Centre for Internet and Society

Reading the Fine Script: Service Providers, Terms and Conditions and Consumer Rights

jyoti — 2014-07-04T06:31:37Z

This year, an increasing number of incidents, related to consumer rights and service providers, have come to light. This blog illustrates the facts of the cases, and discusses the main issues at stake, namely, the role and responsibilities of providers of platforms for user-created content with regard to consumer rights.

On 1st July, 2014 the Federal Trade Commission (FTC) filed a complaint against T-Mobile USA,[1] accusing the service provider of 'cramming' customers bills, with millions of dollars of unauthorized charges. Recently, another service provider, received flak from regulators and users worldwide, after it published a paper, 'Experimental evidence of massive-scale emotional contagion through social networks'.[2] The paper described Facebook's experiment on more than 600,000 users, to determine whether manipulating user-generated content, would affect the emotions of its users.

In both incidents the terms that should ensure the protection of their user's legal rights, were used to gain consent for actions on behalf of the service providers, that were not anticipated at the time of agreeing to the terms and conditions (T&Cs) by the consumer. More precisely, both cases point to the underlying issue of how users are bound by T&Cs, and in a mediated online landscape—highlight, the need to pay attention to the regulations that govern the online engagement of users.

I have read and agree to the terms

In his statement, Chief Executive Officer, John Legere might have referred to T-Mobile as "the most pro-consumer company in the industry",[3] however the FTC investigation revelations, that many customers never authorized the charges, suggest otherwise. The FTC investigation also found that, T-Mobile received 35-40 per cent of the amount charged for subscriptions, that were made largely through innocuous services, that customers had been signed up to, without their knowledge or consent. Last month news broke, that just under 700,000 users 'unknowingly' participated in the Facebook study, and while the legality and ethics of the experiment are being debated, what is clear is that Facebook violated consumer rights by not providing the choice to opt in or out, or even the knowledge of such social or psychological experiments to its users.

Both incidents boil down to the sensitive question of consent. While binding agreements around the world work on the condition of consent, how do we define it and what are the implications of agreeing to the terms?

Terms of Service: Conditions are subject to change

A legal necessity, the existing terms of service (TOS)—as they are also known—as an acceptance mechanism are deeply broken. The policies of online service providers are often, too long, and with no shorter or multilingual versions, require substantial effort on part of the user to go through in detail. A 2008 Carnegie Mellon study estimated it would take an average user 244 hours every year to go through the policies they agree to online.[4] Based on the study, Atlantic's Alexis C. Madrigal derived that reading all of the privacy policies an average Internet user encounters in a year, would take 76 working days.[5]

The costs of time are multiplied by the fact that terms of services change with technology, making it very hard for a user to keep track of all of the changes over time. Moreover, many services providers do not even commit to the obligation of notifying the users of any changes in the TOS. Microsoft, Skype, Amazon, YouTube are examples of some of the service providers that have not committed to any obligations of notification of changes and often, there are no mechanisms in place to ensure that service providers are keeping users updated.

Facebook has said that the recent social experiment is perfectly legal under its TOS,[6] the question of fairness of the conditions of users consent remain debatable. Facebook has a broad copyright license that goes beyond its operating requirements, such as the right to 'sublicense'. The copyright also does not end when users stop using the service, unless the content has been deleted by everyone else.

More importantly, since 2007, Facebook has brought major changes to their lengthy TOS about every year.[7] And while many point that Facebook is transparent, as it solicits feedback preceding changes to their terms, the accountability remains questionable, as the results are not binding unless 30% of the actual users vote. Facebook can and does, track users and shares their data across websites, and has no obligation or mechanism to inform users of the takedown requests.

Courts in different jurisdictions under different laws may come to different conclusions regarding these practices, especially about whether changing terms without notifying users is acceptable or not. Living in a society more protective of consumer rights is however, no safeguard, as TOS often include a clause of choice of law which allow companies to select jurisdictions whose laws govern the terms.

The recent experiment bypassed the need for informed user consent due to Facebook's Data Use Policy[8], which states that once an account has been created, user data can be used for 'internal operations, including troubleshooting, data analysis, testing, research and service improvement.' While the users worldwide may be outraged, legally, Facebook acted within its rights as the decision fell within the scope of T&Cs that users consented to. The incident's most positive impact might be in taking the questions of Facebook responsibilities towards protecting users, including informing them of the usage of their data and changes in data privacy terms, to a worldwide audience.

My right is bigger than yours

Most TOS agreements, written by lawyers to protect the interests of the companies add to the complexities of privacy, in an increasingly user-generated digital world. Often, intentionally complicated agreements, conflict with existing data and user rights across jurisdictions and chip away at rights like ownership, privacy and even the ability to sue. With conditions that that allow for change in terms at anytime, existing users do not have ownership or control over their data.

In April New York Times, reported of updates to the legal policy of General Mills (GM), the multibillion-dollar food company.[9] The update broadly asserted that consumers interacting with the company in a variety of ways and venues no longer can sue GM, but must instead, submit any complaint to “informal negotiation” or arbitration. Since then, GM has backtracked and clarified that “online communities” mentioned in the policy referred only to those online communities hosted by the company on its own websites.[10] Clarification aside, as Julia Duncan, Director of Federal programs at American Association for Justice points out, the update in the terms were so broad, that they were open to wide interpretation and anything that consumers purchase from the company could have been held to this clause. [11]

Data and whose rights?

Following Snowden revelations, data privacy has become a contentious issue in the EU, and TOS, that allow the service providers to unilaterally alter terms of the contract, will face many challenges in the future. In March Edward Snowden sent his testimony to the European Parliament calling for greater accountability and highlighted that in "a global, interconnected world where, when national laws fail like this, our international laws provide for another level of accountability."[12] Following the testimony came the European Parliament's vote in favor of new safeguards on the personal data of EU citizens, when it’s transferred to non-EU.[13] The new regulations seek to give users more control over their personal data including the right to ask for data from companies that control it and seek to place the burden of proof on the service providers.

The regulation places responsibility on companies, including third-parties involved in data collection, transfer and storing and greater transparency on concerned requests for information. The amendment reinforces data subject right to seek erasure of data and obliges concerned parties to communicate data rectification. Also, earlier this year, the European Court of Justice (ECJ) ruled in favor of the 'right to be forgotten'[14]. The ECJ ruling recognised data subject's rights override the interest of internet users, however, with exceptions pertaining to nature of information, its sensitivity for the data subject's private life and the role of the data subject in public life.

In May, the Norwegian Consumer Council filed a complaint with the Norwegian Consumer Ombudsman, “… based on the discrepancies between Norwegian Law and the standard terms and conditions applicable to the Apple iCloud service...”, and, “...in breach of the law regarding control of marketing and standard agreements.”[15] The council based its complaint on the results of a study, published earlier this year, that found terms were hazy and varied across services including iCloud, Drop Box, Google Drive, Jotta Cloud, and Microsoft OneDrive. The Norwegian Council study found that Google TOS, allow for users content to be used for other purposes than storage, including by partners and that it has rights of usage even after the service is cancelled. None of the providers provide a guarantee that data is safe from loss, while many, have the ability to terminate an account without notice. All of the service providers can change the terms of service but only Google and Microsoft give an advance notice.

The study also found service providers lacking with respect to European privacy standards, with many allowing for browsing of user content. Tellingly, Google had received a fine in January by the French Data Protection Authority, that stated regarding Google's TOS, "permits itself to combine all the data it collects about its users across all of its services without any legal basis."

To blame or not to blame

Facebook is facing a probe by the UK Information Commissioner's Office, to assess if the experiment conducted in 2012 was a violation of data privacy laws.[16] The FTC asked the court to order T-Mobile USA, to stop mobile cramming, provide refunds and give up any revenues from the practice. The existing mechanisms of online consent, do not simplify the task of agreeing to multiple documents and services at once, a complexity which manifolds, with the involvement of third parties.

Unsurprisingly, T-Mobile's Legere termed the FTC lawsuit misdirected and blamed the companies providing the text services for the cramming.[17] He felt those providers should be held accountable, despite allegations that T-Mobile's billing practices made it difficult for consumers to detect that they were being charged for unauthorized services and having shared revenues with third-party providers. Interestingly, this is the first action against a wireless carrier for cramming and the FTC has a precedent of going after smaller companies that provide the services.

The FTC charged T-Mobile USA with deceptive billing practices in putting the crammed charges under a total for 'use charges' and 'premium services' and failure to highlight that portion of the charge was towards third-party charges. Further, the company urged customers to take complaints to vendors and was not forthcoming with refunds. For now, T-Mobile may be able to share the blame, the incident brings to question its accountability, especially as going forward it has entered a pact along with other carriers in USA including Verizon and AT&T, agreeing to stop billing customers for third-party services. Even when practices such as cramming are deemed illegal, it does not necessarily mean that harm has been prevented. Often users bear the burden of claiming refunds and litigation comes at a cost while even after being fined companies could have succeeded in profiting from their actions.

Conclusion

Unfair terms and conditions may arise when service providers include terms that are difficult to understand or vague in their scope. TOS that prevent users from taking legal action, negate liability for service providers actions despite the companies actions that may have a direct bearing on users, are also considered unfair. More importantly, any term that is hidden till after signing the contract, or a term giving the provider the right to change the contract to their benefit including wider rights for service provider wide in comparison to users such as a term that that makes it very difficult for users to end a contract create an imbalance. These issues get further complicated when the companies control and profiting from data are doing so with user generated data provided free to the platform.

In the knowledge economy, web companies play a decisive role as even though they work for profit, the profit is derived out of the knowledge held by individuals and groups. In their function of aggregating human knowledge, they collect and provide opportunities for feedback of the outcomes of individual choices. The significance of consent becomes a critical part of the equation when harnessing individual information. In France, consent is part of the four conditions necessary to be forming a valid contract (article 1108 of the Code Civil).

The cases highlight the complexities that are inherent in the existing mechanisms of online consent. The question of consent has many underlying layers such as reasonable notice and contractual obligations related to consent such as those explored in the case in Canada, which looked at whether clauses of TOS were communicated reasonably to the user, a topic for another blog. For now, we must remember that by creating and organising social knowledge that further human activity, service providers, serve a powerful function. And as the saying goes, with great power comes great responsibility.

[1] 'FTC Alleges T-Mobile Crammed Bogus Charges onto Customers’ Phone Bills', published 1 July, 2014. See: http://www.ftc.gov/news-events/press-releases/2014/07/ftc-alleges-t-mobile-crammed-bogus-charges-customers-phone-bills

[2] 'Experimental evidence of massive-scale emotional contagion through social networks', Adam D. I. Kramera,1, Jamie E. Guilloryb, and Jeffrey T. Hancock, published March 25, 2014. See:http://www.pnas.org/content/111/24/8788.full.pdf+html?sid=2610b655-db67-453d-bcb6-da4efeebf534

[3] 'U.S. sues T-Mobile USA, alleges bogus charges on phone bills, Reuters published 1st July, 2014 See: http://www.reuters.com/article/2014/07/01/us-tmobile-ftc-idUSKBN0F656E20140701

[4] 'The Cost of Reading Privacy Policies', Aleecia M. McDonald and Lorrie Faith Cranor, published I/S: A Journal of Law and Policy for the Information Society 2008 Privacy Year in Review issue. See: http://lorrie.cranor.org/pubs/readingPolicyCost-authorDraft.pdf

[5] 'Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Days', Alexis C. Madrigal, published The Atlantic, March 2012 See: http://www.theatlantic.com/technology/archive/2012/03/reading-the-privacy-policies-you-encounter-in-a-year-would-take-76-work-days/253851/

[6] Facebook Legal Terms. See: https://www.facebook.com/legal/terms

[7] 'Facebook's Eroding Privacy Policy: A Timeline', Kurt Opsahl, Published Electronic Frontier Foundation , April 28, 2010 See:https://www.eff.org/deeplinks/2010/04/facebook-timeline

[8] Facebook Data Use Policy. See: https://www.facebook.com/about/privacy/

[9] 'When ‘Liking’ a Brand Online Voids the Right to Sue', Stephanie Strom, published in New York Times on April 16, 2014 See: http://www.nytimes.com/2014/04/17/business/when-liking-a-brand-online-voids-the-right-to-sue.html?ref=business

[10] Explaining our website privacy policy and legal terms, published April 17, 2014 See:http://www.blog.generalmills.com/2014/04/explaining-our-website-privacy-policy-and-legal-terms/#sthash.B5URM3et.dpufhttp://www.blog.generalmills.com/2014/04/explaining-our-website-privacy-policy-and-legal-terms/

[11] General Mills Amends New Legal Policies, Stephanie Strom, published in New York Times on 1http://www.nytimes.com/2014/04/18/business/general-mills-amends-new-legal-policies.html?_r=0

[12] Edward Snowden Statement to European Parliament published March 7, 2014. See: http://www.europarl.europa.eu/document/activities/cont/201403/20140307ATT80674/20140307ATT80674EN.pdf

[13] Progress on EU data protection reform now irreversible following European Parliament vote, published 12 March 201 See: http://europa.eu/rapid/press-release_MEMO-14-186_en.htm

[14] European Court of Justice rules Internet Search Engine Operator responsible for Processing Personal Data Published by Third Parties, Jyoti Panday, published on CIS blog on May 14, 2014. See: http://cis-india.org/internet-governance/blog/ecj-rules-internet-search-engine-operator-responsible-for-processing-personal-data-published-by-third-parties

[15] Complaint regarding Apple iCloud’s terms and conditions , published on 13 May 2014 See:http://www.forbrukerradet.no/_attachment/1175090/binary/29927

[16] 'Facebook faces UK probe over emotion study' See: http://www.bbc.co.uk/news/technology-28102550

[17] Our Reaction to the FTC Lawsuit See: http://newsroom.t-mobile.com/news/our-reaction-to-the-ftc-lawsuit.htm

For more details visit https://cis-india.org/internet-governance/blog/reading-between-the-lines-service-providers-terms-and-conditions-and-consumer-rights

Press Coverage of Online Censorship Row

pranesh — 2011-12-08T11:31:30Z

We are maintaining a rolling blog with press references to the row created by the proposal by the Union Minister for Communications and Information Technology to pre-screen user-generated Internet content.

Monday, December 5, 2011

India Asks Google, Facebook to Screen Content | Heather Timmons (New York Times, India Ink)

Tuesday, December 6, 2011

Sibal warns social websites over objectionable content | Sandeep Joshi (The Hindu)

Hate speech must be blocked, says Sibal | Praveen Swami & Sujay Mehdudia (The Hindu)

Won't remove material just because it's controversial: Google | (Press Trust of India)

Any Normal Human Being Would Be Offended | Heather Timmons (New York Times, India Ink)

After Sibal, Omar too feels some online content inflammatory | (Press Trust of India)

Online uproar as India seeks social media screening | Devidutta Tripathy and Anurag Kotoky (Reuters)

Kapil Sibal for content screening: Facebook, Twitter full of posts against censorship | (IANS)

India May Overstep Its Own Laws in Demanding Content Filtering | John Ribeiro (IDG)

Kapil Sibal warns websites: Mixed response from MPs | (Press Trust of India)

Websites must clean up content, says Sibal | (NewsX)

Kapil Sibal warns websites; Google says won't remove material just because it's controversial | Press Trust of India

Censorship By Any Other Name... | Yamini Lohia (Mint)

Kapil Sibal: We have to take care of sensibility of our people | Associated Press

Kapil Sibal gets backing of Digvijaya Singh over social media screening | Press Trust of India

Sibal Gets What He Set Out To Censor | (Hindustan Times, Agencies)

Objectionable Matter Will Be Removed, Censorship Not in Picture Yet: Kapil Sibal | Amar Kapadia (News Tonight)

Wednesday, December 7, 2011

Kapil Sibal Doesn't Understand the Internet | Shivam Vij (India Today)

'Chilling' Impact of India's April Internet Rules | Heather Timmons (New York Times, India Ink)

Screening, not censorship, says Sibal | (Business Standard)

Chandni Chowk to China | Salil Tripathi (Mint)

Kapil Sibal vs the internet | Sandipan Deb (Mint)

No Need for Censorship of the Internet: Cyber Law Experts | (Times News Network)

Protest with flowers for Sibal | (The Hindu)

Kapil Sibal cannot screen this report | Team DNA, Blessy Chettiar & Renuka Rao (Daily News and Analysis)

Kapil Sibal warns websites, but experts say prescreening of user content not practical | (Reuters)

Sibal's Remarks Brought Disgust | Hitesh Mehta (News Tonight)

BJP backs mechanism to curb objectionable content on websites | (The Hindu)

Move to regulate networking sites should be discussed in Parliament: BJP | (Press Trust of India)

Sibal under attack in cyberspace | (Press Trust of India)

Kapil Sibal's web censorship: Indian govt wanted 358 items removed, says Google | (Press Trust of India)

Kapil Sibal gets BJP support but with rider | (Indo-Asian News Service)

Sibal's way of regulating web not okay, says BJP | (Indo-Asian News Service)

Censorship in Blasphemy's Clothings | Gautam Chikermane (Hindustan Times, Just Faith)

India wants Google, Facebook to screen content | Sharon Gaudin (Computer World)

Should we be taming social media? | Swati Prasad (ZDNet, Inside India)

Kapil Sibal gets lampooned for views on Web control | (Daily News and Analysis)

'We don't need no limitation' | Asha Prakash (Times of India)

Five reasons why India can't censor the internet | Prasanto K. Roy (Indo-Asian News Service)

We Are the Web | (Indian Express)

Thursday, December 8, 2011

Kapil Sibal under attack in cyberspace, (Press Trust of India)

Speak Up for Freedom | Pranesh Prakash (Indian Express)

Newswallah: Censorship | Neha Thirani (New York Times, India Ink)

No Question of Censoring the Internet, Says Sachin Pilot | (NDTV)

Mind Your Netiquette, or We'll Mind it for You | A.A.K. (The Economist)

Take Parliament's view to regulate social networking sites, BJP tells govt | (Times News Network)

India wanted 358 items removed | Priscilla Jebaraj (The Hindu)

Indian Government v Social Networking sites: Expert Views | (Bar & Bench News Network)

Can Government Muzzle Websites? | Priyanka Joshi & Piyali Mandal (Business Standard)

US concerned over internet curbs, sidesteps India move | (Indo-Asian News Service)

Why Internet Companies Are Upset with Kapil Sibal | (Rediff)

Why Censor Facebook When You Don't Censor Sunny Leone? | (Indo-Asian News Service)

Online content issue: Talks with India on, says U.S. | (Press Trust of India)

US calls for Internet freedom amid India plan | Agence France-Presse

For more details visit https://cis-india.org/internet-governance/blog/press-coverage-online-censorship

PDP Bill is coming: WhatsApp Privacy Policy analysis

Pallavi Bedi & Shweta Reddy — 2021-01-19T08:12:23Z

WhatsApp started off the new year with changes to its privacy policy that has several implications for data protection and the digital governance ecosystem at large. This post is the first in a series by CIS unpacking the various implications of the policy.

On January 4, 2021, WhatsApp announced a revised privacy policy. The announcement was through an in-app notification. Users were asked to agree to the policy by February 8, else they will lose access to their accounts. The announcement triggered a backlash, globally and in India and it led to millions of users in India migrating to other messaging platforms. In light of the backlash, WhatsApp had on January 15 announced that it will delay rolling out the new policy to May 15, 2021.

It is important to note that many users have also commented that the new explicit terms of mandatory data sharing with Facebook and the extent of metadata collection haven’t changed drastically from WhatsApp’s existing operations. In 2016, WhatsApp had revised its privacy policy to enable data sharing with Facebook. Users were provided 30 days to opt out of such data sharing. However, the option to opt out was not provided to users who joined the service after September 25, 2016 or who failed to exercise the opt-out option. The changes in the policy were challenged in the Delhi High Court. The High Court (i) directed WhatsApp to delete the complete information of users who exercised the option to opt out before September 25, 2016; and (ii) with respect to users who did not exercise the opt-out option, WhatsApp was directed to not share the information of users collected until September 25, 2016 with Facebook. The matter is currently pending before the Supreme Court.

The change in people’s reactions to the data processing from 2016 can partly be attributed to the change in the users perception of privacy and personal data protection. Conversations around privacy and data protection and harms arising out of unauthorized data collection are much more prevalent. What has also irked a large number of users is the difference between the privacy policy applicable to the European Region and the policy applicable to the rest of the world; There is a disparity in the two policies regarding the rights of the users in relation to sharing of data with Facebook Companies(Facebook payments inc, Facebook Payments International Limited, Onavo, Facebook technologies LLC, Facebook Technologies Ireland limited, WhatsApp inc. WhatsApp Ireland Limited and Crowdtangle) due to the application of the General Data Protection Regulation.

Currently, Indian users have a fundamental right to privacy and an overarching data protection framework is set to be tabled in the Parliament soon. The Personal Data Protection Bill, 2019, being deliberated by the Joint Parliamentary Committee, is expected to provide comprehensive requirements for authorized collection and management of personal data. The proposed Bill, despite several shortcomings, does offer significantly more protection than the current framework consisting of S. 43A of Information Technology Act, 2000 and the Information Technology (Reasonable Security practices and procedures and sensitive personal data or Information) Rules, 2011. This blogpost will examine the viability of the revised privacy policy of WhatsApp if the proposed bill is enacted in the currently available public version of the Bill. In the subsequent posts we will analyse the effect of the revised privacy policy on the pending litigation.

Privacy notice

Section 7 of the proposed bill puts an obligation on the data fiduciary to provide a privacy notice, i.e. a document containing granular details of the processing of personal data to the data principals. The details must be provided in a manner that is clear, concise and easily comprehensible to a reasonable person. The notice should also be provided in multiple languages where necessary and practicable. The importance of a clear and concise policy has been highlighted in the Justice Srikrishna Report on Data Protection. However, there is no guidance from the Indian authorities on what it constitutes. Guidance from the Article 29 working party in the EU suggests that the policy must be presented in a manner that avoids information fatigue. In the digital context, it has been recommended that presenting a policy in a layered format enhances readability. The guidance also suggests that policy should avoid reliance on complex sentences and abstract terms to convey the details of the processing operations. The revised privacy policy of WhatsApp cannot be termed a clear and concise policy. The purely text-based policy, containing around 3800 words, is not presented in a layered format resulting in shockingly low readability for the amount and type of personal data collection the policy is attempting to convey. In addition to improper design and structure, the policy contains vague language providing an average user a hazy understanding of the extent of data processing and can leave room for different interpretations. The earlier version of the policy also uses similar language and structure to convey details regarding the processing and doesn’t provide transparent details regarding its data sharing with Facebook. Relying on a similar format as its earlier versions without revising it based on global discussions around the best methods seems to be an opportunity lost to remedy the privacy policy. The structure, form and language of the policy will have to be revised if the Bill is enacted in its current form and the policy will also have to be provided in multiple languages.

Bundled consent

According to its policy, WhatsApp relies on the consent of the user for the purpose of providing messaging and communication services, sharing information with third party service providers that help WhatsApp “operate, provide, improve, understand, customize, support, and market” their Services, and sharing information with other Facebook companies for “providing integrations with Facebook Company products” to name a few. It is important to verify if the consent being obtained is valid according to the standard set by the proposed framework.

For consent to be valid under the proposed framework (Section 11(4)) , the provision and quality of services provided should not be linked to consenting to processing of personal data that is not directly necessary for that purpose. In WhatsApp’s case, the primary purpose of processing is to provide messaging and communication services on that particular platform. Neither sharing personal data with third party service providers for better marketing of their services on other platforms nor sharing it with Facebook company of products for better integration of services is incidental to the primary purpose of processing. The bundling of consent results in forcing individuals to either accept processing of personal data for all of the purposes outlined or lose the services altogether resulting in an invalid consent. An explicit opt-in mechanism for all those processing operations that are not compatible with the primary purpose of processing will have to be provided to the Indian users if the Bill is enacted in its current form and consent is being relied on as the lawful ground of processing.

Data sharing with Facebook

WhatsApp’s policy on sharing of information with Facebook has garnered a significant amount of attention and has also raised privacy concerns amongst WhatsApp users in non-European countries. This is because the policy applicable to non- European countries now does not provide the user option to opt out from sharing the information if the user wants to continue using and operating WhatsApp. The policy under the heading ‘How we work with other Facebook Companies’ states that “As part of the Facebook Companies, WhatsApp receives information from, and shares information (see here) with, the other Facebook Companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Facebook Company Products.” The information that may be shared by WhatsApp with Facebook Companies includes; (i) users phone number; (ii) transaction data; (iii) service-related information, (iv) information on how the users interact with others (including businesses); (v) mobile device information; (vi) the user’s IP address; and (vii) and any other data covered by the privacy policy. All this information/data will fall within the ambit of personal data in terms of the current version of the Bill and therefore WhatsApp would have to comply with the obligations put on it under the Bill for it to be able to share personal data with other data fiduciaries including Facebook Companies.

As noted earlier, it is pertinent to note that the privacy policy is not the same globally. As per the privacy policy applicable to Europe, WhatsApp states that any information that it shares with Facebook Companies is to be used on WhatsApp’s behalf and in accordance with its instructions. Any such information cannot be used for the Facebook Companies own purposes. This statement is not reflected in the privacy policy applicable to non European countries. Facebook has in a statement stated that “For the avoidance of any doubt, it is still the case that WhatsApp does not share European region WhatsApp user data with Facebook for the purpose of Facebook using this data to improve its products or advertisements”

Data sharing with other third party service providers

It is also important to note that sharing of information is not limited to Facebook Companies, but also extends to other third party service providers. However, apart from a vaguely drafted statement stating that WhatsApp works with third party service providers as well as other Facebook Companies to help it to “operate, provide, improve, understand, customize, support, and market our Services”, the privacy policy is silent and does not provide any insight or clear information on (a) the nature of these third party entities; (b) extent of information shared with such third party entities. Further, even though the policy provides a link to the other Facebook Companies (Facebook Payments Inc, Facebook International Limited, Onavo CrowdTangle) that it works with; there is again no clarity as to what are the specific services provided by these companies.

One of the rights provided to a data principal under Section 17 (3) and Section 7 (1)(g) of the current version of the Bill, is the right to be informed and the consent to be obtained from the data principal about the individuals or entities with whom personal data may be shared. The data principal also has the right to be informed about and given access to the categories of personal data shared with the other data fiduciaries. However, the policy as it stands on date is silent about both the details of the third parties service providers as well as the categories of personal data that could be shared with them.

Metadata collection and data minimisation

The details on usage and log information in the previous version of the policy were rather vague as a result of which the extent of data collection was difficult to ascertain. The revised version indicates that WhatsApp’s metadata collection went further than most of the other popular messaging applications and the data being collected was linked back to the user and device identity. The principle of data minimisation (Section 6 of the proposed framework) limits the collection of personal data to that which is necessary for the purpose of processing. The compelling reasons that justify the metadata collection for the primary purpose of messaging and communication are so far unclear. The metadata collection section is similar in the privacy policy for the EU region and on the face of it doesn’t look GDPR compliant as well. Collection of those categories of personal data that are not necessary for processing of the primary purpose will need to be discontinued if the Bill is enacted in its current form.

Data Principal rights

The difference between the protection afforded to Indian resident users and European resident users is highlighted in the rights accorded to the data principal under the two privacy policies. The European privacy policy has a section dedicated to how users can exercise their rights and specifies that users have the right to access, rectify, port, and erase their information, as well as the right to restrict and object to certain processing of their information. These rights are a reflection of the protection afforded to data principles under the GDPR. As per the current version of the Bill, the data principal will have the right to (i) confirmation and access (Section 17); (ii) correction and erasure (Section 18); and (iii) data portability (Section 19). If the current version of the Bill is enacted, then WhatsApp will be required to amend its privacy policy regarding its applicability to India and incorporate the rights of data accorded to the data principal .

Grievance redressal

The European Region privacy policy specifies the entity within WhatsApp responsible for addressing the complaints of the users and it further also informs the user that they have the right to approach the Irish Data Protection Commission, or any other competent data protection supervisory authority. None of these provisions are specified in the Non-European Region privacy policy. The current version of the PDP Bill places an obligation on the data fiduciary to establish an effective grievance redressal mechanism (Section 32(1)) and to inform the data principal about their right to approach the Data Protection Authority (which is proposed to be established under the PDP Bill) (Section 7(k)). Additional details regarding the same will have to be provided if the Bill is enacted in its current form.

Clarifications from WhatsApp

On January 13, 2021, WhatsApp published a blog stating that the changes to the privacy policy will not affect users who use the platform messaging with friends and family, the changes will only apply to users who use the platform to communicate with business accounts. As per WhatsApp messages to business accounts on WhatsApp can be shared with third-party service providers, which may include Facebook itself. As per the blog, “But whether you communicate with a business by phone, email, or WhatsApp, it can see what you’re saying and may use that information for its own marketing purposes, which may include advertising on Facebook.” It is important to note that we recognise that the content of the messages and the call remains encrypted, however, the concern arises from the collection and use of ‘metadata.’

WhatsApp’s repeated assurances and clarifications asserting their commitment to data privacy falls short. Their insistence that their chats still use end to end encryption and that only interactions with WhatsApp Business will be shared with Facebook indicates ignorance with regard to the different contours of informational privacy. The expectations of privacy that individuals have over their personal data is linked to the extent of control they have over disclosure of such data. The mandatory metadata collection and lack of opt out clauses for data sharing for marketing purposes results in a mere illusion of control through its façade consent collecting process.

For the most part, the proposed framework should provide us the same level of protection offered to EU users of WhatsApp regarding some of the key contentions highlighted above. However, additional data principal rights such as the right to object and right to restrict processing will give additional protections to the data principal in case of data processing for marketing purposes. The uproar over the data collection practices of WhatsApp have cemented the immediate need for an effective data protection legislation in the country. The final draft of the Bill with 89 new amendments is expected to be released soon. Considering the renewed apprehensions regarding unwarranted processing of personal data, we can only hope that the amendments have taken into consideration the feedback and comments provided by relevant stakeholders.

(This post was edited and reviewed by Amber Sinha, Arindrajit Basu and Aman Nair)

For more details visit https://cis-india.org/internet-governance/blog/pdp-bill-is-coming-whatsapp-privacy-policy-analysis

Mufti Aijaz Arshad Qasmi v. Facebook and Ors (Order dated December 20, 2011)

pranesh — 2012-02-20T18:02:44Z

This is the order passed on December 20, 2011 by Addl. Civil Judge Mukesh Kumar of the Rohini Courts, New Delhi. All errors of spelling, syntax, logic, and law are present in the original.

Suit No 505/11

Mufti Aijaz Arshad Qasmi
vs.
Facebook etc.

20.12.11

Fresh suit received by assignment. It be checked and registered.

Present: Plaintiff in person with Ld. Counsel.

Ld. Counsel for plaintiff prayed for ex-parte ad-interim injunction. He has filed the present suit for permanent and mandatory injunction against 22 defendants who are running their social networking websites under the name of Facebook, Google India (P) Ltd., Yahoo India (P) Ltd., Microsoft India (P) Ltd., Orkut, Youtube etc as shown in the memo of parties in the plaint. It is submitted that plaintiff is an active citizen of India and residing at the given address and he believes in Secular, Socialist and Democratic India professing Muslim religion. It is further submitted that the contents which are uploaded by some of the miscreants through these social networking websites mentioned above are highly objectionable and unacceptable by any set of the society as the contents being published through the aforesaid websites are derogatory, per-se inflammatory and defamatory which cannot be acceptable by any of the society professing any religion. Even if the same is allowed to be published through these social networking websites and if anybody will take out the print and circulated amongst any of the community whether it is Muslim or Hindu or Sikh, then definitely there would be rioting at mass level which may result into serious law and order problem in the country. Where the miscreants have not even spare any of the religion, even they have created defamatory articles and pictures against the Prophet Mohammad, the Hindu goddess Durga, Laxmi, Lord Ganesha and many other Hindu gods which are being worshiped by the people of Hindu community. It is prayed by the counsel for plaintiff that the defendants may be directed to remove these defamatory and derogatory articles and pictures from their social websites and they should be restrained from publishing the same anywhere through Internet or in any manner. It is further submitted that the social websites are being utilised by the every person of whatever age of he is whether he is 7 years old or 80 years old. These defamatory articles will certainly corrupt not only young minds below the 18 years of age but also corrupt the minds of all age group persons. It is further submitted that even the miscreants have not spared the leaders of any political party whether it is BJP, Congress, Shiv Sena or any other political party doing their political activities in India, which may further vitiate the minds of every individual and may result into political rivalry by raising allegations against each other.

I have gone through the record carefully wherein the plaintiff has also filed a CD containing all the defamatory articles and photographs, plaintiff also wants to file certain defamatory and obscene photographs of the Prophet Mohammad and Hindu Gods and Goddesses. Photographs are returned to the plaintiff, although, the defamatory written articles are taken on record. Same be kept in sealed cover.

In my considered opinion, the photographs shown by the plaintiff having content of defamation and derogation against the sentiments of every community. In such circumstances, I am of the view that the plaintiff has a prima facie case in his favour. Moreover, balance of convenience also lies against the defendants and in favour of the plaintiff. Moreover, if the defendants will not be directed to remove the defamatory articles and contents from their social networking websites, then not only the plaintiff but every individual who is having religious sentiments would suffer irreparable loss and injury which cannot be compensated in terms of money. Accordingly, in view of the above discussion, taking in consideration the facts and circumstances and nature of the suit filed by the plaintiff where every time these social networking websites are being used by the public at large and there is every apprehension of mischief in the public, the defendants are hereby restrained from publishing the defamatory articles shown by the plaintiff and contained in the CD filed by the plaintiff immediately on service of this order and notice. Defendants are further directed to remove the same from their social networking websites.

Application under Order 39 Rule 1 & 2 CPC stands allowed and disposed of accordingly.

Summons be issued to the defendants on filing of PF/RO/Speed Post. The defendants having their addresses in different places may be served as per the provisions of Order 5 CPC. Reader of this court is directed to keep the documents and CD in a sealed cover. Plaintiff is directed to get served the defendants along with all the documents. Plaintiff is further directed to ensure the compliance of the provisions under Order 39 Rule 3 CPC and file an affidavit in this regard. Copy of this order be given dasti.

Put up for further proceedings on 24.12.11.

Sd/-
(Mukesh Kumar)
ACJ-cum-ARC, N-W
Rohini Courts, Delhi

For more details visit https://cis-india.org/internet-governance/resources/order-2011-12-20-mufti-aijaz-arshad-qasmi-v-facebook-and-ors

Linking Facebook use to free top-up data

praskrishna — 2016-02-14T12:33:17Z

Just before the Trai notification, the Ambani brothers signed a spectrum sharing pact and they have been sharing optic fibre since 2013.

The article was published in the Deccan Chronicle on February 14, 2016. Pranesh Prakash gave inputs.

Some people argue that Trai should have stayed off the issue since the Competition Commission of India (CCI) is sufficient to tackle Net Neutrality harms. However it is unclear if predatory pricing by Reliance, which has only nine per cent market share, will cross the competition law threshold for market dominance? Interestingly, just before the Trai notification, the Ambani brothers signed a spectrum sharing pact and they have been sharing optic fibre since 2013.

Will a content sharing pact follow these carriage pacts? As media diversity researcher, Alam Srinivas, notes: “If their plans succeed, their media empires will span across genres such as print, broadcasting, radio and digital. They will own the distribution chains such as cable, direct-to-home (DTH), optic fibre (terrestrial and undersea), telecom towers and multiplexes.”

What does this convergence vision of the Ambani brothers mean for media diversity in India? In the absence of net neutrality regulation could they use their dominance in broadcast media to reduce choice on the Internet? Could they use a non-neutral provisioning of the Internet to increase their dominance in broadcast media? When a single wire or the very same radio spectrum delivers radio, TV, games and Internet to your home — what under competition law will be considered a substitutable product? What would be the relevant market?

At the Centre for Internet and Society (CIS), we argue that competition law principles with lower threshold should be applied to networked infrastructure through infrastructure specific non-discrimination regulations like the one that Trai just notified to protect digital media diversity.

Was an absolute prohibition the best response for Trai? With only two possible exemptions — i.e. closed communication network and emergencies — the regulation is very clear and brief. However, as our colleague Pranesh Prakash has said, Trai has over-regulated and used a sledgehammer where a scalpel would have sufficed. In CIS’ official submission, we had recommended a series of tests in order to determine whether a particular type of zero rating should be allowed or forbidden. That test may be legally sophisticated; but as Trai argues it is clear and simple rules that result in regulatory equity. A possible alternative to a complicated multi-part legal test is the leaky walled garden proposal. Remember, it is only in the case of very dangerous technologies where the harms are large scale and irreversible and an absolute prohibition based on the precautionary principle is merited.

However, as far as network neutrality harms go, it may be sufficient to insist that for every MB that is consumed within Free Basics, Reliance be mandated to provide a data top up of 3MB.

This would have three advantages. One, it would be easy to articulate in a brief regulation and therefore reduce the possibility of litigation. Two, it is easy for the consumer who is harmed to monitor the mitigation measure and last, based on empirical data, the regulator could increase or decrease the proportion of the mitigation measure.

This is an example of what Prof Christopher T. Marsden calls positive, forward-looking network neutrality regulation. Positive in the sense that instead of prohibitions and punitive measures, the emphasis is on obligations and forward-looking in the sense that no new technology and business model should be prohibited.

For more details visit https://cis-india.org/internet-governance/news/deccan-chronicle-february-14-2016-linking-facebook-use-to-free-top-up-data

It Took Just 355 Indians to Mine the Data of 5.6 Lakh Facebook Users. Here's How

Admin — 2018-04-07T15:33:46Z

Data privacy in India is still a nascent subject. Experts say cheap data has led to unprecedented Facebook penetration. Often, it is seen that those who open an account are not aware of the privacy concerns.

The blog post by Subhajit Sengupta was published in CNN-News 18 on April 7, 2018. Sunil Abraham was quoted.

Over 5.6 lakh Indian Facebook profiles have allegedly been compromised and their data leaked to the controversial data analytics firm Cambridge Analytica. As per the company, only 335 people in India installed the App yet they managed to penetrate over half a million profiles.

So, how does this work?

Once a user downloaded the quiz app called “thisisyourdigitallife”, Global Science Research Limited got access to the entire treasure trove of data. There are two mechanisms which are used for this.

First, the Application Program Interface (API) of Facebook called ‘Social Graph’ allows any app to harvest the entire contact list and everything else that could be seen on a users’ friend’s profile. This would take place even for private profiles, says Sunil Abraham, Executive Director of Bangalore based research organization ‘Centre for Internet and Society’.

The second way is when users have a public profile. The algorithm seeks out public profiles from the friend list and would go on multiplying from one public profile to another without any of the users even coming to know what is happening. This is like the ‘True Caller’ application, for it to get your number, you don’t need to download the software. If anyone has the app and your number, then it gets automatically logged there.

Facebook says "Cambridge Analytica’s acquisition of Facebook data through the app developed by Dr Aleksandr Kogan and his company Global Science Research Limited (GSR) happened without our authorisation and was an explicit violation of our Platform policies."

GSR continued to access this data from all the Facebook profiles throughout the entire lifespan of the app on the Facebook platform, which was roughly two years between 2013 and 2015. This means, even if a user is careful enough to not download the application but his/her profile’s privacy settings are weak, the algorithm would infiltrate the data bank.

Amit Dubey, a Cyber Security Expert goes into the details of what the app did, “The app called 'thisisyourdigitallife', which was created for research work by Aleksandr Kogan, was eventually used for psychometric profiling of users and then manipulating their political biases. The app was offered to users on the pretext to take a personality test and it agreed to have their data collected for academic use only. But the app has exploited a security vulnerability of Facebook application.”

Facebook “platform policy” allowed only collection of friends’ data to improve user experience in the app and barred it from being sold or used for advertising.

But this kind of data scrapping is not just limited to Cambridge Analytica. The Social Media Algorithm is often abused in the world of data scavenging and analytics. Even law enforcement agencies have often used similar means to locate possible miscreants.

According to Shesh Sarangdhar, Chief Executive Officer in Seclabs & Systems Pvt Ltd, similar data scrapping helped them unearth the terror module behind one of the attacks at an airbase last year. Shesh said that through Social Media Algorithm they would often narrow down on unknown terror modules. What his team did was to connect to the profile the whereabouts of multiple known nods converging. That is how the mastermind was located.

Data privacy in India is still a nascent subject. Experts say cheap data has led to unprecedented Facebook penetration.

Often, it is seen that those who open an account are not aware of the privacy concerns. But as Sunil Abraham puts it, Caveat emptor or ‘Let the Buyers Beware’ does not even apply here. It is not possible for anyone to go through the entire privacy policy.

“So it is not even right to ask if the consumer can protect his/her own interest. Thus, the state should proactively regulate the industry,” said Abraham.

Facebook has brought in a number of changes to its privacy settings. It now allows you to remove third-party apps in bulk. This welcome change has come after sustained pressure on the tech giant from users and a number of regulatory bodies across the world.

For more details visit https://cis-india.org/internet-governance/news/news-18-subhajit-sengupta-how-just-355-indians-put-data-of-5-6-lakh-facebook-users-at-risk

ISIS and Recruitment using Social Media – Roundtable Report

Vidushi Marda, Aditya Tejus, Megha Nambiar and Japreet Grewal — 2016-12-16T02:19:16Z

The Centre for Internet and Society in collaboration with the Takshashila Institution held a roundtable discussion on “ISIS and Recruitment using Social Media” on 1 September 2016 from 5.00 p.m. to 7.30 p.m. at TERI in Bengaluru.

The objective of this roundtable was to explore the recruitment process and methods followed by ISIS on social media platforms like Facebook and Twitter and to understand the difficulties faced by law enforcement agencies and platforms in countering the problem while understanding existing counter measures, with a focus on the Indian experience.

Reviewing Existing Literature

To provide context to the discussion, a few key pieces of existing literature on online extremism were highlighted. Discussing Charlie Winter’s “Documenting the Virtual Caliphate”, a participant outlined the multiple stages of the radicalisation process that begins with a person being exposed to general ISIS releases, entering an online filter bubble of like minded people, initial contact, followed by persuasion by the contact person to isolate the potential recruit from his/her family and friends. This culminates with the assignment of an ISIS task to such person. The takeaway from the paper, was the colossal scale of information and events put out by ISIS on the social media. It was pointed out that contrary to popular belief, ISIS publishes content under six broad themes: mercy, belonging, brutality, victimhood, war and utopia, least of which falls under the category of brutality which in fact garners the most attention worldwide. It was further elaborated that ISIS employs positive imagery in the form of nature and landscapes, and appeals to the civilian life within its borders. This strategy is that of prioritising quantity, quality, adaptability and differentiation while producing media. This strategy of producing media that is precise, adaptable and effective, according to the author, must be emulated by Governments in their counter measures, although there is no universal counter narrative that is effective. This effort, he stressed cannot be exclusively state-driven.

JM Berger’s “Making Countering Violent Extremism Work” was also discussed. Here, a slightly different model of radicalisation has been identified with potential recruits going through 4 stages: the first being that of Curiosity where there is exposure to violent extremist ideology, the second stage is Consideration where the potential recruit evaluates the ideology, the third being Identification where the individual begins to self identify with extremist ideology, and the last being that of Self-Critique which is revisited periodically. According to Berger, law enforcement need only be involved in the third stage identified in this taxonomy, through situational awareness programs and investigations. This paper stated that counter-messaging policies need not mimic the ISIS pattern of slick messaging. A data-driven study had found that suspending and suppressing the reach of violent extremist accounts and individuals on online platform was effective in reducing the reach of these ideologies, though not universally so. It also found that generic counter strategies used in the US was more efficient than targeted strategies followed in Europe.

Lack of Co-ordination, Fragmentation between the States and Centre

Speaking of the Indian scenario in particular, another participant brought to light the lack of co-ordination and consensus between the State and Central Governments and law enforcement agencies with respect to countering violent extremism with leads to a breakage in the chain of action. Another participant added that the underestimation of the problem at the state level coupled with the theoretical and abstract nature of work done at the Centre is another pitfall. While the fragmentation of agencies was stated to be ineffective, bringing them under the purview of a single agency was also proposed as an ineffective measure. It was instead suggested that a neutral policy body, and not an implementing body, should coordinate the efforts of the multiple groups involved.

Unreliable Intelligence Infrastructure

It was pointed out that countries are presently underequipped due to the lack of intelligence infrastructure and technical expertise. This was primarily because agencies in India tend to use off-the shelf hardware and software produced by foreign companies, and such heavy dependence on unreliable parts will necessarily be detrimental to building reliable security infrastructure. Emphasis was laid on the significance of collaboration and open-source intelligence in countering online radicalisation. An appeal was made to inculcate a higher IT proficiency, indigenous production of resources, funding, collaboration, integration of lower level agencies and more research to be produced in this regard.

Proactive Counter Narratives

The importance of proactive counter-narratives to extremist content was stressed on, with the possibility of generating inputs from government agencies and private bodies backing the government being discussed. Another solution identified was the creation and internal circulation of a clear strategy to counter the ISIS narrative and the public dissemination of research on online radicalization in the Indian context.

Policies of Social Media Platforms

The conversation moved towards understanding policies of social media. One participant shed light on a popular platform’s strategies against extremism, wherein it was pointed out that the site’s tolerance policy extends not only to directly extremist content but also content created by people who support violent extremism .The involvement of the platform with several countries and platforms in order to create anti-extremist messaging and its intention to expand these initiatives was in furtherance of its philosophy to prevent any celebration of violence. The participant further explained that research shows that anti-extremist content that made use of humour and a lighter tone was more effective than media which relied on gravitas.

Having identified the existing literature and current challenges, the roundtable concluded with suggestions for further areas of research:

Understanding the use of encrypted messaging services like Whatsapp and Telegram for extremism, and an analysis of these platforms in the Indian context. A deeper understanding of these services is essential to gauge the dimensions of the problem and identify counter measures.
A lexical analysis of Indian social media accounts to identify ISIS supporters and group them into meta-communities, similar to research done by the RAND Corporation
Collation of ISIS media packages was also flagged off as an important measure in order to have a dossier to present to the government. This would help policymakers gain context around the issue, and also help them understand the scale of the problem.

For more details visit https://cis-india.org/internet-governance/blog/isis-and-recruitment-using-social-media-2013-roundtable-report

Is This The Beginning Of The End For Facebook?

Admin — 2018-04-17T14:44:23Z

After two days of congressional hearings that collectively lasted over ten hours, there are many questions about Facebook, its policies and its future that experts are debating.

The article by Aayush Ailawadi was published in Bloomberg Quint on April 15, 2018. Pranesh Prakash was quoted.

Do Facebook’s privacy policies confuse more than they inform? Is the platform a near monopoly that may need to be broken? And how do you ensure that the vast wealth of data that Facebook has is not misused, particularly in elections?

BloombergQuint has collected views on some of these issues.

Privacy Policy Or Legalese?

Since the Cambrdge Analytica scandal came to light, Facebook has been receiving a lot of flak for its ambiguous and verbose privacy and data policy. Lawmakers quizzed founder Mark Zuckerberg about how an ordinary user was expected to decipher the terms of the user agreement, something even some of the lawmakers grilling him couldn’t comprehend.

Jitendra Waral of Bloomberg Intelligence says, “It’s so complicated that nobody reads it. Essentially the data sharing beyond the Facebook ecosystem came into question here. Is it just necessary to have data sharing for the service to work? Is it restricted to you sharing your content with your friends in your network or do the restrictions go beyond that? So basically they have a lot of work to do in terms of transparency, in terms how the data is used and shared.”

During the conversations, it also came to light that Facebook collects data even on those who don’t use the platform.

“In general we collect data on people who are not signed up for Facebook for security purposes," Zuckerberg said Wednesday in a hearing about the social network’s privacy practices in Washingtonbefore the House Energy and Commerce Committee.

While privacy experts and tech geeks have been crying foul for years about the data collection and storage practices adopted by tech behemoths like Facebook, this revelation by the Facebook founder was the first public acknowledgement of the fact.

Is Facebook A Monopoly?

It’s not just data concerns that were brought up at the hearings.

Sen. Lindsey Graham asked Zuckerberg if Facebook enjoys a monopoly on the type of service it provides to its users. He asked, “If I buy a Ford and it doesn’t work well and I don’t like it, I can buy a Chevy, if I’m upset with Facebook, what’s the equivalent product that I can go sign up for?”

Zuckerberg responded to say that there are other tech companies which operate in the same sphere as Facebook does. He offered statistics of how many Americans use different social apps nowadays, in support of his argument that Facebook does not enjoy a monopoly in the tech world.

Jeff Hauser, executive director of the Revolving Door Project at the non-partisan Center for Economic and Policy Research says, “ Zuckerberg's answer to who his competitor was kind of comically unsatisfying because there is no competition for Facebook and they do have monopoly power in the United States and in many other countries across the world. ”

So one idea is to take Facebook and break it into many other parts that it acquired through previous acquisitions. Instagram would be a powerful competitor to Facebook if it was independent of Facebook. WhatsApp would be a powerful competitor to Facebook if it was an independent competitor to Facebook.

Jeff Hauser, Center for Economic and Policy Research

Time To Regulate The Internet?

Another big moment during the testimony was when Zuckerberg conceded that it was only a matter of time before the internet would be regulated.

He said, “The internet is growing in importance around the world in people’s lives and I think that it is inevitable that there will need to be some regulation.”

Waral agrees that light touch regulation is the way to prevent a Cambridge Analytica like scandal from occurring again in the future. But, he believes that regulation will only raise costs for a company like Facebook. He explains, “What it does is raise compliance costs through out the ecosystem. So, the impact on Facebook from this is that the company is going to increase expenses due to compliance costs.”

The Big Election(s) Year

During his testimony, Zuckerberg did acknowledge that a lot needs to be done to ensure data does not get misused, particularly in elections. Concerns about misuse of user data have emerged in countries like the U.S., but also in India.

Last month, the Union Minister for Law and Information Technology, Ravi Shankar Prasad warned Zuckerberg that if there was any data theft of Indian users due to Facebook’s data collection practices, he would stop at nothing short of summoning the Facebook founder to India.

While Pranesh Prakash, policy director at the Centre For Internet and Society, doesn’t believe the government would actually summon Zuckerberg to India, he says, “One new concern that's valid across the world, where there are limitations put on freedom of expression during times of campaigning and elections, how do they translate online? There is no typical answer to this.”

Most of the speech regulations apply to candidates and apply to media platforms, which are largely mass media platforms. Now, social media platforms where individuals express themselves might not be regulated the same way or currently at least aren’t regulated the same way.

Pranesh Prakash, Policy Director, Centre For Internet and Society

Pranesh thinks it is time to re-look at the existing election laws which might not prove to be as useful now as they were some time ago.

Hauser thinks Facebook should help users discern between fakes news and a legitimate source of news.

In the 2016 elections cycle, for fake news, a lot of bots and trolls liked them and they started appearing in the lot of users’ feeds. So the algorithm of Facebook encouraged manipulation. Facebook needs to address these concerns. I don’t think we can trust Facebook if it doesn’t make hard decisions about its algorithms. Right now, Facebook needs to say this is what the algorithm does.

Jeff Hauser, Center for Economic and Policy Research

For more details visit https://cis-india.org/internet-governance/news/bloomberg-quint-aayush-ailawadi-april-15-2018-is-this-the-beginning-of-the-end-for-facebook

India, Egypt say no thanks to free Internet from Facebook

praskrishna — 2016-02-03T01:49:25Z

ALWAR, India — Connecting people to the Internet is not easy in this impoverished farming district of wheat and millet fields, where working camels can be glimpsed along roads that curve through the low-slung Aravalli Hills.

The article by Annie Gowen was published in Washington Post on January 28, 2016. Sunil Abraham gave inputs.

So when Facebook chief executive Mark Zuckerberg helicoptered in about a year ago to visit a small computer lab and tout Internet for all, Osama Manzar, director of India’s Digital Empowerment Foundation, was thrilled.

But when Manzar tried Facebook’s limited free Internet service, he was bitterly disappointed. The app, called Free Basics, is a pared-down version of Facebook with other services such as weather reports and job listings.

“I feel betrayed — not only betrayed but upset and angry,” Manzar said. “He said we’re going to solve the problem with access and bandwidth. But Facebook is not the Internet.”

Zuckerberg launched his sweeping Internet.org initiative in 2013 as a way to provide 4 billion people in the developing world with Web access, which he says he sees as a basic human right.

But the initiative has hit a major snag in India, where in recent months Free Basics has been embroiled in controversy — with critics saying that the app, which provides limited access to the Web, does a disservice to the poor and violates the principles of “net neutrality,” which holds that equal access to the Internet should be unfettered to all.

Activist groups such as Save the Internet, professors from leading universities and tech titans such as Nandan Nilekani, the co-founder of Infosys, have spoken out against it. Another well-known Indian entrepreneur dubbed it “poor Internet for poor people.”

The debate escalated in recent weeks after India’s telecommunications regulator suspended Free Basics as it weighs whether such plans are fair, with new rules expected by the end of the month.

A week later, Free Basics was banned in Egypt with little explanation, prompting concern that the backlash could spread to other markets. More recently, Google pulled out of the app in Zambia after a trial period. An estimated 15 million people are using Free Basics in 37 countries, including 1 million in India.

[India’s Modi wants to woo Silicon Valley, but privacy fears grow at home]

“It’s a very important test case for what will be India’s network neutrality regime,” said Sunil Abraham of the Center for Internet and Society in Bangalore.

India’s debate could affect the way other countries address the question of whether it is fair for Internet service providers to price websites differently. The U.S. Federal Communications Commission’s rules on net neutrality went into effect only in June.

Officials at Facebook launched an advertising blitz to counteract the negative publicity. “Who could possibly be against this?” Zuckerberg wondered in a Times of India editorial on Dec. 28.

“I think we’ve been a bit surprised by the strong reaction,” said Chris Daniels, Facebook’s vice president for Internet.org. “Fundamentally, the reason for the surprise is that the program is doing good. It’s bringing people online who are moving onto the broader Internet.”

India, a country of 1.2 billion, has the second-highest number of Internet users in the world, but an estimated 80 percent of the population does not have Internet access.

India’s tech-savvy prime minister, Narendra Modi, is trying to combat this with an ambitious “Digital India” plan to link 250,000 village centers with fiber-optic cable and extend mobile coverage. He has turned to the Indian tech community as well as Silicon Valley for help, securing an agreement with Google to provide free WiFi in railway stations.

India has 130 million Facebook users, second only to the United States, and is a key market as the social-media giant looks to expand beyond the developed world, where its growth has slowed.

“If Facebook manages to get another half a billion users in India, that’s a valuable set of eyeballs to sell to a political party or corporation,” Abraham said.

[Is India the next frontier for Facebook?]

Facebook has long said that its program is about altruism, not eyeballs.

But it does reap new customers. Those who buy a SIM card from Facebook’s local mobile partner, Reliance Communications, are then prompted to pay for additional data. About 40 percent who sign up for Free Basics buy a data plan to move to the wider Web after 30 days, Daniels said.

The service is still running despite the India suspension. A Reliance spokesman said it is in “testing mode” and is not being promoted.

“The thing people forget about Free Basics is that it’s intended to be a temporary transition for people to give them a taste of the Internet and sign up. It’s a marketing program for the carrier in some sense,” said David Kirkpatrick, author of “The Facebook Effect.” But he added: “The idea that it’s some kind of alternative Internet that’s a discriminatory gesture to the poor is the prevailing view among the Indian intelligentsia. It’s fundamentally misunderstood.”

Facebook has pledged to open up to new scrutiny the selection process for companies with new applications, Daniels said. That is a response to concerns by many in India’s tech community that Facebook’s process put India’s fledgling start-ups at a disadvantage.

The project’s proponents say that India’s needs are so great it cannot afford to suspend one program that could help.

Mahesh Uppal, a telecommunications consultant, notes that more than 10 percent of the country does not have mobile phone coverage and that India’s progress in extending fiber-optic cable to village centers is proceeding at a glacial pace. Modi had set a goal of linking all 250,000 by 2016, but only 27,000 have cable so far and it is ready for use in only 3,200, according to a government report.

In comparison, some 80 percent of China’s villages are linked by broadband.

[Inside the Indian temple that draws America’s tech titans]

In Alwar district in the northern state of Rajasthan, many remember when Zuckerberg came to visit but fewer know about Free Basics.

“I’ve heard it’s free and by Facebook and you don’t have to pay for it,” said Umer Farukh, 43, a folk musician. “But I don’t think Facebook should control it. The Internet should be for everybody.”

Farukh has only been computer literate for two years, but he’s already emailing and using YouTube to post videos and promote his band.

He’s become such a proponent that he has donated space for one of Manzar’s computer centers — part of a government initiative to build cyber-hubs in minority communities — and encouraged the female members of his family to take classes, which is rare in his conservative community.

Farukh says that challenges to connecting India go far beyond data plans and fiber-optic cable or the government broadband that often sputters out. Wages are low, and hours are long. Only about half of the women in his state are literate, and about a quarter of the young women in his neighborhood are kept at home and not educated.

“This place is very backward,” he said. “India as a society is lagging far behind in terms of Internet.”

In the small nearby community of Roja Ka Baas, ringed by fields of blooming mustard greens, residents are still awaiting the opening of their planned WiFi center. They are struggling along on cheap mobile phones with slow 2G spectrum until then, they said.

Sakir Khan, 14, said that once the Internet finally arrived in this village, the first thing he would do would be to sign up for Facebook.

Farheen Fatima and Subuhi Parvez contributed to this report.

For more details visit https://cis-india.org/internet-governance/news/washington-post-annie-gowen-january-28-2016-india-egypt-say-no-thanks-to-free-internet-from-facebook

India's Broken Internet Laws Need a Shot of Multi-stakeholderism

pranesh — 2012-04-26T13:45:25Z

Cyber-laws in India are severely flawed, with neither lawyers nor technologists being able to understand them, and the Cyber-Law Group in DEIT being incapable of framing fair, just, and informed laws and policies. Pranesh Prakash suggests they learn from the DEIT's Internet Governance Division, and Brazil, and adopt multi-stakeholderism as a core principle of Internet policy-making.

(An edited version of this article was published in the Indian Express as "Practise what you preach" on Thursday, April 26, 2012.)

The laws in India relating to the Internet are greatly flawed, and the only way to fix them would be to fix the way they are made. The Cyber-Laws & E-Security Group in the Department of Electronics and Information Technology (DEIT, who refer to themselves as 'DeitY' on their website!) has proven itself incapable of making fair, balanced, just, and informed laws and policies. The Information Technology (IT) Act is filled with provisions that neither lawyers nor technologists understand (not to mention judges). (The definition of "computer source code" in s.65 of the IT Act is a great example of that.)

The Rules drafted under s.43A of the IT Act (on 'reasonable security practices' to be followed by corporations) were so badly formulated that the government was forced to issue a clarification through a press release, even though the clarification was in reality an amendment and amendments cannot be carried out through press releases. Despite the clarification, it is unclear to IT lawyers whether the Rules are mandatory or not, since s.43A (i.e., the parent provision) seems to suggest that it is sufficient if the parties enter into an agreement specifying reasonable security practices and procedures. Similarly, the "Intermediary Guidelines" Rules (better referred to as the Internet Censorship Rules) drafted under s.79 of the Act have been called "arbitrary and unconstitutional" by many, including MP P. Rajeev, who has introduced a motion in the Rajya Sabha to repeal the Rules ("Caught in a net", Indian Express, April 24, 2012). These Rules give the power of censorship to every citizen and allow them to remove any kind of material off the Internet within 36 hours without anybody finding out. Last year, we at the Centre for Internet and Society used this law to get thousands of innocuous links removed from four major search engines without any public notice. In none of the cases (including one where an online news website removed more material than the perfectly legal material we had complained about) were the content-owners notified about our complaint, much less given a chance to defend themselves.

Laws framed by the Cyber-Law Group are so poorly drafted that they are misused more often than used. There are too many criminal provisions in the IT Act, and their penalties are greatly more than that of comparable crimes in the IPC. Section 66A of the IT Act, which criminalizes "causing annoyance or inconvenience" electronically, has a penalty of 3 years (greater than that for causing death by negligence), and does not require a warrant for arrest. This section has been used in the Mamata Banerjee cartoon case, for arresting M. Karthik, a Hyderabad-based student who made atheistic statements on Facebook, and against former Karnataka Lokayukta Santosh Hegde. Section 66A, I believe, imperils freedom of speech more than is allowable under Art. 19(2) of the Constitution, and is hence unconstitutional.

While s.5 of the Telegraph Act only allows interception of telephone conversations on the occurrence of a public emergency, or in the interest of the public safety, the IT Act does not have any such threshold conditions, and greatly broadens the State's interception abilities. Section 69 allows the government to force a person to decrypt information, and might clash with Art.20(3) of the Constitution, which provides a right against self-incrimination. One can't find any publicly-available governmental which suggests that the constitutionality of provisions such as s.66A or s.69 was examined.

Omissions by the Cyber-Law Group are also numerous. The Indian Computer Emergency Response Team (CERT-In) has been granted very broad functions under the IT Act, but without any clarity on the extent of its powers. Some have been concerned, for instance, that the broad power granted to CERT-In to "give directions" relating to "emergency measures for handling cyber security incidents" includes the powers of an "Internet kill switch" of the kind that Egypt exercised in January 2011. Yet, they have failed to frame Rules for the functioning of CERT-In. The licences that the Department of Telecom enters into with Internet Service Providers requires them to restrict usage of encryption by individuals, groups or organisations to a key length of only 40 bits in symmetric key algorithms (i.e., weak encryption). The RBI mandates a minimum of 128-bit SSL encryption for all bank transactions. Rules framed by the DEIT under s.84A of the IT Act were to resolve this conflict, but those Rules haven't yet been framed.

All of this paints a very sorry picture. Section 88 of the IT Act requires the government, "soon after the commencement of the Act", to form a "Cyber Regulations Advisory Committee" consisting of "the interests principally affected or having special knowledge of the subject-matter" to advise the government on the framing of Rules, or for any other purpose connected with the IT Act. This body still has not been formed, despite the lag of more than two and a half years since the IT Act came into force. Justice Markandey Katju’s recent letter to Ambika Soni about social media and defamation should ideally have been addressed to this body.

The only way out of this quagmire is to practise at home that which we preach abroad on matters of Internet governance: multi-stakeholderism. Multi-stakeholderism refers to the need to recognize that when it comes to Internet governance there are multiple stakeholders: government, industry, academia, and civil society, and not just the governments of the world. This idea has gained prominence since it was placed at the core of the "Declaration of Principles" from the first World Summit on Information Society in Geneva in 2003, and has also been at the heart of India's pronouncements at forums like the Internet Governance Forum. Brazil has an "Internet Steering Committee" which is an excellent model that practices multi-stakeholderism as a means of framing and working national Internet-related policies. DEIT's Internet Governance Division, which formulates India's international stance on Internet governance, has long recognized that governance of the Internet must be done in an open and collaborative manner. It is time the DEIT's Cyber-Law and E-Security Group, which formulates our national stance on Internet governance, realizes the same.

For more details visit https://cis-india.org/internet-governance/blog/india-broken-internet-law-multistakeholderism

India Sets Strict New Net Neutrality Rules

praskrishna — 2016-02-11T01:53:19Z

In India, advocates of net neutrality have welcomed new rules by the telecom regulator that have blocked efforts by Facebook to offer free but limited access to the web in the country’s fast growing Internet market.

The article by Anjana Pasricha was published in Voice of America on February 9, 2016. Sunil Abraham was quoted.

In a widely awaited ruling, the Telecom Regulator Authority of India (TRAI) said on Monday that “no service provider shall charge differential pricing on the basis of application, platforms or websites or sources." It will impose penalties of $735 a day if the regulations are broken.

Kiran Jonnalagadda, who was among a group of 10 that launched an impassioned campaign called Save the Internet, says they have won a “fabulous” victory against large corporations to ensure equal web access for millions.

“We were up against the most powerful companies in the world, we had no chance of fighting Airtel last year, we had no chance of fighting Facebook. I think the only reason it worked is that we were on the side of facts, the opposition was not,” says Jonnalagadda.

Debate on Airtel

The campaign on net neutrality snowballed into a nationwide public debate after an Indian telecom company, Airtel, launched a marketing platform last April on which it planned to offer customers access with no data charges to certain Internet services and sites.

In recent weeks, the focus turned to “Free Basics”, a service being offered by Facebook on mobile phones to a handful of sites in areas such as communication, healthcare, and education.

Saying it wanted to vastly expand Internet access in poor, rural areas, Facebook had launched a massive advertising campaign in support of the platform. Only about 300 million in the country of 1.2 billion people have access to the net, many just through mobile devices.

But campaigners slammed Free Basics as “poor Internet for poor people” and said it would create a “walled garden” in which Facebook would control the content it offered users. Leading Indian technology entrepreneurs and university professors also called on the government to guard against attempts by Internet giants to turn the country into a “digital colony.”

Many of them have applauded the regulator’s move to strengthen net neutrality.

Ban on differential pricing

However, some are raising questions about the the complete ban on differential pricing announced by the regulator. That includes the Bangalore-based Center for Internet and Society research group, which says India has put in place the most stringent net neutrality regulations across the world. Its executive director, Sunil Abraham, says TRAI cited the examples of the Netherlands and Chile, but the ban on differential pricing in those countries is not as absolute as the one notified in India.

“We think that if proper technological safeguards and other market safeguards are put in place, it would be possible to have both — to have rapid growth in Internet access and reduced harm that emerge[s] from network neutrality violations,” says Abraham.

Indeed, the last word may not have been said on net neutrality in India as big telecom operators are expected to mount legal challenges to the regulator’s ruling in the coming months.

Expressing disappointment with India’s ruling, the Cellular Operators Association of India has called the ban on differential pricing a “welfare reducing measure” that could block an avenue for “less advantaged citizens to move to increased economic growth and prosperity by harnessing the power of the Internet.”

In a statement, Facebook has said “we will continue our efforts to eliminate barriers and give the unconnected an easier path to the Internet.”

But after having tasted victory, the volunteers at Save the Internet, who have grown from about 10 to 100 in the last year, have already set their sights on another aspect of net neutrality besides differential pricing.

“The campaign is not going to retire because this is not the end of it. There is also discrimination on the basis of speed, which the regulator has not taken up yet,” says Jonnalagadda.

For more details visit https://cis-india.org/internet-governance/news/voice-of-america-anjana-pasricha-february-9-2016-india-sets-strict-new-net-neutrality-rules

India bans Facebook’s ‘free’ Internet for the poor

praskrishna — 2016-02-10T02:53:49Z

India’s telecom regulator said Monday that service providers cannot charge discriminatory prices for Internet services, a blow to Facebook’s global effort to provide low-cost Internet to developing countries.

The article by Annie Gowen was published in Washington Post on February 8, 2016. Sunil Abraham gave inputs. The article was also mirrored by NDTV.

Facebook’s “Free Basics” program provides a pared-down version of Facebook and weather and job listings to some 15 million mobile-phone users in 37 countries around the world.

When it debuted in India in April, however, Free Basics immediately ran afoul of Internet activists who said it violated the principle of “net neutrality,” which holds that consumers should be able to access the entire Internet unfettered by price or speed.

On Monday, the Telecom Regulatory Authority of India agreed, prohibiting data service providers from offering or charging different prices for data — even if it’s free. The Free Basics program has run into trouble elsewhere in the world recently — with Egypt banning it and Google clarifying that it pulled out of the application during a testing phase in Zambia.

In a statement, Facebook said that while the company was “disappointed with the outcome, we will continue our efforts to eliminate barriers and give the unconnected an easier path to the Internet.”

In an interview before the ruling, Chris Daniels, Facebook’s vice president for Internet.org — the umbrella organization of the global effort — said India’s negative reaction has been “unique versus other markets we’ve seen. We’ve been welcomed with open arms in many countries.”

Facebook chief executive Mark Zuckerberg launched the program to great fanfare in 2013, partnering with other international tech firms on a mission to connect the 4 billion people in the world without Internet access — which he says is a basic human right.

India has 300 million mobile Internet users but still has close to 1 billion people without proper Internet access. But it is second only to the United States in number of Facebook users, with 130 million, with vast expansion potential as Facebook works to increase its user base beyond the developed world.

Yet the Free Basics program was controversial from the start in India, where critics accused Facebook of creating a “walled garden” for poor users that allowed them access to only a portion of the web that Facebook controlled.

Dozens of well-known tech entrepreneurs, university professors and tech industry groups spoke out against it, saying that the curated app, with its handpicked weather, job and other listings, put India’s scrappy start-ups and software developers at a disadvantage.

On Monday, Vijay Shekhar Sharma, the founder and creator of India’s payment application PayTM, applauded the regulator’s move.

He had been among the program’s fiercest critics, dubbing Free Basics “poor Internet for poor people” and comparing Facebook’s actions to that of British colonialists and their East India Co.

“India, Do u buy into this baby internet?” Sharma tweeted in December. “The East India company came with similar ‘charity’ to Indians a few years back!”

“In a country like India that’s just taking off, it’s important that there is an equal playground for every app developer,” he said in an interview.

In December, India’s regulator put out a position paper on differential pricing and asked for public comment on whether such programs were fair.

In response, Facebook launched a public relations blitz, with television and newspaper advertisements, billboards and an opinion piece by Zuckerberg in the Times of India in which he argued against criticism that the social-media giant was providing the service simply to expand its user base.

Facebook also engineered a prompt to users that sent “robo” letters of support for Free Basics to India’s telecommunications regulator. The regulator, flooded with form letters, was not amused.

Facebook’s behavior may not have helped its cause, some analysts said.

“Facebook went overboard with its propaganda [and] convinced ‘the powers that be’ that it cannot be trusted with mature stewardship of our information society,” said Sunil Abraham of the Center for Internet and Society in Bangalore.

Yet David Kirkpatrick, the author of “The Facebook Effect,” says that Zuckerberg is determined to see the program succeed.

“Facebook is relentless,” he said. “Zuckerberg has said from the beginning his goal is to make the world more open and connected. And that’s a phrase he continues to repeat 10 years later.”

The regulator had asked Facebook, and its local telecom partner, Reliance Communications, to suspend Free Basics’ operations during the public comment period. But the social-media giant and its partner appeared to flout the suspension order, with the program continuing to be operational on Reliance SIM cards.

A spokesman for Reliance earlier said that the applications was in “testing mode” and that it was not commercially promoting the product.

The regulatory body said Monday that anybody violating the order in the future will be subject to a fine of about $735 a day. It will return to review the policy in two years to see if it is effective.

For more details visit https://cis-india.org/internet-governance/news/washington-post-annie-gowen-february-8-2016-india-bans-facebooks-free-internet-for-the-poor

How To Win Friends, FB Style

praskrishna — 2015-10-18T12:02:10Z

True to form—and Facebook—there was a warm, friendly and familial feel to Prime Minister Narendra Modi’s townhall meeting at Melon, California, with Mark Zuckerberg on September 27. Modi got emotional (yet again) while talking about his mother. Zuckerberg, the youngish founder of the world’s largest social networking site, got his parents to meet and pose with Modi.

The article by Arindam Mukherjee was published in Outlook on October 12, 2015. Sunil Abraham was quoted.

“The most amazing moment was when I talked about our families,” Zuckerberg wrote in a post, “and he (Modi) shared stories of his childhood....” That’s just the kind of stuff we would see and post on Facebook—the benign visage of a profitable, all-pervasive US-based corporation. (Needless to say, everyone who has worked on this story is a registered user).

Of course, we know Modi too is on Facebook. No other Indian politician has so effectively utilised the power of ‘likes’: and he has got 30 million. The problem with this chummy approach is that one could almost forget that the PM is also the supreme leader of a country that is Facebook’s second-largest market in the world with 125 million users. A few days earlier, Zuckerberg flew to Seattle to meet Chinese President Xi Jinping. Facebook is not present in China. “On a personal note, this was the first time I’ve ever spoken with a world leader entirely in a foreign language,” wrote Zuckerberg in another post.

In contrast, Modi and Zuckerberg were speaking the same language. In fact, they even jointly updated their profile picture on Facebook—wrapped in the shades of the Indian tricolour—to support the Modi government’s Digital India initiative. Millions of Indians followed suit. And that’s when the shit hit the internet—it was discovered that people supporting the Digital India campaign were also putting in a ‘yes’ vote for Facebook’s contentious initiative internet.org (free but restricted net access; see accompanying faqs for all the details). Immediately, Modi became a party to the raging debate in India over net neutrality. This is unfortunate as the Modi government is yet to put on paper its stand on net neutrality. The nervous reaction to this engagement is also a function of the new truism of our times—“with this government, you never know”.

What we do know is that the internet.org class name was built into the code for support for Digital India. Many experts feel this is not a coincidence; rather a clever ploy by Facebook to get the support of Indians and promote its internet.org initiative. This upset a vocal community of activists who see internet.org on the opposite camp. This led to the charge that Facebook was trying to influence the debate. Says Sunil Abraham, executive director with the Bangalore-based Centre for Internet and Society (CIS), “The moves by Facebook are quite juvenile as it is trying to use the Modi visit to further muddy the net neutrality debate. We should be concerned about Facebook trying to damage the debate in India to spin the PM’s participation in its own favour.” Of course, there are two sides to this debate. There are many people within the government who feel net neutrality is an elitist concern—increasing internet penetration, which Facebook and other such initiatives promise, is the way forward in a poor, unconnected country like India. “Today to talk about net neutrality is to talk about the 20 per cent who have access to the internet,” says telecom expert Mahesh Uppal. “It is unreasonable to dismiss out of hand anybody who offers free service to a subset of websites or services. Eventually, access to internet must come first before we talk about net neutrality.”

Facebook promoted internet.org along with Samsung, Nokia, Qualcomm, Ericsson, MediaTek and Opera Software, the aim being to provide free internet service to developing nations. India, obviously, is a hot target for Facebook. Facebook has a partnership with Reliance in the country; the free internet service will be available only to Reliance users and the free access will be limited to Facebook’s partner sites. The debate over internet.org too has picked up steam in India—big media companies like NDTV and Times of India have pulled out of it on these issues. While Facebook has stressed that internet.org will ensure that the internet reaches people who do not have access to it, there have been concerns that it will restrict internet access only to sites that are internet.org’s partners.

On its part, Facebook has been quick to refute the charge. A spokesperson in the US said, “There is absolutely no connection between updating your profile picture for Digital India and internet.org. An engineer mistakenly used the words ‘internet.org profile picture’ as a shorthand name he chose for part of the code.” The code was changed soon after. Despite repeated requests, representatives from Facebook India were unavailable for comment.

But the damage has been done. Many now openly question Facebook’s motives in India and whether they have been truthful or not. Given all this brouhaha, questions will naturally be raised about Modi’s alignment with Facebook. Digital India is many things—but obviously increasing net penetration is one its goals. “Now whatever he does on net neutrality, it will be seen in terms of whether it will benefit Google or Facebook. That is the risk he took. I would like to know why the diplomatic advisors took the risk of putting the PM in a bargaining position instead of a bonus at the end of a deal,” says Prof Narendar Pani, who teaches at the National Institute of Advanced Studies, Bangalore.

All this matters because the Modi government positions itself as digital-friendly, even though its moves on this front have been invasive (the push for Aadhar despite a legal sanction and increasing reports of monitoring digital conversations), and contradictory (the abortive porn and WhatsApp bans, among others). “The PM is going way beyond the e-governance plan to a stage where the government will just sit and watch people speaking. It is scary,” says internet activist Usha Ramanathan. She feels it doesn’t make sense to have companies like Google sharing ideas with the government while Indian people are being kept out of the loop. “And now Facebook will be joining that gang, it doesn’t make sense. What has Facebook done to get that privilege?” she asks.

Here again there is a carefully worded counter-argument. Former telecom entrepreneur and Rajya Sabha MP Rajeev Chandrashekhar says, “Net neutrality is a definition that would be made in the public domain. It will not be influenced by the PM’s engagement with Facebook and Mark Zuckerberg. Anyone who tries to mess with the definition of net neutrality will be met with a public outcry and judicial intervention.” The substance of this view is that Modi was within his rights to speak to corporations to further Digital India, or Make in India for that matter, and that there should be an open debate on the future direction of net neutrality.

Clearly, the political knives are out. “Either the prime minister is not being briefed properly or he does not read his brief properly,” says former UPA minister Manish Tewari. Arguing that governments should be discussing rules of engagement in cyberspace, and not stakeholders, he asks, “Is India comfortable with that construct especially when the bulk of the technology companies, the root servers which form the underlying hardware of the internet, are all based in the US, and one being in Europe?”

Although the government is yet to firm up its decision on net neutrality and a policy on it is yet to be announced, the debate has already acquired political colour in India, with the Congress and Aam Aadmi Party putting their weight behind the people’s voice. This is the first time that there has been a nation-wide upsurge of such an unprecedented size and magnitude on an internet policy. Says AAP’s Adarsh Shastri, “Facebook, Google etc are just tools. People can use them at will. To make them the mainstay of your programme for digital empowerment is to step on the civil rights and liberties of citizens. Doing this is a complete no-no. Let people access internet as they want is the way to go.”

A consultation paper floated by telecom regulator Telecom Regulatory Authority of India (TRAI) got almost 15 lakh responses from the Indian public in support of net neutrality. There was also strong opposition to zero rating platforms announced by telecom companies like Airtel which sought to provide free access to some websites on their platform in much the same way that internet.org proposes. And the reactions to the Facebook coding error are a pointer to what people in India think. Says Nikhil Pahwa, editor of Medianama and a leading net neutrality activist, “The reactions of the people to the Facebook event were heartening and showed that people are emotive and there is still mass support for net neutrality. The reaction to the TRAI paper was not a flash in the pan.”

Interestingly, a couple of months ago, a department of telecommunications committee had said that internet.org was a violation of net neutrality and should not be allowed. It will be difficult for Modi and the government to overrule that and give it full and free access in India. Internet experts feel that the engagement with India and Modi was a desperate move by Facebook to get numbers from India. Says internet expert Mahesh Murthy, “Facebook is pulling out all stops to get favour for internet.org and is desperate about it. If India says yes, many others will say yes, but if India says no, other countries will follow.”

Murthy says Facebook’s real problem is that it is finding it difficult to justify its price to earnings ratio as against its user numbers vis-a-vis Google which is much better in this respect. For this, it is desperately trying to get numbers, and with China banning Facebook, the only country left to get numbers is India. The massive electronic and print campaign at the cost of Rs 40-50 crore is a pointer towards this. He says everything about internet.org is about hooking Indians to it.

No wonder, Facebook has been cultivating Indian media. The Modi visit has also been tarnished by the news that Facebook paid for the travel and accommodation of journalists from three Indian newspapers and one magazine to go and cover the Facebook-Modi meeting and get favourable coverage. Says writer-activist Arundhati Roy, “Many journalists covering the event for the Indian media were flown in from India by Facebook. So were some who asked pre-assigned questions at the event. I don’t know who sponsored the crocodile tears and the clothes.” It is also quite strange that the entire display picture and source code controversy got almost no play in the national media which chose instead to talk about Modi’s speech and his tears.

All said and done, it is obvious that Facebook may be seeing India as an easy and vulnerable target which can be manipulated for its own advantage. Says Parminder Jeet Singh, executive director with IT for Change, an NGO working on information society, “India has low internet penetration and lots of people want to get on to the internet. There is low purchasing power but lots of aspiration. So the moment a free service is offered, a whole lot of people are likely to jump on it.” And that is something Facebook may be looking and aiming at.

Currently, three processes are on that will determine how India will look at net neutrality—one at the DoT, one at TRAI and a third one at a parliamentary standing committee. But given the massive people’s response net neutrality has got vis-a-vis TRAI’s paper and also during the present Facebook issue, the outcome is predictable. Or so it seems. There’s a lot of money power at stake. For now, millions of internet Indians have already voted with that dislike button. And then, governments move in mysterious ways.

For more details visit https://cis-india.org/internet-governance/news/outlook-india-october-12-2015-arindam-mukherjee-how-to-win-friends-fb-style

Government gives free publicity worth 40k to Twitter and Facebook

Akriti Bopanna — 2018-04-27T09:52:26Z

We conducted a 2 week survey of newspapers for links between government advertisement to social media giants. As citizens, we should be worried about the close nexus between the Indian government and digital behemoths such as Facebook, Google and Twitter. It has become apparent to us after a 2 week print media analysis that our Government has been providing free publicity worth Rs 40,000 to these entities. There are multiple issues with this as this article attempts at pointing out.

We analyzed 5 English language newspapers daily for 2 weeks from March 12^th to 26^th, one week of the newspapers in Lucknow and the second week in Bangalore. Facebook, Twitter, Instagram and Alphabet backed services such as Youtube and Google Plus were part of our survey. Of a total of 33 advertisements (14 in Lucknow+19 in Bangalore), Twitter stands out as the most prominent advertising platform used by government agencies with 30 ads but Facebook at 29 was more expensive. In order to ascertain the rates of publicity, current advertisement rates for Times of India as our purpose was to solely give a rough estimation of how much the government is spending.

Advertising of this nature is not merely an inherent problem of favoring some social media companies over others but also symptomatic of a bigger problem, the lack of our native e-governance mechanisms which cause the Government to rely and promote others. Where we do have guidelines they are not being followed. By outsourcing their e-governance platforms to Twitter such as TwitterSeva, a feature created by the Twitter India team to help citizens connect better with government services, there is less of an impetus to construct better websites of their own.

If this is so because we currently do not have the capacity to build them ourselves then it is imperative that this changes. We should either be executing government functions on digital infrastructure owned by them or on open and interoperable systems. If anything, the surveyed social media platforms can be used to enhance pre-existing facilities. However, currently the converse is true with these platforms overshadowing the presence of e-governance websites. Officials have started responding to complaints on Twitter, diluting the significance of such complaint mechanisms on their respective department’s portal. Often enough such features are not available on the relevant government website. This sets a dangerous precedent for a citizen management system as the records of such interactions are then in the hands of these companies who may not exist in the future. As a result, they can control the access to such records or worse tamper with them. Posterity and reliability of such data can be ensured only if they are stored within the Government’s reach or if they are open and public with a first copy stored on Government records which ensures transparency as well. Data portability is an important facet to this issue as well as being a right consumers should possess. It provides for support of many devices, transition to alternative technologies and lastly, makes sure that all the data like other public records will be available upon request through the Right to Information procedure. The last is vital to uphold the spirit of transparency envisioned through the RTI process since interactions of government with citizens are then under its ambit and available for disclosure for whomsoever concerned.

Secondly, such practices by the Government are enhancing the monopoly of the companies in the market effectively discouraging competition and eventually, innovation. While a certain elite strata of the population might opt for Twitter or Facebook as their mode of conveying grievance, this may not hold true for the rest of the online India population.

Picking players in a free market is in violation of technology and vendor neutrality, a practice essential in e-governance to provide a level playing field for all and competing technologies. Projecting only a few platforms as de facto mediums of communication with the government inhibits the freedom of choice of citizens to air their grievances through a vendor or technology they are comfortable with. At the same time it makes the Government a mouthpiece for such companies who are gaining free publicity and consolidating their popularity. Government apps such as the SwachBharat one which is an e-governance platform do not offer much more in terms of functionality but either reflect the website or are a less mature version of the same. This leads to the problem of fracturing with many avenues of complaining such as the website, app, Twitter etc. Consequently, the priority of the people dealing with the complaints in terms of platform of response is unsure. Will I be responded to sooner if I tweet a complaint as opposed to putting it up on the app? Having an interoperable system can solve this where the Government can have a dashboard of their various complaints and responses are then made out evenly. Twitter itself could implement this by having complaints from Facebook for example and then the Twitter Seva would be an equal platform as opposed to the current issue where only they are favored.

Recent events have illustrated how detrimental the storage of data by these giants can be in terms of privacy. Data security concerns are also a consequence of such leaks. Not only is this a long overdue call for a better data protection law but at the same time also for the Government to realize that these platforms cannot be trusted. The hiring of Cambridge Analytica to influence voters in the US elections, based on their Facebook profiles and ancillary data, effectively put the governance of the country on sale by exploiting these privacy and security issues. By basing e-governance on their backbone, India is not far from inviting trouble as well. It is unnecessary and dangerous to have a go-between for matters that pertain between an individual and state.

As this article was being written, it was confirmed by the Election Commission that they are partnering with Facebook for the Karnataka Assemby Elections to promote activities such as encourage enrollment of Voter ID and voter participation. Initiatives like these tying the government even closer to these companies are of concern and cementing the latter’s stronghold.

Note: Our survey data and results are attached to this post. All research was collected by Shradha Nigam, a Vth year student at NLSIU, Bangalore.

Survey Data and Results

This report is based on a survey of government advertisements in English language newspapers in relation to their use of social media platforms and dedicated websites (“Survey”). For the purpose of this report, the ambit of the social media platforms has been limited to the use of Facebook, Twitter, YouTube, Google Plus and Instagram. The report was prepared by Shradha Nigam, a student from National Law School of India University, Bangalore. Read the full report here.

For more details visit https://cis-india.org/internet-governance/blog/government-giving-free-publicity-worth-40-k-to-twitter-and-facebook

FB & Google have already monopolised Indian cyberspace

praskrishna — 2016-07-08T15:59:46Z

In an interview with Catch, Sunil Abraham, executive director of Center for Internet & Society, puts the recent US-India cyber relationship framework into perspective. Abraham also talks about how Indian surveillance policies are outdated and why the country has failed to check the hegemonic tendencies of companies like Facebook and Google.

The interview was published by Catch News on July 3, 2016.

US-India signed a cyber relationship framework earlier this month. Could you explain some of the takeouts that may have important implications in the near future?

In the framework, both sides have made a "commitment to the multi-stakeholder model of Internet governance" - in immediate practical terms that means India will accept the Internet Assigned Numbers Authority (IANA) transition proposed for the Internet Corporation for Assigned Names and Numbers (ICANN). Unfortunately, as my colleague Pranesh Prakash points out "U.S. state control over the core of the internet's domain name system is not being removed by the transition that is currently underway."

India along with Brazil and other emerging powers should have insisted that the question of jurisdiction be addressed before the transition. We must remember, that the multi-stakeholder model is just a fancy name for open and participatory self-regulation by the private sector. While the multi-stakeholder model is useful as a complement to traditional state-led regulation, it cannot be used to protect human rights or ensure the security of a nation state.

[That is precisely why - the very next sentence in the announcement for the the framework for the US-India Cyber Relationship says "a recognition of the leading role for governments in cyber security matters relating to national security". This is because ICANN-style multistakeholderism requires all stakeholders to be on "equal footing" without "distinct roles and responsibilities". In other words, the governments are saying that the multistakeholder model is fine for all Internet Governance areas with the exception of Cyber Security. Given the limits of the multistakeholder model this is indeed the wise thing to do. Since American corporations dominate the Internet, US foreign policy has historically pushed for the multistakeholder model as fig leaf for forbearance and reduced foreign regulatory burden American corporations operating in other jurisdictions. Therefore India must not drink the multistakeholder cool-aid whole sale. It cannot afford a laissez-faire approach where it waits for corporations to self-regulate - it must regulate whenever public interest or human rights are harmed. In other words, it must go beyond the multistakeholder model and produce appropriate regulation where necessary. Needless to add - it must also deregulate in areas where harms don't exist. Apart from this many of the details of the announcement are positive steps that will increase security in India and the USA, and indeed the also across the world.]

What are some aspects of Intellectual Property Rights that should be looked at, in the context of the framework?

There is some language around Intellectual Property Rights (IPR) that should be examined carefully too. The US corporations benefit from a maximalist IP regime. But Make in India, Digital India and Startup India all depend on flexibilities to the IP regime and therefore India should refuse signing. Trans-Pacific Partnership (TPP) obligations like the "Digital 2 Dozen" which the US is actively proselytizing across the Pacific. If we make that mistake, we will make zero progress in indigenous security research and product development and also many other areas of our economy, health sector and education sector will be severely compromised. Therefore it would be best to keep IP rights expansion and enforcement out of the framework for the US-India Cyber Relationship.

The PIL seeking a ban on WhatsApp was refused by the SC recently. Encrypted messaging services like Telegram however, have been used in the past by terror groups. What's your take on such end-to-end encryption services?

Privacy and security are two sides of the same coin. You cannot have one without the other. End-to-end encryption is the basis for online privacy. End-to-end encryption is a pre-requisite for many legitimate actions of law abiding citizens online such as commerce, banking, tele-medicine, protection of intellectual property, witness/source protection, client confidentiality etc. Therefore, banning end-to-end encryption would mean the death of individual privacy and national security.

If the government wants to promote cyber security it should promote the use of end-to-end encryption amongst law abiding citizens.

Terrorist have to be stopped through targeted profiling, surveillance and interception. Big data analytics may be useful to watch for patterns in the meta data but there is no replacement for good old fashioned police work.

Once suspects have been identified the encrypted channels can be compromised by:

Placing trojans on the end-user devices
Performing man-in-the-middle attacks and
Using brute force attacks with super computers.

Snowden's revelations have made it very clear that blanket and mass surveillance does not help foil terror attacks or stop organised crime. So far, research and government reports from across the world indicate that only a minority of terrorists use encryption. However, this situation may change.

We don't have any proper encryption policy under the IT Act yet. What's taking so long and what are the key points that any policy in this matter must include in future?

We need many different types of encryption policies. We need a policy that mandates encryption and digital signature for all government personnel and also for all government transactions. We need policies that promote research and development in cryptography and mathematics. We need to update our criminal procedure code so that encrypted communications and data can be targeted by law enforcement and used effectively in the criminal justice process.

However, we should not have any broad encryption policy that tries to regulate encryption as a technology. That would be a highly regressive move and will be impossible to enforce. That would breed contempt for rule of law.

Surveillance and the tech around it has been contentious for various governments. Where do we stand vis-a-vis regulating surveillance measures by the state?

Our surveillance and interception laws are outdated. They need to be modernized to deal with advancements in technology and also global developments when it comes to data protection and privacy law.

In fact, our organisation was part of a global effort called Necessary and Proportionate which identified 13 principles to modernise surveillance which are connected to various aspects such as Legality, Legitimate aim, Competent judicial authority, Integrity of communications and systems and more. Some of these principles may have to be customised for the Indian context. [For example, given the load on courts perhaps India should stay with executive authorization of interceptions and data access requests. However, getting the law correct is only half the job. For the law cannot fix what the technology has broken. Some surveillance projects are well designed. For ex. the NATGRID - from what I understand it is a standard and platform that which will allow 12 security, intelligence and law enforcement agencies to temporarily make unions of sub-sets of 21 data sources. These automated temporary databases will be created under existing data access provisions of the law. I also hope the NATGRID is also using cryptography to ensure the maintenance of a non-repudiable log that will identify all officers involved in authorizing the each request and accessing the resultant data. Unfortunately, other surveillance projects are unmitigated disasters. For example, UID or Aadhaar. Many Indians don't realize that Aadhaar is a surveillance project. Biometrics is just a fancy name for remote, covert and non-consensual identification technology. Using the UID database the government can identify every single Indian without their consent. The so called "consent layer" in the India Stack is being developed by volunteers outside the UIDAI to avoid transparency under the Right to Information Act. Nothing in the current layer of the "consent layer" allows citizens to revoke consent. There is no facility in the UID Act to delete yourself from the database. Identity information aka the UID number and authentication information aka your biometrics for about a billion Indians have been collected and stored in a centralized location. It is as if our parliamentarians have written an open letter to criminals and foreign governments says "here is the information you need to wreck whole sale damage - come and get it". Hopefully the Supreme Court will save us from this impending disaster.]

With a sluggish US market, India has the biggest potential for companies like FB & Google, next only to China. Do you feel that in the quest to take over the Indian market, FB & Google are going to monopolise cyberspace in India?

I have news for you - they have already monopolised Indian cyberspace. They have completely wiped out competition in certain domains.

One of the many reasons they have done this is because we don't have laws and regulations to temper their hegemonic tendencies. For example, we could use data portability and interoperability mandates for social media to spark competition in markets where there are entrenched monopolies.

Competition law can be used to protect other firms from abuse of market power. Consumer protection law and privacy law could be used to ensure that user's rights are not compromised in the race for market share. In addition, a modern privacy law compliant with the best practices in the European Data Protection Regulation 2016, would allow emerging Indian companies to compete with giants like Facebook and Google on a level playing field. [Speaking of level playing field - only recently has the government introduced the "equalization levy". This was long overdue. Imagine the amount of tax that could have been collected so far and damage that has been done to competition. Regardless the current NDA government deserves our kudos for ensuring that Facebook and Google contribute their fair share of taxes. The new IPR Policy was also an opportunity to address the monopoly of Google and Facebook. There should have been a concerted attempt to use free/open source software, open standard and open content to bolster Indic language technologies. A billion dollars from every spectrum auction should be used to create incentives for Indian private sector, research and academic organisation who can contribute openly to the Indic cyberspace. This is the market where we can still build a highly competitive market. Today, given government inaction - millions of Indians are training Google's language platforms every time they use machine translation or speech to text technologies. This corpus of information will not be available for public interest research. Ideally we should also have Indians contributing to commons-based peer production projects like Wikipedia for their Indic language needs. Unfortunately the government totally missed this opportunity.]

For more details visit https://cis-india.org/internet-governance/news/catch-news-asad-ali-july-3-2016-fb-and-google-have-already-monopolised-indian-cyberspace