 27, 2017).

►Big Data

Upcoming Event

Emerging Issues in the Internet of Things (CIS, Bangalore; October 23, 2017). Andrew Rens will give a talk on the research that he is doing at the Internet Governance Lab.

-----------------------------------

Article

Revamp Telecom Sector & Revive The Economy (Shyam Ponappa; Business Standard; September 7, 2017).

Article

Digital native: What’s in a name? Privilege (Indian Express, September 10, 2017).

Announcement

Internet Researchers' Conference 2018 (IRC18): Offline - Call for Session (P.P. Sneha; September 20, 2017). Teams of two or more members to submit sessions proposals by Sunday, October 22, 2017.

Blog Entry

The Digital Humanities from Father Busa to Edward Snowden (P.P. Sneha; September 4, 2017).

-----------------------------------

About CIS
-----------------------------------
The Centre for Internet and Society (CIS) is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. The areas of focus include digital accessibility for persons with disabilities, access to knowledge, intellectual property rights, openness (including open data, free and open source software, open standards, open access, open educational resources, and open video), internet governance, telecommunication reform, digital privacy, and cyber-security. The academic research at CIS seeks to understand the reconfigurations of social and cultural processes and structures as mediated through the internet and digital media technologies.

► Follow us elsewhere

Twitter: http://twitter.com/cis_india
Twitter - Access to Knowledge: https://twitter.com/CISA2K
Twitter - Information Policy: https://twitter.com/CIS_InfoPolicy
Facebook - Access to Knowledge: https://www.facebook.com/cisa2k
E-Mail - Access to Knowledge: a2k@cis-india.org
E-Mail - Researchers at Work: raw@cis-india.org
List - Researchers at Work: https://lists.ghserv.net/mailman/listinfo/researchers

► Support Us

► Request for Collaboration

For more details visit https://cis-india.org/about/newsletters/september-2017-newsletter

Amber Sinha - The Fundamental Right to Privacy: Part II - Structure

sumandro — 2017-09-28T08:37:26Z

For more details visit https://cis-india.org/internet-governance/files/amber-sinha-the-fundamental-right-to-privacy-ii-structure-pdf

Internet Researchers' Conference 2018 (IRC18): Offline - Call for Sessions

sneha-pp — 2017-11-29T12:30:13Z

Does being offline necessarily mean being disconnected? Beyond anxieties such as FOMO, being offline is also seen as disengagement from a certain milieu of the digital (read: capital), an impediment to the way life is organised by and around technologies in general. However, being offline is not the exception, as examples of internet shutdown and acts on online censorship illustrate the persistence and often alarming regularity of the offline even for the ‘connected’ sections of the population. The *offline* is the theme of the third Internet Researchers' Conference (IRC18). We invite teams of two or more members to submit sessions proposals by Sunday, November 19 (final deadline). The session selection process is described below. The Conference will be hosted by the Sambhaavnaa Institute of Public Policy and Politics (Kandbari, Palampur, Himachal Pradesh) on February 22-24, 2018.

IRC18: Offline

Call for Sessions

Proposed Sessions (Conference Website)

Sambhaavnaa Institute of Public Policy and Politics (External Link)

IRC18: Offline

State and commercial providers of internet and telecommunication services work in tandem to produce both the “online” and the “offline” - through content censorship, internet regulation, generalised service provision failures, and so on. Further, efforts to prioritise the use of digital technologies for financial transactions, especially since demonetisation, has led to a not-so-subtle equalisation of the ‘online economy’ with the ‘formal economy’; thus recognising the offline as the zones of informality, corruption, and piracy. This contributes to the offline becoming invisible, and in many cases, illegal, rather than being recognised as a condition that necessarily informs what it means to be digital.

Who is offline, and is it a choice? The global project of bringing people online has spurred several commendable initiatives in expanding access to digital devices, networks, and content, and often contentious ones such as Free Basics / internet.org, which illustrate the intersectionalities of scale, privilege, and rights that we need to be mindful of when we imagine the offline. Further, the experience of the internet, for a large section of people is often mediated through prior and ongoing experiences of traditional media, and through cultural metaphors and cognitive frames that transcend more practical registers such as consumption and facilitation. How do we approach, study, and represent this disembodied internet – devoid of its hypertext, platforms, devices, it's nuts and bolts, but still tangible through engagement in myriad, personal and often indiscernible ways.

For the third edition of the Internet Researchers’ Conference (IRC18), we invite participants to critically discuss the offline. We invite sessions that present or propose academic, applied, creative, or technical works that explore social, economic, cultural, political, infrastructural, or aesthetic dimensions of the offline.

For example, the sessions may explore one or more of the following themes:

Geographies of internet access: Infrastructural, socio-political, and discursive forces and contradictions
Terms, objects, metaphors, and events of the internet and their offline remediation and circulation
Minimal computing, maker cultures, and digital collaboration and creativity in the offline
Offline economic cultures and transition towards less-cash economy
Offline as democratic choice: the right to offline lives in the context of global debates on privacy, surveillance, and data justice
Methodologies of studying the *offline* at the intersections of offline and online lives

Please note that the above are not sub-themes or tracks under which a session should be proposed, but are illustrations of possible session themes and concerns.

Call for Sessions

We invite teams of two or more members to propose sessions for IRC18. All sessions will be one and half hours long, and will be fully designed and facilitated by the team concerned, including moderation (if any). Please remember this when planning the session. Everything happening during the session, except for logistical support, will be led and managed by the session team.

The sessions are expected to drive conversations on the topic concerned. They may include presentation of research papers but this is not mandatory.

We look forward to sessions that involve collaborative work (either in groups or otherwise), including discussions, interactions, documentation, learning, and making, are most welcome.

We also look forward to sessions conducted in Indic languages. The proposing team, in such a case, should consider how participants who do not understand the language concerned may engage with the session. IRC organisers and other participants shall help facilitate these sessions, say by offering translation support.

The only eligibility criteria for proposing sessions are that they must be proposed by a team of at least two members, and that they must engage with the *offline*.

The deadline for submission of sessions proposals for IRC18 is Sunday, November 19 (final deadline).

To propose a session, please send the following documents (as attached text files) to raw@cis-india.org:

Title of the Session: The session should be named in the form of a hashtag (check the IRC17 selected sessions for example).
Context of the Session: This should be a 300 words note discussing the context, the motivations, and the expectations behind the proposed session.
Session Plan: This should describe the objectives of the session, what will be done and discussed during the session, and who among the people organising the session will be responsible for what. This note need not be more than 300 words long. If your session involves inviting others to present their work (say papers), then please provide a description and timeline of the process through which these people will be identified.
Session Team Details: Please share brief biographic notes of each member of the session team, and contact details.

There is no registration fee for the Conference, but participants are expected to pay for their own travel and accommodation (to be organised by CIS) expenses. Limited funding will be available to support travel and accommodation expenses of few participants who are unemployed or under-employed.

Session selection process:

November 19: Deadline of submission of session proposals.All submitted sessions will be posted on the CIS website, along with the names and details of the session team members.
November 20 - December 17: Open review period. All session teams, as well as other interested contributors, are invited to review and comment upon each other's submitted proposals and revise their own. Read the proposed sessions here: Conference Website.
December 18-31: The selection process takes place. All session teams will select 10 sessions to be included in the IRC18 programme. The votes will be anonymous, that is no session team will know which other sessions have voted for their session.
January 08: Announcement of selected sessions.
February 22-24: IRC18 at Sambhaavnaa Institute!

For more details visit https://cis-india.org/raw/irc18-offline-call

Annual Report 2016-2017

Admin — 2017-09-20T01:43:30Z

For more details visit https://cis-india.org/internet-governance/files/annual-report-2016-2017

Annual Report 2015-2016

Admin — 2017-09-20T01:35:54Z

For more details visit https://cis-india.org/internet-governance/files/annual-report-2015-2016

Centre for Internet and Society

Aadhaar seeding: benefits and concerns

The benefits

The concerns

Grievance redressal and data privacy

What you should do

Breach Notifications

India UK Legal Regulatory Approaches

Submission to TRAI (November 6, 2017)

October 2017 Newsletter

Ahead of data protection law roll out, experts caution that it shouldn't limit collection and use of data

Sex, drugs and the dark web

Shadow world

The onion protocol

As easy as pie

What is bitcoin?

Flagging illegal trades

Sunny side up

CyFy 2017

Emerging Issues in the Internet of Things

The​ ​Fundamental​ ​Right​ ​to​ ​Privacy:​ ​Part​ ​III SCOPE

September 2017 Newsletter

Amber Sinha - The​ ​Fundamental​ ​Right​ ​to​ ​Privacy:​ ​Part​ ​II - Structure

Internet Researchers' Conference 2018 (IRC18): Offline - Call for Sessions

IRC18: Offline

Call for Sessions

Proposed Sessions (Conference Website)

Sambhaavnaa Institute of Public Policy and Politics (External Link)

IRC18: Offline

Call for Sessions

Annual Report 2016-2017

Annual Report 2015-2016

The Fundamental Right to Privacy: Part III SCOPE

Amber Sinha - The Fundamental Right to Privacy: Part II - Structure