Centre for Internet and Society

Meeting of the two Sub-Groups on Privacy Issues under the Chairmanship of Justice AP Shah in Delhi

praskrishna — 2012-06-14T08:31:39Z

The next meeting of the two Sub-Groups on privacy issues under the Chairmanship of Justice A.P. Shah, former Chief Justice of Delhi High Court is scheduled to be held on June 27, 2012 at 11.00 a.m. in the Committee Room No. 228, Yojana Bhawan, Planning Commission.

Members of both the Sub-Groups are requested to send their final write-ups as decided in the last meeting, by June 20, 2012 so that those could be circulated to all concerned for obtaining feedback and for discussions/ deliberations on June 27, 2012.

Shri S. Bose, Under Secretary (CIT & I) communicated this through notice No. M-13040/47/2011-CIT&I.

The notice was e-mailed to the following individuals:

Justice A.P.Shah, Chairman
Dr. Kamlesh Bajaj
Usha Ramanathan
Sunil Abraham
Prashant Reddy
Prof. Arghya Sengupta
Som Mittal
Shri Gulshan Rai
Mala Dutt

For more details visit https://cis-india.org/news/meeting-of-two-sub-groups-in-delhi

Watch out for cyber bullies

praskrishna — 2012-06-05T06:08:19Z

It's time to take a closer look at this form of cyber crime in India, writes KV Kurmanath in an article published in the Hindu Business Line on June 4, 2012.

The suicide of Tyler Clementi, the 18-year-old New Jersey student in 2010, had triggered a strong debate on invasion of privacy in the cyber age.

His roommate, an Indian student, captured the boy kissing another man in their hostel using his web camera.

The boy jumped into a river unable to take the humiliation, when the former tried to circulate the clip. Though the court refused to link the recording with the death, it sentenced the Indian youth to 30 days in prison last month.

What Clementi was subjected to is cyber bullying, argued those who campaigned for the Indian student's deportation.

Along with other cyber crimes, cyber bullying is on the rise in India too. The fledgling cyber police wings in different states are being flooded with complaints of invasion of privacy, blackmail and circulating electronic messages that cause annoyance.

Ms Aparna (name changed) was aghast when a close friend called her up about a nude picture of her being circulated on the web. A quick check pointed the needle of suspicion at a friend who she had just spurned. Angered by her rejection, the boy morphed her picture, checked into her email account and sent it to all the people in the contact list.

After finding Facebook not so amusing, Sujatha (name changed) decided to close her account and discussed this with a few friends too. A few days later, she found both her FB and gmail accounts compromised. She also found obscene pictures posted on the same.

Legal Issues

Incidents like these are growing sharply with poor knowledge among users abut how to protect accounts. Sharing one's passwords with others too is proving dangerous.

Prof. Madabhushi Sridhar, a cyber laws expert at NALSAR University, says the crimes cited above come under the bracket of invasion of privacy.

He says Section 66A in the amended IT Act deals with these crimes. Sending any message (through a computer or a communication device) that is grossly offensive or has menacing character; any communication which he knows to be false, but for the purpose of causing insult, annoyance, criminal intimidation comes under this section. This crime, he says, is punishable up to three years with a fine.

Prof. Sridhar, who has just completed a book on cyber laws, feels that punishments under the IT Act are insufficient. "They should be read with the Indian Penal Code. This will be an effective method to check cyber crimes," he says.

Prof. Sridhar also represents the Institute of Global Internet Governance and Advocacy (GIGA) at the Law University. GIGA conducts research on the Internet and takes up advocacy and training programmes on Internet Governance.

"We already have anti-voyeurism provisions in the IT Act under Sec. 66E," Mr Sunil Abraham, Executive Director of Centre for Internet and Security, says.

This offence is punishable with ‘imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with both.'

Repeated harassment aka cyber bullying can be addressed using the already over-broad provisions under Sec. 66A. Unfortunately this Section goes too far and can be used to censor legitimate speech.

"Security and privacy awareness in India is very poor. It would be very useful if both the government and civil society was more aggressive in awareness raising and triggering change in behaviour. Unfortunately this is a bit like smoking - even though people are aware of the issues - they engage in risky behaviour online," he says.

Lack of Data

Mr.Pavan Duggal, Chairman of Cyber Law Committee and Cyber laws expert, said there is no specific data on cyber crime in India and the data available with the NCRB (National Crimes Records Bureau) of around 900 cases for overall cybercrime is also doubtful.

"The solution is to make cyber laws more strict as current law under IT Act 2000 is a bailable offence with three years imprisonment and a fine," he points out.

"IT Act 2000 has to be re-amended to specific provisions pertaining to cyber bullying. Further, cyber bullying needs to be made a serious offence with minimum five years imprisonment and a fine of Rs 10 lakh. Unless you have deterrence in law it will be a continuing offence," he observes.

Fortunately, there are some safeguards which can help prevent such acts of cyber offences. In most cases, the acts of bullying or blackmailing are done by someone close to the victims. People should make it a point to keep their Internet identities very safe.

One should not disclose their identities such as passwords or hint questions to anyone – no matter how close they are. Parents should keep an eye on their children who are addicted to the Internet. They should inform and educate their children on the clear and present dangers that lurk on the Net.

They should also teach the importance of respecting others' privacy apart from taking precautions to keep their private space very safe.

(with inputs from Ronendra Singh)

Click to read the original published in the Hindu Business Line. Sunil Abraham is qouted in this article.

For more details visit https://cis-india.org/news/watch-out-for-cyber-bullies

Privacy International's Trip to Asia

praskrishna — 2012-04-25T09:58:12Z

In February 2012, the PI team travelled to India, Bangladesh and Hong Kong to meet with our local partners in the region and speak at four conferences they had organized. We also got the chance to interview our partners in India and Bangladesh on the privacy issues facing them at the moment - this video is the result of those conversations.

PI spent the first half of February in Asia, visiting our regional partners and speaking at events. Our trip began in Delhi, where the Centre for Internet and Society (in collaboration with the Society in Action Group) had organized two consecutive privacy conferences – an invite-only conclave on Friday 3rd February and a free symposium open to the public on Saturday 4th February. The conclave consisted of two panels, the first focusing on the relationship between national security and privacy, the second on privacy and the Internet. We were seriously impressed with the calibre of the speakers CIS and SAG had gathered – the panels included a Supreme Court Advocate, a Member of Parliament and the Former Chief of the Research and Analysis Wing (the Indian equivalent of MI-6 and the CIA) – but Gus and Eric held their own!

The All India Privacy Symposium the next day was partly intended as a public showcase of the amazing research Privacy India, CIS and SAG have conducted over the past two years, including consultations in Kolkata, Bangalore, Ahmedabad, Guwahati, Chennai and Mumbai. The event was organized into five panels: Privacy and Transparency, Privacy and E-Governance Initiatives, Privacy and National Security, Privacy and Banking, and Privacy and Health. A few themes recurred throughout the day – perhaps the most prominent being the repeated allegation that the Indian government's technological illiteracy is putting its citizens at risk. One panellist described how an RTI (right to information) request had recently revealed that the government had no idea how many of its own computers had been hacked or how much data had been stolen – even though this information has been in the public domain since the Wikileaks diplomatic cable releases.

On Sunday, our IDRC funder in Delhi very kindly lent us his beautiful house for a PrivAsia strategy meeting. We chatted about how the Indian project had gone thus far, and the sort of activities our partners would like to undertake over the next couple of years. Their main priority at the moment is India's proposed UID (Unique Identification) project, which is riddled with flaws, inconsistencies and logical gaps. The project is also extremely expensive, with estimates ranging from just under $4 billion to $33 billion. Our partners strongly oppose the programme in its current form, and are exploring a number of strategies for fighting it - we'll keep you appraised of their progress...

PI then parted ways – Gus headed to Hong Kong and Eric and I flew to Dhaka to meet up with Simon and Ahmed Swapan of Voices for Interactive Choice and Empowerment (VOICE), our partner in Bangladesh. We spent a day at the VOICE offices, getting extremely jealous of their huge kitchen and the fact that they all sit down to a freshly cooked lunch every day. That evening, Ahmed took us to a book fair, which was much livelier than we were expecting! It was held outside and was packed with people socialising, eating deep-fried crayfish and (occasionally) perusing the books and pamphlets on display. The fair is apparently an annual event and VOICE have had their own stand there for the past few years.

The following day was the National Convention on the Right to Privacy and Data Protection, organized by VOICE and a group of other Bangladeshi NGOs. We were delighted by the turnout - over 80 people showed up to listen and to voice their own opinions - but Ahmed was unsurprised, explaining that privacy was a hot topic in Bangladesh at the moment. Several issues were clearly extremely controversial, and the debate became very heated when it turned to the relationship between privacy and the right to information (recently enshrined in law in the RTI Act 2009). It was amazing to see how passionate people were, and how eager to improve things. The debate was presided over by retired Justice Golam Rabbani, who urged the government to create a national tribunal for the protection of the citizen's right to privacy.

Gus spent a brief 36 hours in Hong Kong but was able to participate in a symposium run by our partners at Hong Kong University's Faculty of Law. The participants at the symposium included the Privacy Commissioner of Hong Kong, academics and industry experts from China, Macau and Taiwan, and guest speakers from Switzerland and Canada. The slides of many of the presentations are available online. Apparently the level of sophistication in the academic research that is now starting to influence the legislative environment in Hong Kong and China is astonishing.

Trips like these are exhausting but invaluable - they allow us to see the PrivAsia work in action rather than hearing about it in emails and phone calls, and to discuss progress and problems face-to-face. Eric and Gus are already looking forward to Pakistan in April...

This blog post by Emma Draper was published on the Privacy International blog

Watch the video about contemporary privacy issues in India and Bangladesh below

For more details visit https://cis-india.org/news/privacy-internationals-trip-to-asia

The Centre for Internet & Society Joins the Global Network Initiative

praskrishna — 2012-04-25T09:13:50Z

The Global Network Initiative (GNI) is pleased to announce its newest member, the Centre for Internet & Society based in Bangalore, India. A technology policy research institute, CIS brings to GNI in-depth expertise on global Internet governance as well as online freedom of expression and privacy in India.

"We are delighted to add our first member based in India and welcome CIS’s engagement in support of transparency and accountability in technology," says GNI Executive Director Susan Morgan. "GNI's Principles for responsible company behavior apply globally, but require an appreciation of unique local contexts if they are to take hold. CIS will provide invaluable insight as we consider opportunities to work with India's burgeoning ICT industry."

"India’s ICT sector is one of the most dynamic worldwide, " says CIS Executive Director Sunil Abraham, "but rapid technological advances have raised anxieties around issues including hate speech, political criticism, and obscene content at a time when Indian institutions for the protection of free expression are under strain. We look forward to working with GNI's member organizations on these challenging issues."

CIS an independent, non-profit, research organization which is involved in research on the emerging field of the Internet and its relationship to the society, CIS brings together scholars, academics, students, programmers and scientists to engage in a large variety of Internet issues. CIS also runs different academic and research programs and is receptive to new ideas and collaborations, projects and campaigns for the public.

Leslie Harris, GNI Board Member and President and CEO of the Center for Democracy and Technology says: "The addition of CIS not only increases GNI’s global reach, it significantly enhances the initiative’s capacity around shared learning and policy engagement, not just in India, but on internet policy around the world."

Click to read the original published on the Global Network Initiative website.

For more details visit https://cis-india.org/internet-governance/cis-joins-gni

The All India Privacy Symposium: Conference Report

natasha — 2012-04-30T05:16:41Z

Privacy India, the Centre for Internet and Society and Society in Action Group, with support from the International Development Research Centre, Privacy International and Commonwealth Human Rights Initiative had organised the All India Privacy Symposium at the India International Centre in New Delhi, on February 4, 2012. Natasha Vaz reports about the event.

The symposium was organized around five thematic panel discussions:
Panel 1: Privacy and Transparency
Panel 2: Privacy and E-Governance Initiatives
Panel 3: Privacy and National Security
Panel 4: Privacy and Banking
Panel 5: Privacy and Health

Introduction

Elonnai Hickok (Policy Advocate, Privacy India) introduced the objectives of Privacy India. The primary objectives were to raise national awareness about privacy, do an in-depth study of privacy in India and provide feedback on the proposed ‘Right to Privacy’ Bill. Privacy India has reviewed case laws, legislations, including the upcoming policy and conducted state-level privacy workshops and consultations across India in Kolkata, Bangalore, Ahmedabad, Guwahati, Chennai, and Mumbai. India like the rest of the world is answering some fundamental questions about the powers of the government and citizen’s rights and complications that arise from emerging technologies. Through our research we have come to understand that privacy varies across cultures and contexts, and there is no one concept of privacy but instead several distinct core notions that serve as complex duties, claims and obligations.

Privacy and Transparency

Panelists: Ponnurangam K, (Assistant Professor, IIIT New Delhi), ), Chitra Ahanthem (Journalist, Imphal), Nikhil Dey (Social & Political Activist), Deepak Maheshwari (Director, Corporate Affairs, Microsoft), Gus Hosein (Executive Director, Privacy International, UK), and Prashant Bhushan, (Senior Advocate, Supreme Court of India).
Moderator: Sunil Abraham (Executive Director, Centre for Internet and Society, Bangalore)
Poster: Srishti Goyal (Law Student, NUJS)

Srishti Goyal provided the general contours, privacy protections, limits to privacy and loopholes of policy relating to transparency and privacy, specifically analyzing the Right to Information Act, Public Interest Disclosures Act, and the Official Secrets Act.

Nikhil Dey commented on the interaction between the right to privacy and the right to information (RTI). He referred to Gopal Gandhi, the former Governor of West Bengal, “we must ensure that tools like the UID must help the citizen watch every move of government; not allow the government watch every move of the citizen.” Currently, the RTI and the UID stand on contrary sides of the information debate. A privacy law could allow for a backdoor to curb RTI. So, utmost care has to be taken while drafting legislation with respect to right to privacy.

Data and information has leaked furiously in India and it has leaked to the powerful. A person who is in a position of power can access private information irrespective of any laws in place to safeguard privacy. It is necessary to look at the power dynamics, which exists in the society before formulating legislation on right to privacy. According to Nikhil Dey, there should be different standards of privacy with respect to public servants. A citizen should be entitled to information related to funds, functions and functionaries. The main problem arises while defining the private space of a public servant or functionaries.

The RTI Act has failed to address the legal protection for the right to privacy. Perhaps, rules regarding privacy can be added to the Act. It can be defined by answering the questions: (i) what is ‘personal information’? (ii) what is it’s relation to public activity or public interest? (iii) what is the unwarranted invasion of the privacy of an individual? and (iv) what is the larger public good? Expanding on these four points can provide greater legal protection for the right to privacy.

Gus Hosein described the intersection and interaction of the right to information and the right to privacy. He referred to a petition filed by Privacy International requesting information on the expenses of members of parliament. Privacy and transparency of the government are compatible in the public interest. Gross abuse of the public funds by MPs was revealed by this particular petition such as pornography or cleaning of moats of MPs homes. Privacy advocates are supporters of RTI, however, it cannot be denied that there is no tension between transparency and privacy. In order chalk out the differences, there is a need of a legal framework. According to Gus Hosein, in many countries the government office that deals with right to information also deals with cases related to right to privacy.

Mumbai and New Delhi police have started using social media very aggressively, encouraging citizens to take photographs of traffic violations and upload them to Facebook or Twitter. In reference to this, Ponnurangam described the perceptions of privacy and if it agreed or conflicted with his research findings. Ponnurangam has empirically explored the awareness and perspective of privacy in India with respect to other countries. He conducted a privacy survey in Hyderabad, Chennai and Mumbai. People are very comfortable in posting pictures of others committing a traffic violation or running a red light. Ironically, many people have posted pictures of police officers committing a traffic violation such as not wearing a helmet or running a red light.

Chitra Ahanthem described the barriers and challenges of using RTI in Manipur. There are more than 40 armed militia groups, which are banned by the central and state government. The central government provides economic packages for the development of the north-east region. However, the state government officials and armed groups pocket the economic packages. These armed groups have imposed a ban on RTI. Furthermore, Manipur is a very small community. If people try and access information through RTI they risk getting threatened by the Panchayat members and being ostracized from the community or their clan.

People are apprehensive about filing RTI because they believe that these procedures are costly and the police and government may also get involved. Officials use the privacy plea to avoid giving out information. Since certain information are private and not in the public domain, government officials, use the defense of privacy to hide information. In addition, the police brutality prevalent in the area deters people to even have interactions with government officials.

According to Deepak Maheshwari, the open data initiative is a subset within the larger context of open information. There is an onus on the government to publish information, which is in the public domain. As a result, one does not necessarily have to go through the entire process of filing an RTI to get information, which is already there in the public domain. Moreover, if it is freely available in public domain, then one can anonymously access such information; this further strengthens the privacy aspects of requesting information and facilitating anonymity with respect to access to such information in the public domain. It has also to be noted that it is not sufficient to put data out in the public domain but it should also disclose the basis of the data for example, if there is representation of a data on a pie chart, the data which was used to arrive at the pie chart should also be available in the public domain. The main intention of releasing data to the public domain or having open data standards should not only be to provide access to such data but also should be in such a fashion so as to enable people to use the data for multiple purposes.

Prashant Bhushan noted that one of the grounds for withholding information in the RTI Act is privacy. An RTI officer can disclose personal information if he feels that larger public interest warrants the disclosure, even if it is personal information, which has no relationship to public activity or interest. This raises the important question, “what constitutes personal information?” He referred to the Radia Tapes controversy. Ratan Tata has filed a petition in the Supreme Court on the grounds that the Nira Radia tapes contained personal information and that the release of these tapes into the public domain violated his privacy. The Centre for Public Interest Litigation has filed a counter petition on the grounds that the nature of the conversations was not personal but in relation to public activity. They were between a lobbyist and bureaucrats, journalists and ministers. Prashant Bhushan stressed the importance of releasing these tapes into the public domain to show glimpses of all kinds of fixing, deal-making and show how the whole ruling establishment functions. It is absurd for Ratan Tata to claim that this is an invasion of privacy. Lastly, he felt when drafting a privacy law, clearly defining and distinguishing personal information and public is extremely important.

One of the interesting comments made during the panel was on the assumption that data is transparent. Transparency can be staged; questions have to be asked around whether the word is itself transparent.

Privacy and E-Governance Initiatives

Panelists: Anant Maringanti, (Independent Social Researcher), Usha Ramanathan, (Advocate & Social Activist), Gus Hosein, (Executive Director, Privacy International, UK), Apar Gupta, (Advocate, Supreme Court of India), and Elida Kristine Undrum Jacobsen (Doctoral Researcher, The Peace Research Institute Oslo).
Moderator: Sudhir Krishnaswamy (Centre for Law and Policy Research)
Poster: Adrija Das (Law Student, NUJS)

Adrija Das discussed the legal provision relating to identity projects and e-governance initiatives in India. The objective of any e-governance project is to increase efficiency and accessibility of public services. However, a major problem that arises is the linkage of the data results in the creation of a central database, accessible by every department of the government. Furthermore, implementing data protection and security standards are very expensive.

Sudhir Krishnaswamy highlighted the default assumptions surrounding e-governance initiatives: e-governance initiatives solve governance problems, increase efficiency, increase transparency and increase accountability. It is important to analyze the problems that arise from e-governance initiatives, such as privacy.

Usha Ramanathan described the increased number and vastness of e-governance initiatives such as UID, NPR, IT Rules and NATGRID. There are also many burdens on privacy that emanate from the introduction and existence of electronic data management systems. Electronic data management systems have allowed state to collect, store and use personal information of individual. Currently, the DNA Profiling Bill is pending before the Parliament. It is important to question the purpose and need for the government to collect such personal information. It is also to be noted that, there are certain laws such as Collection of Statistics Act, 2008 that penalize individuals if they do not comply with the information requests of the government.

Anant Maringanti discussed the limitations of data sharing that once existed. Currently, data can move across space in a very short time. He analyzed the state and market rationalities involved in e-governance initiatives, which raise the question “who can access data and at what price?”. Data may seem to be innocent or neutral, but data in the hands of wrong people becomes very crucial due to abuse and misuse. For example, Andhra Pradesh was praised as the model state for UID implementation. However, during the process of collecting data for UID a company bought personal information and sold the data to third parties.

Apar Gupta discussed the dilemmas of e-governance. Generally information in the form of an electronic record is presumed to be authentic. The data which government collects is most often inaccurate and wrong. So the digital identity of a person can be totally different from the real identity of that particular person. The process for correcting such information is also very inconvenient and sometimes impossible.
Under the evidence law any electronic evidence is presumed to be authentic and admissible as evidence. The Bombay High Court decided a case involving the authenticity of a telephone bill generated by a machine. The judgment said that since it is being generated by a machine, through and automated process, there is no need to challenge the authenticity of the document, it is presumed to true and authentic. The main danger in such case is that one does away with the process of law and attaches certain sanctity to the electronic record and evidence.

It should be also observed that how government maintains secrecy as to the ways in which it collects data. For example, the Election Commission has refused to disclose the functioning and design of electronic voting machines. The reason given for such secrecy is that if such information is put in the public domain then the electronic voting machines will be vulnerable and can be tampered with. But we, who use the voting machines, will never find out its vulnerabilities.

According to Gus Hosein, politicians generally have this wrong notion that technology can solve complex administrative problems. Furthermore, the industry is complicit; they indulge in anti-competitive market practice to sell these technologies as a solution to problems. However, such technology does not solve any problems rather it gives rise to problems.

Huge amount of government funds is associated with collection of personal data but such data is rendered useless or rather misused, because the government does not have clue as to how to use the data for development and security purposes. The UK National Health Records project estimated to cost around twelve to twenty billion pounds. However, a survey carried out by a professor in University College London showed that the hospital and other health institutions do not use the information collected by the National Health Records. Similarly, the UK Identity Card scheme was estimated to cost 1.3 billion pounds and finally it was estimated to cost five billion pounds. The identity cards are rendered obsolete, the sole department interested in the identity card was the Home Office Department, no other department intended on using it.

Technology should be built in such a manner that it empowers the individual. Technology should allow the individual to control his identity and as well as access all kinds of information available to the government and private bodies on that individual.

According to Elida Kristine Undrum Jacobsen, technology is regarded in this linear manner. It is increasingly being naturalized and as an all-encompassing solution. The use of biometric systems in the UID raises three areas of concern: power, value and social relationships.

With regards to power, there is a difference between providing documentation and information for identification. However, problems arise when the mode of identification becomes one’s body. It also leads to absolute reliance on technology, if the machine says that this is an individual’s identity then it is considered to be the absolute truth and it does not matter even if the individual is someone else. It becomes furthermore problematic with biometric system because it is generally used for forensic purposes.

The other component of UID or any national identification scheme is the question of consent and its relationship to privacy. In the case of UID project, people are totally unaware about how their information will be used and what purposes can it be used or misused for. Therefore, there is no informed consent when it comes to collection of biometric data under the UID project.

On the issue of social value it is to be noted that the value of efficiency becomes the most important value, which is valued. Many of the UIDAI documents state that the UID will provide a transactional identity. However, at the same time it takes away societal layers, which is inherently part of one’s identity. In addition, it makes it possible for the identity of a person to become a commodity to be sold. This also means that the personal information has economic value and players in the market such as insurance companies, banks can buy and sell the information.

When there is identification projects using biometrics it gives the State a lot of power; the power to determine and dictate one’s identity irrespective of the difference in real identity. Moreover, when such identifications projects are carried out at a national level it also gives rise to problem related to exclusion and inclusion of people or various purposes. The classification of the society based on various factors becomes easy and there is a huge risk involved with such classification.

The issues, which came out from the Q&A session, were:

The interplay between fairness and lawfulness in the context of privacy and data collection. There has to be a question asked as to why certain information is required by the State and how is it lawful.
In the neo-liberal era corporations are generally considered to be private. This has to be questioned and furthermore the difference between what is private and what is public. There are also concerns about corporations increasingly collaborating with the State. Can it be still considered as private?

Privacy and National Security

Panelists: PK Hormis Tharakan (Former Chief of Research and Analysis Wing, Government of India), Saikat Datta (Journalist), Menaka Guruswamy, (Advocate, Supreme Court, New Delhi), Prasanth Sugathan, (Legal Counsel, Software Freedom Law Center), and Oxblood Ruffin, (Cult of the Dead Cow Security and Publishing Collective).
Moderator: Danish Sheikh (Alternative Law Forum)
Poster: Suchitra Menon (Law Student, NUJS)

Suchitra Menon discussed the legal provisions for national security in relation to privacy. Specifically, she described the guidelines and procedural safeguards with respect to phone tapping and interception of communication decisional jurisprudence.

In the year 2000, the Information Technology Act (IT Act), 2000 was enacted, this Act had under section 69 allowed the State to monitor and intercept information through intermediaries. Prasanth Sugathan described how the government has been trying to bypass the procedural safeguard laid down by the Supreme Court in the PUCL case by using Section 28 of the IT Act, 2000. The provision deals with certifying authority for digital signatures. The certifying authority under the Act also has the authority to investigate offences under the Act. The provision mainly deals with digital signature but it is used by the government to intercept communication without implementing the procedural safeguards laid down for such interception. Furthermore, the IT Rules which was notified by the government in April, 2007 allows the government to intercept any communication with the help of the intermediaries. The 2008 amendment to the IT Act was an after effect of the 26/11 attacks in Mumbai. The legislation has become draconian since then and privacy has been sacrificed to meet the ends of national security.

Oxblood Ruffin read out his speech and the same is reproduced below.

“The online citizenry of any country is part of its national security infrastructure. And the extent to which individual privacy rights are protected will determine whether democracy continues to succeed, or inches towards tyranny. The challenge then is to balance the legitimate needs of the state to secure its sovereignty with protecting its most valuable asset: The citizen.

It has become trite to say that 9/11 changed everything. Yet it is as true for the West as it is for the global South. 9/11 kick started the downward spiral of individual privacy rights across the entire internet. It also ushered in a false dichotomy of choice, that in choosing between security and privacy, it was privacy that had adapted to the new realities, or so we’ve been told.

Let’s examine some of the fallacies of this argument.

The false equation which many argue is that we must give up privacy to ensure security. But no one argues the opposite. We needn’t balance the costs of surveillance over privacy, because rarely banning a security measure protects privacy. Rather, protecting privacy typically means that government surveillance must be subjected to judicial oversight and justification of the need to surveillance. In most cases privacy protection will not diminish the state’s effectiveness to secure itself.

The deference argument is that security advocates insist that the courts should defer to elected officials when evaluating security measures. But when the judiciary weighs privacy against surveillance, privacy almost always loses. Unless the security measures are explored for efficacy they will win every time, especially when the word terrorism is invoked. The courts must take on a more active role to balance the interests of the state and its citizens.

For the war time argument security proponents argue that the war on terror requires greater security and less privacy. But this argument is backwards. During times of crisis the temptation is to make unnecessary sacrifices in the name of security. In the United States, for example, we saw that Japanese-American internment and the McCarthy-era witch-hunt for communists was in vain. The greatest challenge for safeguarding privacy comes during times when we are least inclined to protect it. We must be willing to be coldly rational and not emotional during such times.

We are often told that if you have nothing to hide, you have nothing to fear. This is the most pervasive argument the average person hears. But isn’t privacy a little like being naked? We might not be ashamed of our bodies but we don’t walk around naked. Being online isn’t so different. Our virtual selves should be as covered as our real selves. It’s a form of personal sovereignty. Being seen should require our consent, just as in the real world. The state has no business taking up the role of Peeping Tom.

I firmly believe that the state has a right and a duty to secure itself. And I equally believe that its citizens are entitled to those same rights. Citizens are part of the national security infrastructure. They conduct business; they share information; they are the benefactors of democratic values. Privacy rights are what, amongst others, separate us from the rule of tyrants. To protect them is to protect and preserve democracy. It is a fight worth dying for, as so many have done before us.

PK Hormis Tharakan discussed the importance of interception communication in intelligence gathering. In the western liberal democracies, restrictions of privacy were introduced for the anti-terrorism campaigns and these measures are far restrictive than what the Indian legislations contemplate. Preventive intelligence is a major component in maintenance of national security and this intelligence is generated and can be procured through interception.

We do need laws to make sure that the power of interception is not excessive or out of proportion. But the graver issue is that the equipment used for interception of communication is freely available in the market at a cheap price. This allows private citizens also to snoop into others conversation. So, interception by civilians should be the main concern.

Menaka Guruswamy discussed the lack of regulation of Indian intelligence agencies that creates burdens on privacy. When there is a conflict between individual privacy and national security, the court will always rule in favour of the national security. Public interest always takes precedence over individual interest.

When there is a claim right to privacy vis-à-vis national security, generally these claims are characterized by dissent, chilling effects on freedom of expression and government accountability. In India, privacy is fragile and relatively a less justifiable right. Another challenge to privacy is that, when communication is intercepted, which part of the conversation can be considered to be private and which part cannot be considered so.

Saikat Datta described his experience of being under illegal surveillance by an unauthorized intelligence agency. When a person is under surveillance, he or she is already considered to be suspect. If the State commits any mistake as to surveillance, carrying surveillance, who is not at all a person of interest in such case upon discovery, there is no penalty for such discrepancy.
He warned of the dangers of excessive wiretapping, a practice that currently generates such a “mountain” of information that anything with real intelligence value tends to be ignored until it is too late, as happened with the Mumbai bombings in 2008. It is clear that the Indian government’s surveillance and interception programmes far exceed what is necessary for legitimate law enforcement.

The issues, which came during the Q&A session was:

In case of national security vis-à-vis privacy in heavily militarized zone, legislations such as Armed Forces Special Powers Act actually give authority to the army to search and seizure on mere suspicion? This amounts gross violation of privacy.

Privacy and Banking

Panelists: M R Umarji, (Chief Legal Advisor, Indian Banks Associations), N A Vijayashankar, (Cyber Law Expert), Malavika Jayaram, (Advocate, Bangalore)
Moderator: Prashant Iyengar (Associate Professor, Jindal Law University)
Poster: Malavika Chandu (Law Student, NUJS)

Prashant Iyengar highlighted how privacy has been a central feature in banking and finance. Even before the notion of privacy came into existence, banks had developed an evolved notion of secrecy and confidentiality, which was fairly robust. Every legislation dealing with banking and finance generally have a clause related to privacy and confidentiality. It might seem that it would be easy to implement privacy in banking and finance given the long relationship between banking and secrecy and confidentiality. However, this is not the case in the contemporary times. Specifically, with the growth in issues related to national security, transparency and technology, the highly regarded notion of privacy seems to be slowly depleting.

Malavika Chandu described the data protection standards that govern the banking industry. As part of the know-you-customer guidelines, banks are required to provide the Reserve Bank with customer profiles and other identification information. Lastly, she described case laws in relation to privacy with respect to financial records.

N A Vijayashankar noted that the confidentiality and secrecy practices in the banking sector emanate from the banker-customer relationship. In the present context, secrecy and privacy maintained by the banks should be analyzed from the perspective of the right of the customer to safeguard his or her information from any third party. Generally, banks and other financial institutions protect personal information as a fraud control measure and not as duty to protect the privacy of a customer.

There has been a paradigm shift in banking practices from traditional banking practices to more efficient but less secure banking practice. Some of the terms and conditions of internet banking are illegal and do not stand the test of law. In contemporary times, banking institutions use confidentiality to cover up problems and data breach rather than protecting the customer. But the banks are not ready to disclose data breach as it apprehends that it will result in public losing faith in the system. The Reserve Bank of India, has recently notified that protection which is provided to the customers in banking services should also be extended to e-banking services. However, the banks have not properly implemented this.

M R Umarji highlighted fourteen laws related to banking which carries confidentiality clauses. In India, public sector banks dominate the market. These banks are created under a statute and such statute governs them. Therefore, they are duty bound to maintain secrecy and confidentiality. Private banks and cooperative banks are not bound by any statute. They do not have any obligations to maintain secrecy, but they do strictly observe confidentiality as a form of banking practice.

Banks are not allowed to reveal any personal information of an individual unless it is sought by some authority that has a legitimate right to claim such information. There has been a constant erosion of confidentiality due to various laws which empowers authorities to seek confidential information from the banks. Recently, in the light of the growing national security concerns, banks also have an obligation to report suspicious transactions. These have caused heavy burdens on right to privacy of an individual.

Under the Right to Information Act, 2005 public sector banks are considered to be public authorities. By the virtue of the Statute, any person can access information from banks. For example, in a recent case an information officer directed Reserve Bank of India, to disclose Inspection Reports. These reports generally contain information regarding doubtful accounts, non-performing account, etc. There is a need that banks should be exempted from the Right to Information Act, 2005. Since they are not dealing with public funds there is no need to apply transparency law to the banks.

Malavika Jayaram described the major conflicts and tensions with respect to privacy vis-à-vis banking and financial systems and financial data. Other privacy and transparency issues include: the publication of online tax information and income data.

Surveillance is built in the design of banking system, so it is capable of tracking personal information and activity. There is a need to implement more privacy friendly and privacy by design systems in the banking sector. Customers are generally ignorant about privacy policies and this influences informed consent and furthermore marketing institution may influence customers to behave in a particular manner. In this context privacy by design becomes very important.

Data minimization principles should be applied; since the more data collected the more there is a risk of data breach and misuse. In case of data retention it is necessary that person giving such data should know how much proportion of the data is being retained and for how long it is stored and also what is the scope of the data and for what purpose will it be used.

Personal information and data, which was previously collected by the government, are gradually being outsourced to private bodies. On one hand it is a good thing that private sector get their technology and security measures right as compared to the government agencies but it comes with the risk that it can be sold out by private bodies as commodities in the market. Private bodies that are harvesting the data can also be forced by the government to disclose it under a particular law or statute without taking into consideration the consent of the individual whose personal information is sought for.

There is multiplicity of documentation for identification, which makes transactions less efficient. This has attracted customers to more convenient systems such as one-access point systems, but people tend to forget the issues related to privacy, in using such a system. What is portrayed as efficient for the consumer is a tool for social control and who has access and authority to use such information.

Often the reason given for collecting information is that it will help the service provider to combat fraud. However, studies have shown people more often fake situation rather than identity. The other concerns are that of sharing of information and lack of choice with respect to such sharing. There should be check as to sharing of personal information as the data belongs to the individual and not the bank or any other institution which requires furnishing personal information in lieu of services. This gives rise to a binary choice to the user; either the individual has to provide information to avail the service or else one cannot avail the services.

There is supposed to be market for privacy. The notion of personal information is subjective and varies from person to person. For example, one might be comfortable to share certain information. However, others might not be.

The issues that came out of the Q&A sessions are:

The default settings are generally put at the low protection settings. Unless the user is aware of the privacy protection setting, he or she is prone to breach of privacy. Should the default privacy setting be set to maximum security and option can be given to the user to change it according to his or her preference?
Is there any system in the banks, which allows the customers of bank to know about which all third parties the bank has shared his or her personal information with?

Health Privacy

Panelists: K. K. Abraham, (President, Indian Network for People with HIV), Dr. B. S. Bedi, (Advisor, CDAC & Media Lab Asia), and Raman Chawla, (Senior Advocacy Officer, Lawyers Collective).
Moderator: Ashok Row Kavi (Journalist and LGBT Activist)
Poster: Danish Sheikh (Researcher, Alternative Law Forum)

Danish Sheikh outlined the possible health privacy violations. These included the disclosure of personal health information to third parties without consent, inadequate notification to a patient of a data breach, the purpose of collecting data is not specified and improper security standards, storage and disposal. The disclosure of personal health information has the potential to be embarrassing, stigmatizing or discriminatory.

Subsequently, Danish Sheikh examined the status of sexual minorities’ vis-à-vis the privacy framework. Culling out some real life examples based on various studies, media reports and judgments from the Supreme Court and the High Courts of Delhi and Allahabad, he also described privacy violations committed by both individuals as well as state authorities.

Ashok Row Kavi recounted how privacy was very contextual when debating section 377 in the LGBT community. The paradigm upon which they were going to fight the anti-sodomy law was that it was consenting sex between two adults in private space. However, this paradigm was not well received by women, as women did not see private space as safe space, due to domestic violence. Perceptions of privacy are very subjective and it differs from person to person.

Raman Chawla recounted the history of the Draft HIV/AIDS Bill. In 2002, the need for law related to HIV/AIDS was realized in order to protect right to consent, right against discrimination and right to confidentiality of HIV patients. The bill was finalized in the year 2006. Alarmingly, it is yet to be tabled before the Parliament.

The privacy provisions in the HIV bill clearly state that no person can be tested, treated or researched for HIV without the consent of the patient. It also casts that in a fiduciary relationship the health care provider must maintain confidentiality, however if the patient provides written consent then their status may be disclosed. The HIV condition of the patient can also revealed by the doctor if there is a court order demanding such disclosure. The doctor may disclose the status of the patient to his or her partner but he has to follow a particular protocol. The doctor should have sufficient belief that his or her partner is at risk of contracting HIV. The person who is infected will be asked for his/her views and counseled before his/her partner is informed. However, there are doubts as to the implementation and enforcement of this protocol.

Conclusion

Natasha Vaz (Policy Advocate, Privacy India) brought the symposium to a close by thanking the partners, the panelists, the moderators and the participants for their sincere efforts in making the All India Privacy Symposium a grand success. In India, a public discussion regarding privacy has been long over due. The symposium provided a platform for dialogue and building greater awareness around privacy issues in health, banking, national security, transparency and e-governance. Using our research, expert opinions, personal experiences, questions and comments various facets of privacy were explored.

Press Coverage

The event was featured in the media as well:

India needs an independent privacy law, says NGO Privacy India, Economic Times, February 2, 2012
New Bill to decide on individual’s right to privacy, Tehelka, February 6, 2012
Lack of strong privacy law in healthcare a big worry, Daily News & Analysis, February 13, 2012
Privacy concerns grow in India, Washington Post, February 3, 2012

Click to download the Agenda and Profile of Speakers (PDF, 1642 Kb)

Download the PDF (555 Kb)
Follow the webcast of the event

For more details visit https://cis-india.org/internet-governance/all-india-privacy-delhi-report

The High Level Privacy Conclave — Conference Report

natasha — 2012-04-30T09:46:12Z

Privacy India, the Centre for Internet and Society and the Society in Action Group, with support from IDRC and Privacy International, have spent 18 months studying the state of privacy in India, and conducting consultations across India in Kolkata, Bangalore, Ahmedabad, Guwahati, Chennai, and Mumbai. On February 3, 2012, a high-level conclave was held in New Delhi with representatives from government, industry, media, and civil society participating in the event. At the conclave the discussions were focused on Internet Privacy, National Security & Privacy, and the future of Privacy in India.

Rajan Gandhi, CEO, Society in Action Group, opened the conference with an explanation of the mandate of Privacy India, which is to raise awareness, spark civil action, and promote democratic dialogue around privacy challenges and violations in India. He raised the question of whether Indians are concerned about privacy, while citing examples of banking institutions and telecom service providers, who ask for information more than required, such as marital status, financial status, etc. Lastly, he stressed the need for legislation and awareness about right to privacy.

Panel 1: National Security and Privacy

Malavika Jayaram (Advocate, Bangalore) moderated the first panel discussion on “National Security and Privacy”. The panel comprised of Manish Tewari (Member of Parliament, Ludhiana), PK Hormis Tharakan (Former Chief of Research and Analysis Wing, Government of India), Gus Hosein (Executive Director, Privacy International, UK), Vakul Sharma (Advocate, Supreme Court), Eric King (Human Rights and Technology Advisor, Privacy International, UK), Amol Sharma (Journalist, Wall Street Journal).

Malavika Jayaram started the discussion by posing the question as to what in their view is ‘national security’ and when can it be cited by the government to intrude upon our privacy? In response, the panel gave multiple views while agreeing that it is an abstract term. Gus Hosein, in response said that national security does not only mean protecting the national border of a nation, but also protecting the rights of the citizen. He also noted that national security is always implemented in a top-down manner. Thus, unfortunately national security has become the stick, which is used to beat down on people’s right.
PK Hormis Tharakan defined national security as the security of people and property. National security includes all the efforts of the government to raise poor above the poverty line. He also stated that anything that hinders the process of alleviating poverty is a matter of ‘national security’.

Manish Tewari stated that there is a need for legislation to address the various issues of violation of privacy. Specifically, he addressed the need of an independent oversight committee to put a check on the unrestricted powers of the law enforcement and intelligence agencies and the practice of intercepting communications on the grounds of national security. He pointed out that the rules, formulated by the Supreme Court in PUCL v. Union of India on interception of communication, are rarely implemented, and the guidelines are implemented more as an exception rather than a rule. The interception of communication by intelligence agencies should be regulated for a larger national interest.

Manish Tewari also observed that there is a nationwide lack of understanding about new technologies and judges are very rarely technologically literate. This has created a situation in which the government's efforts to fight crime and terrorism by intercepting communications has horribly backfired. By building backdoors into communications systems to allow lawful access, and by restricting cryptography to a 40-bit limit, the authorities have created serious vulnerabilities in India's communications system that can be easily exploited by any malicious third party or foreign government.

Privacy Protection

The panel discussion then moved on to the various tools for protecting privacy such data encryption. Amol Sharma referred to the process followed in the USA for interception of communication. Surveillance in the United States can be carried out by government agencies only on the basis of a court order or a warrant. He noted that in the US regime there is at least an independent body that gives orders of interception of communication. In comparison, in India, the power to authorize wiretaps lies with the government.

Amol Sharma also pointed out that, there are at least 5000-7000 interception requests from the government, out of which only three to five per cent requests for interception of communication are for white-collar crime. He cited the example of the government asking Research in Motion to provide their encryption keys and also provide a room in their offices for the purpose of interception of communication. He stated that he was very skeptic that terrorists will be using Blackberry services for communication, considering that there are many more convenient and untraceable means available to them such as Skype. He asserted that there is need of legislation for regulation and restricting invasion of privacy. He said, “National security is not a free ticket for any kind of wiretap”.

Concerns about Third Party Intrusion

Eric King noted that national security exists so that individuals can protect themselves from any kind of intrusion. Interception of communication is not only limited to government, equipment for interception of mobile phone calls are easily available and also affordable. So any individual can intercept calls. The notion that interception is only limited to the state is not true, it can be carried out by individuals as well. Heavily criticizing the restriction on encryption in India, he said that the people should be given the power to protect their own privacy. He also harped on the possibility that not only citizens are at risk also government high officials and military personnel can be targeted due to the low level of encryption.

Contributing to the conversation, Manish Tewari pointed out that while trying to intercept the mobile phone calls of an individual, the State could listen in to anyone’s conversation within the vicinity; hence there are gross privacy violations.

Gus Hosein added that the problem lies at a more basic level. Governments generally order telecom companies to build back door for the purposes of interception. These vulnerabilities in the system are not only used by the government, but also may be misused by third parties. He cited an incident in Greece, where the government asked a telecom service provider to build backdoors into the system. A third party was able to access the back door, during the Athens Olympics, when security was of utmost importance. He also said, “If you build a system that allows the state to listen in to communications, you build national security vulnerability”. This was followed by a Question & Answer session. The issues raised during the Q&A session were:

Nature of consent given by the user to the telecom service provider. Taking into consideration that service providers have a duty to disclose the user data to the government on request. A situation which gives rise to a binary choice, either use the services or do not use it at all.
At the wake of breaches in cyber-security, the use of general consumer e-mails by high government officials causes serious threat to nation’s security.
Lack of technical know-how among the government officials.
If government is inept in handling technology, then are there any concerns about public private partnership and outsourcing of governmental duties. (For example, UID).
Collection and collation of information by organizations such as NATGRID. Are they vulnerable to misuse?

In the concluding statement of the first panel discussion, Gus Hosein, made the argument that there cannot be a balance between right to privacy and national security, as the former is an individual right and the latter a community right. Community interest will always take precedence over individual right. National security is always the excuse given by government for invading individual privacy.

Panel 2: Internet and Privacy

Sunil Abraham (Executive Director, The Centre for Internet and Society, Bangalore) moderated the second panel discussion on “Internet and Privacy”. The panel comprised of Deepak Maheshwari (Director, Corporate Affairs, Microsoft), Amitabh Das (General Counsel, Yahoo! India), Ramanjit Singh Chima (Sr. Policy Analyst, Google), Talish Ray (Board Member, Software Freedom Law Center), and Vinayak Godse (Director- Data Protection, DSCI).

Defining Privacy

Sunil Abraham asked the panel questions with respect to defining privacy in the context of physical privacy and spatial privacy. In response, Amitabh Das said that the right to privacy of individuals should be protected in a similar fashion online, as it is protected offline. Referring to safeguards under PUCL v. Union of India (SC, 1996), he observed that communication and behavior on the Internet should be free from monitoring and interception. The procedural safeguards offline should be also present online.

Key Escrow Regime

Deepak Maheshwari talked about the inconsistencies in the encryption standards in India. For example, in case of ISP licensees, there is a 40-bit restriction (symmetric key). In case of adopting higher-level encryption, the ISP has to take permission from the government and deposit both the keys to the government.

He also pointed that online railway ticket booking services use 128-bit encryption. RBI mandates 128-bit encryption for online banking transaction. SBI recommends 64-128 bit encryption. The multiple regulations make it impossible to abide by the rules.

Anonymity and Pseudonymity

Sunil Abraham, while setting the context to India, where the government has taken stringent measures to cut down on anonymity and pseudonymity, asked the question whether such a step is welcomed by the internet users as well as intermediaries. Ramanjit Singh Chima, in reply said that for any business, it is necessary to give what the user wants. Real identity provides a better platform for discussion. He also discussed the choices provided by Google, mainly search without login, encrypted searches so it gives the user to be anonymous. He also noted that there are legal as well as technical restraints as to anonymity on the Internet. He also cited the example of Korea, where the government mandated real name verification process for posting comments on the Internet. Google was not able to comply with this request and had to disable comment section in Korea.

Data Privacy

Vinayak Godse analyzed the issue of data privacy in detail. He stressed upon the need of data privacy law in the country for the outsourcing industries. The European Union (EU) data protection laws govern most of the clients of firms that outsource. EU considers India is not a data safe country due to lack of data privacy legislation. He suggested that the data privacy law should be pragmatic, light touch and should allow industry self-regulation.

Conclusion

The High Level Privacy Conclave discussed various issues related to Internet and privacy and national security and privacy. The various concerns raised by the stakeholders were helpful in understanding the problems related to privacy. The main concerns raised by the first panel were about the interaction and relation of national security to privacy. The major concerns around national security and privacy were of data encryption vis-à-vis surveillance by the State and third party intrusion. There was also an attempt made to understand and define national security in the context of its ambit and when can it be used by the State to access private information. The second panel discussed various aspects of privacy on the Internet. The panel included discussions on anonymity and data privacy on the Internet.

We thank the moderators, panelists and participants for making High Level Privacy a constructive and a fruitful session on privacy and it also gave us insight to understand the problems related privacy and a way forward for possible solutions.

Download the PDF (195 Kb)

Click for the agenda and speakers profile.

For more details visit https://cis-india.org/internet-governance/high-level-privacy-report

Government washes hands of Google's new privacy policy

praskrishna — 2012-04-10T09:40:55Z

The government has more or less washed its hands of internet giant Google's new privacy policy that is being criticised in Europe and elsewhere, but wants Indian residents to watch out for themselves, writes Jayadevan in this article published in the Economic Times on April 10, 2012.

Google's new privacy policy provides information on how personal information is collected, processed and secured, as required by relevant Indian laws. "The end users, however, need to fully understand the privacy policy of Google, the consequences of sharing their personal information and their privacy rights before they start using online services," Sachin Pilot, India's minister for information technology, stated in Rajya Sabha on March 30.

Ever since Google came out with a unified privacy policy in January, it has been facing criticism from many users and privacy advocates, especially in Europe where privacy is a fundamental right. The new policy unified separate privacy polices relating to nearly 60 of Google's services.

The new policy also lets the separate Google services, such as Gmail, Google Search or Youtube, share data among each other. In Europe, Google is facing potential sanctions or even fine over its new privacy policy.

Section 43A of the India's amended Information Technology Act (2000) has established a legal framework for data privacy protection in the country. The rules notified last year explain security practices to be followed and the need for guarding sensitive personal information. The Act also requires Indian corporations to publish a privacy policy.

"Google has published a Privacy Policy on their website," said the minister. "Any change in the privacy policy is not within the purview of amended Information Technology Act 2000," Pilot added. Venkatesh Hariharan (Venky), head of public policy and government affairs at Google India, has left the company last month and did not want to comment.

According to the Pilot, while France's independent privacy watchdog, the CNIL (nationale de I'informatique et des libertes) has said that the changes to Google's privacy policy do not comply with the European law, rectification of conflict between Google, an American company and European directive on data protection is not within the purview of the Indian government.

CNIL, the data protection watchdog in France had asked Google to answer 69 questions including what it does with the data collected from users and how long it is retained to better understand the consequences of the new policy for Google users.

Experts agree Google privacy policy is in compliance with Sec 43A of IT Act but cautioned that it may not be enough. "Section 43A does not have all the privacy safeguards that exist for citizen in developed countries," said Sunil Abraham, executive director at the Centre for Internet and Society.

Abraham advocates the creation of a privacy commissioner. "It is important to have a independent and autonomous regulator who can respond on a proactive basis when confronted with evidence of abusive practices," he said.

Legal provisions will have to enable the creation of such a regulator, says cyber law expert Vakul Sharma. "You can not create a regulator out of thin air. You should have legislation for privacy. In India we do not have any such legislation," said Sharma.

The IT act classifies information into two - personal information and sensitive personal information. Safeguards under the section 43A and rules apply to sensitive personal information which includes biometric information, information related to health, passwords, sexual orientation and financial information among others.

"Users must be aware that Google's new policy does not have room for categorization according to Indian laws," says Sharma. "It is a plain vanilla document. The users need more," he added.

Read the original published in the Economic Times on April 10, 2012. Sunil Abraham is quoted in it.

For more details visit https://cis-india.org/news/govt-washes-hands-of-google-privacy-policy

Data protection experts slam state for sending mass SMSes

praskrishna — 2012-03-27T03:46:00Z

Experts in the field of data protection, privacy law and media have criticised the West Bengal government's mass SMS sent to individuals, companies and media houses through private mobile networks last Friday. Lara Choksey reports this in an article published in the Statesman on March 25, 2012.

The government's use of private data in order to spread political messages is ethically dubious and dangerous, say some. The SMS indirectly refers to The Telegraph's publication of the Poonam Pandey tweet, warning against the transmission of “provocative and indecent photographs for hurting the religious sentiments of people and disrupting communal harmony.” It urges recipients to “frustrate the designs of … unscrupulous people and maintain peace and communal harmony,” and is signed by “Mamata Banerjee, Chief Minister”.

Speaking to The Statesman on Saturday, Mumbai-based media lecturer Ms Geeta Seshu identified two issues with the government sending out political messages through mobile phone networks.

Firstly, from an ethical standpoint, the unchecked freedom of mobile phone companies to hand out private data is “completely wrong”, she said.

Secondly, the use of government funds for such dissemination needs to be transparent. If the state government has used public funds to distribute its message through a mobile phone network, then this information should be readily available, said Ms Seshu.

The Telecom Regulation Authority of India's (Trai) unsolicited commercial communications regulations allow unsolicited advertising through mobile phone networks.

Mr Apar Gupta, partner of Delhi-based law firm Advani and Co., explained, “The regulations are not wide enough to prohibit communications from a political party.” He observed, “Using SMS messages is a very efficient propaganda tool because so many people have access to mobile phones.”

Mobile phone networks such as Vodafone make it clear in their privacy policies that the personal data of its customers “may be used for inclusion in any telephone or similar directory or directory enquiry service provided or operated by us or by a third party” (source Vodafone website).

Any third party ~ governmental or corporate ~ can therefore access the company's directory of private mobile numbers at the discretion of the network in question.

It is not yet clear which government department coordinated the SMS, or what funds were used to cover the costs. Representatives from the ministry of information and cultural affairs were not able to shed a light on the matter. “I know that a message was sent out,” said the I & CA director Umapada Chatterjee, "But it was not sent from this department. I do not know that information.”

Some commentators did not condemn the government's SMS. Delhi High Court lawyer and cyber law expert, Mr Praveen Dalal, criticised the publication of the Poonam Pandey tweet on the grounds of it violating the due diligence guidelines of the Cyber Law of India. He commented, “If casual and careless publications … continue, there would be no other option left for the government but to regulate their affairs in a more intrusive manner.”

However, executive director of the Centre for Internet and Society, Mr Sunil Abraham, called the state government's use of unsolicited SMS a “clear abuse of the powers afforded by elected office.” Mr Abraham explained that elected representatives would be justified in such measures, and in utilising public funds, in the event of a disaster, or when public order, public health or national security are compromised.

“However in this case, the government is abusing the provisions of the law and using this incident as a pretext to threaten media professionals with surveillance and to intimidate for the purposes of reigning in free speech,” he told The Statesman. The chief minister was unavailable to make a comment on the matter.

Read the original published in the Statesman

For more details visit https://cis-india.org/news/data-protection-experts-slam-state-for-sending-mass-smses

Is your facebook page your mini resume?

praskrishna — 2012-03-26T07:27:43Z

As privacy debates heat up across the world, Bangaloreans reveal the trend of employers asking job aspirants for their Facebook IDs and passwords has caught on here too. When Adil Pasha, 24, revealed at an advertising job interview that his main strength was creativity, his interviewers asked for his FB password to check his latest updates.

This was published in IBNLive on March 26, 2012 . Sunil Abraham is quoted in this.

They rejected him, as he was going through a break-up and had put up song lyrics as his status message. On the other hand, Sukanya Srinivasan, 19, got an internship chance at a leading IT firm solely based on her FB photo albums.

“A company recently rejected my application after looking at the number of people I’d blocked on my chat list. They thought I didn’t have good interpersonal skills. I might be a friendly, harmless flirt, but the company might think I could sexually harass women employees. If they see my photos at a party, they might think I’m an alcoholic,” said Kiran Giridhar (name changed), who has attended over 12 interviews in the last two months, where his social life mattered more.

Recently, Facebook chief privacy officer Erin Egan said they had seen a distressing increase in reports of employers seeking to gain access to people’s Facebook profiles or private information.

“The most alarming of these practices is the reported incidents of employers asking prospective or actual employees to reveal their passwords,” she wrote on the website’s privacy page. The controversy is now being fought on moral and ethical grounds.

"This is a privacy infringement but there is no provision in the law (IT Act-2008) that prohibits employers from asking for personal information. This is happening with the willingness of potential candidates. If a person finds it unacceptable, he/she shouldn’t share the password. Background checks are common as some companies deal with sensitive information. So it’s not illegal, but intrusive. I think some power relationships can be abused if they cross the social networking barrier — like a boss-employee and teacher-student relationship. Corporate policy should prevent such things," explained Sunil Abraham, executive director, Centre for Internet and Society.

For more details visit https://cis-india.org/news/facebook-page-mini-resume

Why your Facebook Stalker is Not the Real Problem

nishant — 2012-03-21T05:02:16Z

We live in networked conditions. This is a statement that can now be taken at face-value, and immediately explains our highly connected, inter-meshed environments finds Nishant Shah in this article published in FirstPost on March 20, 2012.

Especially within the digital world, the World Wide Web has become synonymous with social networking systems, where increasingly all our access, communication and interaction is located within a series of interconnected networks.

From the imagination of the web as a complex network, we have evolved to looking at the web as facilitating networks where different relationships, transactions and connections can be mapped and managed. This is why we often have romantic imaginations of networks as free, open, collaborative, shared spaces of interaction and expression.

However, we have reached a stage where this idea of a network as a liberatory space is under threat. Even as I write this, Internet Service Providers are now planning to set up sophisticated, automated systems that will do a deep-spy on your data transfer to see if you are sharing files (sometimes also called piracy) using the Internet.

These systems will now keep track of all your digital transactions and will monitor what you consume, who you talk to and determine whether you are a good ethical subject who is only using the Internet in ways that the powers to be want you to.

For me, this particular networked condition of being constantly monitored and watched is scary. And it surprises me that this invasive process is less in public attention than Google’s recently changed privacy policies or the TOS-in-progress nature of privacy on Facebook.

This is because the ubiquitous presences of networks in our lives have made them transparent to us – we do not think of the networks themselves as entities but as spaces where interactions with other objects is possible. Hence, if I ask you, right now, to name the top 5 entities that you interact with the most on Facebook, I am sure you will be able to name them. More probably than not, these top 5 entities with people that you have formed strong Facebook Friendships with.

In fact there are platforms designed to let you know who you are talking with most on your networks. Network influence measurement indices by services like Klout are able to tell you not only who you talk to but also what are your key areas of influence. This is a way by which the network becomes invisible to us. It hides the fact that the thing that talks to you the most on Facebook is Facebook itself.

The marketing of Facebook might tell you that you are talking to other human beings, but reality is that the network is more than the sum total of all human beings on the system. Just look at the amount of information Facebook produces on your behalf and to you. Notifications for adding friends, for liking people, for people writing to you, for people commenting on your walls and posts, form more than 50% of the information traffic on Facebook or social networking systems.

This information is produces and shared by scripts, coded bots, algorithmic applications, and non-human entities that not only support and sustain the network but are also significant members of the networks.

This is the actual networked condition – where the processes and entities that make the networks possible, produce an illusion of seamless communication and interaction, while performing and extraordinary amount of information and for you.

This blindness to our own ‘networkedness’ has crucial ramifications for our online activities because it makes us oblivious to questions of privacy, control, safety and trust. We have privacy settings to protect us from human entities on Facebook. There is very little concern about the non-human entities who store, distribute and use the data that we produce. If we don’t even know what these watchers are, how do we protect ourselves from being watched? What happens when between you and your ‘friend’, is a series of silent interceptors who are recording and using your data without your knowledge?

Being in a network is like being in a glass-house. We cannot see the walls and hence, we presume that we need our privacy from the other inhabitants of the same house. However, in that, we forget that the walls are watching, and that there are invisible watchers beyond the walls, who are in control.

It is time to make our networks visible again. It is time to realise that what we really need to be afraid of, on social networking systems, is the social network itself, and not the mythical stranger who wants to stalk us or that unwanted friend you want to exclude from your information sharing.

Privacy and safety are not merely compromised at the interface, where information might leak and travel into zones outside of your knowledge and control. The real questions of being safe are actually in the protocols and designs of the network itself.

We need to start looking at larger invasive policies exercises by the different invisible actors like the ISP, ICT ministries, corporate policies, design choices and architecture of interception that sustain the networks we so gladly embrace.

Nishant Shah is Director-Research at the Bangalore based Centre for Internet and Society and recently edited a 4 volume book on youth, technology and change, titled ‘Digital AlterNatives with a Cause?’

Read this in FirstPost

For more details visit https://cis-india.org/internet-governance/facebook-stalker-is-not-real-problem

Short-Term Consultant Required: Wordpress Webmaster

praskrishna — 2012-03-13T11:27:34Z

CIS wishes to commission the improvement of the Privacy India website. The Privacy India website should have a well-organized interface and easily navigable

Requirements:

WordPress developer with sufficient relevant experience
Experience in content management
Proven webmaster track record
Savvy and creative

To apply for this position, please send your CV to Natasha Vaz (natasha@cis-india.org)

Click here for the Privacy India website.

For more details visit https://cis-india.org/news/wordprss-webmaster

Short-Term Consultant Required: Events Coordinator

praskrishna — 2012-03-13T11:22:08Z

CIS wishes to commission the planning of 3 privacy meetings in total, scheduled during May and June. Meetings should be well-organized, planned and promoted effectively.

The Events Coordinator should:

Choose a central and convenient Venue
Create the program
Involve relevant multi-stakeholder partners, participants and media
Work with the Privacy India team to organize panels of expert speakers on the topic of discussion

To apply for this position, please send your CV to Natasha Vaz (natasha@cis-india.org)

For more details visit https://cis-india.org/news/events-coordinator

India’s Big Bet on Identity

praskrishna — 2012-03-07T05:44:12Z

The world’s largest biometric authentication system reaches its first major milestone, but lots of challenges remain, writes Joshua J. Romero in ieeespectrum. Sunil Abraham was quoted in this story which was featured in March 2012 edition.

Driving around Bangalore, it’s immediately clear that the infrastructure hasn’t kept up with the IT boom in this once-sleepy South Indian city. Auto rickshaws, scooters, and motorcycles squeeze into a tight phalanx at each red light and choke the air with exhaust. Construction, such as the concrete supports of the new metro rail line that looms overhead, causes detours everywhere, and in spots the entire road abruptly disintegrates into gravel.

But something miraculous happens as you make your way south, past the outer ring road. A ramp lifts a select few vehicles out of the weaving traffic and onto an elevated tollway, where you suddenly have a bird’s-eye view of the urban landscape. This is the road to Electronic City, an oasis of glass and steel high-rises overlooking pristine black asphalt paths that snake through the perfectly manicured lawns of tech companies like Wipro, IBM, and Infosys Technologies.

“If you can have such good roads in the Infosys campus, why are the roads outside so terrible?” That’s the common question foreign visitors would ask Nandan Nilekani, one of the company’s cofounders. “Politics” was his usual reply, according to Nilekani’s 2008 book, Imagining India. Now the man who has been called the Bill Gates of India has jumped into politics to try to use what he learned at the IT giant to transform the dysfunctional country that lies beyond the borders of Electronic City.

Since July 2009, Nilekani has been a cabinet minister, leading hundreds of engineers and entrepreneurs as chairman of the Unique Identification Authority of India (UIDAI). By the most conservative estimates, at least a third of the country’s 1.2 billion citizens live below the poverty line and outside the formal economy. The UIDAI is expected to connect those hundreds of millions of people to government programs, save public money, reduce fraud and corruption, and foster new business opportunities—all by creating an unprecedented biometric system and outside the formal economy. The UIDAI is expected to connect those hundreds of millions of people to government programs, save public money, reduce fraud and corruption, and foster new business opportunities—all by creating an unprecedented biometric system.

“On the one hand, within India and across the world, people of Indian descent have done some remarkable work,” says Nilekani. “And on the other hand, here is a country that needs to solve some very basic problems. This project marries these two worlds.” UIDAI plans to use fingerprints and iris scans to assign every person in the country a unique 12-digit ID number that can be verified online. It’s one of the biggest IT projects in the world, and getting bigger: By early February, the UIDAI had issued 130 million ID numbers, and it can issue up to a million more IDs every day. The agency has set up 36 000 enrollment stations staffed by 87 000 certified enrollment operators. In India the project is called Aadhaar, which means “foundation” or “support,” because it’s meant to be a fundamental technology platform that will enable dozens of new public and private services to be created.

That’s if it all works. It’s easy to list major challenges: How exactly do you collect biometrics from every single person in the world’s second most populous country, especially those living at the margins? How do you keep bad data from getting into the database in a country rife with corruption? And how can you build the entire system around online authentication in a country where fewer than one in 20 people have access to the Internet?

The answers to these questions are getting more than the usual amount of scrutiny, because a lot of political fortunes are riding on the UIDAI.

The program has been heavily supported by the ruling Indian National Congress party; Nilekani was appointed by the prime minister himself, Manmohan Singh. But Singh and his Congress party have had a difficult time enacting many of their biggest policy goals, and the UIDAI has increasingly become the target of criticism.

Earlier this year, the whole scheme seemed in imminent danger of collapse, when a parliamentary committee killed the bill that would have given the program statutory authority, and a political turf war erupted between the UIDAI and the National Population Register, another government project collecting biometrics for the national census. But by late January the two sides had reached an agreement to share biometric data collection, and Aadhaar is once again moving full steam ahead with a new mandate and an estimated budget this year of 15 billion rupees [PDF] (about US $300 million).

Photo: Joshua J. Romero

EXISTING DOCUMENTS: A poster lists the variety of IDs a  person can use to register for an Aadhaar number.

To understand why the government has invested so heavily, it helps to know the current state of affairs in India. Aadhaar is meant to provide a form of identification that’s free, national, impossible to counterfeit—and available to everyone. “There’s an ID divide,” Nilekani explains, between people who have multiple official IDs and the hundreds of millions who have none. Only about 60 million people in India have passports, he says, and only about 100 million have photo ID bank cards. The most prevalent document is a voter ID card, which has been issued to about 700 million people, covering just over half of the country. But these and the rest of the official IDs created by the country’s vast bureaucracy all have shortcomings.

The primary reason for creating a biometric ID system is to give India’s poorest citizens better access to an array of welfare programs. India spends about 2 percent of its gross domestic product on social programs like the Public Distribution System, which provides subsidized rice, wheat, and other staples, and a rural employment scheme that guarantees 100 days of work. But all such programs suffer from severe “leakage”: According to the World Bank, corrupt officials and middlemen siphon away 59 percent of the money before it reaches the intended recipients. Eventually, the government hopes to provide funds directly to each person who needs them.

Most states issue ration cards, but they usually aren’t valid in other states. An official ID that can be used throughout the country is increasingly important as more and more people move away from their hometowns to follow employment, Nilekani says.

Complicating the problem further, existing ID cards are easy to duplicate. Some states have more names on their food ration lists than there are people living in the state. To fight counterfeiting, the Aadhaar team decided to use biometrics instead of issuing just another ID card. From the beginning, they consulted biometric experts, used existing standards when they could, and studied similar systems like the U.S. Visitor and Immigrant Status Indicator Technology program, run by the U.S. Department of Homeland Security.

One thing the team realized early on is that a single biometric measurement wasn’t enough to guarantee uniqueness. In proof-of-concept studies, researchers determined that only by using all 10 fingerprints and a scan of both irises could error rates be kept manageable. Adding iris scans also makes the program more inclusive for people whose fingerprints have been worn down by manual labor.

Photos, clockwise from left: Ruth Fremson/The New York Times/Redux; Joshua J. Romero (2)
NECESSARY GEAR: Each enrollment station has the same basic set of equipment, including an iris scanner [top], a fingerprint scanner [bottom right], a webcam and light [bottom left], a laptop, a second monitor for the resident to view, and a scanner and printer to handle documents.

Getting an Aadhaar number is not a quick process. One Friday after midnight, I watch dozens of families wait patiently in a municipal building where only half the lights are on and there’s always a baby crying. While Anurodh Kanchan waits, he explains that he came at this hour because he’d heard the lines were even longer during the day. He’d already been once before to schedule this appointment. Now his 7-year-old daughter dozes on his wife’s shoulder as the whole family waits another half an hour for the enrollment agent to return from a break.

Hiring and training people to work as agents has been one of the project’s biggest logistical challenges. The UIDAI outsources enrollment to “registrars”—often state governments or banks—which in turn hire accredited agencies to actually set up and staff the centers. The agencies get paid a flat rate for each successful enrollment, as do the agents they hire. A coordinator for one of the largest agencies told me that his organization had significantly overestimated how many enrollments an agent could complete in a day. UIDAI says that an average station (see photos, “Necessary Gear”) can process each enrollment in under 10 minutes, but in the days I spent observing, it wasn’t uncommon for the process to take twice as long. And if you’re an agent looking at a line of people stretching out the door, it’s easy to see how you might begin to rush through your tasks.

That’s why enforcing quality is left to a piece of software known as the enrollment client, installed on each agent’s laptop. The program manages every step of the process and was developed jointly by engineers at UIDAI and MindTree, an Indian IT company. Because enrollment often takes place in remote locations with no Internet access, the client must be fully independent and be able to run off a single laptop. The developers also had to make sure that the enrollment client could work seamlessly with any of the 11 biometric devices from various manufacturers that had been certified for use. And the initial version had to be built fast: MindTree won the contract at the end of April 2010, and the UIDAI wanted to enroll the first resident by that August.

MindTree met the deadline, and the client it designed now manages to prevent and correct most errors an enrollment agent might make. In addition to a simple quality check, the software looks for self-consistency—for instance, verifying that each fingerprint isn’t coming from the operator or another recently enrolled resident and that all 10 fingerprints and two irises are distinct from each other. If something goes wrong in a biometric capture, the software tells the operator how to correct it—for instance, it can distinguish between a facial photo that’s too dark and one in which the person was photographed at the wrong angle.

Still, over the last 21 months, the software engineers have had to continually improve the program to address new challenges encountered in the field. For example, when the UIDAI began enrolling people in the Punjab region of North India, where many men wear long beards and large turbans, enrollment agents had a hard time taking a photo that the software considered acceptable: The turban would be interpreted as an unacceptable background, or the automatic cropping feature would crop around the turban instead of the face. The software team was able to quickly tweak the parameters and release a new version of the client so that enrollment could continue.

It isn’t just the biometric collection that’s tricky. A resident must also supply basic demographic data—name, age, gender, and address. Residents can fill out paper forms in any of the 16 official Indian languages, which agents must first transfer to the computer and then translate into an English version of the form. This is by far the most time-consuming part of the process, and MindTree has tried to speed it up by building transliteration into the client software. But Indic languages have many variations—some are written right to left, and many use unique character sets. Still, the agent is expected to check the results and clean up minor mistakes.

There are obviously both privacy and security concerns when you’re collecting personal data from more than a billion people. “You can’t change your biometrics,” points out Sunil Abraham, the executive director at the Center for Internet and Society, in Bangalore, so if they become compromised, it’s a difficult problem to fix.

Among the precautions the UIDAI takes is to encrypt all data as soon as they’re collected. The data can be decrypted only by UIDAI servers, so the records aren’t even accessible to the operator or enrollment agency that collected them. At the end of each day, all the encrypted enrollment data are stored on USB flash drives, and the drives are transported to a place with Internet access so the data can be uploaded to UIDAI’s servers. It’s in the best interests of the enrollment agencies to safeguard the data, because otherwise they won’t get paid.

From the enrollment centers the action moves to the racks of servers at the UIDAI Central Information Data Repository, which is also in Bangalore. Here is where deduplication—checking each new enrollment against every other record in the database—will arguably make this identity scheme rise above the rest. Ensuring that no person can get two numbers is key to making biometrics a worthwhile investment. A few years ago, one Indian state collected biometrics for everyone below the poverty line, but it didn’t have the technology or a plan to prevent duplicates. It ended up capturing 1.2 times the population, which resulted in a significant leakage of benefits.

Many critics, including members of Parliament, have doubted that it’s even possible to deduplicate records from the entire Indian populace. It’s certainly a big task. In order to issue 1 million Aadhaar numbers in a single day, the current maximum rate, the data center must conduct 100 trillion person matches. To improve this process, the UIDAI came up with an unusual arrangement. Rather than hiring a single firm for the job, it awarded the project to three contractors, each responsible for processing a portion of the enrollments, with the overlapping records used to compare performance between the systems. This arrangement lets the UIDAI know if a system isn’t working correctly and also gives the companies a financial incentive to improve their software—they’ll get to process more records, and get paid more, if their products perform better. The vendors were even required to use the same kind of hardware to build their systems, so the agency isn’t tied to any one company.

In late January, the UIDAI released a report [PDF] that for the first time detailed the results of this deduplication effort. There are two primary factors that determine the accuracy of a biometric system: the false-positive rate, which in this case is how often a newly registered person is incorrectly judged to be already enrolled, and the false-negative rate, which is how often true duplicates are not recognized as such. To measure the false-positive rate, the UIDAI tested 4 million unique records against a subset of the enrollment database containing 84 million records: Of the unique records, 2309 were falsely rejected, for a false-positive rate of 0.057 percent. The agency also tested 31 399 known duplicates. The system caught all but 11, for a false-negative rate of 0.035 percent.

The false-positive rate applies to the total number of records in the database. As that number grows, the rate should increase in a linear fashion, because there are more opportunities for false matches. The false-negative rate, on the other hand, applies only to the small minority of enrollments that really are true duplicates (the UIDAI estimates that these make up only 0.5 percent of all incoming enrollments). Because the false-negative rate doesn’t depend on the total number of records, it should remain steady unless more people try to enroll multiple times.

R.S. Sharma, the director general of UIDAI, says that preventing all duplicates with technology alone is impossible. There are some people who just can’t be uniquely identified through biometrics, because the data for them aren’t good enough—children under age 5, for instance, and people with multiple disabilities. That’s why the responsibility for accuracy and uniqueness isn’t all left up to the software. Several full-time employees manually review the roughly 0.2 percent of cases that the software can’t handle, resolving errors and looking for evidence of fraud.

Even if the system isn’t perfect, it’s likely to be much better than any existing alternative, simply because it will eliminate “ghost identities,” says M.R. Madhavan, who works at the Centre for Policy Research, in New Delhi. “At least people who died in 1995 or 2005 will not get into the system,” he says.

Photo: Joshua J. Romero

AUTHENTICATION TERMINAL: Widespread use of Aadhaar will  rely on biometric terminals, like this prototype at MindTree.

Now that the UIDAI has shown it can collect biometric and demographic data and eliminate duplicate enrollments, much of the attention will shift to the authentication system, where people can prove their identity with just the swipe of a finger. Such systems are still under development, so most residents I met weren’t clear about the benefits of the program. When I asked people why they were enrolling, they often had vague reasons: “It might make it easier to get my benefits,” said one middle-aged woman in Bangalore. “I heard you’ll need it to buy heating gas,” said another woman. “I think it’s mandatory,” an elderly man told me. Nilekani thinks that getting authentication services up and running will be the best way to demonstrate the power of the entire project.

Here’s how such a futuristic system might work: Walking up to a wirelessly connected terminal at a local shop, a person will type in his name and Aadhaar number, and then he’ll scan his fingerprints. The data will be sent to a central database, where the Aadhaar number will be used to locate his record. The submitted name and biometric data will be compared to those on file, and the software will determine whether they match.

The UIDAI imagines that such biometric terminals will eventually be ubiquitous. The first devices deployed will likely be micro-ATMs in rural shops. These machines process transactions electronically, just like a full-size ATM, except they don’t store and dispense cash—that gets handled from the shopkeeper’s till. The hope is that such systems will deliver financial services to the 40 percent of the Indian population who have never had bank accounts. When people enroll for Aadhaar, they simply need to check a box and an Aadhaar-enabled bank account will be created for them.

In January, the UIDAI began a pilot project in the state of Jharkhand, where workers in the rural employment program could collect cash payments by scanning their fingerprints at a micro-ATM. Another pilot program in Maharashtra transferred small amounts of money to individual Aadhaar numbers, showing that bank servers could be easily linked with the UIDAI system.

The authentication system is already available as an application programming interface (API), which means it won’t be limited to just government programs and banks. Private service providers could use it to verify new customers as well. Take India’s vaunted mobile-phone culture: Phone companies are currently required to collect and retain significant documentation for every person they sell a SIM card to, as I found out in the two days I spent collecting the photos and local references I needed to get one myself. “If you look at any service provider, they’re not going to offer the mobile-phone service unless they verify who you are,” says Bala Parthasarathy, an entrepreneur who worked in Silicon Valley but came back to India to volunteer on the project for a year. Parthasarathy says that using Aadhaar for identity verification could provide the telephone companies with major savings.

Still, setting up a nationwide network of biometric terminals has plenty of its own challenges. First, India will need better connectivity. Wireless voice networks now cover most of the country, but wireless data networks have trailed behind. Current penetration of 3G is mostly just in the cities, says Debabrata Das, an IEEE member and a professor of electrical engineering at the International Institute of Information Technology, Bangalore, who has been studying the network challenges of authentication as a technical advisor for the state of Karnataka.

The API will also need to be flexible enough to handle variations in the demographic data that are submitted. The system can’t enforce strict matches: Many Indians use initials in their names, and there is no guarantee that they will always spell their names the same way in English. Further, sometimes a married woman will use her father’s family name instead of her husband’s. Because of the ambiguity in names and addresses, the database must be able to perform partial and fuzzy matches. Eventually, Sharma says, the UIDAI hopes to be able to do database matching for all the Indian languages as well, so the API will continue to undergo revisions.

Now the UIDAI must wait for its partners to begin taking advantage of the system, and Nilekani admits that starting up such services is largely beyond his control. Cooperation with other agencies and industries is all part of Nilekani’s approach to how government initiatives should work. “The big thing to my mind has been, How do you create a model of change, and how do you carry a lot of people with it? How do you think this through in a way that everyone comes on board?” he says. In building the project to this point, he’s managed to bring, if not everyone, then certainly a pretty diverse crowd: technical experts; national, state, and local officials; banks and businesses; and all those millions who willingly wait in line for hours.

“Everyone puts their own aspirations on it…like Obama,” he jokes. But the downside of being so inclusive is that as the project matures, it may be difficult to keep all the interested parties happy, and there’s bound to be disappointment if the project fails to achieve all its lofty ambitions.

The project has made it this far by adapting quickly as problems arise. “Think of it as multigeneration, continuous improvement,” Nilekani says. “You launch and get feedback and you get criticism. You need to build a rapid feedback loop, which is what we’ve built.”

Read the original here

For more details visit https://cis-india.org/news/big-bet-on-identity

Privacy in India — An Early Draft

Natasha Vaz — 2014-02-28T05:05:21Z

Privacy India in partnership with Privacy International, UK, Society in Action Group, Gurgaon, and the Centre for Internet and Society, Bangalore is pleased to bring you the draft chapters of its book on privacy in India. These include the Country Report, Telecommunication and Internet Privacy, E-Governance Identity and Privacy, Finance and Privacy, Health and Privacy, Transparency and Privacy.

Note: The chapters are an early draft which is in the process of being reviewed and updated. We greatly appreciate your comments and feedback.

Download the chapters below:

Country Report [PDF Document, 925 Kb]
Transparency and Privacy [PDF Document, 383 Kb]
Freedom of Expression and Privacy [PDF Document, 365 Kb]
Health and Privacy [PDF Document, 1146 Kb]
Finance and Privacy [PDF document 204 Kb]
E-Governance, Identity and Privacy [PDF Document, 554 Kb]
Telecommunications and Internet Privacy [PDF Document, 471 Kb]
Consumer Privacy [PDF, 390 Kb]
Law Enforcement, National Security, and Privacy [PDF, 422 Kb]

For more details visit https://cis-india.org/internet-governance/privacy-in-india-draft-chapters

Unique ID System: Pros and Cons

Natasha Vaz — 2012-02-29T11:28:58Z

On September 16, 2011, the Citizen’s Voluntary Initiative for the City and Centre for Advocacy and Research organized a public consultation titled “Unique ID System: Pros and Cons” in Bangalore. The consultation was on the utility and impact of the UID system in India and featured a panel discussion with T. Prabhakar, public relations officer, e-governance, Ashok Dalwai, UIDAI regional deputy director, Somashekar V.K., managing trustee of Grahak Shakti and Col. Mathew Thomas, civic activist and retired army officer.

Col. Mathew Thomas began his presentation by a comparative analysis of the Indian and the British experience in providing a unique identity to its citizens. In Britain, this initiative was labelled as ‘intrusive bullying’ and ‘an assault on personal liberties’. Additionally, the government recognized that they must conduct their business as servants of the public and not as their masters. The project was terminated on the grounds that it could not achieve the claimed objectives, and it was dangerous costly.

Nevertheless, the unique identification (UID) system in India is being perscribed as a prestigious project that will eliminate identity fraud, financial exclusion, enhance accessibility for the poor, enable the government to better manage welfare schemes and target corruption in social programs such as the National Rural Employment Guarantee Act (NREGA), the public distribution system (PDS), public health and financial inclusion.

Col. Mathew Thomas chronicled ID schemes. He explained that the advent and growth of information technology increased the availability of technology, which led to a commercial interest to exploit technology for profit. Technological solutions were heavily marketed, however, it is a mistaken belief that there is a technological fix to every problem (technology could solve any problem). Post 9/11 paranoia resulted in the notion that ID cards were the best possible counter measure to terrorism. “The inherent ridiculousness of this notion is that militants do not come with ID cards, but with AK-47s, and possession of ID cards or citizenship does not prevent one from becoming a terrorist”, says Mathew Thomas. National ID cards do not stop or deter terrorist actions.

India’s history with the UID project can be traced to the recommendations made by the Kargil Review Committee chaired by K. Subrahmanyam.The Committee recommended the issuing of ID cards to people in border areas to prevent infiltration and extend the system to the whole country to combat terrorism. Consequently, in 2003 the Citizenship Act of 1955 was amended by the NDA Government so as to compulsorily register all citizens into a “National Population Register” (NPR) and issue a Multi-purpose National Identity Card (MNIC). The NPR database will be inked to the UID. Subsequently, the UPA Government promoted the UID, as a pro-poor project.

Col. Mathew Thomas discussed the various questionable aspects of the UID project: its legality, financial prudence, ethics and its uses and abuses.

UID and Legality

Firstly, there is no law governing the functioning of the Unique Identification Authority of India (UIDAI). The illegal implementation of the UID is a complete insult to the Parliament and citizens, considering that the National Identification Authority of India Bill 2010 was drafted long after the implementation of the UID commenced.

UID and Financial Prudence

The high-level of apprehension surrounding the UID project stems from the fact that a project of this magnitude, cost and impact on the entire population would be undertaken without a feasibility study and a cost-benefit analysis. There exist two studies: one by the London School of Economics, regarding the UK project, and another by the Indian Institute of Management Ahmedabad, on UID in India. Both have concluded that such schemes are unworkable and too costly.

UID and Ethics

Ethical questions related to the UID are regarding its history, participation and ubiquity. Firstly, the UIDAI website is silent on the history prior to 2006. It fails to mention the significant historical roots of the UID, specifically, the Kargil War and the National Population Registry. Second, the UID has been promoted as a pro-poor project, whereas huge possibilities for commercial exploitation exist. Lastly, the UIDAI asserts that enrollment for the UID is ‘voluntary’. Although participation in the UID scheme is supposed to be voluntary, service providers can make it compulsory, thereby making it ubiquitous. A subtle campaign is being carried on, hinting at denial of benefits and services to those without UID.

Uses and Abuses

UID claims to transform governance, make ‘Bharath’ part of the growth process, plug ‘leakages’ & ‘slippages’ in welfare schemes, bring about all round prosperity and put India on a ‘fast-track’ growth by becoming the pivot around which all anti-poverty measures will rotate. One can conclude that UID is a panacea or a ‘one size fits all’ solution. Mathew Thomas questioned how these ambitions can be achieved by fingerprinting and scanning the irises of 1.2 billion people and storing the data for use by agencies responsible for the delivery of services.

These claims revolve around the assumptions that a lack of identity denies people welfare benefits; denies access to opportunities and services; and that a unique identification and de-duplication using biometrics would prevent “leakages”, “slippages” and in effect, all corruption. These assumptions need to be tested and verified so as to ensure validity.

The Public Distribution System and UID

Col. Mathew Thomas examined the PDS to analyze the use and claims of UID. He described the supply and demand of the PDS. The ‘supply’ side involves the fixing of minimum support prices, procurement by the centre and state governments, transport to FCI and state storages, distribution by centre to states and distribution by states to fair-price (ration) shops. All of the stages are affected by corruption and surprisingly UID beneficiaries have no role in any of the aforementioned stages.

‘Leakages’ in the supply process could potentially occur during the fixing of the minimum support prices (if deals exist with large farmers), during procurement (if they lift less quantity than what was paid for) and during accounting and storage (if they write off larger quantities than the actual damage; write off against bogus ration-cards; and show more quantity in storage and shops than is actually there).

The ‘demand’ process of the PDS system requires for state governments to decide on the eligibility of BPL people, issue ration cards, allocate ration-card holders to specific ration shops and requires the ration-card holders go to designated shops and collect entitlements. Corruption is possible, probable and happens in this discretionary decision-making. However, the only stage at which UID would find some use, if at all, is when ration-card holders collect rations.

Col. Mathew Thomas provided an excellent example of the government’s lopsided priorities. He describes the UID in PDS as the story of the ‘fence eating the corn’. The ‘fence’ then says, “let’s brand the cattle to find who is stealing the corn!”

The practicality of utilizing UID for authentication in the PDS system is a huge conundrum. Considering that the process to authenticate at ration shops requires all shops to have scanners (approximately six lakhs) which must be connected to a network and power at all the time.

Another problem surrounds the collection of ration. Ration-card holders do not always go to collect rations. There could be occasions where one family member goes for collection or one person collects rations for a number of families. The worst part of the UID application to the PDS system is that the procedure puts the BPL person at the mercy of the ration-shop keeper. He could simply deny rations, saying, “Authentication failed”.

The potential abuses of the UID could arise from the large collection of fingerprints that will be with various government officials and private agencies which could be used to foist false criminal cases against innocent people, forge title deeds, sale deeds, promissory notes wills, etc., and could target individuals and communities.

Col. Mathew Thomas concluded by explaining the main risks of any centralized database, it can be hacked and can crash. Professor Ian Angle, of the London School of Economics, has said that the UID will be "Olympic games of hacking", providing people with the biggest challenge to hack through.

Making a point: (From left) Public Relations Officer, e-governance, T. Prabhakar; UIDAI Regional Deputy Director Ashok Dalwai; Managing Trustee of Grahak Shakti Somashekar V.K.; and civic activist Mathew Thomas at a panel discussion in Bangalore on Friday. — photo: V. Sreenivasa Murthy.

Photo Source: From the Hindu, September 17, 2011, http://goo.gl/gCnqK

Note: Unfortunately, the other presentations were conducted in Kannada and could not be understood by the author of this blog.

For more details visit https://cis-india.org/internet-governance/unique-id-system-pros-and-cons