Centre for Internet and Society

Habeas Data in India

praskrishna — 2016-12-10T03:58:58Z

For more details visit https://cis-india.org/internet-governance/files/habeas-data-india.pdf

Habeas Data in India

Vipul Kharbanda and edited by Elonnai Hickok — 2016-12-10T04:01:40Z

Habeas Data is a latin word which can be loosely translated to mean “have the data”. The right has been primarily conceptualized, designed, ratified, and implemented by various nation-states in the background of a shared common history of decades of torture, terror, and other repressive practices under military juntas and other fascist regimes.

Download the Paper (PDF)

Introduction

The writ of habeas data was a distinct response to these recent histories which provided individuals with basic rights to access personal information collected by the state (and sometimes byprivate agencies of a public nature) and to challenge and correct such data, requiring the state to safeguard the privacy and accuracy of people's personal data.[1]

The origins of Habeas Data are traced back, unsurprisingly, to the European legal regime since Europe is considered as the fountainhead of modern data protection laws. The inspiration for Habeas Data is often considered to be the Council of Europe's 108th Convention on Data Protection of 1981.[2] The purpose of the Convention was to secure the privacy of individuals regarding the automated processing of personal data. For this purpose, individuals were granted several rights including a right to access their personal data held in an automated database.[3]

Another source or inspiration behind Habeas Data is considered to be the German legal system where a constitutional right to information self-determination was created by the German Constitutional Tribunal by interpretation of the existing rights of human dignity and personality. This is a right to know what type of data is stored on manual and automatic databases about an individual, and it implies that there must be transparency on the gathering and processing of such data.[4]

Habeas Data is essentially a right or mechanism for an individual complaint presented to a constitutional court, to protect the image, privacy, honour, information self-determination and freedom of information of a person. [5]

A Habeas Data complaint can be filed by any citizen against any register to find out what information is held about his or her person. That person can request the rectification, update or even the destruction of the personal data held, it does not matter most of the times if the register is private or public.[6]

Habeas Data in different jurisdictions

Habeas Data does not have any one specific definition and has different characteristics in different jurisdictions. Therefore, in order to better understand the right, it will be useful to describe the scope of Habeas Data as it has been incorporated in certain jurisdictions in order to better understand what the right entails:[7]

Brazil

The Constitution of Brazil grants its citizens the right to get a habeas data “a. to assure knowledge of personal information about the petitioner contained in records or data banks of government agencies or entities of a public character; b. to correct data whenever the petitioner prefers not to do so through confidential judicial or administrative proceedings;[8]

The place or tribunal where the Habeas Data action is to be filed changes depending on who is it presented against, which creates a complicated system of venues. Both the Brazilian constitution and the 1997 law stipulate that the court will be:

The Superior Federal Tribunal for actions against the President, both chambers of Congress and itself;
The Superior Justice Tribunal for actions against Ministers or itself;
The regional federal judges for actions against federal authorities;
State tribunals according to each state law;
State judges for all other cases.[9]

Paraguay
The Constitution of Paraguay grants a similar right of habeas data in its constitution which states:

"All persons may access the information and the data that about themselves, or about their assets, [that] is [obren] in official or private registries of a public character, as well as to know the use made of the same and of their end. [All persons] may request before the competent magistrate the updating, the rectification or the destruction of these, if they were wrong or illegitimately affected their rights."[10]

Compared to the right granted in Brazil, the text of the Paraguay Constitution specifically recognises that the citizen also has the right to know the use his/her data is being put to.

Argentina

Article 43 of the Constitution of Argentina grants the right of habeas data, though it has been included under the action of “amparo”,[11] the relevant portion of Article 43 states as follows:

"Any person may file an amparo action to find out and to learn the purpose of data about him which is on record in public registries or data banks, or in any private [registers or data banks] whose purpose is to provide information, and in case of falsity or discrimination, to demand the suppression, rectification, confidentiality, or updating of the same. The secrecy of journalistic information sources shall not be affected."[12]

The version of Habeas Data recognised in Argentina includes most of the protections seen in Brazil and Paraguay, such as the right to access the data, rectify it, update it or destroy it, etc. Nevertheless, the Argentinean constitution also includes certain other features such as the fact that it incorporates the Peruvian idea of confidentiality of data, being interpreted as the prohibition to broadcast or transmit incorrect or false information. Another feature of the Argentinean law is that it specifically excludes the press from the action, which may be considered as reasonable or unreasonable depending upon the context and country in which it is applied.[13]

Venezuela
Article 28 of the Constitution of Venezuela established the writ of habeas data, which expressly permits access to information stored in official and private registries. It states as follows:

"All individuals have a right to access information and data about themselves and about their property stored in official as well as private registries. Secondly, they are entitled to know the purpose of and the policy behind these registries. Thirdly, they have a right to request, before a competent tribunal, the updating, rectification, or destruction of any database that is inaccurate or that undermines their entitlements. The law shall establish exceptions to these principles. By the same token, any person shall have access to information that is of interest to communities and groups. The secrecy of the sources of newspapers-and of other entities or individuals as defined by law-shall be preserved."[14]

The Venezuelan writ of habeas data expressly provides that individuals "are entitled to know the purpose of and the policy behind these registries." Also, it expresses a right to "updating, rectification, or destruction of any database that is inaccurate or that undermines their entitlements." Article 28 also declares that the “secrecy of the sources of newspapers and of other entities or individuals as defined by law-shall be preserved."[15]

Philippines

It is not as if the remedy of Habeas Data is available only in Latin American jurisdictions, but even in Asia the writ of Habeas Data has been specifically granted by the Supreme Court of the Philippines vide its resolution dated January 22, 2008 which provides that “The writ of habeas data is a remedy available to any person whose right to privacy in life, liberty or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in the gathering, collecting or storing of data or information regarding the person, family, home and correspondence of the aggrieved party.” According to the Rule on Writ of Habeas Data, the petition is to be filed with the Regional Trial Court where the petitioner or respondent resides, or which has jurisdiction over the place where the data or information is gathered, collected or stored, at the option of the petitioner. The petition may also be filed with the Supreme Court or the Court of Appeals or the Sandiganbayan when the action concerns public data files of government offices.[16]

Two major distinctions are immediately visible between the Philippine right and that in the latin jurisdictions discussed above. One is the fact that in countries such as Bazil, Argentina and Paraguay, there does not appear to be a prerequisite to filing such an action asking for the information, whereas in Philippines it seems that such a petition can only be filed only if an individual’s “right to privacy in life, liberty or security is violated or threatened by an unlawful act or omission”. This means that the Philippine concept of habeas data is much more limited in its scope and is available to the citizens only under certain specific conditions. On the other hand the scope of the Philippine right of Habeas Data is much wider in its applicability in the sense that this right is available even against private individual and entities who are “engaged in the gathering, collecting or storing of data or information regarding the person, family, home and correspondence”. In the Latin American jurisdictions discussed above, this writ appears to be available only against either public institutions or private institutions having some public character.

Main features of Habeas Data

Thus from the discussion above, the main features of the writ of habeas data, as it is applied in various jurisdictions can be culled out as follows: [17]

It is a right to the individual or citizen to ask for his/her information contained with any data registry;
It is available only against public (government) entities or employees; or private entities having a public character;[18]
Usually it also gives the individuals the right to correct any wrong information contained in the data registry;
It is a remedy that is usually available by approaching any single judicial forum.

Since the writ of Habeas Data has been established and evolved primarily in Latin American countries, there is not too much literature on it available freely in the English language and that is a serious hurdle in researching this area. For example, this author did not find many article mentioning the scope of the writ of habeas data, for example whether it is an absolute right and on what grounds can it be denied. The Constitution of Venezuela, for example, specifies that the law shall establish exceptions to these principles and infact mentions the secrecy of sources for newspapers as an exception to this rule.[19]

Similarly in Argentina, there exists a public interest exception to the issuance of the writ of Habeas Data.[20]

That said, although little literature on the specific exceptions to habeas data is freely available in English, references can still be found to exceptions such as state security (Brazil), secrecy of newspaper sources (Argentina and Venezuela), or other entities defined by law (Venezuela).[21]

This suggests that the, as would be expected, the right to ask for the writ of habeas data is not an absolute right but would also be subject to certain exceptions and balanced against other needs such as state security and police investigations.

Habeas Data in the context of Privacy

Data protection legislation and mechanisms protect people against misuse of personal information by data controllers. Habeas Data, being a figure for use only by certain countries, gives the individuals the right to access, correct, and object to the processing of their information.

In general, privacy is the genus and data protection is the species, data protection is a right to personal privacy that people have against the possible use of their personal data by data controllers in an unauthorized manner or against the requirements of force. Habeas Data is an action that is brought before the courts to allow the protection of the individual’s image, privacy, honour, self-determination of information and freedom of information of a person. In that sense, the right of Habeas Data can be found within the broader ambit of data protection. It does not require data processors to ensure the protection of personal data processed but is a legal action requiring the person aggrieved, after filing a complaint with the courts of justice, the access and/or rectification to any personal data which may jeopardize their right to privacy.[22]

Habeas Data in the Indian Context

Although a number of judgments of the Apex Court in India have recognised the existence of a right to privacy by interpreting the fundamental rights to life and free movement in the Constitution of India,[23]

the writ of habeas data has no legal recognition under Indian law. However, as is evident from the discussion above, a writ of habeas data is very useful in protecting the right to privacy of individuals and it would be a very useful tool to have in the hands of the citizens. The fact that India has a fairly robust right to information legislation means that atleast some facets of the right of habeas data are available under Indian law. We shall now examine the Indian Right to Information Act, 2005 (RTI Act) to see what facets of habeas data are already available under this Act and what aspects are left wanting. As mentioned above, the writ of habeas data has the following main features:

It is a right to the individual or citizen to ask for his/her information contained with any data registry;
It is available only against public (government) entities or employees; or private entities having a public character;[24]
Usually it also gives the individuals the right to correct any wrong information contained in the data registry;
It is a remedy that is usually available by approaching any single judicial forum.

We shall now take each of these features and analyse whether the RTI Act provides any similar rights and how they differ from each other.

Right to seek his/her information contained with a data registry

Habeas data enables the individual to seek his or her information contained in any data registry. The RTI Act allows citizens to seek “information” which is under the control of or held by any public authority. The term information has been defined under the RTI Act to mean “any material in any form, including records, documents, memos, e-mails, opinions, advices, press releases, circulars, orders, logbooks, contracts, reports, papers, samples, models, data material held in any electronic form and information relating to any private body which can be accessed by a public authority under any other law for the time being in force”.[25]

Further, the term “record” has been defined to include “(a) any document, manuscript and file; (b) any microfilm, microfiche and facsimile copy of a document; (c) any reproduction of image or images embodied in such microfilm (whether enlarged or not); and (d) any other material produced by a computer or any other device”. It is quite apparent that the meaning given to the term information is quite wide and can include various types of information within its fold. The term “information” as defined in the RTI Act has been further elaborated by the Supreme Court in the case of Central Board of Secondary Education v. Aditya Bandopadhyay,[26]

where the Court has held that a person’s evaluated answer sheet for the board exams held by the CBSE would come under the ambit of “information” and should be accessible to the person under the RTI Act.[27]

An illustrative list of items that have been considered to be “information” under the RTI Act would be helpful in further understanding the concept:

Asset declarations by Judges;[28]
Copy of inspection report prepared by the Reserve Bank of India about a Co-operative Bank;[29]
Information on the status of an enquiry;[30]
Information regarding cancellation of an appointment letter;[31]
Information regarding transfer of services;[32]
Information regarding donations given by the President of India out of public funds.[33]

The above list would indicate that any personal information relation to an individual that is available in a government registry would in all likelihood be considered as “information” under the RTI Act.

However, just because the information asked for is considered to come within the ambit of section 2(h) does not mean that the person will be granted access to such information if it falls under any of the exceptions listed in section 8 of the RTI Act. Section 8 provides that if the information asked falls into any of the categories specified below then such information shall not be released in an application under the RTI Act, the categories are:

"(a) information, disclosure of which would prejudicially affect the sovereignty and integrity of India, the security, strategic, scientific or economic interests of the State, relation with foreign State or lead to incitement of an offence;
(b) information which has been expressly forbidden to be published by any court of law or tribunal or the disclosure of which may constitute contempt of court;
(c) information, the disclosure of which would cause a breach of privilege of Parliament or the State Legislature;
(d) information including commercial confidence, trade secrets or intellectual property, the disclosure of which would harm the competitive position of a third party, unless the competent authority is satisfied that larger public interest warrants the disclosure of such information;
(e) information available to a person in his fiduciary relationship, unless the competent authority is satisfied that the larger public interest warrants the disclosure of such information;
(f) information received in confidence from foreign Government;
(g) information, the disclosure of which would endanger the life or physical safety of any person or identify the source of information or assistance given in confidence for law enforcement or security purposes;
(h) information which would impede the process of investigation or apprehension or prosecution of offenders;
(i) cabinet papers including records of deliberations of the Council of Ministers, Secretaries and other officers:
Provided that the decisions of Council of Ministers, the reasons thereof, and the material on the basis of which the decisions were taken shall be made public after the decision has been taken, and the matter is complete, or over:
Provided further that those matters which come under the exemptions specified in this section shall not be disclosed;
(j) information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information:
Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person."

The above mentioned exceptions seem fairly reasonable and infact are important since public records may contain information of a private nature which the data subject would not want revealed, and that is exactly why personal information is a specific exception mentioned under the RTI Act. When comparing this list to the recognised exceptions under habeas data, it must be remembered that a number of the exceptions listed above would not be relevant in a habeas data petition such as commercial secrets, personal information, etc. The exceptions which could be relevant for both the RTI Act as well as a habeas data writ would be (a) national security or sovereignty, (b) prohibition on publication by a court, (c) endangering the physical safety of a person, (d) hindrance in investigation of a crime. It is difficult to imagine a court (especially in India) granting a habeas data writ in violation of these four exceptions.

Certain other exceptions that may be relevant in a habeas data context but are not mentioned in the common list above are (a) information received in a fiduciary relationship; (b) breach of legislative privilege, (c) cabinet papers; and (d) information received in confidence from a foreign government. These four exceptions are not as immediately appealing as the others listed above because there are obviously competing interests involved here and different jurisdictions may take different points of view on these competing interests.[34]

Available only against public (government) entities or entities having public character.

A habeas corpus writ is maintainable in a court to ask for information relating to the petitioner held by either a public entity or a private entity having a public character. In India, the right to information as defined in the RTI Act means the right to information accessible under the Act held by or under the control of any public authority. The term "public authority" has been defined under the Act to mean “any authority or body or institution of self-government established or constituted—

(a) by or under the Constitution;
(b) by any other law made by Parliament;
(c) by any other law made by State Legislature;
(d) by notification issued or order made by the appropriate Government, and includes any— (i) body owned, controlled or substantially financed; (ii) non-Government organisation substantially financed, directly or indirectly by funds provided by the appropriate Government;"[35]

Therefore most government departments as well as statutory as well as government controlled corporations would come under the purview of the term "public authority". For the purposes of the RTI Act, either control or substantial financing by the government would be enough to bring an entity under the definition of public authority.[36]

The above interpretation is further bolstered by the fact that the preamble of the RTI Act contains the term “governments and their instrumentalities".[37]

Right to correct wrong information
While certain sectoral legislations such as the Representation of the People Act and the Collection of Statistics Act, etc. may provide for correction of inaccurate information, the RTI Act does not have any such provisions. This stands to reason because the RTI Act is not geared towards providing people with information about themselves but is instead a transparency law which is geared at dissemination of information, which may or may not relate to an individual.

Available upon approaching a single judicial forum
While the right of habeas data is available only upon approaching a judicial forum, the right to information under the RTI Act is realised entirely through the bureaucratic machinery. This also means that the individuals have to approach different entities in order to get the information that they need instead of approaching just one centralised entity.

Conclusion

There is no doubt that habeas data, by itself cannot end massive electronic surveillance of the kind that is being carried out by various governments in this day and age and the excessive collection of data by private sector companies, but providing the citizenry with the right to ask for such a writ would provide a critical check on such policies and practices of vast surveillance.[38]

An informed citizenry, armed with a right such as habeas data, would be better able to learn about the information being collected and kept on them under the garb of law and governance, to access such information, and to demand its correction or deletion when its retention by the government is not justified.

As we have discussed in this paper, under Indian law the RTI Act gives the citizens certain aspects of this right but with a few notable exceptions. Therefore, if a writ such as habeas data is to be effectuated in India, it might perhaps be a better idea to approach it by amending/tweaking the existing structure of the RTI Act to grant individuals the right to correct mistakes in the data along with creating a separate department/mechanism so that the applications demanding access to one’s own data do not have to be submitted in different departments but can be submitted at one central place. This approach may be more pragmatic rather than asking for a change in the Constitution to grant to the citizens the right to ask for a writ in the nature of habeas data.

There may be calls to also include private data processors within the ambit of the right to habeas data, but it could be challenging to enforce this right. This is because it is still feasible to assume that the government can put in place machinery to ensure that it can find out whether information about a particular individual is available with any of the government’s myriad departments and corporations, however it would be almost impossible for the government to track every single private database and then scan those databases to find out how many of them contain information about any specific individual. This also throws up the question whether a right such as habeas data, which originated in a specific context of government surveillance, is appropriate to protect the privacy of individuals in the private sector. Since under Indian law section 43A and the Rules thereunder, which regulate data protection, already provide for consent and notice as major bulwarks against unauthorised data collection, and limit the purpose for which such data can be utilised, privacy concerns in this context can perhaps be better addressed by strengthening these provisions rather than trying to extend the concept of habeas data to the private sector.

[1]. González, Marc-Tizoc, ‘Habeas Data: Comparative Constitutional Interventions from Latin America Against Neoliberal States of Insecurity and Surveillance’, (2015). Chicago-Kent Law Review, Vol. 90, No. 2, 2015; St. Thomas University School of Law (Florida) Research Paper No. 2015-06. Available at SSRN:http://ssrn.com/abstract=2694803

[2]. Article 8 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 1981, available at https://www.coe.int/en/web/conventions/full-list/-/conventions/rms/0900001680078b37

[3]. Guadamuz A, 'Habeas Data: The Latin-American Response to Data Protection',2000 (2) The Journal of Information, Law and Technology (JILT).

[4]. Id.

[5]. Speech by Chief Justice Reynato Puno, Supreme Court of Philippines delivered at the UNESCO Policy Forum and Organizational Meeting of the Information for all Program (IFAP), Philippine National Committee, on November 19, 2007, available at http://jlp-law.com/blog/writ-of-habeas-data-by-chief-justice-reynato-puno/

[6]. Guadamuz A, 'Habeas Data: The Latin-American Response to Data Protection',2000 (2) The Journal of Information, Law and Technology (JILT).

[7]. The author does not purport to be an expert on the laws of these jurisdictions and the analysis in this paper has been based on a reading of the actual text or interpretations given in the papers that have been cited as the sources. The views in this paper should be viewed keeping this context in mind.

[8]. Article 5, LXXII of the Constitution of Brazil, available at https://www.constituteproject.org/constitution/Brazil_2014.pdf

[9]. Guadamuz A, 'Habeas Data vs the European Data Protection Directive', Refereed article, 2001 (3) The Journal of Information, Law and Technology (JILT).

[10]. Article 135 of the Constitution of Paraguay, available at https://www.constituteproject.org/constitution/Paraguay_2011.pdf?lang=en

[11]. The petition for a writ of amparo is a remedy available to any person whose right to life, liberty and security is violated or threatened with violation by an unlawful act or omission of a public official or employee, or of a private individual or entity.

[12]. Article 43 of the Constitution of Argentina, available at https://www.constituteproject.org/constitution/Argentina_1994.pdf?lang=en

[13]. https://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2001_3/guadamuz/

[14]. Article 28 of the Venezuelan Constitution, available at http://www.venezuelaemb.or.kr/english/ConstitutionoftheBolivarianingles.pdf

[15]. González, Marc-Tizoc, ‘Habeas Data: Comparative Constitutional Interventions from Latin America Against Neoliberal States of Insecurity and Surveillance’, (2015). Chicago-Kent Law Review, Vol. 90, No. 2, 2015; St. Thomas University School of Law (Florida) Research Paper No. 2015-06. Available at SSRN:http://ssrn.com/abstract=2694803

[16]. Rule on the Writ of Habeas Data Resolution, available at http://hrlibrary.umn.edu/research/Philippines/Rule%20on%20Habeas%20Data.pdf

[17]. The characteristics of habeas data culled out in this paper are by no means exhaustive and based only on the analysis of the jurisdictions discussed in this paper. This author does not claim to have done an exhaustive analysis of every jurisdiction where Habeas Data is available and the views in this paper should be viewed in that context.

[18]. Except in the case of the Philippines and Venezeula. This paper has not done an analysis of the writ of habeas data in every jurisdiction where it is available and there may be jurisdictions other than the Philippines which also give this right against private entities.

[19]. González, Marc-Tizoc, ‘Habeas Data: Comparative Constitutional Interventions from Latin America Against Neoliberal States of Insecurity and Surveillance’, (2015). Chicago-Kent Law Review, Vol. 90, No. 2, 2015; St. Thomas University School of Law (Florida) Research Paper No. 2015-06. Available at SSRN:http://ssrn.com/abstract=2694803

[20]. The case of Ganora v. Estado Nacional, Supreme Court of Argentina, September 16, 1999, cf.http://www.worldlii.org/int/journals/EPICPrivHR/2006/PHR2006-Argentin.html

[21]. González, Marc-Tizoc, ‘Habeas Data: Comparative Constitutional Interventions from Latin America Against Neoliberal States of Insecurity and Surveillance’, (2015). Chicago-Kent Law Review, Vol. 90, No. 2, 2015; St. Thomas University School of Law (Florida) Research Paper No. 2015-06. Available at SSRN:http://ssrn.com/abstract=2694803

[22]. http://www.oas.org/dil/data_protection_privacy_habeas_data.htm

[23]. Even the scope of the right to privacy is currently under review in the Supreme Court of India. See “Right to Privacy in Peril”, http://cis-india.org/internet-governance/blog/right-to-privacy-in-peril

[24]. Except in the case of the Philippines. This paper has not done an analysis of the writ of habeas data in every jurisdiction where it is available and there may be jurisdictions other than the Philippines which also give this right against private entities.

[25]. Section 2(f) of the Right to Information Act, 2005.

[26]. 2011 (106) AIC 187 (SC), also available at http://judis.nic.in/supremecourt/imgst.aspx?filename=38344

[27]. The exact words of the Court were: “The definition of `information' in section 2(f) of the RTI Act refers to any material in any form which includes records, documents, opinions, papers among several other enumerated items. The term `record' is defined in section 2(i) of the said Act as including any document, manuscript or file among others. When a candidate participates in an examination and writes his answers in an answer-book and submits it to the examining body for evaluation and declaration of the result, the answer-book is a document or record. When the answer-book is evaluated by an examiner appointed by the examining body, the evaluated answer-book becomes a record containing the `opinion' of the examiner. Therefore the evaluated answer-book is also an `information' under the RTI Act.”

[28]. Secretary General, Supreme Court of India v. Subhash Chandra Agarwal, AIR 2010 Del 159, available at https://indiankanoon.org/doc/1342199/

[29]. Ravi Ronchodlal Patel v. Reserve Bank of India, Central Information Commission, dated 6-9-2006.

[30]. Anurag Mittal v. National Institute of Health and Family Welfare, Central Information Commission, dated 29-6-2006.

[31]. Sandeep Bansal v. Army Headquarters, Ministry of Defence, Central Information Commission, dated 10-11-2008.

[32]. M.M. Kalra v. DDA, Central Information Commission, dated 20-11-2008.

[33]. Nitesh Kumar Tripathi v. CPIO, Central Information Commission, dated 4-5-2012.

[34]. A similar logic may apply to the exceptions of (i) cabinet papers, and (ii) parliamentary privilege.

[35]. Section 2 (h) of the Right to Information Act, 2005.

[36]. M.P. Verghese v. Mahatma Gandhi University, 2007 (58) AIC 663 (Ker), available at https://indiankanoon.org/doc/1189278/

[37]. Principal, M.D. Sanatan Dharam Girls College, Ambala City v. State Information Commissioner, AIR 2008 P&H 101, available at https://indiankanoon.org/doc/1672120/

[38]. González, Marc-Tizoc, ‘Habeas Data: Comparative Constitutional Interventions from Latin America Against Neoliberal States of Insecurity and Surveillance’, (2015). Chicago-Kent Law Review, Vol. 90, No. 2, 2015; St. Thomas University School of Law (Florida) Research Paper No. 2015-06. Available at SSRN:http://ssrn.com/abstract=2694803

For more details visit https://cis-india.org/internet-governance/blog/habeas-data-in-india

Guest Report: Bridging the Concerns with Recommending Aarogya Setu

Siddharth Sonkar — 2020-06-24T05:19:43Z

Keywords: Aarogya Setu, Constitutionality, Digital Contact Tracing, Location Data, Personal Data Protection Bill, 2019, Exemptions, Personal Data, Sensitive Personal Data, Mosaic Theory, Surveillance, Privacy, Governing Law, Necessity, Intensity of Review, disparate Impact, Proportionality

This report was edited and reviewed by Arindrajit Basu, Mira Swaminathan, and Aman Nair.Read the full report here

EXECUTIVE SUMMARY

Aarogya Setu collects real-time location data of users every fifteen minutes to facilitate digital contact tracing during the Pandemic. It inter alia color-codes users indicating the extent of risk they pose based on their health status and predicts hotspots which are more susceptible to COVID-19. Its forecasts have reportedly facilitated the identification of 650 clusters of COVID-19 hotspots and predicting 300 emerging hotspots which may have been otherwise missed. In a welcome move, the source code of the application was recently made public. The initially-introduced mandate to use the application was reportedly diluted and a Protocol supplementing the privacy policy with additional safeguards was released. Despite these steps in the right direction, some key concerns continue to require alleviation through engagement. This Report seeks to constructively engage with these concerns towards making privacy safeguards governing its operability more consistent with international best practices.

First, the Report maps situations in which Aarogya Setu in fact remains mandatory (in Table 1) In these situations, there exists no restriction against private parties (e.g. employers, airlines, etc.) from indirectly making its use mandatory. Consequently, there is no real choice in determining the use of the application. Even where there exists a choice to opt-out (e.g. in contexts where there is only an advisory but no indirect mandate), the choice is not meaningful due to the inability to examine the potential consequences of using the apn remains mandatory for practical purposes since there still exists an obligation to undertake due diligence towards making sure that every employee uses the application. In other words, this part of the report explains why it remains indirectly mandatory to use the application. This indirect mandate impedes the exercise of meaningful consent. This could be addressed through a notification directing that no one should be indirectly compelled to use the application. This part also acknowledges that even where a choice to opt-out (e.g. in contexts where there is only an advisory but no indirect mandate), the choice is not meaningful due to the inability to examine the potential consequences of using the application.

Second, the report explains why the mandate to use the Application raises concerns in the first place: i.e. in the absence of transparency beyond the publication of the source code. The open-source code may not necessarily result in meaningful algorithmic transparency (since the processing in the models at the Government of India server continues to remain a black box) in respect of predictions made to determine appropriate health responses. Based on the source code per se, people are unable to verify the wherever there exists operability of the Application more meaningfully. Algorithmic transparency enables people to make an informed decision in using the Application by choice. The ability to make an informed decision is critical to the right to privacy. The right to privacy does not just mean drawing boundaries or creating limitations against any external interference. The right also includes the public’s right to know how an algorithm affects their lives. Given the centrality of transparency in the ability of the user to exercise their privacy better, beyond releasing the source code of Aarogya Setu, publicizing information about how predictions are made is important. This part acknowledges the limitations of transparency in that it can only facilitate identification of privacy harms and not really solve them by itself. Yet, it goes ahead and re-emphasises the inter-relationship of transparency and privacy, highlighting how it became a basis recently in striking down a government-used algorithm, which indicates incentive to increase transparency.

Third, the report reviews whether based on the already-available information from the combined reading of the privacy policy and the protocol, the operability of the application seems consistent with best international practices in protecting user privacy. This part begins with an analysis of the privacy policy and the protocol, which indicate privacy concerns in relation to inter alia location data, followed by an explanation as to why there exists a reasonable expectation of privacy over location data (to establish a privacy intrusion). This is followed by structurally applying the proportionality test to identify necessary modifications to the current framework:

The 'legality' prong may be satisfied by a combined reading of the NDMA and the specificity in the delegated legislation, as has been done in the past particularly in the context of location tracking. However, it is suggested (in the recommendations section) that a statutory legislation comprehensively governing the operability of the Application is introduced to ensure predictability and permanency in the framework governing the operability of the Application as done internationally. Moreover, determining appropriate health responses to the Pandemic is indeed a legitimate interest that is sought to be achieved through the application
Given the limitations of traditional methods of contact-tracing, digital contact tracing could perhaps be a suitable method of ascertaining appropriate health responses to the Pandemic subject to a comprehensive review of evidence on a regular basis to evaluate verifiably its effectiveness. Since the use of the application seems likely in the long run, its efficacy needs to be backed by concrete evidence which corroborates its accuracy and effectiveness such as statistical data on false positives and negatives that result from the application
A careful reading of the combined reading of the Aarogya Setu privacy policy and the Protocol with Fair Information Protection Principles (‘FIPP’) indicates some inconsistencies with international best practices. The extent of inconsistency with best practices may not be considered the least restrictive and therefore necessary form in which digital contact tracing can be conducted in India
Since the inconsistencies seem relatively more restrictive than necessary to facilitate digital contact tracing in India, a balancing of privacy and public health could result in the conclusion that the application is not ‘proportionate’ to the potential privacy harms that can result from using the application. While conducting the balancing exercise, privacy and public health should be viewed as complementary, not competing interests. This conception would encourage courts to consider privacy concerns with sufficient extent of intensity

Based on this analysis, the report concludes that digital contact tracing provided the following conditions (detailed in the ‘Recommendations’ section) are conjunctively satisfied:

Digital contact tracing should supplement (e.g. be in addition to) and not supplant (i.e. replace) traditional methods of contact tracing entirely, particularly for vulnerable groups (e.g. interviews where vulnerable groups, particularly marginalized women do not have access to mobile phones);
A statutory law should be introduced which strictly and comprehensively governs the scope of the application,
the suitability of the application (with meaningful algorithmic transparency) should be corroborated by reliable and relevant statistical evidence (e.g. with the help of closer scrutiny of the basis of predictive outcomes) and
The privacy compromises using the application should be intrusive to the minimum extent possible. This could be done by further adding robust safeguards through stronger restrictions on sharing the collected data

(Final year undergraduate student of the National University of Juridical Sciences (NUJS), Kolkata with a sustained interest in law, technology and policy (graduating with the class of 2020).

For more details visit https://cis-india.org/internet-governance/guest-report-bridging-the-concerns-with-recommending-aarogya-setu

Guest post: Before cyber norms, let’s talk about disanalogy and disintermediation

Pukhraj Singh — 2019-11-18T10:14:07Z

In a guest post in relation to CIS’s recently held roundtable onIndia’s cyber defense strategy, Pukhraj Singh looks at the critical fissures – at the technical and policy levels – in global normative efforts to secure cyberspace. By charting out the key vectors and power asymmetries among key stakeholders – both leading state actors and private actors like Microsoft – Singh posits that there is much to be done before we circumscribe cyber operations within legal strictures.

By: Pukhraj Singh
Reviewed and Edited by: Elonnai Hickok, Arindrajit Basu, and Karan Saini

The ongoing decoupling of norms

In September 2019, the French ministry of defense published a document stating its views on the applicability of international law to cyber operations. While it makes an unequivocal espousal of the rules-based order in cyberspace, some of the distinctions made by the paper within the ambit of international law could be of interest to technical experts.

The document makes two key contributions. First, it addresses two modes of power projection within cyberspace: cyber operations acting as a force multiplier in a hot war that is strictly delineated by kinetic and geographical redlines; and below-threshold, single-domain “dematerialized” operations leveraging cyber intrusions. Secondly, the document has made an attempt to gently decouple itself from the Tallinn Manual on some aspects.

In an unrelated development, Microsoft joined hands with a group of peers within the technology industry, civil society and government to set up the CyberPeace Institute – a private sector initiative to strengthen the rules-based order.

It is an outcome of the sustained, unrelenting effort of Microsoft in thwarting what it believes to be the unchecked weaponization of cyberspace. Suffering a major reputational loss after the Snowden leaks, the company has gradually cultivated fiercely contrarian positions on issues like state-enabled surveillance.

Microsoft’s daring contests and cases against the US government have been intimately recorded in the recently released book Tools and Weapons, authored by its chief legal officer Brad Smith.

Seen through the lens of the future, the aforementioned developments highlight the ongoing readjustment of the legal discourse on cyber operations to account for its incongruous technical dynamics.

As the structures of cyber power are peeled layer-by-layer, the need to address this technical divergence in the overly legal interpretations of cyber norms would only increase.

Disanalogy & disintermediation

Take the case of two fundamental dimensions – disanalogy and disintermediation – which have the potential to alter our understanding of how power is wedded with cyberspace.

Disanalogy is a logical postulation that challenges the primacy of “reasoning by analogy” using which international law is mapped to cyber conflict. Disintermediation highlights how the power dynamics of cyberspace have disrupted statism.

Understanding when and how the realization that international law is reasonably applicable to cyber operations dawned upon the international community leads one to an unending maze. It becomes a cyclical process where one set of initiatives only cross-reference the others, in a self-fulfilling sort of way.

The notes of the 2013 session of the United Nations’ Governmental Group of Experts, affirming the sanctity of international law in cyberspace, look like an exercise in teleology.

Not to be distracted by the deeply philosophical nature of war, Kubo Mačák of the University of Exeter did point out that “the unique teleological underpinning of the law of war” should be considered before it is exported to new normative frameworks.

The deductive process inspired by reasoning by analogy that lies at the heart of the cyber norms discourse has not undergone much scrutiny.

In his 2013 talk at NATO’s CCDCOE, Selmer Bringsjord, cognitive sciences professor at the Rensselaer Polytechnic Institute, introduced the idea of disanalogy. Citing the general schema of an analogical argument, Bringsjord arrived at a disproof divorcing the source domain (the just war theory for conventional war) and target domain (just war theory for cyberwar).

He mapped jus in bello in a conventional war across the dimensions of Control, Proportionality, Accessibility, and Discrimination.

Bringsjord further added that these source attributes would not be evident in the target domain for two reasons: the inevitable digitization of every analog object and its interfaces; and the inherent propensity of artificial intelligence to wage attacks on its own.

In a supporting paper, he exhorts that while “Augustine and Aquinas (and their predecessors) had a stunningly long run…today’s world, based as it is on digital information and increasingly intelligent information-processing, points the way to a beast so big and so radically different, that the core of this duo’s insights needs to be radically extended.”

Celebrated malware reverse engineer Thomas Dullien, too, is of the opinion that machine learning and artificial intelligence are more suited for cyber offence as it has remained a “stable-in-time distribution.”

Brandon Valeriano of the Marine Corps University has drawn upon the case of incendiary balloons to question the overreliance on reasoning by analogy. Sadly, such viewpoints remain outliers.

Senior computer scientist David Aucsmith wrote in Bytes, Bombs and Spies that “one of the major challenges in cyberspace is the disintermediation of government.” He adds that while cyberspace has become the “global center of gravity for all aspects of national power,” it further removes the government from the “traditional functions of safety and security.”

The commercialized nature of the Internet is obvious to many. But steadily over the years, the private sector has also acquired vast swathes of cyber power in a manner that strangely mirrors the military concepts of counterintelligence, defense and deterrence.

In Tools and Weapons, Brad Smith recalls a meeting of top technology executives at the White House. As the executives pushed for surveillance reform after the Snowden leaks, Obama defensively retorted that “the companies at the table collectively had far more data than the government.” The “signals intelligence” capabilities of Google and Microsoft rival that of a nation state.

Former deputy director of the NSA Chris Inglis writes in Bytes, Bombs and Spies:

In cyberspace, a small change in configuration of the target machine, system, or network can often negate the effectiveness of a cyber weapon against it. This is not true with weapons in other physical domains…The nature of target-weapon interaction with kinetic weapons can usually be estimated on the basis of physics experimentation and calculation. Not so with cyber weapons. For offensive cyber operations, this extreme “target dependence” means that intelligence information on target characteristics must be precise, high-volume, high-quality, current, and available at the time of the weapon’s use.

Inglis argues that fielding “ubiquitous, real-time and persistent” intelligence, surveillance and reconnaissance (ISR) frameworks is crucial for mustering the ability to produce cyber effects at a place and time of choosing.

Daniel Moore of King’s College London broadly categorizes cyber operations into event-based and presence-based.

The ISR framework envisioned by Inglis pre-positions implants with presence-based operations to make sure that the adversarial infrastructure -- perpetually in a state of flux -- remains primed for event-based operations. Falling prey to an analogy, this is as challenging as a group of river-rafters trying to keep their raft still at one position in a raging torrent of water.

However, it is worthy to note that a major component of such an ISR framework would manifest over privately-owned infrastructure.

It is exactly why the commercial threat intelligence industry lead by the likes of Fireeye, Kaspersky and Crowdstrike has flourished the way it has.

Joe Slowik, principal adversary hunter at Dragos, Inc., corroborates it: “An entire ecosystem of defense and security developed within the private space…essentially, private (defensive) ‘armies’ grew up and proliferated in the cyber security space over the course of many years.”

Jason Healey of Columbia’s School of International and Public Affairs has another way of looking at it: “In counterinsurgency, host nation must take lead & U.S. role is to provide aid & support. USG not seen as legitimate, may lack the local & cultural knowledge, & lack sufficient resources. In cyberspace, the private sector, esp tech & security companies, are the host nation (sic)”.

Initiatives like the CyberPeace Institute and Cybersecurity Tech Accord are to be seen as emerging geopolitical formations pivoted around the power vacuum created by growing disintermediation.

While Microsoft avows the applicability of international law, the decreasing technological dependence on it to enforce the rules-based order may herald data-driven normative frameworks solely originating from the private sector.

Take the specific case of fashionable “black-letter rules” – like barring cyber actors from hacking into adversary’s election infrastructure – variedly promulgated by the Tallinn Manual, Microsoft and Global Commission on the Stability of Cyberspace. They could very well act as impediments to the success of the norms process.

Cyber actors can be variedly be divided into various capability tiers: A, B, C or D Teams, etc. Such categorizations could be derived from multiple variables like operational structure, concept of operations, capabilities and toolchains, and operating budget, etc.

In what may sound paradoxical, mindless enforcement of such rules creates an inherently inequitable environment where actors would be compelled to flout them. Targeting and target discrimination are possibly the most expensive components of the cyber offensive toolchain. As intelligence analyst Grugq said, “You need a lot of people to have a small numbers of hackers hacking.”

The ability to avoid a vulnerable target or an attack surface without sacrificing the initiative is a luxury that only an A-team could afford, further disincentivizing smaller players from participating in confidence-building measures.

In such cases, the private sector could lead the way in the neutral and transparent interpretation of the dynamics and thresholds of power projection in cyberspace. Companies, not countries, have the vantage point and commercial interest to create a level playing field.

Taking the original case of France’s new dossier on cyber operations, its gradual rollback from the strictly black-and-white world of, say, the Tallinn Manual hints at a larger devolution of legally interpreted cyber operations, influenced by technical incongruities like disanalogy and disintermediation.

While the said document answers many questions relating to the applicability of international law to cyber operations with uncanny confidence, the devil still lies in the details.

For example, it talks about creating militaristic cyber effects by altering the confidentiality and availability of data on adversarial systems, but skirts around integrity – as if the three dimensions of data security are not symbiotic. Such picket-fencing may be trying to carefully avoid the legal ambiguity on information operations, post-ICJ US vs Nicaragua.

Ask any cyber operator, can a cyber operation proceed without sabotaging the integrity of log artifacts or other such stealthy or deceptive maneuvering?

It also postulates the export of “non-international armed conflict” to the territory of consenting nation states, as if such factors are completely controllable.

Discussed earlier, a majority of the cyber-ISR frameworks manifest over globally scattered private infrastructure. And almost every layer of the computing architecture is now network-enabled.

In cyberspace, the ‘territory’ of a nation state expands and contracts in real time. It may exist online as the sum of all the global information flows, across the many millions of interfaces, associated with it at any given moment. The sheer emergent complexity of this organism has baffled many.

The adversarial environment fluxes at such a rapid pace that taking “territorial” sanctity into account during an ongoing operation is nigh impossible. This, in fact, is the very premise of Defend Forward.

The French document is a good attempt at decoupling cyber operations from legal strictures, but it should be seen as the mere beginning of that process.

Cognitive cyber offence

Lastly, the complete absence of the cognitive dimension in the norms process is something that should be outrightly addressed.

Keith Dear, a research fellow at Oxford’s Changing Character of War Program, feels that war – as “a continuation of politics by other means” – is essentially persuasive and has predominantly psychological effects. They get aggravated more so by the scale and speed of cyber-enabled behavioral modelling.

The threat landscape is at a stage where we are going to see the increasing exploitation of cyber-cognitive attack surfaces – the cost-benefits are now heavily tilted towards their side. It is like what conventional cyber operations used to be 20 years ago: cheap and easy over scale and speed.

The cyber norms community only considers the first or second order effects of cyberattacks. The reality is that causation could be separated by many, many degrees – also missing out on the fact that a cyberattack is generally an indiscernible mixture of not just effects, but also perceptions. Every cyber operation could be deemed as an information operation even after full denouement.

We have only begun to understand the significance of the cognitive dimension. Leading thinkers like former Secretary of the Navy Richard Danzig had for long proposed perceptive instead of spatial redlines for cyber conflict, aptly capturing its emergent properties.

His suggested baseline was: “The United States cannot allow the insecurity of our cyber systems to reach a point where weaknesses in those systems would likely render the United States unwilling to make a decision or unable to act on a decision fundamental to our national security.”

Danzig’s paradigm neatly fits into the Defend Forward philosophy of the US Cyber Command. Former director of the NSA Michael Hayden once said that Stuxnet had the “whiff of August 1945,” while former NSA exploitation engineer Dave Aitel labelled it as the “announcement of a team.” The theatres of war, frameworks for deterrence and parameters for proportional response may turn out to be purely perceptive in nature.

As the cyber option gets increasingly expended by militaries, we have come to understand that the esoteric cognitive parameters of digital conflict could be crucial enough to decide victory or defeat.

Conclusion

As the United Nations’ Governmental Group of Experts’ dialogue came to a grinding halt in 2016, Michelle Markoff, former deputy coordinator for Cyber Issues in the US State Department, gave a candid account of what went wrong.

She also went on to recommend “interleaving strategies” like defence, declaratory policies, alliance activities, and norms of behaviour. It is interesting to note all the four dimensions proffered by her neatly fit into the remit of the private sector when it comes to fostering cyber stability.

The threat intelligence industry, by its indirect participation in the great power play, is already carving a rudimentary framework for declaratory signaling. Private sector alliances – by being more open and neutral about attack attribution, adversarial intent and capabilities, and targeting criteria – may lower the incentives while increasing the costs of cyber actions. That may force various actors to the negotiating table.

The emergence of customary international law in cyberspace, as a precursor to effective normative frameworks, is a necessity that may squarely fall on the shoulders of corporations. In that sense, diplomatic initiatives and alliance activities by Microsoft and others must be keenly observed.

Pukhraj Singh is a cyber threat intelligence analyst who has worked with the Indian government and security response teams of global companies. He blogs at www.pukhraj.me. Views posited are the author’s alone.

For more details visit https://cis-india.org/internet-governance/blog/guest-post-before-cyber-norms-let2019s-talk-about-disanalogy-and-disintermediation

GSMA Research Outputs

elonnai — 2015-04-06T14:18:18Z

This is a collection of research under our GSMA project that we have undertaken in collaboration with Privacy International. The research has sought to understand different legal and regulatory aspects of security and surveillance in India and consists of blog entries and reports. Any feedback or comment is welcome.

Indian Law and the Necessary Proportionate Principles

The presentation shows that there are no comprehensive provisions for the principles of legitimate aim, competent judicial authority, proportionality, transparency, etc. whereas these are partially present for the principles of legality, necessity, adequacy, public oversight, safeguards for international cooperation, etc. The presentation also looks at the Indian intelligence agencies and shows us that there are nine agencies authorized to intercept communications along with at least eleven additional agencies. It further dwelves into the establishment and structure of Indian intelligence agencies and whom they report to, the sharing of information internationally as well as nationally. It shows us that India has MLAT agreements with 36 countries and request to CBI can be initiated informally or formally through court order. It then lists out the various regulatory and important bodies responsible for national security. Some cases of unlawful interception / leaks have been discussed along with examples of arrests based on digital evidence. The various government schemes, the telecommunication companies in India, telecom licenses requirements, government developed security and surveillance solutions, private security companies, security expos, export, import and selling of security and surveillance equipment, and the way forward are also discussed.

Click to download the PDF

Security, Surveillance and Data Sharing Schemes and Bodies in India

Following the 2008 Mumbai terrorist attacks, India had implemented a wide range of data sharing and surveillance schemes. Though developed under different governments the purpose of these schemes has been to increase public safety and security by tackling crime and terrorism. As such, two data sharing schemes have been proposed - the National Intelligence Grid (NATGRID) and the Crime and Criminal Tracking Network & Systems (CCTNS), as well as several surveillance systems, such as the Lawful Intercept and Monitoring (LIM) system, the Network Traffic Analysis system (NETRA), state Internet Monitoring Systems and the Central Monitoring System (CMS). This chapter details the various schemes and provides policy recommendations for their improvement, with regards to the protection of the right to privacy and other human rights.

Click to download the PDF

Export and Import of Security Technologies in India: QA

The write-up examines in question-answer format the standards regulating the export of technologies that can be used for surveillance purposes, the department and legislation that governs exports and imports of security technologies in India, the procedure for obtaining an export licence for the export of SCOMET items, what is ITC (HS) and why is it important, and examples of ITC codes for technologies that can facilitate security or surveillance. The research finds answers to all these queries.

Click to download the PDF

Regulation of CCTV’s in India

In light of the increasing use and installation of CCTV’s in cities across India, and the role that CCTVs play in the Home Ministry's plans for implementing "Mega Policing Cities", this blog seeks to review various attempts to regulate the use of CCTV's in India, review international best practices, and provide preliminary recommendations for the regulation of CCTV's in India.

Click to download the PDF

Mutual Legal Assistance Treaties (MLATs) and Cross Border Sharing of Information in India

It is unclear the exact process that intelligence agencies in India share information with other agencies internationally. India is a member of Interpol and the Central Bureau of Investigation, which is a Federal/Central investigating agency functioning under the Central Government, Department of Personnel & Training is designated as the National Central Bureau of India.

Click to download the PDF

Composition of Service Providers in India

Telecom, at present, is one of the fastest-growing industries in India. As of January 2014, according to the Telecom Regulatory Authority of India (TRAI) there are 922 million wireless and over the wire subscribers in India, and 56.90 million broadband subscribers including wired, wireless and wimax subscribers. India’s overall wireless teledensity was quoted as having 893.31million subscribers, with a 0.79% (7.02 million) monthly addition.

Click to download the PDF

The Surveillance and Security Industry in India - An Analysis of Indian Security Expos

The ‘Spy Files’, a series of documents released by whistleblower website WikiLeaks over the last few years, exposed the tremendous growth of the private surveillance industry across the world – a multi-billion dollar industry thriving on increasing governmental and private capabilities for mass surveillance of individuals. These documents showed how mass surveillance is increasingly made possible through new technologies developed by private players, often exploiting the framework of nascent but burgeoning information and communication technologies like the internet and communication satellites.

Click to download the PDF

An Analysis of News Items and Cases on Surveillance and Digital Evidence in India

In a technologically advanced era, with preponderance of electronic communications in both professional and social interactions and the ability to store such information in digital form, digital evidence has gained significance in civil as well as criminal litigation in India. In order to match the pace with the progressive technology, the Indian Courts have embarked on placing more and more reliance on the digital evidence and a portion of such digital evidence is obtained through electronic surveillance.

Click to download the PDF

Policy Recommendations for Surveillance Law in India and an Analysis of Legal Provisions on Surveillance in India and the Necessary & Proportionate Principles

The Government of India has created a legal framework which supports the carrying out of surveillance by authorities through its various laws and license agreements for service providers. The Centre for Internet and Society (CIS) acknowledges that lawful, warranted, targeted surveillance can potentially be a useful tool in aiding law enforcement agencies in tackling crime and terrorism. However, current Indian laws and license agreements appear to overextend the Government's surveillance capabilities in certain cases, while inadequately safeguarding individuals' right to privacy and data protection.

Click to download the PDF

The Surveillance Industry in India

India has the world's second largest population, an expanding middle class and undoubtedly a huge market which attracts international investors. Some of the world's largest corporations have offices in India, such as Google Incorporated and BlackBerry Limited. In the Information Age, the market revolves around data and companies which produce technologies capable of mining such data are on the rise. Simultaneously, companies selling surveillance technologies appear to be on the peak too, especially since the global War on Terror requires law enforcement agencies around the world to be equipped with the latest surveillance gear.

Click to download the PDF

State of Cyber Security and Surveillance in India: A Review of the Legal Landscape

The issue of cyber security and surveillance, especially unauthorised surveillance, though traditionally unprioritised, has recently gained much traction due to the increasing number of news reports regarding various instances of unauthorised surveillance and cyber crimes. In the case of unauthorised surveillance, more than the frequency of the instances, it is their sheer magnitude that has shocked civil society and especially civil rights groups. In the background of this ever increasing concern regarding surveillance as well as increasing concerns regarding cyber security due to the increased pervasiveness of technology in our society, this paper tries to discuss the legal and regulatory landscape regarding surveillance as well as cyber security.

Click to download the PDF

For more details visit https://cis-india.org/internet-governance/blog/gsma-research-outputs

GSMA Conference Invite

praskrishna — 2015-10-14T01:49:36Z

For more details visit https://cis-india.org/internet-governance/blog/gsma-conference-invite.pdf

Growing cyberspace controls, Internet filtering

praskrishna — 2011-08-20T14:36:26Z

OpenNet Initiative investigates, analyses filtering and surveillance practices, writes T Ramachandran in this article published in the Hindu on Sunday, February 20, 2011.

Governments in many parts of the world have been aggressively adopting a new generation of controls aimed at filtering and controlling information flow on the Internet, citing concerns such as cyber security, crime and terrorism, according to the OpenNet Initiative.

The OpenNet Initiative, which says it “investigates and analyses Internet filtering and surveillance practices in a credible and non-partisan fashion,” in its updated study released last year titled, “Access Controlled: The Shaping of Power, Rights, and Rule in Cyberspace,” said that it was fast becoming the global norm to control information flow on the Internet.

The OpenNet is a collaborative partnership between the Citizen Lab at the Munk School of Global Affairs, University of Toronto, the Berkman Centre for Internet and Society at Harvard University, and the Ottawa-based SecDev Group.

Asked whether the trend was likely to become more pronounced, given the recent developments in the Middle East, one of the contributors to the study, Ethan Zuckerman, a senior researcher at the Berkman Centre, said, “In general, we see governments becoming more aggressive and more overt about their Internet filtering.”

The OpenNet has described the recent Internet blackout in Egypt as ‘just-in-time-blocking' - when information flow is brought to a halt during critical times such as political crises, elections, or social unrest. Discussions have resurfaced about the deployment of 'Internet kill switches,' a way in which nations could snuff out the Internet when such a crisis occurs.

“For all the talk of Internet kill switches, turning off the Internet is a relatively easy and unsophisticated thing to do. What is hardest to do is filtering on finer, more granular levels,” Mr. Zuckerman told The Hindu.

The first-generation controls were deployed primarily at Internet “choke points,” places in the network where Internet addresses that had been blacklisted by the authorities could be filtered and blocked. These were mainly the gateways run by the Internet Service Providers (ISPs). The number-based IP addresses connected to particular websites or domain names could be used for the blocking. Keywords could also be used in weeding out proscribed sites or pages.

Reports of watchdogs such as the OpenNet and Freedom House indicate that though not pronounced, selective filtering has been a part of the Indian Internet scene. Google's Transparency Report for the first half of 2010 also shows that India is among the nations from where a number of government inquiries for information about users and requests to remove or censor content emanate.

“As far as censorship of Internet goes in India it is still first generation in terms of blocking and filtering at the Internet choke points. However, the Indian government has made and is making several moves that continue to undermine privacy and anonymity on the Internet. This has a chilling effect on freedom of expression and information accessing behaviour on the Internet,” says Sunil Abraham, executive director of the Bangalore-based Centre for Internet and Society.

Second and third generation techniques of Internet filtering, as described in Access Controlled, are “more subtle, flexible, and even offensive in character,” often using legal regulations to supplement or legitimise technical filtering measures, extralegal or covert practices. These include the use of viruses to infiltrate computer systems, the launching of distributed denial-of-service (DDoS) attacks and surveillance at strategic points in the Internet and telecommunications infrastructure. The DDoS attacks involve directing traffic of such large volume at targeted sites during a particular period, in order to crash them, or keep them largely inaccessible. Counter-information campaigns could also be mounted, supplemented by policy measures and other strategies, including legal ones.

Governments have also been assiduously building up capabilities for monitoring and intercepting the large volume of information that flows on the Internet, including email, which mostly flows through the infrastructure of Internet Service Providers (ISPs) and Internet exchange points. In the Indian context, the I.T. Act “along with the ISP licences allows for blanket surveillance and also data retention,” says Mr. Abraham.

It is difficult to say if this sort of monitoring and interception is really effective in countering terrorism and other national security threats, says Mr. Zuckerman. “I don't believe trading privacy for security is a fair trade.”

Read the original news in the Hindu

For more details visit https://cis-india.org/news/growing-cyberspace-controls

Grants:APG/Proposals/2014-2015 round2/The Centre for Internet and Society/Impact report form

hasan — 2016-10-09T14:40:36Z

This form is for organizations receiving Annual Plan Grants to report on their results to date. For progress reports, the time period for this report will the first 6 months of each grant (e.g. 1 January - 30 June of the current year). For impact reports, the time period for this report will be the full 12 months of this grant, including the period already reported on in the progress report (e.g. 1 January - 31 December of the current year).

Read the original published on Wikimedia Blog here.

This form includes four sections, addressing global metrics, program stories, financial information, and compliance. Please contact APG/FDC staff if you have questions about this form, or concerns submitting it by the deadline. After submitting the form, organizations will also meet with APG staff to discuss their progress.

Global metrics overview - all programs

We are trying to understand the overall outcomes of the work being funded across our grantees' programs. Please use the table below to let us know how your programs contributed to the Global Metrics. We understand not all Global Metrics will be relevant for all programs, so feel free to put "0" where necessary. For each program include the following table and

Next to each required metric, list the outcome achieved for all of your programs included in your proposal.
Where necessary, explain the context behind your outcome.
In addition to the Global Metrics as measures of success for your programs, there is another table format in which you may report on any OTHER relevant measures of your programs success.

For more information and a sample, see Global Metrics.

Overall

Metric	Achieved outcome	Explanation
1. # of active editors involved	157	CIS-A2K has been able to increase participation of female editors across its Focus Language Areas.
2. # of new editors	799	Our WEP initiatives have helped in introducing and retaining editors across FLA (except for Odia).
3. # of individuals involved	1200	Public events and anniversary celebrations held in Odia and Kannada have helped Wikimedia projects in reaching the general public as these events have been widely covered by media.
4. # of new images/media added to Wikimedia articles/pages	2823	Photo-walks, WEP activities and image re-licensing efforts have helped the A2K team in achieving this metric.
5. # of articles added or improved on Wikimedia projects	18998	Thematic edit-a-thons anchored by A2K and Collaborative edit-a-thons that have been supported by A2K have been a big hit during the last grant period amongst Indic Wikimedians.
6. Absolute value of bytes added to or deleted from Wikimedia projects	109.64 MB

Kannada

Metric	Achieved outcome	Explanation
1. # of active editors involved	23	As of now the Kannada community is relatively small, A2K would like to expand the user and editor base by taking Wikimedia activities to various parts of the state.
2. # of new editors	609	These numbers include new editors from WEP initiative and editathons conducted as part of 13 Kannada Wikipedia anniversary.
3. # of individuals involved	700	Public event organised during the 13th Kannada Wikipedia anniversary has boosted our reach.
4. # of new images/media added to Wikimedia articles/pages	1290	Due to the Photo walk organised as part of the 13th year Kannada Wikipedia anniversary celebrations.
5. # of articles added or improved on Wikimedia projects	8132	Most of the articles created under WEP initiative are still under sandbox (as a quality enforcing measure), hence the number is low. The number also includes Wikisource folios.
6. Absolute value of bytes added to or deleted from Wikimedia projects	56.5 MB

Konkani

Metric	Achieved outcome	Explanation
1. # of active editors involved	4	Activities in Konkani Wikipedia dipped after the project became live.
2. # of new editors	20	The new editors were introduced to Konkani Wikipedia with the help of Nirmala Institute of Education, Panjim an institutional partner of CIS-A2K.
3. # of individuals involved	50
4. # of new images/media added to Wikimedia articles/pages	34
5. # of articles added or improved on Wikimedia projects	1546	Konkani Wikipedians took the project of creating one article per village in Goa quite enthusiatically.
6. Absolute value of bytes added to or deleted from Wikimedia projects	8.11 MB

Marathi

Metric	Achieved outcome	Explanation
1. # of active editors involved	64	Events conducted at Pune University, Pune and IIT-Bombay involved existing Wikipedians.
2. # of new editors	59	Activities conducted at SWERI, Pandharpur, TISS, Mumbai and IIT-Mumbai have contributed to this.
3. # of individuals involved	150	Involvement of Maharashtra Knowledge Corporation Limited opened up new readership to get involved in Marathi Wikimedia projects.
4. # of new images/media added to Wikimedia articles/pages	27	A2K team could not organise a dedicated photo walk or invest in image re-licensing activity.
5. # of articles added or improved on Wikimedia projects	331	Although the number of the articles is low, many new female editors were introduced and have taken up editing on Marathi Wikipedia.
6. Absolute value of bytes added to or deleted from Wikimedia projects	2.64 MB

Odia

Metric	Achieved outcome	Explanation
1. # of active editors involved	21	Wiki Tungi activities are lead by active Wikimedians from the Odia community.
2. # of new editors	56	Nabakalebara edit-a-thon gained a lot of currency on the social media platforms which in turn resulted in new editors for Odia Wikimedia projects.
3. # of individuals involved	120	Three events with Puri WikiTungi (Puri Workshop, 15th Anniversary celebration, and Mission Odisha event), Wikipedia workshop in Utkal University.
4. # of new images/media added to Wikimedia articles/pages	601	Nabakalebara edit-a-thon had an in-built component of adding images related to the Rathayatra.
5. # of articles added or improved on Wikimedia projects	1780	Only pages created in Odia Wikipedia and Odia Wikisource are indicated and not article improved.
6. Absolute value of bytes added to or deleted from Wikimedia projects	9.56 MB

Telugu

Metric	Achieved outcome	Explanation
1. # of active editors involved	30
2. # of new editors	45	Need to try getting more New users on to the board.
3. # of individuals involved	150
4. # of new images/media added to Wikimedia articles/pages	871
5. # of articles added or improved on Wikimedia projects	1342	Includes folios digitized in Wikisource.
6. Absolute value of bytes added to or deleted from Wikimedia projects	7.23 MB

Train-a-Wikipedian

Metric	Achieved outcome	Explanation
1. # of active editors involved	15	Editors who have participated in at least one training session.
2. # of new editors	10	Editors who got beginners' training (includes account creation and basic Wikipedia training such as Wikiformatting, components of Wikipedia, article structure).
3. # of individuals involved	30	#1+#2 and the people who were involved during training sessions.
4. # of articles added or improved on Wikimedia projects	5867
5. Absolute value of bytes added to or deleted from Wikimedia projects	25.6 MB

Telling your program stories - all programs

Please tell the story of each of your programs included in your proposal. This is your chance to tell your story by using any additional metrics (beyond global metrics) that are relevant to your context, beyond the global metrics above. You should be reporting against the targets you set at the beginning of the year throughout the year. We have provided a template here below for you to report against your targets, but you are welcome to include this information in another way. Also, if you decided not to do a program that was included in your proposal or added a program not in the proposal, please explain this change. More resources for storytelling are at the end of this form. Here are some ways to tell your story.

We encourage you to share your successes and failures and what you are learning. Please also share why are these successes, failures, or learnings are important in your context. Reference learning patterns or other documentation.

Make clear connections between your offline activities and online results, as applicable. For example, explain how your education program activities is leading to quality content on Wikipedia.

We encourage you to tell your story in different ways by using videos, sound files, images (photos and infographics, e.g.), compelling quotes, and by linking directly to work you produce. You may highlight outcomes, learning, or metrics this way.

We encourage you to continue using dashboards, progress bars, and scorecards that you have used to illustrate your progress in the past, and to report consistently over time.

You are welcome to use the table below to report on any metrics or measures relevant to your program. These may or may not include the global metrics you put in the overview section above. You can also share your progress in another way if you do not find a table like this useful.

A2K key activities

During this grant period CIS-A2K has organized and supported a number of events in collaboration with Indic Wikimedia community members. Some of those are:

July 2015	August 2015	September 2015
Konkani Wikipedia goes live, (See more)	Telugu Wikipedia edit-a-thon at Annamacharya library Tulu Wikipedia edit-a-thon in Mangalore (See more)	Seminar on "Empowering Marathi Schools", Pune, Kannda Wikipedia meetup (See more)
October 2015	November 2015	December 2015
Konkani language book donation (See more)	4 Indic language communities IRC meeting, Community discussion for making Tulu Wikipedia live (See more)	Sau Dhuni Teen Project: December Wikipedia Edit-a-thon, Initiative to bring 1000 books about the culture of Maharashtra on Marathi Wikipedia (See more)
January 2016	February 2016	March 2016
Konkani-language Edit-a-thon and English-Romi Konkani dictionary release, Geographical Indications in India Edit-a-thon (See more)	Digitisation sprint at Andhra Loyola College, Kannada Wikipedia's 13th anniversary (See more)	(See more) National Wikipedia Education review program, Odia-language Women’s History Month edit-a-thons (See more)
April 2016	May 2016	June 2016
Odia Wikipedia's 14th anniversary (See more)	Mini TTT and MWT in Pune, Advanced training for Kannada-language Wikimedians (See more)	Train the Trainer 2016, MediaWiki Training (See more)

Capacity building

Train the Trainer

Train the Trainer (or TTT in short) is a residential program that attempts to groom leadership skills among the Indian Wikimedians. Participating Wikimedians interact with A2K staff members and community leaders towards designing, implementing and documenting activities such as outreach, GLAM projects, edit-a-thons, etc. Various topics such as grants' structure, funding opportunities both with A2K and WMF, effective reporting and documentation, use of Global and other metrics, etc., are also covered.

After the first 2 iterations in 2013 and 2015, the third iteration of the training program was conducted in June 2016.

Diversity

In this iteration—

Language: 16 Wikimedians from 10 different language communities participated as shown in the pie chart below.

Participants of TTT 2016, representing different language communities

Gender: This year we had 5 female participants (out of 15 participants). After the 2013 iteration we felt we should try to encourage more female Wikipedians to participate in TTT. However, this does not mean that we had any different eligibility criteria set for the female Wikipedians.

Participants division by gender

Representation of Indic Wikimedia communities: We had participants from all over India. Although TTT is a national-level event, we also had participants from outside of India (Nepal and Sri Lanka).

Lessons learnt

TTT 2016 participants

After the 2015 version we found that a few participants faced difficulties to understand and work on the pre-event presentations. This year (2016), we have given more detailed instructions and were in touch with the participants while they were doing pre-event works.
By dovetailing TTT and MWT, A2K team was able to bring Indic Wikimedians working for outreach and on technical front together. This helped the participants to create a wishlist regarding tools, gadgets, and other technical help required to conduct effective outreach activities.

Based on participants' feedback and suggestions plus our own observations, while keeping Wikimedia Foundation's guidelines in mind, we make necessary changes to our program structure. In this year's TTT we made a number of changes‖

We encouraged more eligible female editors to participate.
We found that the objective and aims of the event remained unclear to a few participants in the earlier iterations. This year we have given more attention to explain the program's objectives, aims and expectations.

Challenges

We expected that the participants would be in touch with us while planning, conducting, and making reports of an event. After 2015 TTT^[1] we found a few participants did not respond to our emails or messages.
While TTT 2016 participants have shown active interest during WCI-related edit-a-thon, the same level of interest was not seen during regular monthly meetups.
Despite having communicated to the TTT 2015 participants that a mini TTT should be organized in their communities, however this was not taken up actively.

Mediawiki Training

Participants of MWT 2016, during the workshop

MediaWiki Training (MWT) is an annual residential training workshop that intends to bridge the prevalent gap between outreach volunteers and MediaWiki volunteers and developers. MWT attempts to create and groom 'tech' leaders from the existing Indian language Wikipedians. It aims to facilitate discussions around nurturing leadership regarding technical issues such as filing bugs that hinder the growth of Indian language Wikipedia and Wikimedia projects. At the same time, it encourages active contribution towards improving the existing MediaWiki software from the participants to understand importance of utilizing technology for outreach activities.

The first iteration of the event was held on 24-27 June 2015. 14 editors from 8 Indic communities participated in this workshop. Some of the topics taught during the workshop were: Bugs -presentation, demo & case study, Bots - Pywiki & AWB, MediaWiki tools, TranslateWiki, Quarry, WikiMetrics, APIs, User scripts.

The second iteration of the workshop was conducted on 17-19 June 2016 in Bangalore. MWT 2016 was planned to facilitate an idea-exchange platform between outreach volunteers and MWT participants. 11 editors from 6 Indic Wikimedia communities recieved training during this workshop. Some of the topics discussed during the program were Wikidata, usage of Wikimedia labs tools, templates and infobox creation, as well as AutoWikiBrowser (AWB).

Lessons learnt

Ensure better logistics co-ordination thus guaranteeing involved participation from the participants.
Priority topics must be given more time.

Challenges

Scheduling follow-up events such as mini version of MWT across Indic Wikimedia communities.
To identify female Wikimedians and encourage them to participate in MWT.

Train-a-Wikipedian

Train-a-Wikipedian session in Hyderabad on 15 May 2016

Train-a-Wikipedian (TAW) was started in December 2015 to identify enthusiastic Indic Wikipedians, to train and groom them to develop their editing skills. Inspired by the Adopt-a-User program of the English-language-Wikipedia, this initiative is working on encouraging new Wikimedians who nominate themselves to learn basic Wikimedia policies. Until 30 June 2016, more than 25 training sessions have been conducted.

The concept of Train-a-Wikipedian was appreciated by several Indic Wikimedians from different communities.
More than 25 Wikimedians signed up for this program.

Reflections

These are some of the reflections/feedback we received from Train-a-Wikipedian participants:

Username

	Community	Topics/Learnings	Feedback/Reflections
User:Nrgullapalli (Training page)	Telugu Wikipedia	Policy discussion such as civility, stub, How to search in a better way using operators etc on the web to get references Introduction to The Wikipedia Library / Resource exchange / CIS-A2K Resource exchange.	“ The training was helpful, I learned a couple of new tools. But I feel such trainings should be conducted on regular basis and follow-ups should be done. ”
User:Mouryan (Training page)	Bengali Wikipedia	Essentials of conducting local Wiki-event. Using special pages such as Special:UncategorizedPages,, Special:ShortPages etc., Google Books citation, Metrics.wikimedia.org	“ It was amazing and a quite enriching experience for me at a personal level sir. The things I learnt at Train-a-Wikipedian Hyderabad actually paid the results soon enough.and it enabled to successfully conduct my first offline Wikipedia Meetup in Kolkata just within one month's time. . . ”
User:Rajasekhar1961 (Training page)	Telugu Wikipedia	AdminTools such as MoreMenu, QuickWikiEditor, Citation making using Google Books citation tool, autofilling (from reftoolbar), DOI citation tool; Quick Page purging	“ I picked up some very useful skills & learnt good tools. But, I became a little inactive after that so could not utilize these learnings much. I hope to do so in future.

Lessons learnt

This initiative was inspired by English Wikipedia's program Adopt-a-user, however we found that we must make necessary changes to meet requirements of Indic Wikimedians.
Real-life training sessions left a deeper impact and motivated Wikimedians much more than online training modules.

Challenges

We failed to conduct sufficient number of offline training sessions.
Follow-ups have not been done for a couple of workshops, for example a TAW workshop was conducted in Hyderabad on 15 May and was well-received, but no follow-up TAW workshop has been conducted since then in the city.
From A2K's side sometimes there were delays in connecting and co-ordinating with the signed-up participants. On the other hand sometimes, we did not got responses from the participants when we contacted them.

Policies and guidelines on Indic Wikipedias

Indic Wikipedia policy handbook

CIS-A2K started working on a project to support and encourage Indic Wikipedians to create and/or localize policies in their native languages. A survey was conducted and a policy handbook was also created.

Lessons learnt

Efforts must be taken to initiate discussion regarding creation, localisation of policies in events organized by A2K

Challenges

Although a few policy-discussion meetups have been conducted (such as this one), we faced difficulties finding volunteer translators to translate the handbook into Indic languages.

Play media

Dr. Soubhagyavathi talks about Kannada Wikipedia

Kannada

Kannada Wikipedia Edit-a-thon partcipants at DSERT in January 2016

Kannada Wikipedia has reached the 20,000 article mark during this year. Kananda community members collaboratively designed the plan for the 13th Kannada Wikipedia anniversary. This activity brought together Wikimedians from different parts of Karnataka. By applying for a PEG Kannada Wikipedians have interacted with global Wikipedians and WMF staff. This event resulted in new editors and outreach activities in various parts of Karnataka. A2K has appointed a Program Associate as per its revised strategy A2K 2.0 for Kannada Wikimedia projects.

Institutional partnership

Two new partnerships have been initiated during this grant period–

The Department of State Educational Research and Training (DSERT), Government of Karnataka and
Alva's Education Foundation at Moodabidri.

While Alva's Education Foundation is going to be a partner in implementing Wikipedia Education Program. DSERT is an institution that trains school teachers all across Karnataka state. A2K will be training the trainers about using and editing Wikipedia and other Wikimedia projects in the context of their classroom. However, the 3 other institutional partnerships - Karnataka Janapada University, Manjusha Museum, Dharmasthala, and Tumkur University, Tumkur- that were anticipated during the writing of workplan, could not materialize. This was due to the delay in recruiting a Program Associate for the Kannada Wikimedia projects.

A2K has successfully continued its earlier partnerships and has benefited from their advice regarding our WEP activities and workplan.

Awareness and Outreach

Both the DSERT partnership and the 13th anniversary helped raise awareness around thematic article writing which encouraged Kannada Wikipedians to engage in projects. Various editing projects on literature, science, engineering subjects were taken up actively by the community members. Approximately 225 articles were created exclusively as part of 13th year anniversary celebrations.

Offline versions of Kannada Wikipedia (using kiwix) were distributed through flash drives like this during 13th year Kannada Wikipedia anniversary

CIS-A2K also tried to engage in skill-building activities for the Kannada community members. As per the requests from volunteers, capacity building programs were arranged both in groups and in one-on-one settings to individual Wikimedians. Both TTT and MWT saw active participation from Kannada community. The results of these would be visible in the coming months.

In order to increase the offline readership of Kannada Wikipedia, offline versions of Kannada Wikipedia (using kiwix) were distributed through flash drives during 13th year Kannada Wikipedia anniversary held at Mangalore. 50 such flash drives have been distributed so far to those in need.

Lessons learnt

Kannada was not properly represented in terms of blogs and media coverage and we have been working on addressing this issue.
A better communication method would be devised with inputs from the community members.

Gating factors

A2K has not been successful towards re-releasing of textbooks published by the Government of Karnataka under CC-by-SA licences.

An orientation for Kananda bloggers, some of who could be potential Wikimedians, has not taken place.
Some community members have repeatedly emphasized on having better communication, documentation of activities taken up by the Program Associate.

Odia

Active editors in Odia Wikipedia during the period July 2015 to Feb 2016

Through the community building activities such as the formation of Puri WikiTungi and revival of Bhubaneswar WikiTungi, active editors of the Odia Wikipedia movement reached 30 editors (as of 30 June 2016). Regular follow-up with Wikimedians on-Wiki and via different social media channels along with monthly meetups has helped in editor retention. This has further encouraged Odia Wikimedians to participate in both on-Wiki and off-Wiki activities.

CIS-A2K has supported the community to celebrate the 14th Anniversary of Odia Wikipedia, which facilitated 30 Wikimedians to meet and discuss the future activities for Odia Wikimedia projects.

Formation of Puri WikiTungi

Play media

Adyasha Sahu a Wikimedian from Puri community sharing her journey in the Wikimedia movement.

Puri WikiTungi is a city-based editing group formed by Wikimedians from Puri to spread awareness about Odia Wikimedia projects in and around the city. This group was formed after the first Wikipedia workshop in Puri. Around 30 individuals attended the workshop. 14 participants from this workshop have emerged as active editors on Odia Wikipedia and Odia Wikisource. They are also involved in conducting offline meet-ups, seminar and workshops.

Bridging the Gender gap

Gender diversity in Odia Wikimedia community during 2014-16. For this statistics Odia Wikipedia and Odia Wikisource have been considered.

CIS-A2K has engaged with seven new female Wikipedians and this has resulted in their active participation on Odia Wikimedia projects. One of the female Wikmedians, Chinmayee Mishra has independently conducted a Wikipedia orientation workshop. This workshop has boosted participation of female Wikipedians. Their efforts have been discussed through blog posts and other social media platforms.

Lessons learnt

Two organizations are unofficially supporting Odia Wikimedia community by providing meetup space and internet access for Bhubaneswar and Puri WikiTungis. A2K must make official agreements with these institutions.

Gating factors

Failed to build a partnership with any institution for running Education program for Odia Wikimedia projects. Awareness about the importance of WEPs is required for achieving this.

Telugu

A2K team has been successfully collaborating with Telugu Wikipedia community to improve content quality on Telugu Wikipedia and strengthen the community by increasing its reader and editor base. The team also shares ideas by providing and extending support such as involving community members in discussions with potential partners and designing programs based on their suggestions. Such collaboration has strengthened communities to conduct many Edit-a-thons which have resulted in a wide variety of quality articles. A2K intends to continue such collaborative activities resulting in improvements of stub and poorly translated articles.

Activities and Events

CIS-A2K team has been involved in conducting (holding or co-ordinating) several edit-a-thons in Telugu Wikimedia community, while a few were anchored in Telugu, others were multi-lingual. Many initiatives of the last grant period (i.e. July 2014 to June 2015) have been continued. A2K and the community have collaboratively organised an of sharing resources has resulted in which focused on improving Telugu movie articles. Community members have expanded stubs with information, references and photos. For the edit-a-thon A2K provided resources and references and the community members developed stub articles and created new articles.

Capacity building activities have also been carried out with Telugu Wikipedians. A copyrights session was conducted to improve Telugu Wikimedians' understanding on the subject and clear doubts for Wikisource contributors. Community members, Meena Gayathri and T.Sujatha, attending CIS A2K's Train-a-Wikipedian session have expressed that they gained invaluable knowledge and skills in content translation. The two later initiated a project to improve the quality of Google Translated articles. More than 30 such articles have been improved through it.

Similarly, the Quick introduction sessions held in Hyderabad community meet-ups by CIS A2K helped explain some online tools usage and enabled Wikipedians to contribute better for Wikimedia projects. One of the most active Wikipedians, Swaralasika, said that he was able to make better citations after the sessions which has helped him improve his editing.

Institutional Partnership

With the institutional partnerships established between CIS A2K and Annamayya library, Telugu Wikisource community members have uploaded some of the missing pages in on Telugu Wikisource. Due to the attempts of the community members towards proofreading these books can be downloaded now. The Andhra Loyola College partnership has also cultivated new editors and engage in WEP activities.

Outreach and Media

Increased media coverage has helped the cause of Telugu Wikimedia projects. Hard work of several Telugu Wikipedians (such as Pranayraj and Viswanadh) has been recognized and highlighted. Pranayraj points out that the media coverage helped him reach more people who want to contribute to Wikipedia.

Lessons learnt

A2K team has been working to make Telugu Wikipedia more visible in popular Telugu media, especially in printed media such as off-wiki and on-wiki events coverage in major local newspapers like Eenadu, Sakshi, Andhra Jyothi
WEP activities at partner institutions need to be synchronized with their academic schedule.

Gating factors

Technical support requests from the community were delayed on our end. To overcome this, we are trying to find interns to assign technical tasks requested from communities.

Konkani

Play media

Darshan Kandolkar talks about Konkani Wikipedia

Having gone live since July 2015 after nine years of incubation, Goan Konkani Wikipedia has developed and expanded with the help of CIS A2K to draw more contributors and resources into the project. CIS-A2K has attempted to develop Konkani Wikipedia in all the three scripts (Romi, Devanagari, Kannada). Institutions such as Thomas Stephen Konkani Kendra (TSKK) for Romi script, Goa Konkani Sahitya Academy for Devanagari script, Karnataka Konkani Sahitya Academy for Kannada script have agreed to donate content.

Department of Computer Science, Goa University, had organized an edit-a-thon to include the villages of Goa state on Konkani Wikipedia.

Due to the discontinuation of the Program Associate for Konkani, several of our programmatic activities have not been accomplished during this grant period.

Partnership

In the past year, CIS-A2K had the honour to collaborate with Mannd Sobhaann and World Konkani Centre, organizations working with Konkani language and culture, to bring in more resources into Konkani Wikipedia. These two organizations work for popularization and conservation of Konkani culture and language. Mannd Sobhaan has donated three Konkani books under CC-BY-SA license which has provided great sources for citation and references. On the other hand, these organizations have also agreed to hold GLAM activities, while A2K would digitize their archives of audio, video and text resources to further expand resources available for Konkani Wikimedia projects.

Activities and Events

A one-day edit-a-thon was organized at Krishnadas Shama Central Library, Goa in January 2016. Members of CIS-A2K participated in this event to help mentor the participants. The event created 100 new articles on Konkani Wikipedia in a single day.

Lessons learnt

Increase editor base by engaging academicians and bloggers.
Increase readership by introducing Konkani Wikipedia in primary and higher primary schools.

Gating factors

Activity in the end of 2015 was low in Konkani Wikipedia that no new articles were created in November and December.
Non-availability of a Program Associate

Marathi

Partnership

Maharashtra Granthottejak Sanstha (MGS) has re-licensed 1000 books on the culture, history, and literature under CC-by-SA 4.0 license in October, 2015. In December 2015, a discussion was initiated by CIS A2K at The Energy Resources Institute (TERI) to plan digitization and uploading of the books for Marathi Wikisource.

Events and Outreach

A two-day workshop was organised by the CIS A2K Program Associate in August 2015 at Srimati Savitribai Phule Pune University. This workshop was an attempt to bridge the gender gap on Marathi Wikipedia. The "Sau Dhuni Teen" project focused on creating Wikipedia articles on notable women, themes and works related to gender studies. This event attracted new editors and introduced to them input methods for Marathi methods and basic guidelines of contributing to Wikipedia. The event also served as an important initiative to utilize Wikipedia in generating Indian language annotations on academic sources in Women's Studies and the Social Sciences.

In May, 2016, CIS A2K organized a two-day mini version of Train-the-trainer (TTT) and Mediawiki Training (MWT) for Marathi Wikimedians in Pune. Topics covered in the Mediawiki training include Wikidata, bug triage, Mediawiki extensions, etc., while the TTT session focused on advanced editing skills, outreach planning, and grants structure introduction.

Lessons learnt

A strategy is required to utilize books donated by Maharashtra Granthottejak Sanstha (MGS) as references on Marathi Wikipedia.
Spreading Marathi Wikipedia-related activities to different parts of Maharashtra .

Gating factors

Some participants of workshops reflect that unavailability of sandboxes in Marathi Wikipedia was a concern for new editor as they were unsure if the article might be changed during the time they edit.

General Support and Service to the Movement

Play media

Odia Wikisourcer Pankajmala Sarangi shares her experience and future plans to grow the community. Video by Pankajmala Sarangi (original video) and Subhashish Panigrahi (post production), CC BY-SA 4.0. Pankajmala recorded the video herself covering a few specific topics sent over email.

Partnership Summary

Growing partnerships in WEPs: A2K team has successfully continued all the partnerships form the previous grant period and has also been able to bring new partners onboard thus adding value to the Wikimedia movement. A2K conducted a review program for its WEP partners in Bangalore during the last grant period. This review program allowed the WEP partners across 3 different states to meet and discuss the salient features of the WEP initiative being run at their institutions. This review program helped A2K team to understand institutional expectations and challenges. The review meeting also helped us to generate inter institutional collaboration and sync A2K schedule with academic calendar of these institutions.
Book/Resource donation and digitization: A2K team is immensely happy to have partnered with Maharashtra Granthottejak Sanstha which has donated 1000 books about the Maratha administration, culture, history and social life. Maharashtra Knowledge Corporation Limited, Pune has offered us in-kind support by digitising all these books and making them available to be uploaded on Marathi Wikisource.
Our collaboration with Manasu Foundation, Bangalore has also allowed us to digitise content donated to A2K for free. Andhra Loyola College, Vijayawada now hosts a Digital Resource Lab that provides nevessary infrastructure (Computers, Internet access and printing facility) for all the Telugu Wikimedians.
Centurion University, Bhubhaneswar has expressed in digitising Odia publications from the copyright lapse period. With this partnership A2K expects to add close to 50000 folios to Odia Wikisource.
Goa University partnership and Indian village articles: After a brief lull in the activities of Konkani Wikipedia activities have spiked up again mainly because of the encouragement offered by Goa University. Prof. Madhav Gadgil with support from Goa University has launched a project of using the Census of India data to create articles on Villages of India. This activity has been eagerly taken up by the Konkani community members.Encouraged by the level of enthusiasm shown by the Konkani community members Telugu, Marathi and Odia community members have also been engaged in creating articles on villages of India in their respective languages.
Partnership in image re-licensing: Alva's Education Foundation have donated more than 15000 images under CC-BY_SA license. These images depict the folk art forms, famous personalities, cultural practices, tribal costumes and other areas regarding the social and cultural life of Karnataka in particular and South India in general.
Decision of focusing on existing partnerships: Many institutions that were indicated under the category 'To be explored' for a partnership during this plan year have not been approached as A2K team worked towards consolidating its work with the existing institutions rather than crowding our resources. This decision was taken in accordance with the suggestion of community members and FDC suggestion.
Partnership re-assessment: A further re-assessment of Institutional partnerships based on the parameters of RoI, contribution to Global Metrics and community support will be undertaken during the grant period July 2016- June 2017. Thus providing the A2K team opportunity to consolidate its work further and adopting course corrections (such as working with a different Wikimedia project, changing target group, conducting intensive summer/winter camps and if necessary exiting the partnership).

Outreach Strategies Development

Online and offline media outreach strategies: Stories related to Indian language Wikipedias and Wikimedia projects used to get less attention in the regional language media in India. There has been a hike in news articles and columns related to Indic-language Wikimedia projects both in print and electronic media. One of the most important reasons behind this is the establishment and growing relations with journalists and news editors that are responsible for specific genre of news. Actively writing opinion pieces to newspaper editorials and making blog posts on popular online portals are another reason.
Laying out strategies for recruiting new contributors using social media: Learning from our past initiative experiences such as the movement where new contributors on social media helped Odia Wikisource go live^[2], CIS-A2K has been helping communities with online outreach strategies. Some of the lessons learned can be found in this learning pattern.

Other Communication and Contribution

Balance of Focus Language Area (FLA) and non-FLA language: As CIS-A2K has been working primarily in five focus languages (Kannada, Konkani, Marathi, Odia and Telugu, with Tulu and Santali as two additional languages), there has been more attention paid to the aforementioned seven languages and less on the remaining Indian languages. The same pattern also reflects in our media outreach. To balance this and to provide support in the larger Indic language community, CIS-A2K has made efforts in connecting non-FLA Wikimedians with global community leaders^[3] and writing about work accomplished in non-FLA communities.^[4]
Highlighting the' community-led projects and less-known languages: CIS-A2K has contributed and highlighting in promoting the projects that are primarily community-led^[5] that are not necessarily catalyzed by the CIS-A2K. Also, via public speaking and publications, CIS-A2K has attempted to promote indigenous and the less-known languages of India.^[6]

Challenges

Labor intensive WEP programs: WEP initiative at many of our institutions have proven to be labour intensive. A2K team has not been able to integrate its efforts with the community members. There has also been a perception that the participating Higher Education institutions are required to only provide infrastructure and carve time out of academic schedule. This leads to a situation where the A2K team is often forced to devote time and resources towards the evaluation of assignments.
Lack of institutional partnership in Odia community: Despite the A2K team's attempts to establish formal institutional partnership and further a WEP initiative in Odia language, we have not been successful. With the consent of the Odia community A2K team has approached Centurion University regarding setting up a Wikisource Learning Centre.

CIS-A2K request page

CIS-A2K has a request page intended for Wikimedian/s from India to place requests for support from CIS-A2K. Between 1 July 2015 and 30 June 2016, CIS-A2K has supported 21 such programs/initiatives. The communities supported by CIS-A2K include Odia, Kannada, Telugu, Malayalam, Bengali etc. Besides offering financial support to conduct events, CIS-A2K has also provided non-financial support such as SWAG material, and technical and documentaion support.

Some of the events/initiatives we have supported are

Odia Wikipedians conducting Nabakalebara edit-a-thon (July 2015), Odia Wikisource 1st anniversary celebration (October 2015), Wikipedia's 15th Birthday celebration (January 2016)
funding Bengali Wikipedia community to conduct a workshop (Wikiacademy) (August 2015), a meetup (October 2015), and an "in-depth Meet-up of Bengali Wikipedia editor community in Kolkata" (June 2016)
helping Malayalam Wikimedia community to organize a meet-up at Kozhikode, Kerala (July 2015), and Wikisangamotsavam 2015 (December)
support Telugu Wikipedians to conduct a photowalk and a joint Telugu-English Wikimedians’ meetup in Hyderabad (both in December)
supporting two-day workshop on Samskrit Wikisource - 2016

Lessons learnt

WMF grants opportunities should be discussed and promoted amongst Indic Wikimedia communities.
Wikimedia communities must be encouraged to optimize in-kind support such as event venue, internet connectivity.

Challenges

We have continuously informed communities that a request (specially if it is a large one) should come to us at least 3-4 weeks before the event date(s). However we have received requests at the last moment and hence faced difficulties (such as time-pressure) reviewing and process these requests in time.
We ask communities to submit expenditure details and narrative report of an event soon after its completion. However, we have faced difficulties collecting the said records in time.

Revenues received during this period (6 month for progress report, 12 months for impact report)

Provide exchange rate used:

1 USD = 61.88 INR

Table 2 Please report all spending in the currency of your grant unless US$ is requested.

Please also include any in-kind contributions or resources that you have received in this revenues table. This might include donated office space, services, prizes, food, etc. If you are to provide a monetary equivalent (e.g. $500 for food from Organization X for service Y), please include it in this table. Otherwise, please highlight the contribution, as well as the name of the partner, in the notes section.

Revenue source	Currency	Anticipated	Q1	Q2	Q3	Q4	Cumulative	Anticipated ($US)*	Cumulative ($US)*	Explanation of variances from plan
GSMA	INR	263,783.00	263,783.00	-	-	-	263,783.00	4262.73	4262.73
Wikimedia Foundation	INR	12,000,000.00	6,997,845.00	-	4,998,082.00	-	11,995,927.00	193,923.72	193,857.90
Kusuma Foundation	INR	15,000,000.00	7,500,000.00	-	7,500,000.00	-	15,000,000.00	242,404.65	242,404.65
MacArthar Foundation	INR	6,593,625.00	6,593,625.00	-	-	-	6,593,625.00	106,555.03	106,555.03
Cybersteward Project	INR	495,100.00	495,100.00	-	-	-	495,100.00	8,000.97	8,000.97
Big Data MF	INR	4,578,734.00	-	4,578,734.00	-	-	4,578,734.00	73,993.76	73,993.76
Privacy International	INR	3,883,300.63	-	405,388.00	3,477,912.63	-	3,883,300.63	62,755.34	62,755.34
IDRC	INR	6,751,260.57	-	-	6,751,260.57	-	6,751,260.57	109,102.47	109,102.47
The Mozilla Corporation	INR	662,173.00	-	-	-	662,173.00	662,173.00	10,700.92	10,700.92

* Provide estimates in US Dollars

Grants	Explanation
GSMA	This fund is allocated to CIS for GSMA project undertaken in collaboration with Privacy International. The research has sought to understand different legal and regulatory aspects of security and surveillance in India.
Wikimedia Foundation	Wikimedia Foundation has given this grant, as part of their APG, to work with the Wikimedia community of volunteers in India to expand Wikimedia’s Indic language free knowledge projects, including Wikipedia in Indic languages. In addition, the grant aims to generate improvements in India-relevant free knowledge in Wikimedia’s English projects and wider distribution of free knowledge within India.
Kusma Foundation Fund	Kusuma Foundation funds the core of CIS programmes.

Spending during this period (6 month for progress report, 12 months for impact report)

Please use the exchange rate in your APG proposal.

Table 3 Please report all spending in the currency of your grant unless US$ is requested.

(The "budgeted" amount is the total planned for the year as submitted in your proposal form or your revised plan, and the "cumulative" column refers to the total spent to date this year. The "percentage spent to date" is the ratio of the cumulative amount spent over the budgeted amount.)

Expense	Currency	Budgeted	Q1	Q2	Q3	Q4	Cumulative	Budgeted ($US)*	Cumulative ($US)*	Percentage spent to date	Explanation of variances from plan
Staff Cost	INR	5,884,320.00	986,800.00	1,328,057.00	1,695,815.00	1,455,531.00	5,466,203.00	95,092.44	88,335.54	92.9	Slightly under spent
Staff Travel & Stay	INR	985,000.00	211,267.00	162,566.00	453,724.00	-	827,557.00	15,917.91	13,373.58	84.02	Due to inclusion of Program Associates presence staff travel has come down
Volunteer Support	INR	1,530,000.00	41,847.00	422,041.00	100,631.00	764,787.00	1,329,306.00	24,725.27	21,482.00	86.89	Increased activities with the intervention of Program Associates
Meetups	INR	895,000.00	84,285.00	4,679.00	151,904.00	114,825.00	355,693.00	14,463.48	5,748.11	39.74	A2K team has conducted Train-the-Trainer and Media Wiki Training during the last quarter of the grant period. These receipts will be updated in the final cumulative financial report
Digitization	INR	150,000.00	5,250.00	-	10,250.00	-	15,500.00	2,424.05	250.48	39.74	Purchase of scanners to assist communities towards digitisation has been done
Equipment	INR	80,000.00	-	170,000.00	362,430.00	122,660.00	655,090.00	1,292.82	10,586.46	819	Essential equipment such as laptops, video camera and hard disks purchased for newly hired Program Associates and A2K staff
Assistant/Intern	INR	110,000.00	20,000.00	30,000.00	110,000.00	-	160,000.00	1,777.63	2,585.65	145.45	Hiring of 3 Program Associates has resulted in over spending
Consumables (Printing, Statinery, Swag)	INR	460,000.00	-	-	-	-	0	7,433.74	0	0	A2K was unable to utilise these funds for publishing and distributing of Community Resources
Miscellaneous	INR	165,000.00	89,003.00	21,207.00	50,978.00	50,442.00	211,630.00	2,666.45	3,420.01	128	Unanticipated expenses regarding orientation of PA
Design/Documentation & Research	INR	50,000.00	-	20,950.00	-	16,508.00	37,458.00	808.02	605.33	75	Optimal spending
Program Advisor	INR	580,800.00	132,000.00	132,000.00	132,000.00	132,000.00	528,000.00	9,385.91	8,532.64	90.9	Optimal spending
TOTAL	INR	11,979,132.00	1,570,452.00	2,291,500.00	3,067,732.00	2,656,753.00	9,586,437.00	193,586.49	154,919.80	80	Final Financial report will have the cumulative details.

* Provide estimates in US Dollars

Compliance

Is your organization compliant with the terms outlined in the grant agreement?

As required in the grant agreement, please report any deviations from your grant proposal here. Note that, among other things, any changes must be consistent with our WMF mission, must be for charitable purposes as defined in the grant agreement, and must otherwise comply with the grant agreement.

Are you in compliance with all applicable laws and regulations as outlined in the grant agreement? Please answer "Yes" or "No".

Are you in compliance with provisions of the United States Internal Revenue Code (“Code”), and with relevant tax laws and regulations restricting the use of the Grant funds as outlined in the grant agreement? Please answer "Yes" or "No".

References

2016 TTT version was conducted between 15–17 June 2016, and in this impact report we are reporting only till 30 June 2016. Although we have seen positive impact after this year's TTT, we are not including these in this report.
Panigrahi, Subhashish. "More Than 40 Million People Await the Launch of Odia Wikisource". Wikimedia Blog (21 October 2014).
[ Roali], an IME for Assamese language that is quite popular in the Assamese speakers, came live after long time. CIS-A2K has worked closely with the developer of this IME, some of the Assamese Wikipedia community members and Wikimedia Foundation's Language Engineering team in the entire process.
Broadening the scope of blogs CIS-A2K has contributed to the larger Indic communities has been a constant effort, though in a limited capacity. A few such blogs can be read here: 1, 2, and 3.
In this article, a community-led project for creating a script encoding converter for the Odia-language Wikimedia projects was highlighted. There were more publication in the Odia newspapers and the project was promoted on social media so that more people contribute using the Unicode standard. The latter will eventually help spread the language's reach on the Internet.
CIS-A2K and type designer Pooja Saxena submitted a paper and presented a paper titled "Bringing Ol Chiki to the digital world" at the Typoday 2016, an annual conference in India to bring type designers and script experts under one roof. The presentation is about CIS-A2K's work in bringing a freely-licensed typeface for the Ol Chiki script that is used to write Santali, an indigenous language spoken across several countries in South Asia.

Signature

Once complete, please sign below with the usual four tildes.

Lahariyaniyathi (talk) 17:01, 28 September 2016 (UTC)

Resources

Resources to plan for measurement

Global metrics are an important starting point for grantees when it comes to measuring programmatic impact (Learning Patterns and Tutorial) but don’t stop there.
Logic Models provide a framework for mapping your pathway to impact through the cause and effect chain from inputs to outputs to outcomes. Develop a logic model to map out your theory of change and determine the metrics and measures for your programs.
Importantly, both qualitative and quantitative measures are important so consider both as you determine measures for your evaluation and be sure to ask the right questions to be sure to capture your program stories.

Resources for storytelling

WMF storytelling series and toolkit (DRAFT)
Online workshop on Storytelling. By Frameworks institute
- The origin of storytelling
- Story frames, with a focus on news-worthiness.
Reading guide: Storytelling and Social change. By Working Narratives
- The uses of the story.
- Case studies.
Blog: 3 Tips on telling stories that move people to action. By Paul VanDeCarr (Working Narratives), on Philanthropy.com
Building bridges using narrative techniques. By Sparknow.net
- Differences between a report and a story
- Question guides and exercises.
Guide: Tools for Knowledge and Learning. By Overseas Development Institute (UK).
- Developing a strategy
- Collaboration mechanisms
- Knowledge sharing and learning
- Capturing and storing knowledge.

For more details visit https://cis-india.org/a2k/blogs/grants-apg-proposals-2014-2015-round2-the-centre-for-internet-and-society-impact-report-form

Govt wants to scrub the Internet clean

praskrishna — 2011-12-07T04:07:03Z

Web advocacy groups, experts say govt’s move to evolve content guidelines amounts to censorship. This article by Surabhi Agarwal & Leslie D’monte was published in Livemint on 7 December 2011. Sunil Abraham has been quoted in this article.

India, the world’s largest democracy, may force companies such as Google Inc., Microsoft Corp., Yahoo Inc. and Facebook Inc. to take down online content that it deems offensive because they haven’t been able to come up with an effective self-censorship mechanism governing millions of users.

The Congress-led United Progressive Alliance government had no option but to "evolve guidelines" to ensure that "blasphemous content on the Internet or television is not allowed", with Internet and social networking sites such as those above "failing to respond to and cooperate with" the government’s request to keep "objectionable" content out of their websites, Kapil Sibal, minister of communications and information technology (IT), said in New Delhi on Tuesday.

His comments unleashed a firestorm of criticism by Internet advocacy groups and experts, who said the move amounted to censorship and was anti-democratic, impractical and unwarranted since existing laws were comprehensive enough to remove "objectionable" content. The move, they argued, would also stem the growth of user-generated content sites, and thus the Internet itself.

The government has been battling a series of corruption scandals and criticism of its inability to move forward on policy reforms. A campaign against corruption fuelled by online support has also challenged the government’s authority to legislate, forcing its own version of an anti-graft legislation onto the agenda.

The latest move by the government follows the introduction of new rules to the Information Technology Act, 2008, that were published earlier this year, also heavily criticized, that called on Internet service providers (ISPs) along with other entities to police online postings, including blogs.

Sibal referred to what he considered objectionable content as a "matter of grave concern", which affects the "sensibility of our people and is against our cultural ethos".

Once the new policy framework is implemented, companies “will be duty-bound to share information about those who post content, even if it (the content) is posted outside India”. He didn’t say by when the policy would be put in place.

Discussions with executives from the firms mentioned above had begun in September, Sibal said. They had been asked to come up with solutions to address the perceived problem in a month’s time and had failed to do so, he said.

According to local media reports, the move follows posts about some senior Congress leaders, including party president Sonia Gandhi. The minister, who is also one of India’s top lawyers, did not refer to any specific "objectionable" material during his press briefing, but rued that “the content has still not been removed".

Google India defended the right of free speech, while saying that it didn’t condone illegality.

"Even where content is legal but breaks our own terms and conditions, we take that down too, once we’ve been notified about it," Google India said in a release. "But it also means that when content is legal but controversial, we don’t remove it because people’s differing views should be respected, so long as they are legal."

Facebook India also said that it would remove any content that crossed the line.

It "has policies and onsite features in place that enable people to report abusive content", the company said. "We will remove any content that violates our terms, which are designed to keep material that is hateful, threatening, incites violence or contains nudity off the service."

While Yahoo India declined to comment, Microsoft did not respond to an email till press time.

Internet censorship is a rising trend, with approximately 40 countries filtering the Web in varying degrees, including democratic and non-democratic governments. Governments are using increasingly sophisticated censorship and surveillance techniques, including blocking social networks, to restrict a variety of types of content, says the 2010 Global Network Initiative (GNI) report. GNI seeks to protect freedom of speech online.

This August, for instance, the Centre had written to the department of telecommunications, asking it to "ensure effective monitoring of Twitter and Facebook", which minister of state for communications and IT Milind Deora acknowledged a few days later in a written reply to a question in the Rajya Sabha. He mentioned access to “encrypted data” on social networking sites, but did not elaborate on the subject.

Currently, the Indian Telegraph Act and the IT Act, 2008, (amendments were introduced in IT Act, 2000) give the government the power to monitor, intercept and even block online conversations and websites. The Centre for Internet and Society (CIS) has put up a list of 11 such websites blocked by a government order. The data was received from the department of information technology (DIT).

Moreover, under section 79 of the IT Intermediary (Rules and Guidelines), 2011, intermediaries (comprising telcos, ISPs, network services providers, search engines, cyber cafes, Web-hosting companies, online auction portals and online payment sites) are mandated to exercise "due diligence" and advise users not to share/distribute information violative of the law or a person’s privacy and rights. Intermediaries are expected to act on a complaint within 36 hours of receiving it, and remove such content when warranted.

In case the intermediary doesn’t find the content objectionable, the matter will have to be contested in a court of law.

"Currently, you need a court of law to direct a company in case something has to be removed. That takes a lot of time. So there has to be a mechanism that is faster in dealing with such content as (it) can be very damaging," said a DIT official, who did not want to be named.

"The Indian government can, and should, monitor conversations and websites if it believes the content can harm the security, defence, sovereignty and integrity of the country," said Pavan Duggal, a Supreme Court lawyer and cyber law expert. However, he wondered how the government would go about implementing the task of monitoring each and every conversation on an unstructured Internet.

Bangalore-based CIS, an Internet advocacy group, said "this pre-emptive manual screening of content, if implemented, would sound the death knell of freedom of expression in India".

"This screening is worrisome. Companies will err on the side of caution in a bid to please the government, and the courts will not be involved," said Sunil Abraham, executive director of CIS. “This is not only unconstitutional, but technically impossible too. Speech and words have nuances. Can humans decipher these with accuracy?"

The move will undermine key principles on which the Internet was built, said Nikhil Pahwa, editor and publisher of digital industry news and analysis blog MediaNama.

"It is completely impossible to enforce this. There is no way that content can be prescreened before it is placed online," he said. “It also kills the concept of immediate communication, which the Internet stands for."

Cyber law expert NA Vijayashankar, who runs cyber law information portal Naavi, said: "The government has valid reason to control anti-national activities on the Internet. But there are existing laws for it. The current proposition is impractical since pre-scrutiny of content on the Internet is not possible. It will affect the growth of user-generated content, which is helping Internet penetration grow in India."

Internet censorship happens frequently in countries such as Myanmar, Cuba, China (which had blocked keyword searches of the word "Egypt" on the Internet as well as on Weibo, the Chinese equivalent of Twitter), Iran, Egypt and Saudi Arabia. On the very day the Egyptian government set out to block Internet services in the country (in January), US Republican senator Susan Collins floated the COICA Bill, popularly called the "kill switch" Bill, which, if approved, would give the US president similar powers.

Read the original published in Livemint here

For more details visit https://cis-india.org/news/scrub-the-internet-clean

Govt wants to monitor Facebook, Twitter

praskrishna — 2011-08-09T09:21:55Z

The Union home ministry has written to the department of telecom asking it to "ensure effective monitoring of Twitter and Facebook".

Milind Deora, minister of state for communications and information technology, said in written reply to a question on Friday in the Rajya Sabha that DoT has received a letter from MHA to ensure monitoring of social networking websites like Facebook and Twitter in order to "strengthen cyber security paraphernalia".

He said that in cases where the data is encrypted, the department works with all concerned parties to obtain lawful access to it.

Citing security a reason, India in the recent months has sought more surveillance and monitoring from internet service providers as well as companies like Research In Motion, which sells BlackBerry phones capable of encrypted emails and messaging.

In April the government notified a new set of IT rules, virtually making intermediaries like internet service providers and web hosts and websites like Facebook and Twitter responsible for any wrongdoings on their networks. The rules were widely criticized by privacy activists.

Sunil Abraham, executive director of Centre for Internet and Society said these "blanket surveillance practices" are counterproductive.

"People advocating greater surveillance don't understand how the web works. In some cases, if there is evidence, targeted monitoring can be done but if governments wants to go through each tweet and every status update, it's just waste of money and resources. Agencies involved in monitoring can do better work by focusing on core issues. This will also save ordinary law-abiding citizens from unnecessary harassment," said Abraham.

According to their policies, Twitter and Facebook don't share any private information available on their servers without valid court order or subpoena. Twitter had said in the past that even if there was a court order, it would first inform the users in question before sharing information related to them.

This article was published in the Times of India on August 8, 2011. The original can be read here.

For more details visit https://cis-india.org/news/govt-to-monitor-facebook-twitter

Govt to keep Aadhaar record for 7 years, activists worried

praskrishna — 2016-10-17T01:53:24Z

The government will keep for seven years a record of all the services and benefits availed using the Aadhaar number, say new rules, prompting fears that the database could be used for surveillance.

The article by Aloke Tikku was published in the Hindustan Times on October 17, 2016. Sunil Abraham was quoted.

The Unique Identification Authority of India (UIDAI), which issues the 12-digit biometric identity to all Indian residents, will be required to preserve its record of verification of an Aadhaar number for the duration.

“This is an unprecedented centralised data retention provision,” said Sunil Abraham, director of the Bengaluru-based think tank, Centre for Internet and Society.

UIDAI chief executive officer ABP Pandey said the concerns were exaggerated. The agency was keeping records in case a dispute arose over a transaction.

The information will be retained online for two years and another five years in the offline archives, say the rules notified in September.

Users will be able to check the records but only for two years.

This restriction won’t apply to security agencies. Pandey, however, said the records would not be available to them without a district judge’s permission.

But, HT found that the rules allow designated joint secretary-level officers at the Centre to order access to information on the grounds of national security.

“Once Aadhaar becomes mandatory for all services, it can be used by benign and malignant actors to conduct a 360-degree surveillance on any individual,” Abraham said.

This is how the system, which will need millions of fingerprint-reading machines, works.

Every time a person fingerprints and quotes the Aadhaar number, the agency concerned sends the data to UIDAI to crosscheck the particulars.

The UIDAI authenticates about five million Aadhaar numbers, which are quoted to avail LPG subsidy, cheap ration and even passport, a day against a capacity to verify 100 million requests daily.

“You can think of it as Natgrid Plus,” Abraham said, a reference to the National Intelligence Grid being built by the government.

A one-stop database for counter-terrorism agencies, Natgrid will collate information real time from databases of various agencies such as bank, rail and airline networks.

“…we do not record the purpose for which an authentication request was received but only the details of the agency that sent it,” UIDAI’s Pandey said.

But seven years is a long time. Only a select category of government files are kept for longer than five years.

Asked about two-year deadline for users, Pandey said it would have been a logistic nightmare to let people access the records once the information was offline.

The Supreme Court has a ruled that Aadhaar is not a must for availing welfare schemes and is to decide if collecting biometric data for the 12-digit number infringed an individual’s privacy.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-aloke-tikku-october-17-2016-govt-to-keep-aadhaar-record-for-seven-years-activitsts-worried

Govt releases white paper on data protection framework

Admin — 2017-11-28T14:34:09Z

Public comments are welcome till 31 December on the data protection white paper, which is aimed at securing digital transactions and addressing privacy issues.

The article by Komal Gupta was published in Livemint on November 28, 2017

A nuanced approach towards data protection will have to be followed in India, keeping in mind the fact that individual privacy is a fundamental right limited by reasonable restrictions, according to a white paper issued by the government on a data protection framework.

The government has sought public comments till 31 December on the white paper, which is aimed at securing digital transactions and addressing customer and privacy protection issues.

The white paper, drafted by the committee of experts on data protection framework, was released by the ministry of electronics and information technology on Monday.

On 31 July, the government constituted a 10-member committee of experts headed by former Supreme Court justice B.N. Srikrishna to study various issues relating to data protection and make specific suggestions on the principles to be considered for data protection as well as suggest a draft Data Protection bill.

Other members of the committee include telecom secretary Aruna Sundararajan, Unique Identification Authority of India chief executive Ajay Bhushan Pandey, and additional secretary in the information technology ministry Ajay Kumar.

The committee seeks to put the onus on stakeholders and the public through a questionnaire on issues such as collection of personal data, consent of consumers, penalties and compensation, code of conduct and an enforcement model that should be set up.

“The sensitivity of the data could also develop based on its combination with other types of information. For example, an email address taken in isolation, is not sensitive. However, if it is combined with a password, then it could become sensitive as it opens access to many other websites and systems, which may expose the individual to harm such as cyberattacks and phishing frauds,” the white paper said.

It is also possible that personal or even non-personal data, when processed using big data analytics, could be transformed into sensitive personal data. Therefore, there may be a need to create safeguards which will prevent misuse of personal information in these contexts of use, it added.

The white paper also seeks “to designate certain lawful grounds under which data can be processed, even in the absence of consent.”

In some situations, seeking consent prior to a data processing activity would not be possible, or it may defeat the purpose of the processing. For instance, where law enforcement officials need to apprehend a criminal, seeking the consent of the criminal prior to processing would defeat the purpose of the investigation, it said.

“It seems to be an eminently reasonable white paper which raises the right questions. However, it lacks analysis of data protection vis-a-vis Aadhaar,” said Pranesh Prakash, policy director at the Centre for Internet and Society, a Bengaluru-based think tank.

Safeguarding privacy rights needs much more than a data protection law; it needs a larger consultation that includes issues like surveillance as well, added Prakash.

For more details visit https://cis-india.org/internet-governance/news/livemint-november-28-2017-komal-gupta-govt-releases-white-paper-on-data-protection-framework

Govt presses 'undo' button on draft encryption policy

praskrishna — 2015-09-25T01:55:57Z

The decision came a day before PM embarked on a visit to the US, where he is expected to meet leaders of firms such as Apple, Facebook, Google and Tesla.

The article was published in Business Standard on September 23, 2015. Sunil Abraham gave inputs.

The government on Tuesday scrapped a draft national encryption policy that mandated firms and individuals to allow authorities access to all encrypted information on email, apps, websites and business servers.

The decision came a day before Prime MinisterNarendra Modi embarked on a visit to the US, where he is expected to meet leaders of firms such as Apple, Facebook, Google and Tesla. Activists and executives from technology firms had expressed outrage on the draft policy, saying the move would have taken India a step back in technology adoption.

At a meeting of the Union Cabinet on Tuesday, Modi was livid at the controversy generated by the draft policy and directed officials to withdraw it ahead of his US trip, sources said.

The draft had global ramifications, as Facebook,Twitter and messaging apps such as WhatsApp were named in it.

Ravi Shankar Prasad, Union minister for communications and information technology, distanced the government from the draft hosted on the IT department site, but admitted it gave “uncalled-for misgivings”. He directed officials to rework the draft but did not set a timeframe for seeking feedback from the public.

“Yesterday (Monday), it was brought to our notice that the draft had been put in the public domain for, seeking comment. I read the draft. I understand that the manner in which it was written could lead to misconceptions. I have asked for the draft policy to be withdrawn and reworded. I personally feel some of the expressions used in the draft are giving rise to uncalled-for misgivings,” Prasad said. “Experts had framed the draft policy. It is not the government’s final view.”

According to the original draft, the encryption policy sought every message sent by a user, be it through services such as WhatsApp, an SMS or an email, be mandatorily stored in plain text format for 90 days and made available on demand to security agencies. Failure to do so, it added, would draw legal action.

This was because typically, all messaging apps and services such as WhatsApp, Viber, Line, Google Chat and Yahoo! Messenger have high levels of encryption, which security agencies find hard to crack and intercept.

Early on Tuesday, before Prasad announced the withdrawal of the draft policy, the government had issued an addendum to keep social media and web applications such as WhatsApp, Twitter and Facebook out of its purview.

In a three-point clarification, the Department of Electronics and Information Technology (DeitY) said some encryption products were exempt. “Mass-use encryption products, currently being used in web applications, social media sites and social media applications, such as WhatsApp, Facebook and Twitter…SSL/TLS encryption products being used in internet banking and payment gateways, as directed by the Reserve Bank of India”, and SSL/TLS encryption products being used for e-commerce and password based transactions,” it said.

“Ideally, the new policy should only focus on two objectives: It should mandate encryption standards within the government, military, law enforcement and intelligence agencies. It shouldn’t regulate the use of encryption by the private sector; the private sector should be allowed to use whatever it believes is appropriate, as long as it is considered a reasonable security measure by courts, under section 43A of the IT Act,” said Sunil Abraham, director,Centre for Internet and Society (CIS).

Prasad reiterated the government, under the leadership of Prime Minister Narendra Modi, had promoted social media activism. “The right of articulation and freedom we fully respect. But at the same time, we need to acknowledge that cyber space transaction is rising enormously for individuals, businesses, the government and companies,” he said.

Opposition parties slammed the Draft policy. Congress communications in-charge Randeep Surjewala said, “Subjugation of individual freedom, surveillance of the citizen and suppression of dissent have emerged as the DNA of the Narendra Modi-led BJP government. The draft policy on encryption, first circulated, then amended and now, withdrawn with a rider for re-issuing it, is a totalitarian, misconceived and a failed attempt of the Modi government to override all sense of individual freedom of speech and expression and encroach upon the right to privacy of communication…With 243.1 million internet users in India at the end of 2014 (173 million being mobile internet users), 112 million Facebook users, 80 million WhatsApp users, 22 million Twitter users and 950 million mobile connections, the intrusion of individual liberty is fraught with dangerous dimensions under the Modi government.”

Aam Aadmi Party spokesperson Raghav Chadha said, “Only a fascist government can bring such a policy. The draft policy was in violation of the right to personal liberty and the fundamental tenets of freedom of speech and expression…the draft policy was for snooping. It presupposes the 1.2 billion people of India are potential criminals. It reflects the inclination of the government and its intention to turn India into a totalitarian state.”

ABOUT THE NATIONAL ENCRYPTION POLICY

Five things the government draft policy wanted

Information security for individuals, businesses and government agencies
Development of indigenous encryption standards
Use of digital signatures to authenticate transactions
Legal interception and data retention
Service providers to register under appropriate government agency

Things that caused outrage

Regulation of private sector encryption
Storage of all encrypted communications for

90 days

Gaining backdoor into private communications of users

Amendment & withdrawal

Omission of mass encryption products such as those used by social networks
Withdrawal of draft policy following Ravi Shankar Prasad’s statement

For more details visit https://cis-india.org/internet-governance/news/business-standard-september-23-2015-govt-presses-undo-button-on-draft-encryption-policy

Govt narrative on Aadhaar has not changed in the last six years: Sunil Abraham

praskrishna — 2016-03-16T16:37:19Z

The bill is basically the same as the UPA version, with some cosmetic changes, and some tokenism towards the right to privacy, says Abraham.

Shreeja Sen interviewed Sunil Abraham. The article was published in Livemint on March 8, 2016.

The government’s bid to push financial inclusiveness and access to government services has received a fresh boost, with finance minister Arun Jaitley introducing a proposed law to give legislative backing to Aadhaar, being implemented by the Unique Identification Authority of India (UIDAI).

This project, which uses a person’s biometric data like fingerprints and iris scans to authenticate identity of people receiving subsidies and other state benefits, will move India towards a cashless economy and help digital initiatives such as biometric attendance, Pradhan Mantri Jan Dhan Yojana, digital certificates, pension payments and the proposed introduction of payments banks.

Sunil Abraham, 42

Abraham is executive director of Centre for Internet and Society, a Bengaluru-based think tank focusing on accessibility, access to knowledge, telecom and Internet governance. He has written extensively on the UID scheme, and the intersection of privacy and security. He founded Mahiti—an enterprise that aims to reduce the cost and complexity of information and communications technology for the voluntary sector by using free software.

The Aadhaar project has faced its share of roadblocks with cases challenging it pending before the Supreme Court. A constitution bench of the court will decide whether the right to privacy is a fundamental right and if Aadhaar violates it.

Sunil Abraham, the executive director of Centre for Internet and Society, a Bengaluru-based policy research institute, is a critic of Aadhaar for several reasons. He explained his concerns in an interview. Edited excerpts:

Have any of the concerns regarding the Aadhaar project since its inception in 2009 been addressed?

Whatever we complained about six or seven years ago, whatever complaints were made by the civil society...all of those complaints remain in the exact same situation.

Nothing has changed.

What kind of concerns?

The first thing to remember is that privacy and security are just two sides of the same coin. You cannot have one without the other.

Our first concern with the project is centralization. Whenever you build an information system, and you create a central point of failure, then it will fail because the possibility of failure exists. The Internet has no central point of failure. That is why it is so difficult for you to bring the Internet down. Complaint number 2 is the opaque technology.

UIDAI keeps saying that “we have built a technology using a free software and open standard stack”. The first is a de-duplication software and the second one is the authentication software—those are the most important pieces of software.

This software is proprietary and nobody knows how they work and nobody can independently audit them.

The third complaint is the use of an irrevocable and non-consensual authentication factor. In the UID scheme, the biometrics serve two purposes: it can be used to identify a citizen and it can be used to authenticate a transaction. Authentication factors, commonly known as passwords, should always be revocable. That means if the password is compromised, you should be able to change the password or at least say that this password is no longer valid. The use of biometrics eliminates those two important requirements.

Further, in most other authentication, the process of authentication ensures that you are consenting. For example, PIN (personal identity number) authentications. But suppose I am authenticating you through your irises, then as long as your eyes are open, the machine will think you’re authenticating. There’s no way of saying I don’t want to authenticate. Or if you’re sleeping, somebody can hold your fingers over a biometric reader and open your iPhone. So that’s complaint number three.

The fourth complaint from the privacy perspective is: there is a very important database that they don’t talk about. I call it the transactions database. Suppose there is somebody who is using the UIDAI service to authenticate a transaction, then UIDAI should keep a record of that successful or unsuccessful transaction authentication. That means you have been registered into the database.

You go to a fair price shop to purchase subsidized grain and at that fair price shop or ration shop, you use your finger on the biometric reader, and then the UIDAI system says “yes you are indeed who you say you are”.

So, at that point, later the shop should not be able to say X never came here, or X came twice. So, in order for them to not say all those things, a record should be made on the UID database, that on this day, from this geographical location, this particular biometric reader sent us X’s biometric template and asked if the template matched against X’s UID number...the transaction database can be used for profiling. They never talk about it.

They never tell us what that database holds and how long they’re keeping all those records. None of that is clear.

Does Aadhaar bill help assuage your doubts about the project?

The government narrative has not changed in the last six years; the bill is basically the same as the UPA (United Progressive Alliance) version, with some cosmetic changes, and some tokenism towards the right to privacy. The proof that the technology is fallible is in the bill.

If the technology was infallible, as the UIDAI would like us to believe, then the bill would not criminalize the following: (1) impersonation at the time of enrolment; (2) unauthorized access to the Central Identities Data Repository.

Imagine that the bill admits that every Indian’s biometric can be stolen from one single centralized database. Now why don’t we have a similar offence for stealing all private keys from the Internet—we don’t because that is technical impossibility thanks to decentralization.

Therefore we don’t need a law to make (it) illegal. We’ve suggested changes to both the technology and the law. We’ve written seven open letters to the UIDAI, and we’ve never gotten any response. Very few of our concerns have been addressed. We’ve seen dogs getting UID, various other things getting UID, so there’s a lot of evidence that the system does not work. From Kerala we have stories of one person getting several UIDs, so we have no idea about technological feasibility of the project.

One of our distinguished fellows, Hans Varghese Mathews, has published an academic paper in the latest EPW (Economic and Political Weekly), by extrapolating UIDAI field trial data to national scale. He predicts that by the time the number crosses 1 billion, every time UIDAI tries to register someone new, they will match with about 850 people already in the database positively. So, the unique identification capability of the UIDAI will not scale above the billion. The consequence of the technology failing is not trivial. If someone replaces your biometrics in the central database, then the onus is on you to prove that you are a resident of India.

Previously, human beings determined the answer to this question, and they had to find proof that you were not a resident. Now, a fallible technology will be asked to answer this important question.

Isn’t the basic function of the Aadhaar project to ensure that benefits reach the person they are meant for, and it’s easier for people to get an identity proof for those who have no other ID, like migrant workers?

Two responses: is it good anti- corruption technology? Unfortunately not, because it is intended at retail fraud. The person under surveillance is very poor. But the person responsible for corruption is not poor. So, I believe you should be surveilling those responsible for corruption.

What I had said is UID should be first given to every single bureaucrat and every single politician in the country. From Delhi till the Panchayat office, till the ration shop in the village, that supply chain must be monitored and documented using cryptography, so that nobody can deny anything. We need non-repudiatable audit trail from New Delhi to the village because according to all analyses, that is where the theft is happening—in the supply chain. The villager who is taking false benefits, that is called retail fraud.

The bulk of the fraud is actually wholesale fraud. Please tackle wholesale fraud using non-repudiatable public audit trail from New Delhi to the village first, before you start surveilling the poor.

The second point is that people find it easy to get the UID. That is fine, but there is a problem; that it’s not uniquely identifying anybody. So, people will keep registering and the UID system will keep giving them more and more UIDs because there are no human checks and balances. Because you’ve gone with a pure technological solution, it’s very easy to fool (the system).

So, the ease of registration has not served the purpose.

For more details visit https://cis-india.org/internet-governance/news/livemint-march-8-2016-shreeja-sen-govt-narrative-on-aadhaar-has-not-changed-in-last-six-years-sunil-abraham

Govt and BlackBerry firm wait for the other to hang up

praskrishna — 2011-04-02T10:46:54Z

Sunil Abraham speaks to Archna Shukla on the stand-off between the Government of India and RIM. The news was published in expressindia.com.

What is the current stand-off between the government and RIM all about?

The current logjam is with regards to BlackBerry messenger, email and web traffic. Around two years ago, the government had asked BlackBerry to allow it to monitor the text messages (SMSes) and phone calls exchanged through its platform. The government has since then been monitoring these services with the help of telecom service providers. It, however, still doesn’t have any means to monitor, intercept or decrypt BlackBerry’s messenger, email and web exchanges. The government wants to put in place a surveillance infrastructure to monitor these services and is asking BlackBerry to cooperate.

What is unique about BlackBerry services? Why doesn’t the government have a similar problem with Nokia or Apple?

Companies such as Apple do not provide email and messenger services in India. They only sell their handsets in the country. Nokia recently started providing such services under the Nokia Messaging Services Platform. The service, which includes enterprise solutions, consumer services and Nokia’s own messaging solution Ovi mail, is still in beta format. Nokia’s India spokesperson said the company will set up servers for its various services inside India whenever it kickstarts the functions in a full fledged manner.

Canadian firm Research in Motion (RIM), makers of BlackBerry, on the other hand, provides all these services alongside selling its handsets. It also manages all its data and traffic on its own without giving the access to anybody. The servers for these services are installed outside India. The government is concerned that keeping servers outside the country will give access to foreign authorities to monitor its local traffic and information. In the US, for instance, this kind of monitoring will be possible under the provisions of the Patriot Act.

Is BlackBerry the only one to use strong encryptions?

The use of strong encryption in information technology is prevalent in both the wireless industry and Internet platforms. BlackBerry, however, uses a superior encryption that is highly reliable and secure and it owes its popularity in the world markets to this feature mainly. According to Sunil Abraham, the Executive Director of Bangalore-based advocacy group Centre for Internet and Society, BlackBerry uses strong encryption with 256 bit keys. In comparison, gmail.com and Citibank.co.in use only 128 bit keys.

“If you have encryption on while visiting citibank.com or when using an offline mail client like MS Outlook Express, the government can identify the encrypted service that you are using and the recipient of your encrypted messages. Then they can launch a targeted brute-force attack to intercept and decrypt specific communications,” he says, adding that with the BlackBerry, the government can only see that you are having an encrypted transaction with the BlackBerry servers. They cannot identify the recipients and web services. This makes the brute-force attack difficult as a lot of time is spent decrypting unimportant messages.

What is the problem that RIM is facing in UAE and Saudi Arabia?

In UAE, it is facing the same problem as in India. In Saudi Arabia, BlackBerry will instal computer servers, which would allow the government some access to user’s data.

Can the Indian government and RIM meet half-way?

Unlikely. Though, as per PTI reports,

BlackBerry has made an attempt to break the logjam by offering metadata and relevant information to security agencies which will enable them in lawful interception, it has has failed to enthuse them. At a meeting between government officials and RIM, company’s representatives said that “they can provide the metadata of the message like the Internet Protocol address of BES and PIN and International Mobile Equipment Identity of the BlackBerry mobile”, sources said. Metadata is loosely defined as data about data. It provides information about a certain item’s content like how large the picture is, the colour depth, the image resolution when the image was created, and other data. A text document’s metadata may contain information about how long the document is, who the author is, when the document was written, and a short summary of the document. However, sources said the RIM, which has nearly one million subscribers across India, failed to enthuse the security agencies who want an uninterrupted access to the messaging services on BlackBerry platform. The security agencies apprehend that BlackBerry services in the present format pose a serious security threat.

The government may argue that if surveillance is allowed in some countries, it should have the same access, too.

So far, RIM’s public stand has been that its security architecture was specifically designed to provide corporate customers with the ability to transmit information wirelessly while providing them with the necessary confidence that no one, including RIM, could access their data.

Abraham of the Centre for Internet and Society says there is a possibility of a compromise behind the doors and the citizens may never get to know that a surveillance regime and infrastructure have been put in place to monitor their communications.

Click to read the original.

For more details visit https://cis-india.org/news/govt-and-blackberry