Centre for Internet and Society

Patanjali's Kimbho swiftly retreats over security scare, ripped on Twitter

Admin — 2018-06-01T14:15:44Z

Swadeshi" messaging app targeted at WhatsApp taken off from app stores hours after launch.

The article by Alnoor Peermohamed and Manavi Kapur was published in the Business Standard on May 31, 2018. Gurshabad Grover was quoted.

The fate of Patanjali’s “swadeshi” instant messaging app Kimbho was sealed in the span of just a few hours, thanks to viral messages being shared on Facebook-owned WhatsApp, the app that the Baba Ramdev-promoted company was trying to combat.

Patanjali on Thursday launched Kimbho with the sole intent of checking the rise of messaging giant WhatsApp in India. However, after Kimbho’s various data vulnerabilities were exposed by the security expert and whistleblower who goes by the pseudonym Elliot Alderson on Twitter, the app made a quiet exit from Google’s Play Store.

Jokes surrounding the app’s quick retreat spread like wildfire on rival platform WhatsApp. It was perhaps the quickest rise and fall in the popularity of a mobile application.

Alderson, who has exposed data breaches in the UIDAI’s website, took to Twitter to rip apart the Kimbho app. “This @KimbhoApp is a joke, next time before making press statements, hire competent developers... If it is not clear, for the moment don't install this app,” he wrote. His next tweet sent alarm bells ringing among users: “The #Kimbho #android #app is a security disaster. I can access the messages of all the users...”

Kimbho, though, claims that every message on its platform is encrypted by the Advance Encryption Standard and that it saves “no data on our servers or cloud”. But Alderson pointed out that the one-time password security could be worked around. “It's possible to choose a security code between 0001 and 9999 and send it to the number of your choice,” he tweeted. Kimbho, explained as a Sanskrit greeting by S K Tijarawala, Ramdev’s spokerperson, on Twitter, is also a patched-up application over the existing Bolo messaging app.

This is most likely the reason the app was taken off the Google Play Store. “There were basic authentication and authorisation related vulnerabilities where an end user can see the data of other users. These flaws may be the reason the developers took down the app. Google flags such things,” said Anand Prakash, a Bengaluru-based ethical hacker.

“WhatsApp uses end-to-end encryption that essentially means even they can’t access the messages you send. But Kimbho, on the other hand, was not using end-to-end security and probably even saving every message as plain text on its server,” adds Gurshabad Grover, policy officer at the Centre for Internet and Society.

Google did not respond to queries about whether the developer took the app down or Google flagged it as unsecure. Kimbho declared on its Twitter handle that its app was removed from the Play Store because of heavy traffic, claiming that it was downloaded 150,000 times in a mere three hours since its launch.

On Apple’s App Store, it was trending in the social networking category at the fourth position in India, just below WhatsApp, Facebook and Facebook’s Messenger, and above popular messaging apps such as Skype, LinkedIn and hike messenger.

Tijarawala had announced Kimbho’s launch on Twitter, calling it an app developed by the “shishyas” (disciples) and “navdikshit sadhus” (newly ordained priests) of Ramdev and Acharya Balkrishna, managing director, Patanjali Ayurved and co-founder, Patanjali Yogpeeth in Haridwar. Tijarawala’s tweet also claimed that this app was built using “swadeshi” techniques, though what these are remains a mystery. Emails, text messages and calls to Tijarawala went unanswered.

In keeping with an “Indian” aesthetic, the app’s logo has a “shankh” (conch shell), perhaps signifying a war cry against foreign-born WhatsApp, which has over 200 million active users in India. The conch shell also blends well with Kimbho’s tag line, “Ab Bharat Bolega” (now India will speak). But that is where its tenuous Indianness begins to crumble.

While the app was registered as a product of Patanjali Ayurved on the Play Store, the developer on Apple’s App Store is Appdios Inc, a San Francisco-based app development company. Aditi Kamal and Sumit Kumar are this company’s founders according to LinkedIn. The duo has worked with technology giants such as Google and Apple and hold masters degrees from University of Southern California in the US. A blonde man features on the screenshots that the app has featured on its landing page on the App Store.

Taking forward Bolo’s keyboard suggestions, cheekily called “Quickies”, Kimbho offers pre-typed messages such as “hugs and kisses”, “what the heck” and “parents are watching”. Whether these millennial-friendly features and Kimbho itself are an attempt to get young millennials in touch with their “swadeshi” roots remains to be seen.

For more details visit https://cis-india.org/internet-governance/news/business-standard-manavi-kapur-alnoor-peermohamed-may-31-2018-patanjali-s-kimbho-swiftly-retreats-over-security-scare-ripped-on-twitter

Nasscom chief saying full data protection isn’t possible should wake us from our digital slumber

praskrishna — 2017-03-17T01:47:25Z

Considering India is rapidly moving towards a digital economy, the hurdles not withstanding, data and identity security are topics which have to be taken very seriously. Since the demonetisation, a large part of the population who would never bother with digital transactions has suddenly come online. But there is no such thing as complete security of personal data, according to Nasscom chief R Chandrashekhar.

This was published by First Post on March 16, 2017. Pranesh Prakash was quoted.

Attending the World Consumer Rights Day, R Chandrashekhar said that personal data of online consumers cannot be completely secure and stressed on the need to have strict enforcement of consumer protection laws. Speaking to PTI, Chandrashekhar said, “More than 3 million credit card data details were misused recently. Let us face it, these kind of security breaches will take place. There is nothing called fully perfect security in IT.”

It’s high time we call a spade, a spade

R Chandrashekhar, President Nasscom. Image: PIB

Coming from the head of Nasscom, this announcement pertaining to security is very important. According to Chandrashekhar one cannot expect complete cyber security, but there are definitely ways in which such attacks and incidents can be minimised. He very rightly said that that protecting the online consumer data, specially looking at how rapidly e-commerce is growing in the country, is of prime importance.

One cannot help but agree with Chandrashekhar, specially considering the fact India does not have a privacy law ecosystem that is present in countries such as the US and the UK, where online consumer protection is taken very seriously. Germany and other EU nations have always been at the forefront, when it comes to protecting data privacy, and it has ensured that consumer-facing technology companies do not run roughshod when it comes to protecting user data.

Chandrashekhar stated that there was no need for separate regulations for e-commerce sites, but the priority was ensuring means to enforce consumer laws in the digital world.

Lack of dedicated privacy laws

According to cyberlaw and cybersecurity expert, Pavan Duggal, “Going forward, there is an urgent need for India to take a strong view on privacy in terms of legislative frameworks. Unfortunately, at the time of writing, India does not have a dedicated law on privacy.”

Image: Foamy Media

Social media websites for instance have a lot of user data. But what happens when they suddenly change their privacy policies? For instance, a lot of users signed on to WhatsApp when it was an independent company. But post the Facebook acquisition, there have been a lot of instances where WhatsApp has updated its terms and conditions to suit its parent Facebook.

That’s not completely illegal one may say. Loss of privacy is a price you pay for free services. But what if, I as a consumer of WhatsApp do not want the app to share any of my data with Facebook? The only option I am left with is to delete WhatsApp. But then again, I do not know if my data is also deleted from WhatsApp servers or it has already been shared. Social media apps, only let you know what updates are being added. Consent is only required to update the app. You can stall that, up to a point. But there will come a time when you will have to update an app. Then by default you have given approval to all the terms and conditions associated with the app.

Two students had challenged WhatsApp’s revision to its privacy policy before Delhi High Court. The Court dismissed the petition insisting that users could opt out by deleting their accounts.

When a similar challenge was mounted before the authorities in UK, Facebook had to put a pause on their data sharing – and this was because of its strong data protection policy. Under the UK data protection law, the company has to inform the authority established under the Act of any changes in the use of user data. In the case of WhatsApp, the UK authority objected to such sharing.

Aadhaar – the 12-digit biometric storehouse

Aadhaar card is being used for many financial and non financial transactions. Also the Aadhaar number associated with an individual also holds a lot of personal and biometric data. So when recently, there was news about a possible Aadhaar data breach when UIDAI filed a police complaint against Axis Bank, business correspondent Suvidhaa Infoserve and e-sign provider eMudhra, it was naturally a shock to many.

Unlike a password which can be changed, with biometric information there is no scope to do that if it is compromised. Although UIDAI claims that there are multiple levels of security and firewalls to ensure there is no breach of Aadhaar information of an individual, one can only hope that it is robust enough to withstand any attack. Collection of biometric data by the government to form a database, for instance, was debated and ultimately not used in the UK.

Pranesh Prakash, policy director of the Centre for Internet and Society, expressed concern about the pace at which we are progressing when it comes to having a legal and regulatory framework when it comes to the Digital India push. “While the security architecture of Aadhaar Enabled Payment Systems (AEPS) might in itself be good, the idea of providing your fingerprints to merchants for financial transactions is a terrible idea since that is like asking you to give your bank password to a merchant, and the merchant can reuse that password, and you can’t ever change the password,” said Prakash.

Enforcing the correct processes

Last year, a malware affected the systems of Hitachi Payment Services, which provides back end services to ATM machines and Point of Sale nodes across India. As a result of this, around 32 lakh debit cards were compromised including those issued by SBI, HDFC, Yes Bank, Axis, BOB and ICICI. Security experts and consultants have pointed out various holes in the electronic transaction systems in place in India. Intel has also warned that ATM machines in India are vulnerable to malicious attacks. Intel points out that countries in the Asia Pacific region are developing and are particularly vulnerable because of old systems and machines being used.

Image: REUTERS/Amit Dave

According to Mahesh Patel, president and group CTO, AGS Transact Technologies this was more of a governance issue of the data centre than any technical error. “It is not about the software, but it is about the processes and procedures you put in place to ensure that the system is secure. Everything from physical security to computing security to admin management, etc should be process driven. So somewhere there could have been a weak link there. Cloud has to be secure and encrypted which suffices the use case of payments. This cloud is different from the ones used by e-commerce sites to display all their products,” said Patel.

We may have the best of software and security measures, but ensuring that they are implemented the right way is equally important. Plugging the loopholes in current regulations is also important.

Existing laws and regulations, not enough

According to Duggal, “The Information Technology Act, 2000 hardly has effective provisions to protect any data and personal privacy in the digital ecosystem. The Indian Government needs to come up with strong privacy law which can protect both personal privacy and data privacy in an effective manner.”

One may find it really shocking to hear the head of Nasscom saying something to the extent that full data protection for online consumers is not possible, but there is definitely truth to the matter. It will require concerted efforts from not only regulators, governments, digital wallet players and banking industry to come up with these privacy laws, but also you the consumer has to ensure that you are aware of the dangers lurking in the digital world. Educating oneself of the various ways in which your data can be compromised is a good way to protect your online self.

Because, let’s face it, for all practical purposes if you are online, your privacy is dead.

For more details visit https://cis-india.org/internet-governance/news/first-post-march-16-nimish-sawant-nasscom-chief-saying-full-data-protection-isnt-possible-should-wake-us-from-our-digital-slumber

It's That Eavesdrop Endemic

praskrishna — 2016-07-30T15:45:31Z

Whatsapp Says It’s Snoop-Proof Now, But There’s Always A Way In

The article by Arindam Mukherjee was published in Outlook on July 25, 2016. Pranesh Prakash was quoted.

Lock and Key

WhatsApp says it has end-to-end encryption, so no one, not even WhatsApp, can snoop into calls.

Experts say any encryption can be broken by security agencies. Android phones can also get infected by malware.

For years, a Delhi power-broker used to call from nondescript landline numbers, changing them ever so often. Of late, he has started using WhatsApp calls for ‘sensitive’ conversations. He’s not alone. WhatsApp has revealed that over 100 million voice calls are being made on the social network every day. That’s over 1,100 calls a second! India is one of the biggest user bases of WhatsApp. And many Indian users are making the app their main engine for voice calls.

One reason for this shift is that WhatsApp calls are seen to be essentially free (though they indeed have data charges). But for a lot of people, the chief allure lies in the touted fact that WhatsApp calling is far more secure than mobile calling. In April, the app introduced end-to-end encryption for its messages and voice calls.

Consequent to this, Sudhir Yadav, a Gurgaon-based software engineer filed a PIL in the Supreme Court seeking a ban on WhatsApp on the grounds that its calls are so safe that it could be misused by ‘terrorists’. Last month, a court in Brazil issued orders to block WhatsApp for 72 hours after it failed to provide the authorities access to encrypted data.

Are WhatsApp calls really impenetrable? WhatsApp believes so and says that the encryption key is held by the two persons at the two ends of the message or call and no one, not even the company, can snoop in. “The calls are end-to-end encrypted so WhatsApp and third parties can’t listen to them,” a WhatsApp spokesperson told Outlook. This is precisely Yadav’s concern. “Because the encryption is end to end, the government can’t break it and WhatsApp cannot provide the decryption key,” he says.

However, experts do not buy this argument. They believe everything on the Internet is vulnerable. “Anything that uses a phone number is vulnerable,” says Kiran Jonnalagadda, founder of technology platform HasGeek. “Anyone can impersonate the phone number by getting a duplicate SIM and get access to a phone. There are also bugs in the system which security agencies use.”

WhatsApp uses a person’s phone number to open an account and authenticate a user. So, if the government or a security agency wants to get access to a WhatsApp call, it would be very easy. “Telecom companies cannot access these calls as they are encrypted before they reach the network. But the government can. It just has to replicate a SIM to access any number and its messages or voice calls,” says Aravind R.S., a volunteer for Save the Internet campaign and founder of community chat app Belong,

There are other modes of attack as well. It is a given that Android phones, which form the majority of mobile phones used in India today, are most vulnerable to malware attacks. So, even if the app itself is secure, the device is not and if the device is attacked, just about everything in it can be tapped into. For instance, there’s the ‘man in the middle’ mode of attack, where a third person gets into a call and mirrors the messages to both the sides and relays the messages or calls to a different server. There is also the SS7 signalling protocol that can help hackers get into networks and calls. These attacks can make even a WhatsApp encryption vulnerable.

Security agencies and hackers routinely implant viruses into the phones of people they are monitoring. Once a phone is “infected”, everything is accessible. And Android phones are extremely prone to attacks from malware. “It's not perfectly secure, especially if there is any virus in an Android phone, which is what security agencies work with. They have many more ways to get into a phone. There is no defence against that,” says Aravind,

Experts believe it is possible that US intelligence agencies like the FBI and the NSA may have access to or are capable of breaking into even the WhatsApp encryption. This is proven by the recent incident where the FBI, after being refused by Apple to open up an iPhone used by a terrorist, broke into the phone by itself.

“If you are on the NSA list, there is nothing you can do to protect yourself,” says Pranesh Prakash, policy director with the Centre for Internet and Society. “They will find a way to get into your phone. In WhatsApp, many things like photographs and videos are not encrypted; these can get access to a person’s account.”

In India, the debate on access to encrypted phones has been on since the government engaged with Blackberry a few years ago. “There is no law governing an Over The Top (OTT) service like WhatsApp. If the government orders decryption of a call and WhatsApp cannot comply, it will become illegal,” says cyber lawyer Asheeta Regidi. The government’s seeming comfort level with all this legal ambiguity is yet another indicator that all is not what is seems with WhatsApp. As for callers, they would do well to speak discreetly on any network.

For more details visit https://cis-india.org/internet-governance/news/outlook-july-25-2016-arindam-mukherjee-its-that-eavesdrop-endemic

India WhatsApp Privacy Fight May Affect Multinationals

praskrishna — 2017-02-02T02:28:23Z

The Indian Supreme Court’s review of Facebook Inc.'s and WhatsApp Inc.'s data security practices may lack teeth but also presages a desire for a stronger privacy regime and oversight of multinationals, internet and privacy specialists told Bloomberg BNA.

The article by Nayanima Basu was published by Bloomberg BNA on February 1, 2017. Pranesh Prakash was quoted.

WhatsApp revised its privacy policy in August 2016 to share data with owner Facebook and allow targeted ads and messages from businesses, laying the groundwork for the free messaging service to monetize such data. But a public interest complaint, akin to a class action in the U.S., filed by two Indian students and regulatory inquiries have resulted in India’s top court asking Facebook and WhatsApp about their data protection practices.

The court’s move Jan. 17 to seek the information may make multinational companies jittery, Rahul Khullar, former secretary of commerce for India’s Ministry of Commerce and Industry, told Bloomberg BNA. Although stronger data privacy enforcement is needed, all the high court has done is aggravate Facebook and other large multinationals, he said.

Facebook is the second largest media company in the world with a $367 billion market capitalization, Bloomberg data show. It acquired WhatsApp in 2014 for approximately $18 billion, data show. Facebook didn’t immediately respond to Bloomberg BNA’s e-mail request for comments.

Khullar, who is also the former chairman of the Telecom Regulatory Authority of India, said multinationals need to be more careful in sharing their data because of the “distinction between digital non-commercial data and digitally sensitive data,” he said. A strong national data privacy law would resolve some of these issues, he said.

An U.S. official based at the U.S. Embassy in New Delhi, speaking on background, told Bloomberg BNA that any maneuver that restricts the free flow of data may harm the operations of U.S.-based multinationals and similar companies.

Clarity, Stronger Laws Needed

Some internet and privacy specialists say that Facebook and WhatsApp failed to provide effective data protection under Indian law.

Pranesh Prakash, policy director at the nonprofit digital technologies advocate Centre for Internet and Society, told Bloomberg BNA that Facebook and WhatsApp are in violation of Section 43A of the Information Technology Act that lays out “reasonable security practices and procedures.”

Indian citizens are reaching out to the courts for data protection enforcement because lawmakers have “failed to do so,” he said. That highlights the need for robust data protection laws in India and, he said, hopefully “goads the government and Parliament into enacting a privacy and data protection law.”

In lieu of further legislative action, companies may be able to resolve some issues by establishing clearer privacy policies, Niraj Gunde, a Mumbai-based attorney and consumer advocate, told Bloomberg BNA. Most software agreements have a clandestine clause that allows companies to access user data, but those agreements should also state how the data will be used, stored and eventually disposed of, he said.

For more details visit https://cis-india.org/internet-governance/news/bloomberg-bna-february-1-2017-nayanima-basu-india-whatsapp-privacy-fight-may-affect-multinationals

India steps up vigilance against WhatsApp abuse

Admin — 2018-08-27T15:22:23Z

Delhi wants firm to open local office, appoint grievance officer as misinformation spreads.

The article by Debashree Dasgupta was published by Straits Times on August 24, 2018. Sunil Abraham was quoted.

In one of its strongest directives yet to WhatsApp, the Indian government has asked the California-based messaging service firm to set up an office and appoint a grievance officer in India.

Indian Information Technology Minister Ravi Shankar Prasad conveyed the request to WhatsApp chief executive Chris Daniels during a meeting on Tuesday. It came against the backdrop of the growing misuse of the messaging app to disseminate misinformation.

"I requested WhatsApp chief executive Chris Daniels to set up a grievance officer in India, establish a corporate entity in India, comply with Indian laws. He assured me that #WhatsApp will soon take steps on all these counts," Mr Prasad tweeted after the meeting.

"I further asked WhatsApp CEO... to work closely with law enforcement agencies of India and create public awareness campaign to prevent misuse of WhatsApp. He assured me that #WhatsApp will undertake these initiatives," he added in another tweet.

The firm has not yet provided a confirmation of these claims.

The spread of misinformation about child kidnappings through WhatsApp has been linked to a series of mob lynchings that have led to the deaths of least 28 people across India since April.

TAKING RESPONSIBILITY

When rumours and fake news get propagated by mischief mongers, the medium used for such propagation cannot evade responsibility and accountability. If they remain mute spectators, they are liable to be treated as abettors and thereafter, face consequent legal action.

INDIA'S MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

There are also concerns that the spread of fake news via the application could gather further momentum ahead of next year's general elections in India. The firm has more than 200 million active monthly users in India - its biggest market and a sizeable chunk of its 1.5 billion global user base.

WhatsApp, the most widely used messaging app in India, has struggled to control the spread of misinformation in India on its platform.

With the government demanding greater accountability from it, the firm has made it more difficult for users to forward content by removing shortcuts. It has limited to five the number of people a message can be forwarded to each time, and introduced a "forwarded" label for such messages.

But the authorities have found this inadequate given the enormity of the challenge and rampant abuse.

Last month, the Indian Ministry of Electronics and Information Technology said: "There is a need for bringing in traceability and accountability when a provocative/inflammatory message is detected, and a request is made by law enforcement agencies.

"When rumours and fake news get propagated by mischief mongers, the medium used for such propagation cannot evade responsibility and accountability. If they remain mute spectators, they are liable to be treated as abettors and thereafter, face consequent legal action."

Mr Prasad, speaking to the media after the meeting, said: "I have said in the past that it does not take rocket science to locate a message being circulated in hundreds and thousands... You must have a mechanism to find a solution."

The Indian government's demand for WhatsApp to set up a local office is not unprecedented.

The European Union General Data Protection Regulation says a foreign firm that processes personal data of individuals in the EU "may be required" to appoint a representative in an EU state. However, calls by the government to detect messages and track down senders have prompted concerns over privacy violation, and pose a technical challenge.

Mr Sunil Abraham, executive director of the Centre for Internet and Society, a Bangalore-based nonprofit organisation, said: "Application-wide blocking of the same content is not possible on WhatsApp because it uses end-to-end cryptography, and there is no way WhatsApp can determine which messages are being forwarded."

But there are potential remedies that are less controversial, and easier to achieve.

Mr Abraham suggested that WhatsApp fund a large network of fact checkers and provide a "fact check this" button along with all forwarded messages. "This button could then transmit the suspicious message to a common database that is managed by the network for fact checkers," he added.

Last month, the Ministry of Electronics and Information Technology raised concerns on the expected roll-out of WhatsApp Payments, which lets users make financial transactions via the application. It has sought clarity on whether the service adheres to the Reserve Bank of India's security and privacy rules.

For more details visit https://cis-india.org/internet-governance/news/the-straits-times-august-24-2018-debarshi-dasgupta-india-steps-up-vigilance-against-whatsapp-abuse

Don't blindly forward WhatsApp messages. You could be sued

Admin — 2018-05-31T23:49:19Z

Never before in Bengaluru has the Internet and social media taken such a vicious and violent turn as it did last week.

The article by Rajitha Menon and Surupasree Sarmmah was published in the Deccan Herald on May 29, 2018.

A fake Whatsapp message that went viral has led to the death of a man in Chamarajpet. But Bengaluru is not alone. In the recent past many have been lynched in Andhra Pradesh, Telangana, Tamil Nadu, Uttarakhand, Jharkhand and Hyderabad over rumours and fake videos.

In tech-savvy Bengaluru, a 26-year old man was beaten to death in Chamarajpet by a mob that mistook him for a kidnapper. "The big problem is that for a large part of India, WhatsApp is the first exposure to the Internet. What they see there becomes news; people don't do a critical analysis of what comes their way," says Swaraj Barooah, senior programme manager, Centre for Internet & Society, Bengaluru.

What are the legal implications of forwarding fake WhatsApp news? "It's a grey area in terms of current regulation," he says.

However, he advises caution: don't circulate messages you can't vouch for.

MT Nanaiah, senior advocate says, "If a message is intended to harm a person's reputation, it might come under the purview of the Indian Penal Code Section 499 A, which defines defamation and Section 500, which defines the punishment."

Defamation can attract a punishment of up to two years in jail and a fine. Victims of fake forwards can also sue for damage, he says.

In Varanasi, district officials are holding WhatsApp admins responsible for fake news, and issued guidelines.

"I think the courts have been doing a flip-flop on this. I am not sure but the legal validity is weak to hold admins responsible for what happens in the group," notes Barooah.

For more details visit https://cis-india.org/internet-governance/news/deccan-herald-rajitha-menon-surupasree-sarmmah-dont-blindly-forward-whatsapp-messages-you-could-be-sued

Death By WhatsApp

Admin — 2018-06-25T15:47:41Z

The fatal messages were both in text and in audio. They were in Telugu, Kannada, Tamil, Hindi, Assamese and Gujarati among others.

This was published by News18.com on June 25, 2018. Sunil Abraham was quoted.

Guys please be on high alert10:24 PM

Three kids were kidnapped from my friend’s area this morning.. There were 10 guys giving biscuits and people from that area have caught all 10 n 5 more based on their info...10:24 PM

Cops arrived at scene and informed that 400 people have landed in Hyderabad (or Bangalore or Chennai or KarbiAnglong or Singhbhum or any other place) for child trafficking. Check my next video and repost. Parents pls be on high alert.10:25 PM

The Snowball Effect

No one had any idea where the messages originated from or who was the original sender. But when it comes to the safety of one’s children, these questions become irrelevant.

Maybe, if someone had stopped to ask these questions, this fake WhatsApp message wouldn’t have led to 22 murders in one year. These 22 ‘outsiders’ were lynched by mobs on the mere suspicion of being the non-existent ‘child lifters’.

Phony as a three-dollar bill, the message spread like forest fire from Jharkhand to Tamil Nadu and Assam to Gujarat. In each state, it preyed on the raging ‘local versus outsider’ sentiment. It started doing the rounds of southern states around the time when political discourse was hijacked by the ‘North versus South’ debate.

It might be easy now to scoff at those who believed and further shared the fake message, but hindsight is always a perfect 20/20.

In fact, according to a research by University of Warwick, 40% of fake news cannot be spotted by average educated adults. Even if they do feel something is amiss, only 45% adults can place their finger on what exposes the news as fake.

Social media and internet penetration have only aggravated the problem in India, where the written word is rarely doubted.

Social media and internet penetration have only aggravated the problem in India, where the written word is rarely doubted.

In the last four years, social media usage in the country has gone up by 150% with an 83% increase in smartphone ownership. Such proliferation and the availability of competitive data plans have ensured digital intrusion in areas where people have had no exposure to the concept of fake news or digital privacy.

Caveat emptor does not apply in this case, says Sunil Abraham, the Executive Director of Bangalore-based research organisation Centre for Internet and Society.

A Timeline of Deaths

CHAPTER 1

The Propaganda Machine

WhatsApp has unfortunately become a fertile breeding ground for parasites that prey on fear. At present, it has 200 million active users. These users are potential victims of fake news given the complex form of anonymity that WhatsApp offers. It is mainly to arrest the fake news propaganda that the first step in violence-hit areas is to suspend internet services.

In this case, too, the original culprits took cover in this anonymity and experts believe they may never be unmasked. While Facebook and other social media websites are under pressure to address the menace, an inter-personal software, such as WhatsApp, skirts the scanner.

“Those who are passing the rumours cannot be traced or haven’t been traced purely because they are on WhatsApp groups. My guess is that they would have started it (the rumours) on WhatsApp because it is difficult to trace. Once it starts, it (the message) makes its way to everywhere. Somebody gets it on WhatsApp, they put it on their Facebook profile or forward to other WhatsApp users. It goes across multiple platforms. It is not limited to one platform,” says Alt News co-founder Pratik Sinha.

Those who are passing the rumours cannot be traced or haven’t been traced purely because they are on WhatsApp groups

Given its penetration, WhatsApp has emerged as a cheap medium to propagate hate.

Police officials investigating the murder of senior journalist and Left-leaning thinker Gauri Lankesh in Bengaluru were surprised to find out that a key suspect was an ‘admin’ for hundreds of groups.

KT Naveen Kumar, a college dropout, floated his outfit ‘Hindu Yuva Sena’ in Mandya near Bengaluru three years ago. The Hindutva activist confessed to the police that he created several WhatsApp groups — Hindu Yuva Sena, Jago Hindu Maddur, Bajrang Maddur and Kaveri Boys among others — to propagate his ‘Save Hinduism’ agenda.

Once you create a WhatsApp group and add ‘participants’, you are free to make others the ‘admin’, who in turn can add scores of people to the group. There is no known cap to the number of participants in a WhatsApp group.

How To Spot Fake News

CHAPTER 2

Jharkhand

The fake message on ‘child lifters’ added fuel to fire in Jharkhand, which has been plagued by child abductions and kidnappings for years. Young girls from the state have been known to be abducted and forced into modern-day slavery in other states.

Villagers, who had never heard of the concept of fake news, bought into the rumours. And since a photo can say a 1,000 fake words as well, graphic images freely available on the internet were used alongside the message. The propaganda did the trick and aroused murderous rage among the local tribal population.

At least nine people were killed in separate incidents over as many days in Singhbhum district. Angry mobs beat and hacked the victims to death, assuming they were saving their young ones from ‘child lifting’ gangs that were rumoured to be abducting children for organ trade.

The death toll would have been higher had protest marches against the fake news and the killings not been held in cities like Jamshedpur. While these protests did not get the police to act against hate mongers on social media, the uproar publicised the fact that the message was a fake one.

Over the next few days, alleged ‘child lifters’ were caught in other villages, but were duly handed over to the police.

The disinformation campaign died a natural death in Jharkhand, but moved to a new hunting ground.

CHAPTER 3

Tamil Nadu

More than 2,000 km from Jharkhand, the message landed in Tamil Nadu with an additional detail — be wary of ‘North India people’. It warned of a gang of 400 ‘North Indians’ out to lure children for organ trade. These people, the message added, may try to gain entry inside homes on the pretext of being repair men or hawkers. Again, the images of mutilated bodies did the trick.

No one stopped to think whether a ‘gang of 400 outsiders’ could travel undetected. No one called the 100 helpline to confirm the rumour with the police. The mere ‘police-arrived-at-the-scene’ was enough to convince people of its authenticity.

A man in Thiruvalluvar, north of Chennai, became the state’s first victim of the fake news. A mob beat him mercilessly and hung him from a bridge in Pulicat on May 10.

The mob didn’t even give her a chance to be heard.

The second lynching came in less than 24 hours. This time the victim was an elderly woman identified as Rukmani in the temple town of Thiruvannamalai. She was returning from a temple visit with her relatives when they stopped their car at a village. Rukmani was handing out ‘foreign chocolates’ to local children when word spread that a woman was ‘luring’ kids with sweets.

“The mob didn’t even give her a chance to be heard. Giving out chocolates to children doesn’t make you a child trafficker. I’m scared to even step out after this incident,” says a relative who was in the car with Rukmani and was grievously injured.

Police officials rounded up at least 30 people and charged them with murder.

CHAPTER 4

Andhra Pradesh & Telangana

The mob madness spread to Andhra Pradesh and Telangana next, again preying on anti-migrant sentiment. The first attack was reported mid-May when 12 people were suspected to be members of ‘Parthi’ gang, a group notorious for dacoity in Madhya Pradesh and Maharashtra.

A couple of days later, a mob beat up two beggars in Vishakhapatnam, killing one of them.

Another horrific attack unfolded in Hyderabad where a transgender was stoned to death by a mob of 200. The victim had travelled from Mahabubnagar district with three others to seek alms in the holy month of Ramzan.

Soon, the fake news reached other districts. A man visiting a relative in Nizamabad was killed when he failed to give ‘satisfactory’ explanation to the mob about his presence there.

A murder in Yadadri district of Telangana, an attack on nine people in Vikarabad district and an assault on a woman at the Guntur railway station followed within days.

CHAPTER 5

Karnataka

The mob mentality fuelled by the fake news campaign reached Karnataka, where the ‘local versus outsider’ debate had reached fever pitch during election campaigning.

WhatsApp users in Bengaluru, India’s Silicon Valley, started receiving warnings on ‘child lifters’ in Kannada.

“Don’t leave your kids unattended..if you find such traffickers, tie them up and call the cops (sic),” one such message advised.04:24 PM

A 26-year-old construction labourer from Rajasthan, identified as Kalu Ram, who had come to look for work was tied with a rope, dragged through the streets of Chamarajpet in west Bengaluru. Beaten with bats and other household ‘weapons’, he succumbed to his injuries.

According to Additional Commissioner (West) BK Singh, India saw a similar kind of 'madness’ 20 years ago with the ‘Ganesha drinking milk’ rumour, but WhatsApp has taken it to a dangerous new height.

“This hapless man was walking alone. Two persons standing there saw him and started following him to a shop just 100 metres away. Suddenly, a crowd gathered. People brought whatever they could find in their homes — cricket bats, stumps, ropes etc,” Singh says.

“Once a crowd becomes a mob, you cannot control it. Many of them may be meek persons individually, but they are taken in by the presence of the mob. The mob thinks that if they act collectively, police won’t act and they can get away easily,” Singh adds.

People brought whatever they could find in their homes — cricket bats, stumps, ropes etc.

Around 20 people were arrested based on CCTV footage and videos taken by bystanders, who did nothing to help the hapless victim. One of the main accused is 26-year-old Anbu, who has other criminal cases pending against him. Four women and a minor were among those in custody. All of them face murder charges now.

The spread of the fake news in Tamil Nadu may also have led to the violence.

Pension Mohalla in Bakshi Garden where the attack took place has a dominant Tamil population. Some of them could have been aware of the rumours before it made its way to Bengaluru. When the WhatsApp messages started doing the Silicon Valley’s rounds, it may have been perceived as a confirmation of the fake news.

Another person was killed under similar circumstances in Salem. The state witnessed seven more such attacks.

CHAPTER 6

Assam

The latest casualty of the fake news was reported in Assam, again a state which deals with anti-migrant sentiment.

On June 8, two youths from Guwahati were battered to death in Karbi Anglong district on suspicion of being child lifters. Police said Abhijit Nath and Nilutpal Das were on their way to the Kanthe Langshu picnic spot when their vehicle was attacked by a group of men at Panjuri Kachari village, 16 km from Dokmoka town.

Eyewitnesses said the two boys were brutally beaten with bamboo poles and wood, and tortured to death by a mob of allegedly inebriated villagers.

“It happened when some locals informed a group of villagers about two men travelling in a black car with an abducted child. These few villagers were drinking in the roadside dhaba and immediately called upon more people to trace the car and catch them. The mob stopped the car and surrounded the two boys inside. The village elders tried to stop them from beating the boys, but they would not listen,” said a local shopkeeper.

The two boys were brutally beaten with bamboo poles and wood, and tortured to death by a mob of allegedly inebriated villagers.

This incident was yet again preceded by paranoia fuelled by WhatsApp forwards. The messages warned people of 'sopadhora' (child lifters) being on the prowl. Many in Karbi Anglong, one of the most backward areas of the country, took those messages as gospel.

“We have arrested 35 people so far. Some of them are directly involved in the attack, while one has been arrested for posting objectionable content on social media, inciting communal violence soon after the incident took place. There’s no substance to the rumour of ‘sopadhora’ (child lifters) in the area. But it had created a fear psychosis among people here,” says Agarwal.

Death By Whatsapp

For more details visit https://cis-india.org/internet-governance/news/death-by-whatsapp

Centre draws red lines for Whatsapp over fake news, says must comply with Indian laws

Admin — 2018-08-27T14:24:51Z

In a meeting with WhatsApp’s CEO Chris Daniels, Union minister Ravi Shankar Prasad said India put forward several demands, including that the company must have a grievance officer in India and have proper compliance of Indian laws.

The article by Nakul Sridhar was published in the Hindustan Times on August 21, 2018.

The Union government on Tuesday told the Facebook-owned WhatsApp to comply with Indian law, set up an Indian entity, and appoint a grievance officer in India to who people can reach immediately.

The directive comes at a when the government has pulled up the company for fake news spread on the social media platform serving as a contributory factor in several incidents of mob lynching across the country.

Ravi Shankar Prasad, Minister for Electronics and Information Technology, conveyed this to the global head of WhatsApp, Chris Daniels, who is in India this week. This is the first time that the government has spelt out its key expectations from the platform.

“I told him there have been sinister developments like fake news and revenge porn, which are criminal and against Indian laws. I suggested three points: they must have a grievance officer in India; they must comply with Indian laws; and they must have a local, corporate entity in India,” Prasad said.

Daniels, he added, had agreed to the three conditions. WhatsApp did not offer an independent confirmation or respond to questions.

Prasad said he also told Daniels that WhatsApp would have to comply with Reserve Bank of India (RBI) guidelines to start its payments services in India, saying that the firm would have to store the financial data it collects from India within the country.

After at least 30 lynchings in the past one year were linked to rumours and fake news spread through the WhatsApp platform, the IT ministry sent two notices to the company last month, asking it to curb the spread of such messages. WhatsApp’s chief operating officer, Matthew Idema, had met the IT ministry secretary Ajay Sawhneytowards the end of July to discuss the issue of fake news with the ministry and explain the steps it was taking in curbing its spread.

The application made it more difficult to forward media by removing shortcuts, limited the number of people a forwarded message can be sent to at a time to five, and introduced a ‘forwarded’ label for such messages after the push from the government.

Explaining its broad approach, a top government functionary, who asked not to be named, said, “We cannot accept digital imperialism. India is an open society. We have embraced technology and innovation. But no one should think they can come and do as they like. Firms like WhatsApp must conform to our rules, laws, and address problems.”

Reiterating his demand that WhatApp must find “a technological solution” to trace the origin of rumour-mongering messages, Prasad said, “It does not need rocket science to locate a message being circulated thousands and lakhs of times on the same day, on the same issue, in the same district and same state.” He said Daniels agreed to comply.

But experts believe that delivering on these demands will be challenging. “WhatsApp, according to my understanding, does not store metadata (such as phone number sent from) for text messages that are transmitted using their application or via the web client. Unfortunately, WhatsApp does not make this explicit in their public documentation,” said Sunil Abraham, founder of the think tank, Centre for Internet and Society.

“Therefore, many governments erroneously believe that sources of specific messages can be determined by big data analysis similar to the analysis of SMS metadata from telecom operators,” he said.

Metadata includes information such as the sender and recipient, date and time. “Now it would also include whether the message is forwarded,” said Abraham.

For more details visit https://cis-india.org/internet-governance/news/hindustan-times-august-21-2018-centre-draws-red-lines-for-whatsapp-over-fake-news-says-must-comply-with-indian-laws

An 'app'ening world

praskrishna — 2016-10-05T00:24:19Z

A ‘forward’ has been doing the rounds on WhatsApp about the privacy concerns relating to that instant messaging app; it’s asking for permission to share user data with Facebook.

The article by Chetana Divya Vasudev was published in Deccan Herald on October 4, 2016. Rohini was quoted.

In the WhatsApp notification, asking users to agree to the terms and conditions again, the option to share these user details to help improve ads on Facebook is already selected. Those who are uncomfortable parting with this information have to uncheck it before clicking on the ‘I agree’ button.

“Agreeing to this would mean Facebook can see who you’re chatting with and what you’re talking about,” says tech expert Chinmayi S K. “So if you’re talking about cat adoption, the ads displayed on the side could be relevant to that.”

When it comes to other smartphone apps, she cites Zomato as an example. “It has been asking for user history — previous orders and other such details — to make recommendations,” she says. “This comes with the app update. Tinder, too, is asking for your location using wifi, which is more accurate than the GPRS location.”
It’s alright to agree to these permissions, she says, so long as you’re aware of what you’re signing up for and how that data is going to be used.

If you have qualms about agreeing to this, there are usually alternatives you can find, adds Rohini Lakshane, program officer, Centre for Internet and Society. “If not, it’s usually a trade-off: you have to see how much you want the app,” she points out.

There are, however, other apps that might be duplicates asking for access to your device or files, cautions Chinmayi.

“If a cooking app, a simple one that gives you recipes, asks for your call logs or other files, for example,” she says.

A discerning user, interjects Rohini, will check for permission to access files or functions that are not strictly necessary for the features the app supports. “I don’t want to name anything but some e-commerce and travel apps ask to access your browsing history and the other apps or networks you’re connect to. It could be to serve you contextual ads or content, like Zomato, or to sell it to someone. You never know,” she says. However, some devices or versions of the Android OS let you control what permissions you enable, she informs.

Aeronautical engineer Pavan Raj P V says he takes care not to compromise on his safety, whenever possible. “But there are a few apps that I have on my phone no matter what — Facebook, WhatsApp, LinkedIn, Instagram. Most of them auto-update and require no extra permissions.”

However, he has noticed that LinkedIn asks for access to Gmail contacts that you could accidentally accept “if you’re logging in mechanically”.

Varsha C V, communications specialist at Karnataka State Highways Improvement Project, says, “Last month, my husband asked me to download a Google app for free calls that required all sorts of permissions, such as access to your phone logs. When Skype offers the same features without asking for all this, why should anyone use this app?”

She believes privacy in India is not taken as seriously as it should be. “You should keep in mind that if you’re giving them access to your contacts, you’re also compromising on others’ privacy,” she points out.

Lokanand, a sound engineer, admits to not paying attention to what he’s giving apps access to. “I’m no expert but if you ask me, you download apps because they are useful. So I don’t really bother about what I’m saying yes to.”

For more details visit https://cis-india.org/internet-governance/news/deccan-herald-chetana-divya-vasudev-october-4-2016-an-appening-world

'Full belief in fake texts shows cops not trusted'

Admin — 2018-06-26T01:21:04Z

Nilotpal Basu and Abhijeet Nath, an audio engineer and digital artiste, were beaten to death in Assam's Karbi Anglong last week based on rumours that they were kidnappers.

The article was published in the Times of India on June 18, 2018. Pranesh Prakash was quoted. Inputs from Kim Arora.

A manipulated WhatsApp video is said to be the source of the panic. While it is just the medium and not the reason behind the killings, WhatsApp, with its 250-million users in India, allows rumours to travel farther than ever before. "In many non-urban areas, such WhatsApp videos are the first form in which people encounter the internet on their phones. They don't always go online and verify them," says Jency Jacob, who runs the fact checking outlet Boom. This gullibility can't be explained just by class or education, he says. "Technology makes it easy to believe what you want to believe and spread it," says Jacob.

The spread of internet gives wings to rumours in pockets where kidnappings are a real fear. The states where lynchings have been reported are also among those with high figures for child abductions. Technology has helped rumours travel greater distances with greater impunity, says Pranesh Prakash, fellow at Centre for Internet and Society, recalling that child abduction rumours led to a lynching in Tamil Nadu in 2015 too, but this time, "such rumours have spread all over South India". And as the Karbi Anglong killings show, to Assam as well.

WhatsApp being an encrypted platform, police cannot trace the source of the rumourmongering. WhatsApp did not respond to TOI's queries on tracing origins of hate messages, but a spokesperson shared a statement saying they "block automated messages" and are educating people about spotting fake news and hoaxes.

In many cases, law enforcement has failed at a more basic level. Child abduction is a disturbing rumour, designed to provoke an emotional reaction, but other anxieties are at work too. "Rumours tend to escalate when there is a lack of official information, and clearly many feel what happens to them and their children does not get attention at higher levels," says sociologist Dipankar Gupta. It also points to a collapse in the state's credibility, he says. So, Gupta says, "there is no seeking of justice, only reprisal."

For more details visit https://cis-india.org/internet-governance/news/times-of-india-june-18-2018-full-belief-in-fake-texts-shows-cops-not-trusted