Centre for Internet and Society

Open Letter to the Finance Committe: Biometrics

praskrishna — 2011-02-17T13:12:22Z

This note points out the weaknesses inherent in biometrics and the pitfalls in using them. It recommends procedural safeguards that should be adopted by the UID in order to make the use of biometrics more secure and inclusive.

Biometrics are not centrally stored and are used only for identification

Biometrics, as our first letter notes 1 are better suited for identification, and are inappropriate for authentication. Therefore, the central server need not store biometric information, and need only store the public key of each citizen's digital signature.2 Biometrics on a smart card for authentication will allow service providers to determine if the card is being carried by the right person. This configuration of biometrics has many positives. It is :
- Cost effective
- More secure
- Places the control of biometric information in the hands of the data subject
Use encrypted data, rather than live data

The UID scheme has stated that biometrics will be encrypted, but has not provided further details. 3
It is recommended that biometrics are:
- Encrypted whenever it is used, stored and transferred;
- A biometric should be encrypted to such a degree that it is not possible to reconstruct the biometric data; and
- After an encrypted version of the biometric is made, the original biometric should be deleted.
In order to perform an identification check – the biometrics presented should be encrypted and then compared to the encrypted version stored on the card. If the card is stolen – the thief would not be able to harvest biometrics.
Security clearance for all associated entities and personnel

UID registrations and transactions will be handled by 'registrars' or in other words personnel who work at organizations not directly under the control of the UIDAI. A clear process associated with who can perform transactions and a proper audit system is needed to prevent 'insider' attacks.
Clearly defined alternate identification factors

There are many situations in which a biometric cannot be accepted in a transaction. For example, when the biometric changes, is misread, or is unreadable. The UID has recognized this possibility and has stated: “In case of authentication, the operator needs to find an alternate method of authentication if fingerprint verification fails. The operator/application would not know the cause of verification failure. A timeout will be implemented in service after five attempts.”4
The alternative identity factors that will be accepted need to be clearly defined and articulate.
Standards for acceptance of biometric as authentication factor

The UIDAI has proposed a whole range of authentication factors – pin, password, partial biometrics, full biometrics, mobile phone and combination's thereof. 5 Some of these authentication factors may also be presented by the data subject over the Internet. As our previous letters have stated – some authentication factors are more secure than others. Therefore, the UIDAI should publish standards for acceptance of different authentication factors based on the security requirements of different types of transactions. Even if biometrics are used as an authentication standard – in our opinion it should only be used for trivial transactions without major financial or citizenship implications.

Footnotes:

1http://www.cis-india.org/advocacy/igov/privacy-india/letter-to-finance-committee

2 Distinguish and separate the authentication process from the identification process: Identification is a comparison of one set of biometric data against all sets of collected biometrics in one central database to verify the identity of the owner of the biometric data. Authentication is a comparison of a biometric against a stored template to validate the existence of that specific biometric

3 http://uidai.gov.in/index.php?option=com_fsf&view=faq&Itemid=206&catid=7

4 Biometric Design Standards for UID Applications: pg 37

5 UIDAI Strategy Overview. Creating a Unique Identity Number for Every Resident in India. Pg. 28

For more details visit https://cis-india.org/internet-governance/blog/privacy/biometrics

Open Letter to the Finance Committee: Finance and Security

praskrishna — 2011-02-17T11:57:42Z

This note explores the three connections between finance and security and demonstrates the cost implications of operating a centrally designed identity management system as proposed by the UID. In doing so, it shows how the monitoring, storing, and securing of transactional data in a centralized database fall short of meeting the project's objectives of authentication, and thus is an additional cost. Further, it is argued that the blanket monitoring of the transaction database is not an effective method of detecting fraud, and is an expensive component of the project.

Operating a centralized identity management system that requires the use of a remote database for every transaction is always more expensive than a decentralized identity management system that could optionally use a local database.

Centralized database costs

Both public and private keys must be centrally stored
All transactions require connectivity for the sending and receiving of authentication of data, and have an associated connectivity cost
Securing all data at a central database has augmented costs

Decentralized database costs

Only the public key must be centrally stored
Some transactions require connectivity for the sending and receiving of authentication data

The cost of building an identity management system that includes recording, monitoring, and securing each transaction is more than the cost of building only an identity authentication system. The goal of the project is to identify a person. Recording each transaction will add unnecessary cost.

Cost of identity authentication system
Cost of monitoring transactions	> Cost of identity authentication system
Cost of securing transaction data

Increasing security or fighting fraud can be done in two ways - having a targeted approach or through blanket monitoring. The UID scheme, through the monitoring of the transaction database featuring trillions of transaction by 1.2 billion people is a blanket approach, and will provide lower return on investment than a targeted approach.

For more details visit https://cis-india.org/internet-governance/blog/privacy/finance-and-security

Open Letter to the Finance Committee: UID and Transactions

praskrishna — 2011-02-24T13:35:11Z

Since official documentation from the UIDAI is very limited, we assume that data pertaining to transactions would comprise of the Aadhaar number, identifier of the authenticating device, date-time stamp, and approval/rejection/error code. Recording and maintaining of data pertaining to transactions is very important because it increases transparency and accountability through an audit trail. However, storage of such sensitive data creates many privacy risks, because more often than not metadata gives you as much intelligence as raw data.

For example – even if you didn’t have access to the Radia recordings – just knowing who she called, when, how frequently, in what order, and for how long, will give quite a comprehensive picture. Thus, we believe that such data should not be fully stored in a central database. By way of an open letter, we suggest three alternative ways of storing and securing data relating to transactions, so that transparency and accountability is preserved without enabling surveillance or profiling of individuals.

Partial storage of data relating to transactions

Once a transaction is processed, half of the UID number is stored in the central database, while the other half of the number is stored with the service provider. Thus, for an agency to reconstruct the audit trail they must seek consent from the service provider and the UIDAI for information regarding a specific transaction. The process would follow steps like these:

Send part of the Aadhaar number to the CIDR
Service provider stores part of the Aadhaar number locally.
Law enforcement and intelligence agencies seeking transaction data securing required approvals from the Home Ministry and then request data from the UIDAI and service provider
Data is provided by UIDAI and the service provider and combined to reconstruct the audit trail.

Storage of the public keys with a custodian

Similar to the model followed in the new wiretapping regulations1, the transaction details in the central database is secured using several custodians. Thus, no single entity has complete knowledge of access to the database. And if the transaction details are leaked to the public, the custodian can be held responsible for negligence. Thus, for an agency to reconstruct the audit trail they must seek approvals and request encrypted data. The process would follow steps like these:

Encrypt transaction data with the public key of the ‘custodian’
Store encrypted data in CIDR
Law enforcement and intelligence agencies seeking transaction details require approvals from the Home Ministry, and then request encrypted data from the UIDAI.
The custodian on receipt of the necessary approvals decrypts the data using his/her private key, and then the audit trail becomes available.

Complete storage of transaction details at the service provider level

After a transaction is processed, the information is encrypted and stored in a de-centralized manner with the service provider, thus agencies or individuals can only access information regarding a specific transaction at a specific organization. The process would follow steps like these:

Encrypt transaction data
Store encrypted data at service provider level
Law enforcement and intelligence agencies seeking transaction details require approvals from the Home Ministry, and then request encrypted data from each service provider. Audit trail is reconstructed by merging data sets from different service providers.
The CIDR will only hold Aadhaar number, date-time stamp, and approval/rejection/error code.

Note

1 http://timesofindia.indiatimes.com/india/Tapping-norms-Govt-will-erase-private-talk/articleshow/7407633.cms

For more details visit https://cis-india.org/internet-governance/blog/privacy/uid-and-transactions

'Privacy Matters', Ahmedabad: Conference Report

praskrishna — 2011-04-04T04:45:49Z

On 26 March 2011, civil society, lawyers, judges, students and NGO’s, gathered together at the Ahmedabad Management Association to take part in 'Privacy Matters' – a public conference organised by Privacy India in partnership with IDRC and Research Foundation for Governance in India (RFGI) — to discuss the challenges of privacy in India, with an emphasis on national security and privacy. The conference was opened by Prashant Iyengar, head researcher at Privacy India and Kanan Drhu, director of RFGI. Mr. Iyengar explained Privacy India’s mandate to raise awareness of privacy, spark civil action, and promote democratic dialogue around privacy challenges and violations in India. RFGI is a think tank established in 2009 which aims to research, promote, and implement various reforms to improve the legal and political process in Gujarat and across India. ‘Privacy Matters – Ahmedabad’ is the third conference out of the eight that Privacy India will be hosting across India. The next conference will take place in Hyderabad on 9 April 2011. It will focus on human rights and privacy.

The keynote speech, delivered by Usha Ramanathan, focused on links not often made between privacy and social phenomenon.

Ms. Usha Ramanathan opened the conference by examining the links not often made between privacy and personal security, between databases and national security, and the centrality of dislodging privacy in projects of social control. In her presentation she spoke about the inverse relationship between national and personal security, making the point that an important part of privacy is the ability of an individual to secure their own person. Today, because national security follows a policy of ubiquitous surveillance, it is almost impossible for an individual to secure their person from the state. Ms. Ramanathan also traced the beginnings of ubiquitous surveillance to the increasing global fear of terrorism, and the national break down of the criminal justice system in India. Instead of looking to the roots of terrorism and the roots of failure in the criminal justice system, the Indian State has responded to both these factors by superimposing a system of surveillance on top of the existing rule. Consequently, the state has become pan-optical — closely following the movement of its entire population. The state has been able to achieve this level of surveillance through technology, which it has used to create identifiers for its population. The use of technology by the state mediates a link between corporate interest and state interest. Thus, by facilitating the easy and ubiquitous creation of identifiers and surveillance, technology is changing the idea and the nature of privacy. For example, it is now important that a privacy law allows for individuals to protect and secure their identity, something that every individual has and every individual controls, while regulating the creation and external use of identifiers — something that is used by another (not you) to distinguish a person from the rest of the population.

Questions to Consider

How can privacy legislation work to positively regulate the use of technology by the government, so that invasion of privacy does not consequently become state policy?

How can privacy legislation distinguish between and work to protect an identity while regulating the creation and use of personal information as identifiers?

Session I of the Conference featured a Judicial Perspective of Privacy and a Presentation on the Connections between Privacy and the Federal Income Tax Regime in India.

Privacy and the Constitution

J N Bhatt, the former Chief Justice of Gujarat and Bihar, and currently the head of the Gujarat State Law Commission, spoke about privacy as a fundamental right that has been written into articles 19 and 21 of the Constitution of India. Important points from his presentation include:

As privacy is already a recognized fundamental right, the question at hand is not if there is a right to privacy, but instead how can the right to privacy be best proliferated.

Within the question of how a privacy can best be proliferated, is a question about rights and duties. Wherever there is a right to privacy there is also a corresponding duty to privacy — as rights and duties are interdependent.

Though privacy has been recognized as a fundamental right in India, when looking at the actual assertion of the right, it is important to be aware of the cultural realities of India. India is a country with 39 per cent of her population living below the poverty line, with an even lower literacy rate, and there is a direct connection between the assertion of civil liberties, an individual’s civic sense, and education.

When looking at how to best proliferate the right to privacy, governance and common law, a methodology to reach the poorest of the poor should be laid out first.

Questions to Consider

What is the best way to proliferate the right to privacy ?

What legal structures need to be in place to ensure that the poor can assert their right to privacy?
What social structures need to be in place to ensure that the poor can assert their right to privacy?

Privacy and the Indian Tax Regime

Professor Amal Dhru, visiting professor from the Indian Institute of Management, Ahmedabad and a practicing Chartered Accountant spoke on the connections between privacy and the federal income tax regime in India. In his presentation he explained how the information collected by the federal income tax regime in India can be both useful in holding a citizen accountable, and invasive of one’s personal privacy if mis-used. Important points from his presentation include:

The Indian tax regime highlights the tension between public interest as tax evasion is considered an exception to the right to privacy as it is a matter of public interest.

There is a lack of confidence in the existing banking and tax system in India. For example in the business sector, Indian investors have deposited over 700 billion dollars abroad as they are given complete privacy and security over their money.

Though there is a lack of confidence in the current banking and tax system, a tighter law is not necessarily the solution. For example, studies have found that tighter tax regimes lead to greater evasion, while looser tax regimes have higher compliance rates.

On April 1, 2011 the new tax codes for India will be implemented. The reform will give enormous power to tax offices, and as the tax authorities will become equipped to do taxes smarter – this will come at a cost to citizen’s privacy.

Questions to Consider

Just as a tighter tax law leads to a higher percentage of tax evasion, will a tight privacy law simply lead to greater numbers of privacy violations?

What creates public confidence in a law?

Should a privacy legislation be responsible for defining the public good?

Should privacy protection of tax-related information be incorporated into a privacy legislation or contained only in tax law?

To what extent should tax authorities be allowed to investigate potential tax evasion i.e., one’s computer, house or e-mail?

How does one balance the private vs. the public good?

Session II of the Conference focused on National Security and Privacy, and Cultural Conceptions of Privacy

National Security and Privacy

In the second session on Privacy and National Security, Colonel Mathew Thomas spoke on privacy and national security. Colonel Thomas is a management consultant and activity leader for development centers and has held top positions in the Indian Army, and the Defence Research and Development Organisation, where he headed the missile manufacturing facility. Sharing his personal experiences in the army he explained the connection between privacy and national security. Important points from his presentation include:

National Security is often not an internal threat, but instead an external threat.

There is a connection between the increase in surveillance and liberalization of Government.

More surveillance does not bring more security.

Foreign software poses as a threat to national security.

Greater security is gained through intelligent use and analysis of data.

A strong national security plan should not rely solely on surveillance of its citizens. Instead national security should be brought about through strong economic policies, non-reliance on foreign software, neutrality in foreign policy, fair trade policies, rural development and prevention of migration to cities, and having a politically honest and accountable governance.

Questions to Consider

Is it effective for privacy to be compromised in the name of anti- terror laws?
Can the development and distribution of indigenous software protect national privacy?
How can strong economic policies indirectly protect an individual's privacy?
How can a strong foreign policy protect an Indian citizen's privacy when it is stored or sent abroad?

Privacy as a Cultural Construct

Gagan Sethi from the Centre for Social Justice, Ahmedabad shared his opinion on privacy. Important points from his presentation include:

Privacy is a cultural construct that changes with context, perspective, and time.
When considering a privacy policy it is important to create a policy that does not strictly define what privacy is and what it is not, but instead create a policy that defines and promotes a common respect for human dignity.

Questions to Consider

If a privacy policy is developed to promote a common respect for human dignity – will it be effective?

Can you develop a policy that has a loose definition and mandate, but has strong legal teeth?

Session III of the Conference focused on Minority Identities and Privacy, Prisoner Rights, and Cyber Security.

Privacy and Minority Identities

Bobby Kuhnu, a lawyer and activist, presented in the third session on Privacy, Minority Identities, and Security. In his talk Mr. Kuhnu through the use of three examples examined the ideological underpinnings of the discourse on privacy and its bearings on socially marginalized identities in the context of the Indian State and the constitutional right to privacy. Important points from his presentation include:

In India, names can be sensitive and personal information like one’s religion, family, caste, and background can all be known through a name.
Because of the sensitivity of a person’s name, many people do not feel safe or comfortable in their own identity.
Reservation lists and public postings of information, can and have been used to discriminate and violate another’s privacy.

Questions to Consider

Should a privacy legislation requirement throughout institutions and government bodies that names should not be publicly displayed to the point of identification?
What is the most effective way of legally protecting an individual from discrimination based on their name?

Perspectives of Privacy

In the last portion of the day, Yash Sampat and Aditya Yagnik spoke on the origins of privacy and privacy in the cyber world. Vimmi Surti spoke on prisoner's rights and privacy and Ramswaroop Chaudhary presented on minority identities in South Asia and privacy. Important points from their presentation include:

Internet has led to an increase in privacy violations.
The result of privacy infringements is often the deprivation of individuals from safe access to services availed to them.
When looking at privacy as the protection of human dignity, prisoner’s rights are violated through overcrowding in prisons, poor health, and poor sanitation.

Questions to Consider

Are there legal mechanisms that can be put in place to ensure the least amount of deprivation to services when an individual’s privacy is invaded?

To what extent should prisoners be availed the right to privacy?

The concluding session was a time for discussion and opinion sharing

From the closing session, and the above sessions many themes and questions pertaining to privacy came out that will need to be addressed when considering the way forward for a privacy legislation including:

Regulation of ubiquitous surveillance in the name of national security
Regulation over public display of names and personal information
The need to distinguish between identity and identifier.
The need to protect an individual's identity while regulating the production and use of identifiers.
Privacy rights and prisoners: what does the right to privacy mean to a prisoner, i.e., clean facilities and health care.
Can the right to privacy be a platform for individuals to claim sanitary/safe working and living conditions.
Recognize the changing nature of privacy rights in a technological society.
Privacy implications of biometric usage.
Creation of a definition of when privacy rights will supersede identification needs.
How can government institutions, like the tax department, incorporate and protect the right to privacy with the collection of large amounts of data for more efficient services.
Privacy and the family

Download the report and agenda here [pdf - 452kb]

Also see Matthew's presentation [powerpoint file 116kb]

For more details visit https://cis-india.org/internet-governance/blog/privacy/privacy-matters-report-from-ahmedabad

Privacy and the Information Technology Act — Do we have the Safeguards for Electronic Privacy?

Prashant Iyengar — 2012-12-14T10:29:12Z

How do the provisions of the Information Technology Act measure up to the challenges of privacy infringement? Does it provide an adequate and useful safeguard for our electronic privacy? Prashant Iyengar gives a comprehensive analysis on whether and how the Act fulfils the challenges and needs through a series of FAQs while drawing upon real life examples.

What kinds of computer related activities impinge on privacy?

Although Information and Communications Technologies (ICTs) have greatly enhanced our capacities to collect, store, process and communicate information, it is ironically these very capacities of technology which make us vulnerable to intrusions of our privacy on a previously impossible scale. Firstly, data on our own personal computers can compromise us in unpleasant ways — with consequences ranging from personal embarrassment to financial loss. Secondly, transmission of data over the Internet and mobile networks is equally fraught with the risk of interception — both lawful and unlawful — which could compromise our privacy. Thirdly, in this age of cloud computing when much of "our" data — our emails, chat logs, personal profiles, bank statements, etc., reside on distant servers of the companies whose services we use, our privacy becomes only as strong as these companies’ internal electronic security systems. Fourthly, the privacy of children, women and minorities tend to be especially fragile in this digital age and they have become frequent targets of exploitation. Fifthly, Internet has spawned new kinds of annoyances from electronic voyeurism to spam or offensive email to ‘phishing’ — impersonating someone else’s identity for financial gain — each of which have the effect of impinging on one’s privacy.

Although there are a number of technological measures through which these risks can be reduced, it is equally important to have a robust legal regime in place which lays emphasis on the maintenance of privacy. This note looks at whether and how the Information Technology Act that we currently have in India measures up to these challenges of electronic privacy [1].

What provisions in the IT Act protect against violations of privacy?

At the outset, it would be pertinent to note that the IT Act defines a ‘computer resource’; expansively as including a “computer, computer system, computer network, data, computer database or software” [2]. As is evident, this definition is wide enough to cover most intrusions which involve any electronic communication devices or networks — including mobile networks. Briefly, then IT Act provides for both civil liability and criminal penalty for a number of specifically proscribed activities involving use of a computer — many of which impinge on privacy directly or indirectly. These will be examined in detail in the following sub-sections.

Intrusions into computers and mobile devices

accessing

downloading/copying/extraction of data or extracts any data

introduction of computer contaminant[3];or computer virus[4]

causing damage either to the computer resource or data residing on it

disruption

denial of access

facilitating access by an unauthorized person

charging the services availed of by a person to the account of another person,

destruction or diminishing of value of information

stealing, concealing, destroying or altering source code with an intention

The Act provides for the civil remedy of “damages by way of compensation” for damages caused by any of these actions. In addition anyone who “dishonestly” and “fraudulently” does any of these specified acts is liable to be punished with imprisonment for a term of upto three years or with a fine which may extend to five lakh rupees, or with both[5].

Bangalore techie convicted for hacking govt site (2009, Deccan Herald)[6]

In November 2009, The Additional Chief Metropolitan Magistrate, Egmore, Chennai, sentenced N G Arun Kumar, a techie from Bangalore to undergo a rigorous imprisonment for one year with a fine of Rs 5,000 under section 420 IPC (cheating) and Section 66 of IT Act (hacking).

Investigations had revealed that Kumar was logging on to the BSNL broadband Internet connection as if he was the authorised genuine user and ‘made alteration in the computer database pertaining to broadband Internet user accounts’ of the subscribers.

The CBI had registered a cyber crime case against Kumar and carried out investigations on the basis of a complaint by the Press Information Bureau, Chennai, which detected the unauthorised use of broadband Internet.

The complaint also stated that the subscribers had incurred a loss of Rs 38,248 due to Kumar’s wrongful act. He used to ‘hack’ sites from Bangalore as also from Chennai and other cities, they said.

Children's privacy online

As computers and the Internet become ubiquitous children have increasingly become exposed to crimes such as pornography and stalking that make use of their private information. The newly inserted section 67B of the IT Act (2008) attempts to safeguard the privacy of children below 18 years by creating a new enhanced penalty for criminals who target children.

The section firstly penalizes anyone engaged in child pornography. Thus, any person who “publishes or transmits” any material which depicts children engaged in sexually explicit conduct, or anyone who creates, seeks, collects, stores, downloads, advertises or exchanges this material may be punished with imprisonment upto five years (seven years for repeat offenders) and with a fine of upto Rs. 10 lakh.

Secondly, this section punishes the online enticement of children into sexually explicitly acts, and the facilitation of child abuse, which are also punishable as above.

Viewed together, these provisions seek to carve out a limited domain of privacy for children from would-be sexual predators.

The section exempts from its ambit, material which is justified on the grounds of public good, including the interests of "science, literature, art, learning or other objects of general concern". Material which is kept or used for bona fide "heritage or religious purpose" is also exempt.

In addition, the newly released Draft Intermediary Due-Diligence Guidelines, 2011 [7]require ‘intermediaries’[8]to notify users not to store, update, transmit and store any information that is inter alia, “pedophilic” or “harms minors in any way”. An intermediary who obtains knowledge of such information is required to “act expeditiously to work with user or owner of such information to remove access to such information that is claimed to be infringing or to be the subject of infringing activity”. Further, the intermediary is required to inform the police about such information and preserve the records for 90 days.

Electronic Voyeurism

Although once regarded as only the stuff of spy cinema, the explosion in consumer electronics has lowered the costs and the size of cameras to such an extent that the threat of hidden cameras recording people’s intimate moments has become quite real. Responding to the growing trend of such electronic voyeurism, a new section 66E has been inserted into the IT Act which penalizes the capturing, publishing and transmission of images of the "private area" [9]of any person without their consent, "under circumstances violating the privacy" [10] of that person.

This offence is punishable with imprisonment of upto three years or with a fine of upto Rs. two lakh or both.

Phishing – or Identity Theft

The word 'phishing' is commonly used to describe the offence of electronically impersonating someone else for financial gain. This is frequently done either by using someone else’s login credentials to gain access to protected systems, or by the unauthorized application of someone else’s digital signature in the course of electronic contracts. Increasingly a new type of crime has emerged wherein sim cards of mobile phones have been ‘cloned’ enabling miscreants to make calls on others' accounts. This is also a form of identity theft.

Two sections of the amended IT Act penalize these crimes:

Section 66C makes it an offence to “fraudulently or dishonestly” make use of the electronic signature, password or other unique identification feature of any person. Similarly, section 66D makes it an offence to “cheat by personation” [11] by means of any ‘communication device’[12] or 'computer resource'.

Both offences are punishable with imprisonment of upto three years or with a fine of upto Rs. one lakh.

Mumbai Police Solves Phishing scam [13]

In 2005, a financial institute complained that they were receiving misleading emails ostensibly emanating from ICICI Bank’s email ID.

An investigation was carried out with the emails received by the customers of that financial institute and the accused were arrested. The place of offence, Vijaywada was searched for the evidence. One laptop and mobile phone used for committing the crime was seized.

The arrested accused had used open source code email application software for sending spam e-mails. He had downloaded the same software from the Internet and then used it as it is.

He used only VSNL to spam the e-mail to customers of the financial institute because VSNL email service provider does not have spam box to block the unsolicited emails.

After spamming e-mails to the institute customers he got the response from around 120 customers of which 80 are genuine and others are not correct because they do not have debit card details as required for e-banking."

The customers who received his e-mail felt that it originated from the bank. When they filled the confidential information and submitted it the said information was directed to the accused. This was possible because the dynamic link was given in the first page (home page) of the fake website. The dynamic link means when people click on the link provided in spam that time only the link will be activated. The dynamic link was coded by handling the Internet Explorer onclick () event and the information of the form will be submitted to the web server (where the fake website is hosted). Then server will send the data to the configured e-mail address and in this case the e-mail configured was to the e-mail of the accused. All the information after phishing (user name, password, transaction password, debit card number and PIN, mother’s maiden name) which he had received through the Wi-Fi Internet connectivity of Reliance.com was now available on his Acer laptop.

This crime was registered under section 66 of the IT Act, sections 419, 420, 465, 468 and 471 of the Indian Penal Code and sections 51, 63 and 65 of the Indian Copyright Act, 1957 which attract the punishment of three years imprisonment and fine upto Rs 2 lac which the accused never thought of.

Spam and Offensive Messages

Although the advent of e-mail has greatly enhanced our communications capacities, most e-mail networks today remain susceptible to attacks from spammers who bulk-email unsolicited promotional or even offensive messages to the nuisance of users. Among the more notorious of these scams is/was the so-called "section 409 scam" in which victims receive e-mails from alleged millionaires who induce them to disclose their credit information in return for a share in millions.

Section 66A of the IT Act attempts to address this situation by penalizing the sending of:

any message which is grossly offensive or has a menacing character
false information for the purpose of causing annoyance, inconvenience, danger, insult, criminal intimidation, enmity, hatred or ill-will
any electronic e-mail for the purpose of causing annoyance or inconvenience, or to deceive the addressee about the origin of such messages;

This offence is punishable with imprisonment upto three years and with a fine[14]

Hoax E-mails [15]

In 2009, a 15-year-old Bangalore teenager was arrested by the cyber crime investigation cell (CCIC) of the city crime branch for allegedly sending a hoax e-mail to a private news channel. In the e-mail, he claimed to have planted five bombs in Mumbai, challenging the police to find them before it was too late.

According to police officials, at around 1p.m. on May 25, the news channel received an e-mail that read: “I have planted five bombs in Mumbai; you have two hours to find it.” The police, who were alerted immediately, traced the Internet Protocol (IP) address to Vijay Nagar in Bangalore. The Internet service provider for the account was BSNL, said officials.

Minor Hoax Spells Major Trouble

Sixteen-year-old Rakesh Patel (name changed), a student from Ahmedabad, sent an e-mail to a private news channel on March 18, 2008, warning officials of a bomb on an Andheri-bound train. In the e-mail, he claimed to be a member of the Dawood Ibrahim gang. Three days later, the crime investigation cell (CCIC) of the city police arrested the boy under section 506 (ii) for criminal intimidation. He was charge-sheeted on November 28, 2008.
Status: Patel was given a warning by a juvenile court
A 14-year-old Colaba boy sent a hoax e-mail to a TV channel in Madhya Pradesh, three days after the July 26, 2008, Ahmedabad bomb blasts. He claimed that 29 bombs would go off in Jabalpur. He was picked up by officers of the anti-terrorism squad (ATS) who, with the help of the MP police, were able to trace the e-mail to a cyber café in Colaba.
Status: No FIR was registered. The Cuffe Parade police registered a non-cognizable (NC) complaint against him, and the boy was allowed to go home after the police gave him a “strict warning”.
Shariq Khan, 18, was arrested in Bhopal on July 26, 2006, for sending out three e-mails claiming to be a member of the terrorist organisation, which the police believed was behind the 7/11 train bombings. He was arrested by the Bhopal police. Later, the ATS brought the boy to Mumbai and also booked him for a five-year-old unsolved case where an unknown accused had sent e-mail warnings to the department of Atomic Energy (DAE) in 2001.
Status: The police filed a charge-sheet against Shariq who claimed that he had sent the e-mails for fun. Trial is pending in a juvenile court. Shariq is presently out on bail in Bhopal.
On February 26, 2006, a 17-yearold student from Jamnabai Narsee School called an Alitalia flight bound to Milan at 2 a.m. telling them there was a bomb on board. He wanted to stop his girlfriend from going abroad. She was one of the 12 students on their way to attend a mock United Nations session in Geneva.
Status: After being grilled by the police, he was arrested, but let out on bail.

Lawful Interception and monitoring of electronic communications under the IT Act

In addition to violations of privacy by criminal and the mischievous minded, electronic communications and storage are also a goldmine for governmental supervision and surveillance. This section provides a brief overview of the provisions in the IT Act which circumscribe the powers of the state to intercept electronic communications.

The newly amended IT Act completely rewrote its provisions in relation to lawful interception. The new section 69 dealing with “power to issue directions for interception or monitoring or decryption of any information through any computer resource” is much more elaborate than the one it replaced, In October 2009, the Central Government notified rules under section 69 which lay down procedures and safeguards for interception, monitoring and decryption of information (the “Interception Rules 2009”). This further thickens the legal regime in this context.

Unlawful Intercept

In August 2007, Lakshmana Kailash K., a techie from Bangalore was arrested on the suspicion of having posted insulting images of Chhatrapati Shivaji, a major historical figure in the state of Maharashtra, on the social-networking site Orkut. The police identified him based on IP address details obtained from Google and Airtel – Lakshmana’s ISP. He was brought to Pune and detained for 50 days before it was discovered that the IP address provided by Airtel was erroneous. The mistake was evidently due to the fact that while requesting information from Airtel, the police had not properly specified whether the suspect had posted the content at 1:15 p.m. or a.m.

Taking cognizance of his plight from newspaper accounts, the State Human Rights Commission subsequently ordered the company to pay Rs 2 lakh to Lakshmana as damages [16].

The incident highlights how minor privacy violations by ISPs and intermediaries could have impacts that gravely undermine other basic human rights [17].

In addition to section 69, the Government has been empowered under the newly inserted section 69B to "monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource".

"Traffic data" has been defined in the section to mean “any data identifying or purporting to identify any person, computer system or computer network or any location to or from which communication is or may be transmitted.” Rules have been issued by the Central Government under this section (the “Monitoring and Collecting Traffic Data Rules, 2009”) which are similar, although with important distinctions, to the rules issued under section 69.

Thus, there are two parallel interception and monitoring regimes in place under the Information Technology Act. In the paragraphs that follow, we provide an overview of the regime of surveillance under section 69 — since they are more targeted towards the individual, and consequently the threats to privacy are more severe — while highlighting important differences in the rules drafted under section 69.

Who may lawfully intercept?

Section 69 empowers the “Central Government or a state government or any of its officers specially authorised by the Central Government or the state government, as the case may be” to exercise powers of interception under this section.

Under the Interception Rules 2009, the secretary in the Ministry of Home Affairs has been designated as the "competent authority", with respect to the Central Government, to issue directions pertaining to interception, monitoring and decryption. Similarly, the respective state secretaries in charge of Home Departments of the various states and union territories are designated as "competent authorities" to issue directions with respect to the state government [18].

	Central Government	State/Union Territory
Ordinary Circumstances	Secretary in the Ministry of Home Affairs	Secretary in charge of Home Departments of State
Emergency	Head or second senior most officer of security and law enforcement	Authorized officer not below the rank of Inspectors General of Police

However, an exception is made in cases of emergency, either

in remote areas where obtaining prior directions from the competent authority is not feasible or

for ‘operational reasons’ where obtaining prior directions is not feasible.

In such cases it would be permissible to carry out interception after obtaining the orders of the Head or second senior most officer of security and law enforcement at the central level, and an authorized officer not below the rank of Inspector General of Police at the state or union territory level. The order must be communicated to the competent authority within three days of its issue, and approval must be obtained from the authority within seven working days, failing which the order would lapse.

Where a state/union territory wishes to intercept/monitor or decrypt information beyond its territory, the competent authority for that state must make a request to the competent authority of the Central Government to issue appropriate directions.

Under what circumstances a direction to intercept may be issued?

Purposes for which interception may be directed

Under section 69, the powers of interception may be exercised by the authorized officers “when they are satisfied that it is necessary or expedient” to do so in the interest of:

sovereignty or integrity of India,

defense of India,

security of the state,

friendly relations with foreign states or

public order or

preventing incitement to the commission of any cognizable offence relating to above or

for investigation of any offence.

Under section 69B, the competent authority may issue directions for monitoring for a range of “cyber security”[20] purposes including, inter alia, “identifying or tracking of any person who has breached, or is suspected of having breached or being likely to breach cyber security”.

Contents of direction

The reasons for ordering interception must be recorded in writing [21].

In the case of a direction under section 69, in arriving at its decision, the competent authority must consider alternate means of acquiring the information other than issuing a direction for interception [22]. The direction must relate to information sent or likely to be sent from one or more particular computer resources to another (or many) computer resources [23]. The direction must specify the name and designation of the officer to whom information obtained is to be disclosed, and also specify the uses for which the information is to be employed [24].

Duration of interception and periodic review

Once issued, an interception direction issued under section 69 remains in force for a period of 60 days (unless withdrawn earlier), and may be renewed for a total period not exceeding 180 days [25]. A direction issued under section 69B does not expire automatically through the lapse of time and theoretically would continue until withdrawn.

Within seven days of its issue, a copy of a direction issued under either section 69 or section 69B must be forwarded to the review committee constituted to oversee wiretapping under the Indian Telegraph Act [26]. Every two months, the review committee is required to meet and record its findings as to whether the direction was validly issued in light of section 69(3) [27]. If the review committee is of the opinion that it was not, it can set aside the direction and order destruction of all information collected [28].

What powers of interception do they have?

The competent authority may, in his written direction “direct any agency of the appropriate government to intercept monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource”[29].

Accordingly, the subscriber or intermediary or any person in charge of the computer resource is must, if required by the designated government agency, extend all facilities, equipment and technical assistance to:

provide access to or secure access to the computer resource generating, transmitting, receiving or storing such information; or

intercept, monitor, or decrypt[30] the information, as the case may be; or

provide information stored in computer resource.

The intermediary must maintain records mentioning the intercepted information, the particulars of the person, e-mail account, computer resource, etc., that was intercepted, the particulars of the authority to whom the information was disclosed, number of copies of the information that were made, the date of their destruction, etc. [31]. This list of requisitions received must be forwarded to the government agency once every 15 days to ensure their authenticity [32].

In addition, a responsibility is cast on the intermediary to put in place adequate internal checks to ensure that unauthorized interception does not take place, and extreme secrecy of intercepted information is maintained [33].

How long can information collected during interception be retained?

Interception rules require all records, including electronic records pertaining to interception to be destroyed by the government agency “in every six months except in cases where such information is required or likely to be required for functional purposes”. In the case of the Monitoring and Collecting of Traffic Data Rules 2009, this period is nine months from the date of creation of record.

In addition, all records pertaining to directions for interception and monitoring are to be destroyed by the intermediary within a period of two months following discontinuance of interception or monitoring, unless they are required for any ongoing investigation or legal proceedings. In the case of Monitoring Rules, this period is six months from the date of discontinuance.

What penalties accrue to intermediaries and subscribers for resisting interception?

Section 69 stipulates a penalty of imprisonment upto a term of seven years and fine for any “subscriber or intermediary or any person who fails to assist the agency” empowered to intercept.

Data Protection under the IT Act

Data Retention Requirements of 'Intermediaries'

Section 67C of the amended IT Act mandates ‘intermediaries’[34] to maintain and preserve certain information under their control for durations which are to be specified by law.

Any intermediary who fails to retain such electronic records may be punished with imprisonment up to three years and a fine.

Liability for body-corporates under section 43A

The newly inserted section 43A makes a start at introducing a mandatory data protection regime in Indian law. The section obliges corporate bodies who ‘possess, deal or handle’ any ‘sensitive personal data’ to implement and maintain ‘reasonable’ security practices, failing which they would be liable to compensate those affected by any negligence attributable to this failure.

It is only the narrowly-defined ‘body corporates’ [35] engaged in ‘commercial or professional activities’ who are the targets of this section. Thus government agencies and non-profit organisations are entirely excluded from the ambit of this section [36].

“Sensitive personal data or information” is any information that the Central Government may designate as such, when it sees fit to.

The “reasonable security practices” which the section obliges body corporates to observe are restricted to such measures as may be specified either “in an agreement between the parties” or in any law in force or as prescribed by the Central Government.

By defining both “sensitive personal data” and “reasonable security practice” in terms that require executive elaboration, the section in effect pre-empts the courts from evolving an iterative, contextual definition of these terms.

Mphasis BPO Fraud: 2005 [37]

In December 2004, four call centre employees, working at an outsourcing facility operated by MphasiS in India, obtained PIN codes from four customers of MphasiS’ client, Citi Group. These employees were not authorized to obtain the PINs.

In association with others, the call centre employees opened new accounts at Indian banks using false identities. Within two months, they used the PINs and account information gleaned during their employment at MphasiS to transfer money from the bank accounts of CitiGroup customers to the new accounts at Indian banks.

By April 2005, the Indian police had tipped off to the scam by a U.S. bank, and quickly identified the individuals involved in the scam. Arrests were made when those individuals attempted to withdraw cash from the falsified accounts, $426,000 was stolen; the amount recovered was $230,000.

Draft Reasonable Security Practices Rules 2011 [38]

In February 2011, the Ministry of Information and Technology, published draft rules under section 43A in order to define “sensitive personal information” and to prescribe “reasonable security practices” that body corporates must observe in relation to the information they hold.

Sensitive Personal Information
Rule 3 of these Draft Rules designates the following types of information as ‘sensitive personal information’:

password;

user details as provided at the time of registration or thereafter;

information related to financial information such as Bank account / credit card / debit card / other payment instrument details of the users;

physiological and mental health condition;

medical records and history;(vi) Biometric information;

information received by body corporate for processing, stored or processed under lawful contract or otherwise;

call data records;

This however, does not apply to “any information that is freely available or accessible in public domain or accessible under the Right to Information Act, 2005”.

They and “any person” holding sensitive personal information are forbidden from “keeping that information for longer than is required for the purposes for which the information may lawfully be used”[40]

Mandatory Privacy Policies for body corporates

Rule 4 of the draft rules enjoins a body corporate or its representative who “collects, receives, possess, stores, deals or handles” data to provide a privacy policy “for handling of or dealing in user information including sensitive personal information”. This policy is to be made available for view by such “providers of information” [41]. The policy must provide details of:

Type of personal or sensitive information collected under sub-rule (ii) of rule 3;
Purpose, means and modes of usage of such information;
Disclosure of information as provided in rule 6 [42].

Prior Consent and Use Limitation during Data Collection

In addition to the restrictions on collecting sensitive personal information, body corporate must obtain prior consent from the “provider of information” regarding “purpose, means and modes of use of the information”. The body corporate is required to “take such steps as are, in the circumstances, reasonable”[43] to ensure that the individual from whom data is collected is aware of :

the fact that the information is being collected; and
the purpose for which the information is being collected; and
the intended recipients of the information; and
the name and address of :
the agency that is collecting the information; and
the agency that will hold the information.

During data collection, body corporates are required to give individuals the option to opt-in or opt-out from data collection [44]. They must also permit individuals to review and modify the information they provide "wherever necessary" [45]. Information collected is to be kept securely [46], used only for the stated purpose [47] and any grievances must be addressed by the body corporate “in a time bound manner” [48].

Unlike "sensitive personal information" there is no obligation to retain information only for as long as is it is required for the purpose collected.

Limitations on Disclosure of Information

The draft rules require a body corporate to obtain prior permission from the provider of such information obtained either “under lawful contract or otherwise” before information is disclosed [49]. The body corporate or any person on its behalf shall not publish the sensitive personal information [50]. Any third party receiving this information is prohibited from disclosing it further [51]. However, a proviso to this sub-rule mandates information to be provided to ‘government agencies’ for the purposes of “verification of identity, or for prevention, detection, investigation, prosecution, and punishment of offences”. In such cases, the government agency is required to send a written request to the body corporate possessing the sensitive information, stating clearly the purpose of seeking such information. The government agency is also required to “state that the information thus obtained will not be published or shared with any other person” [52].

Sub-rule (2) of rule 6 requires “any information” to be “disclosed to any third party by an order under the law for the time being in force.” This is to be done “without prejudice” to the obligations of the body corporate to obtain prior permission from the providers of information [53].

Reasonable Security Practices

Rule 7 of the draft rules stipulates that a body corporate shall be deemed to have complied with reasonable security practices if it has implemented security practices and standards which require:

a comprehensive documented information security program; and

information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected.

In case of an information security breach, such body corporate will be “required to demonstrate, as and when called upon to do so by the agency mandated under the law, that they have implemented security control measures as per their documented information security program and information security policies”.

The rule stipulates that by adopting the International Standard IS/ISO/IEC 27001 on “Information Technology – Security Techniques – Information Security Management System – Requirements”, a body corporate will be deemed to have complied with reasonable security practices and procedures.

The rule also permits “industry associations or industry clusters” who are following standards other than IS/ISO/IEC 27001 but which nevertheless correspond to the requirements of sub-rule 7(1), to obtain approval for these codes from the government. Once this approval has been sought and obtained, the observance of these standards by a body corporate would deem them to have complied with the reasonable security practice requirements of section 43A.

Penalties and Remedies for breach of Data Protection

Civil Liability for Corporates

As mentioned above, any body corporates who fail to observe data protection norms may be liable to pay compensation if:

it is negligent in implementing and maintaining reasonable security practices, and thereby

causes wrongful loss or wrongful gain to any person;[54]

Claims for compensation are to be made to the adjudicating officer appointed under section 46 of the IT Act. Further, details of the powers and functions of this officer are given in succeeding sections of this note.

Criminal liability for disclosure of information obtained in the course of exercising powers under the IT Act

Section 72 of the Information Technology Act imposes a penalty on “any person” who, having secured access to any electronic record, correspondence, information, document or other material using powers conferred by the Act or rules, discloses such information without the consent of the person concerned. Such unauthorized disclosure is punishable “with imprisonment for a term which may extend to two years, or with fine which may extend to one lakh rupees, or with both.”

Criminal Liability for unauthorized disclosure of information by any person of information obtained under contract

Section 72A of the IT Act imposes a penalty on any person [55] (including an intermediary) who

has obtained personal information while providing services under a lawful contract and

discloses the personal information without consent of the person,

with the intent to cause, or knowing it is likely to cause wrongful gain or wrongful loss [56]

Such unauthorised disclosure to a third person is punishable with imprisonment upto three years or with fine upto Rs five lakh, or both.

Whom to call? Adjudicatory Mechanism and Remedies under the IT Act

This section provides a brief outline of the mechanism installed by the IT Act to activate the various remedies and penalties prescribed in various sections of the Act. As a victim of online intrusion, how does one use the IT Act to seek redressal?

As mentioned above, the IT Act provides for both the civil remedy of damages in compensation (Chapter IX) as well as criminal penalties for offences such as imprisonment and fine (Chapter XI). In general, claiming a civil remedy does not bar one from seeking criminal prosecution and ideally both should be pursued together. For clarity, in the sections that follow, we will be discussing the two procedures separately.

Civil Damages and Compensation

Whom to approach?

Section 46 of the IT Act empowers the Central Government to appoint “adjudication officers” to adjudicate whether any person has committed any of the contraventions described in Chapter IX of the Act (See section 2.1 and 4.2 above) and to determine the quantum of compensation payable. Accordingly, the Central Government has designated the secretaries of the Department of Information Technology of each of the states or union territories as the “adjudicating officer” with respect to each of their territories [57].

However, a pecuniary limit has been placed on the powers of adjudicating officers, and they may only adjudicate cases where the quantum of compensation claimed does not exceed Rs. five crores. In cases where the compensation claimed exceeds this amount, jurisdiction would vest in the “competent court”, under the Code of Civil Procedure [58].

Section 61 of the Act bars ordinary civil courts from jurisdiction over matters which the adjudicating officers have been empowered to decide under this Act.

When must a complaint be filed?

The Limitation Act provides that a suit must be filed within three years from when the right to sue accrues [59].

What is the procedure?

Section 46 and the rules framed under that section provide elaborate guidelines on the procedure that is to be followed by the adjudicating officer. Thus, the adjudicating officer is required to give the accused person “a reasonable opportunity for making representation in the matter”. Thereafter, if , on an inquiry, “he is satisfied that the person has committed the contravention, he may impose such penalty or award such compensation as he thinks fit in accordance with the provisions of that section.”

In order to carry out their duties adjudicating officer have been invested with the powers of a civil court which are conferred on the cyber appellate tribunal [60]. Additionally, they have the power to punish for their contempt undert the Code of Criminal Procedure.

Rules framed under the section provide further details on the procedure that must be followed and provide for the issuance of a “show cause notice”, manner of holding enquiry, compounding of offences, etc. [61].

Section 47 provides that in adjudging the quantum of compensation, the adjudicating officer shall have due regard to the following factors, namely:—

the amount of gain of unfair advantage, wherever quantifiable, made as a result of the default;

the amount of loss caused to any person as a result of the default;

the repetitive nature of the default.

Where must a complaint be filed and in what format?

The complaint must be made to the adjudicating officer of the state or union territory on the basis of location of computer system, computer network. The complaint must be made on a plain paper in the format provided in the Performa attached to the rules [62].

In case the offender or computer resource is located abroad, it would be deemed, for the purpose of prosecution to be located in India [63].

How long does the process take?

The Rules direct that the whole matter should be heard and decided “as far as possible” within a period of six months [64].

How much does it cost?

The Rules stipulates a variable fee payable by a bank draft calculated on the basis of damages claimed by way of compensation

a) Upto Rs. 10,000	10% ad valorem rounded off to nearest next hundred
b) From 10001 to Rs.50000	Rs. 1000 plus 5% of the amount exceeding Rs.10,000 rounded off to nearest next hundred
c) From Rs.50001 to Rs.100000	Rs. 3000/- plus 4% of the amount exceeding Rs. 50,000 rounded off to nearest next hundred
d) More than Rs. 100000	Rs.5000/- plus 2% of the amount exceeding Rs. 100,000 rounded off to nearest next hundred

Appeals to the Cyber Appellate Tribunal and the High Court

The Act provides for the constitution of a cyber appellate tribunal to hear appeals from cases decided by the adjudicating officer.

Within 25 days of the copy of the decision being made available by the adjudicating officer, the aggrieved party may file an appeal before the cyber appellate tribunal.

Section 57 provides that the appeal filed before the cyber appellate tribunal shall be dealt with by it as expeditiously as possible and endeavor shall be made by it to dispose of the appeal finally within six months from the date of receipt of the appeal. Section 62 gives the right of appeal to a high court to any person aggrieved by any decision or order of the cyber appellate tribunal on any question of fact or law arising out of such order. Such an appeal must be filed within 60 days from the date of communication of the decision or order of the cyber appellate tribunal.

Can contraventions be compounded (compromised) with the offender?

Except in the case of repeat offenders, contraventions may be compromised by the adjudicating officer or between the parties either before or after institution of the suit. Where any contravention has been compounded the IT Act provides that “no proceeding or further proceeding, as the case may be, shall be taken against the person guilty of such contravention in respect of the contravention so compounded”[65].

Criminal Penalties

The process described above applies to “contraventions” under Chapter IX of the Act. In addition to being liable to pay compensation, in the cases falling under section 43, such offenders may also be liable for criminal penalties such as imprisonment and fines [66]. This sub-section of this paper deals with the procedure to be followed with respect to the criminal offences set out under Chapter XI of the Act (for example, see sections 2.2 to 2.5 above).

Whom to approach? Who can take cognizance of offences and investigate them?

Section 78 of the IT Act empowers police officers of the rank of Inspectors and above to investigate offences under the IT Act.

Many states have set up dedicated cyber crime police stations to investigate offences under this Act [67]. Thus, for example, the State of Karnataka has set up a special cyber crime police station responsible for investigating all offences under the IT Act with respect to the entire territory of Karnataka [68].

When must a complaint be lodged?

Although there is no time limit prescribed by the IT Act or the Code of Criminal Procedure with respect to when an FIR must be filed, in general, courts tend to take an adverse view when a significant delay has occurred between the time of occurrence of an offence and it’s reporting to the nearest police station.

The Code of Criminal Procedure forbids courts from taking cognizance of cases after three years “if the offence is punishable with imprisonment for a term exceeding one year but not exceeding three years”. Where either the commission of the offence was not known to the person aggrieved, or where it is not known by whom the offence committed, this period is computed from the date on which respectively the offence or the identity of the offender comes to the knowledge of the person aggrieved [69].

What is the procedure?

No special procedure is prescribed for the trial of cyber offences and hence the general provisions of criminal procedure would apply with respect to investigation, charge sheet, trial, decision, sentencing and appeal.

Can offences be compounded?

Offences punishable with imprisonment of upto three years are compoundable by a competent court. However, repeat offenders cannot have their subsequent offences compounded. Additionally, offences which “affect the socio-economic conditions of the country” or those committed against a child under 18 years of age or against women cannot be compounded [70].

Bibliography

[1].The IT Act is only one of the various laws which safeguard citizens from violations of online privacy. In addition, in the domain of finance, for instance, various RBI regulations mandate strong security protocols with respect to data held by financial institutions. Since this is the subject of a different dispatch on banking and privacy which we have brought out, these regulations are omitted from this discussion.

[2].Section 2(k) of the IT Act defines ‘computer’ as any electronic magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic, and memory functions by manipulations of electronic, magnetic or optical impulses, and includes all input, output, processing, storage, computer software, or communication facilities which are connected or related to the computer in a computer system or computer network.

[3].Section 43 defines "computer contaminant" as any set of computer instructions that are designed— (a) to modify, destroy, record, transmit data or program residing within a computer, computer system or computer network; or (b) by any means to usurp the normal operation of the computer, computer system, or computer network;

[6].Section 66 of the IT Act. Anon, 2009. Bangalore techie convicted for hacking govt site. Deccan Herald. Available at: http://goo.gl/jCvAh. [Accessed March 29, 2011];

[7].The Information Technology (Due Diligence observed by Intermediaries Guidelines) Rules, 2011;

[8].‘Intermediary’ has been defined very expansively under section 2(w) of the Act to mean, with respect to any electronic record, “any person who on behalf of another person receives, stores or transmits that record, or provides any service with respect to that record and includes telecom service providers, network service providers, Internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes

[9].‘Private area’ has been defined in section 66E as “the naked or undergarment clad genitals, pubic area, buttocks or female breast”.

[10].Defined as “circumstances in which a person can have a reasonable expectation that (i) he or she could disrobe in privacy, without being concerned that an image of his or her private area was being captured or (ii) any part of his or her private area would not be visible to the public regardless of whether that person is in a public or private place”. See explanation to Section 66E

[11]."Cheating by personation" is a crime defined under section 416 the Indian Penal Code. According to that section, “a person is said to "cheat by personation" if he cheats by pretending to be some other person, or by knowingly substituting one person for another, or representing that he or any other person is a person other than he or such other person really is." The explanation to the section adds that "the offence is committed whether the individual personated is a real or imaginary person". Two illustrations to the section further elaborate its meaning: (a) A cheats by pretending to be a certain rich banker of the same name. A cheats by personation (b) A cheats by pretending to be B, a person who is deceased. A cheats by personation.

[12].Communication device" has been defined to mean "cell phones, personal digital assistance (sic) or combination of both or any other device used to communicate send or transmit any text, video, audio or image".

[13].2005. Cyber Crime Cell, Mumbai: Case of Phishing. Mumbai Police. Available at: http://www.cybercellmumbai.com/case-studies/case-of-fishing [Accessed March 23, 2011].

[14]. Although no maximum limit is prescribed for the fine under this section, Section 63 of the Indian Penal Code declares that “Where no sum is expressed to which a fine may extend, the amount of fine to which the offender is liable is unlimited, but shall not be excessive”.

[15].Hafeez, M., 2009. Crime Line: Curiosity was his main motive, say city police. Crime Line. Available at: http://mateenhafeez.blogspot.com/2009/05/curiosity-was-his-main-motive-say-city.html [Accessed March 23, 2011].

[16]. Holla, A., 2009. Wronged, techie gets justice 2 yrs after being jailed. Mumbai Mirror. Available at: http://www.mumbaimirror.com/index.aspx?page=article&sectid=2&contentid=200906252009062503144578681037483 [Accessed March 23, 2011].

[18]. By contrast, rules framed under Section 69B designates only the Secretary to the Government of India in the Department of Information Technology under the Ministry of Communications and IT as the “competent authority” to issue orders of interception.

[19].It is unclear what these “operational reasons” could mean. The text of the rules provide no useful guidance.

[20].“Cyber security breach” is defined as meaning “any real or suspected adverse event in relation to cyber security that violates an explicitly or implicitly acceptable security policy resulting in unauthorized access, denial of service, disruption, unauthorized use of a computer resource for processing or storage of information or changes to date, information without authorization”. Rule 2(f) of the Monitoring and Collecting of Traffic Data Rules 2009.

[21].Rule 7 of the Interception Rules 2009; Rule 3(3) of the Monitoring and Collecting of Traffic Data Rules 2009

[22].Rule 8 of the Interception Rules 2009

[23]. Rule 9 of the Interception Rules 2009

[24].Rule 10 of the Interception Rules 2009;

[25].Rule 11 of the Interception Rules 2009

[26].Rule 7 of the Interception Rules 2009

[27].Rule 22 of the Interception Rules 2009

[28]. Ibid

[29].Section 69 of the IT Act.

[30].The intermediary is required to assist in the decryption only to the extent that the intermediary has control over the decryption key. See Sub-Rule 13(3) of the Interception Rules 2009. Rule 17 enjoins the holder of a decryption key to provide decryption assistance when directed to by the competent authority.

[31].Rule 16 of the Interception Rules 2009

[32].Rule 18 of the Interception Rules 2009

[33]. Rule 20 of the Interception Rules 2009; Rules 10 & 11 of the Monitoring and Collecting of Traffic Data Rules 2009. Failure to maintain secrecy of data may attract punishment under Section 72 of the Information Technology Act.

[34].Supra n. 6 for definition

[35].Section 43A defines "'body corporate" as any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;

[36].This does not necessarily mean that these entitles are exempt from taking reasonable care to safeguard information that they collect, maintain or control – only that remedies against the government must be sought under general common law, rather than under the IT Act.

[37].Anon, 2005. The MphasiS Scandal – And How it Concerns U.S. Companies Considering Offshore BPO. Carretek. Available at: http://www.carretek.com/main/news/articles/MphasiS_scandal.htm [Accessed March 29, 2011]. See also Anon, 2005. MphasiS case: BPOs feel need to tighten security. Indian Express. Available at: http://www.expressindia.com/news/fullstory.php?newsid=44856 [Accessed March 29, 2011].

[38]. The Information Technology (Reasonable security practices and procedures and sensitive personal information) Rules, 2011. Available at http://www.mit.gov.in/sites/upload_files/dit/files/senstivepersonainfo07_02_11.pdf, last accessed February 15th, 2011.

[39].Rule 5 of the Draft Rules.

[40]. This is perhaps a bit vague, since the potential ‘lawful uses’ are numerous and could be inexhaustible. It is unclear whether “lawful usage” is coterminous with “the uses which are disclosed to the individual at the time of collection”. In addition, this rule is framed rather weakly since it does not impose a positive obligation (although this is implied) to destroy information that is no longer required or in use.

[41].“Provider of data” is not the same as individuals to whom the data pertains, and could possibly include intermediaries who have custody over the data. We feel this privacy policy should be made available for view generally – and not only to providers of information. In addition, it might be advisable to mandate registration of privacy policies with designated data controllers.

[42]. This is well framed since it does not permit body corporates to frame privacy policies that detract from Rule 6.

[43].One wonders about the convoluted language used here when a simpler phrase like “take reasonable steps” alone might have sufficed - reasonableness has generally been interpreted by courts contextually. As the Supreme Court has remarked, “`Reasonable’ means prima facie in law reasonable in regard to those circumstances of which the actor, called upon to act reasonably, knows or ought to know. See Gujarat Water Supply and Sewage Board v. Unique Erectors (Guj) AIR 1989 SC 973.

[44].Sub-Rule 5(7).

[45].Sub-Rule 5(6). It is unclear what would count as a ‘necessary’ circumstance and who would be the authority to determine such necessity.

[46].Sub-Rule 5(8).

[47].Sub-Rule 5(5).

[48].Sub-Rule 5(9).

[49]. Sub-Rule 6(1) There are two problems with this rule. First, it requires prior permission only from the provider of information, and not the individual to whom the data pertains. In effect this whittles down the agency of the individual in being able to control the manner in which information pertaining to her is used. Second, it is not clear whether this information includes “sensitive personal information”. The proviso to this rule includes the phrase “sensitive information”, which would suggest that such information would be included. This makes it even more important that the rule require that prior permission be obtained from the individual to whom the data pertains and not merely from the provider of information.

[50].Sub-Rule 6(3).

[51].Sub-Rule 6(4).

[52].This is a curious insertion since it begs the question as to the utility of such a statement issued by the requesting agency. What are the sanctions under the IT Act that may be attached to a government agencies that betrays this statement? Why not instead, insert a peremptory prohibition on government agencies from disclosing such information (with the exception, perhaps, of securing conviction of offenders)?

[53].This sub-rule does not distinguish between orders issued by a court and those issued by an administrative/quasi-judicial body.

[54]. “Wrongful loss” and “wrongful gain” have been defined by Section 23 of the Indian Penal Code. Accordingly, "Wrongful gain" is gain by unlawful means of property which the person gaining is not legally entitled. "Wrongful loss"- "Wrongful loss" is the loss by unlawful means of property to which the person losing it is legally entitled.” The section also includes this interesting explanation “Gaining wrongfully, losing wrongfully- A person is said to gain wrongfully when such person retains wrongfully, as well as when such person acquires wrongfully. A person is said to lose wrongfully when such person is wrongfully kept out of any property as well as when such person is wrongfully deprived of property”. Following this, it could be possible to argue that the retention of data beyond the period of its use would amount to a “wrongful gain”.

[55]. Section 3(39) of the General Clauses Act defines a person to include “any company or association or body of individuals whether incorporated or not”. An interesting question here would be whether the State can be considered “a person” so that it can be held liable for unauthorized disclosure of personal information. In an early case of Shiv Prasad v. Punjab State AIR 1957 Punj 150, the Punjab High Court had excluded this possibility. However, the case law on this point has not been consistent. In Ramanlal Maheshwari v.Municipal Committee, the MP High Court held that the Municipal Council could be treated as a ‘person’ for the purpose of levying a fine attached to a criminal offence. Statutory corporate bodies (such as the proposed UID Authority of India) have been held to be ‘persons’ for purposes of law . See Commissioners, Port of Calcutta v. General Trading Corporation, AIR 1964 Cal 290. Here under the Calcutta Port Act, Port Commissioners were declared to be a “body corporate”, and hence were held to be a ‘person’.

[56].See supra n. 44.

[57]. See G.S.R.240(E) New Delhi, the 25th March, 2003 available at < http://www.mit.gov.in/content/it-act-notification-no-240> .

[58].See Section 46(1A).

[59].Schedule I, Part X of the Limitation Act “Suits for which there is no prescribed period.”

[60].The powers of the Cyber Appellate Tribunal under Section 58 include the powers of (a) summoning and enforcing the attendance of any person and examining him on oath; (b) requiring the discovery and production of documents or other electronic records; (c) receiving evidence on affidavits; (d) issuing commissions for the examination of witnesses or documents; (e) reviewing its decisions; (f) dismissing an application for default or deciding it ex parte.

[61].Information Technology (Qualification and Experience of Adjudicating Officers and Manner of holding Enquiry) Rules, 2003 [GSR 220(E)] Available at <http://cca.gov.in/rw/resource/notification-gsr220e.pdf?download=true>.

[62]. Ibid Rule 4(b).

[63]. Section 75.

[64]. Ibid, Rule 4(k).

[65]. Section 63 of the Act.

[66].Prior to amendment in 2008, contraventions listed in Section 43 were only liable to be compensated by damages through civil proceedings. Thus in 2007, the Madras High Court annulled an FIR lodged in a police station which listed an activity mentioned in 43(g). See S. Sekar vs The Principal General Manager < http://indiankanoon.org/doc/182565/> This position has however been changed with the new Section 66 which makes all actions listed in Section 43 an offence when committed with dishonest or fraudulent intent. Thus an FIR can be lodged with respect to these activities as well.

[67].An incomplete list of cyber crime cells of police in different states can be viewed at <http://infosecawareness.in/cyber-crime-cells-in-india>.

[68]. Home and Transport3 Secretariat, Notification no. HD 173 POP 99 Bangalore, Dated 13th September 2001 Available at < http://cyberpolicebangalore.nic.in/pdf/notification_1.pdf>.

[69]. Sections 468 and 469 of the Code of Criminal Procedure, 1973.

[70]. Section 77A of the Information Technology Act.

Click below to download files of your choice:

PDF [347 kb]
Open Office [51 kb]
Word File [55 kb]

For more details visit https://cis-india.org/internet-governance/blog/privacy/safeguards-for-electronic-privacy

Consumer Privacy in e-Commerce

sahana — 2012-03-28T04:53:17Z

Looking at the larger picture of national security versus consumer privacy, Sahana Sarkar says that though consumer privacy is important in the world of digital technology, individuals must put aside some of their civil liberties when it comes to the question of national security, as it is necessary to prevent societal damage.

What is Consumer Privacy?

In today’s digital economy generating consumer information is inevitable. Though some companies use the personal information they obtain to improve and provide more services to consumers, many companies use the information in an irresponsible manner.

In countries that do provide legal protection for consumer privacy, it is never protected as an absolute right. Consumer privacy is not considered an absolute right for three reasons:

What constitutes consumer privacy is culturally, contextually, individually defined
Consumer privacy often conflicts with other market rights
The ownership of a consumer's private information is debated — as consumer's believe they own the information and businesses believe they own the information.

In order to understand consumer privacy it is useful to outline the privacy expectations and strategies of both consumers and businesses, and to also examine the protection measures taken by firms to safeguard consumer information. The major privacy concerns held by consumer's can be broken down into three main domains:

Consumers want to be informed about the type of information that is being collected from them.
Consumers need to know that they a certain degree of control over the personal information that is being collected.
Consumers need to be assured that their personal information will be secure and will not be abused or stolen.

Though privacy has been defined by many as the "right to be let alone", its application in today’s modern world is not that straightforward. We live in a world where our purchasing behavior, both online and offline, is shared and used invisibly. For instance, if an individual uses a social networking site, it is possible for a third party application to access personal information that is shared. Similarly, if an individual uses a warranty card or loyalty card during a purchase, it is possible for third parties, like data brokers, to collect and use the individuals' personal information.

For instance,15 consumer privacy groups have filed a complaint against Facebook for limiting user's ability to browse anonymously. The complaint was regarding the fact that users only had the choice to designate personal information as publicly linkable, or to not provide information at all. Though Facebook claims to ensure users control over their personal data by allowing users to choose their privacy settings, it does not clarify that these setting can change at any given point. Moreover, the latest privacy embarrassment that hit Facebook proves again that Facebook does not protect users’ privacy. A few weeks ago Facebook admitted to passing personal information of its users onto different gaming applications. These gaming applications have in turn passed the information on to advertisers who otherwise could not have accessed the information.[1]

Breach of Privacy in Information Collection

Internet users often fear the loss of personal privacy, because of the ability businesses and their websites have to collect, store, and process personal data. For example, sites extract information from consumers through a form, and then record data about their user’s browsing habit. After collecting user information, the sites match the data with their personal and demographic information to create a profile of the user’s preferences, which is then used to promote targeted advertisements or provide customized services. The sites might also engage in web lining through which they price a consumer according to their profiles.

Online there are two main ways in which sites collect user information:

Sites collect information directly through a server software. Sites often use automatic software logs to do this.
A third party extracts information from the site without the consumer’s knowledge. Sites often place cookies on websites to extract user information.

Automatic software logs and third party cookie placement are two overlooked aspect of information collection. Cookies work by collecting personal information while a user surfs the net, and then feeds the information back to a Web server. Cookies are either used to remember the user, or are used by network advertising agencies to target product advertisements based on long term profiles of user’s buying and surfing habits. An example of a website that uses cookies is 'double click'. Web bugs are used by advertising networks to add information to the personal profiles stored in cookies. Web bugs are also used in junk email campaigns to see how many visits the site gets. Cookies and web bugs are just two out of hundreds of technologies used to collect personal information. [2]

Challenges Posed by Protection of Consumer Privacy

In conclusion, I would like to talk about the difficulty in maintaining a balance between the legal collections of information and protecting privacy of consumers. Above I demonstrated how this conflict arises between businesses and consumers — and is rooted in businesses wanting personal information for commercial reasons, and a user wanting protection and control over their own information. This conflict can also arise between consumers, businesses, and political bodies. An example that demonstrates this is the ongoing conflict between RIM (Research in Motion) and the Government of India. The Government of India has issued a warning against RIM saying that it would suspend its blackberry operations if they do not adhere to the Indian laws and regulations.

The Ministry of Home Affairs is demanding that RIM allow access to encrypted content that flows in and out of India. In other words the Government of India wants RIM to allow the security forces to have access to data sent using Blackberries by reducing encryption levels, or by providing the government with the decryption keys. The demand by the government is somewhat ironic as Blackberry manufacturers have developed the Blackberry encryption key to protect the consumers’ privacy during any business deal, so that information is not compromised. On the other side of the debate, the government is demanding access to Blackberry communications, because their inability to decrypt the codes makes countering the threats to national security difficult. This is especially true for a country like India, which is constantly facing threats from Maoists, and extremist Islamic groups.

This example highlights an important question: what is more important — national security or consumer privacy? In 2010, RIM agreed to negotiate access to consumer messages only where access requests are within local laws. Blackberry also agreed to not make any specific deals with consumers, and to make its enterprise systems security and confidentiality non-negotiable.

Conclusion

Though, consumer privacy is very important especially in a world of digital technology, however, when we speak of national security, I feel that individuals must set aside some of their civil liberties — at least to the extent that it is necessary to prevent societal damage. For a clearer understanding of national security vs consumer privacy look at the case of RIM Vs Indian Government in the following sites:

[1]http://www.ft.com/cms/s/0/198599e6-dc5f-11df-a0b9-00144feabdc0.html#axzz1O00LowtN

[2]http://cyber.law.harvard.edu/olds/ecommerce/privacytext.htmlFor an overview of some of these new data-collection technologies, along with some information on privacy-enhancing technologies such as P3P, see Developing Technologies.

For more details visit https://cis-india.org/internet-governance/blog/privacy/consumer-privacy-e-commerce

Copyright Enforcement and Privacy in India

Prashant Iyengar — 2012-12-14T10:27:12Z

Copyright can function contradictorily, as both the vehicle for the preservation of privacy as well as its abuse, writes Prashant Iyengar. The research examines the various ways in which privacy has been implicated in the shifting terrain of copyright enforcement in India and concludes by examining the notion of the private that emerges from a tapestry view of the relevant sections of Copyright Act.

Introduction

Copyright can function contradictorily, as both the vehicle for the preservation of privacy as well as its abuse. This paper examines the various ways in which privacy has been implicated in the shifting terrain of copyright enforcement in India. Chiefly, there are three kinds of situations that we will be discussing here: The first is straightforward and deals with the physical privacy intrusion caused by the execution of search and seizure orders during the investigation of infringement. The second situation involves the violation of privacy through the misappropriation of confidential information. The last situation involves the wrongful appropriation of a person’s persona or their ‘publicity’ – the photographs of celebrities, for instance – for private gain. Instances of each of these situations, and the manner in which the courts have negotiated the privacy claims that have arisen are described in the sections that follow. In addition, Copyright law, dealing as it does mainly with offences of the nature of unauthorised publicity/publication putatively inscribes certain spaces and activities as either public or private. The concluding section of this paper examines the notion of the private that emerges from a tapestry view of various sections of the Copyright Act.

Copyright Enforcement

Context setting

Over the past several decades there has been an increasing awareness globally – and within India – of the importance of 'knowledge societies' which, in contrast to earlier industrial or agrarian societies, leverage 'information' as the key raw material and output of a range of productive activity. As one UNESCO Report puts it "Knowledge is today recognized as the object of huge economic, political and cultural stakes"[1].

In this new paradigm, investment in Information and Communications Technology (ICT), the enactment of strong Intellectual Property laws, and their strict enforcement are prescribed as imperative in facilitating the transition away from the older economic modes. The promise of the knowledge society is particularly alluring for developing countries, like India, where it is viewed as a vehicle for achieving what Ravi Sundaram has termed 'temporally-accelerative' development[2], through which we would be able to transcend our "historical disabilities", and achieve parity with the incumbent masters of the world. [3]

In their eagerness to provide the best supportive conditions to usher in this coveted knowledge society, nations have been tightening their Intellectual Property regimes – including copyright law. This has entailed a two fold expansion, firstly, in the scope of copyright to include, for instance, ‘technological protection measures’ within their ambit and secondly, in the powers of investigation, search and seizure put at the disposal enforcement agencies. In addition, as we shall see, courts in India have enthusiastically bought into this vision of a knowledge economy, and this has fuelled their eagerness to craft innovative – if legally unsound – orders which put tremendously intrusive powers in the hands of copyright owners. Taken together, these developments have taken their toll on the privacy of individuals which this section will explore in further detail. We begin with a brief description of the statutory mechanism for copyright enforcement – both civil and criminal - under the Copyright Act. We then move on to the way courts have crafted new orders that magnify the powers of copyright owners to the detriment of the privacy of individuals.

Civil and Criminal Enforcement under the Copyright Act

The Copyright Act provides for both civil and criminal remedies for infringement. Section 55 provides for civil remedies and declares that, upon infringement, "the owner of the copyright shall be entitled to all such remedies by way of injunction, damages, accounts and otherwise as are or may be conferred by law for the infringement of a right." Civil suits are instituted at the appropriate district court having jurisdiction – including where the plaintiff resides.

Similarly, Chapter XIII (Sections 63-70) provides a range of criminal penalties for infringing copyrights which are typically punishable with terms of imprisonment that “may extend up to three years” along with a fine. These offences would be taken cognizance of and tried at the court of the Metropolitan Magistrate or Judicial Magistrate of the First class [Sec 70], in the same manner as all cognizable offences[4] in India i.e., by following the procedures under the Code of Criminal Procedure, 1973. Section 64 of the Copyright Act dealing with police powers was amended in 1984 to give plenary powers to police officers, of the rank of a sub-inspector and above, to seize without warrant all infringing copies of works “if he is satisfied” that an offence of infringement under section 63, “has been, is being, or is likely to be, committed”. Prior to amendment, this power could only be exercised by a police officer when the matter had already been taken cognizance of by a Magistrate. Prima facie, this is a very sweeping power since its exercise is unsupervised by the judiciary and only depends on the “satisfaction” of a police officer. To put matters in perspective, under the Income Tax Act, dealing with the far more sensitive issue of tax evasion, a search and seizure can only be conducted based on information already in the possession of the investigating authority.[5]

In Girish Gandhi & Ors. v Union of India[6], a case before the Rajasthan High Court, the petitioner, who ran a video cassette rental business, challenged the constitutional validity of the wide powers granted to police officers under this section. Citing various instances of violations of privacy that the abuse of the section could occasion, the petitioner contended:

"The provisions of section 64 itself gives arbitrary and naked powers without any guidelines to the police officer to seize any material from the shop and thus, drag the video owners to the litigation. He has given instances in the petition that police officer usually demands for video cassettes to be given to them free of charge for viewing it at their homes and in case, on any reason either the video cassette is not available or it is not given free of charge, there is likelihood that police officer shall misuse his powers and try to seize the material for prosecution under the various provisions of the Act."

Although the High Court dismissed the petition on the grounds that it did not disclose any actual injury to the petitioner, it upheld the constitutionality of the section by reading the word "satisfaction" to mean that the "police officer will not act until and unless he has got some type of information on which information he is satisfied and his satisfaction shall be objective."

[Section 64] is also not arbitrary for the reason that guidelines and safeguards are provided under Sections 51, 52 and 52A and Section 64(2) of the Copyright Act, coupled with the fact that it is expected of the police officer that he would not act arbitrarily and his satisfaction shall always based on some material or knowledge and he shall only proceed for action under Section 64 in a bona fide manner and not for making a roving inquiry. (emphasis added)

Despite the pious hopes expressed in this decision, they do not appear to have influenced the actual behaviour of police officers. In May 2011, the Delhi High Court struck down a notification issued by the Commissioner of Police which had instructed all subordinate functionaries of the police to "attend to and provide assistance" whenever any complaint "in respect of violation of the provisions of Copyright Act, 1957" was received from three companies: Super Cassettes Industries Limited, Phonographic Performance Ltd and Indian Performance Right Society Ltd. This virtually amounted to the commandeering of the criminal enforcement system by a few private owners for their own private interests. In their suit, the petitioner — Event and Entertainment Management Association — had contended that the police machinery "cannot be made to act at the behest of certain privileged copyright owners". Striking the notification down, as unconstitutional, Justice Muralidhar of the Delhi High Court held:

"To the extent the impugned circular privileges the complaints from SCIL over other complaints from owners of copyright it is unsustainable in law for the simple reason that there has to be equal protection of the law in terms of Article 14 of the Constitution. The police are not expected to act differently depending on who the complainant is. All complaints under the Act require the same seriousness of response and the promptitude with which the police will take action, Likewise, the caution that the Police is required to exercise by making a preliminary inquiry and satisfying itself that prima facie there is an infringement of copyright will be no different as regards the complaints or information received under the Act[7]."

The Judge also issued some welcome remarks on the manner in which complaints under Section 64 were to be handled:

In order that the power to seize in terms of Section 64 of the Act is not exercised in an arbitrary and whimsical manner, it has to be hedged in with certain implied safeguards that constitute a check on such power. Consequently, prior to exercising the power of seizure under Section 64(1) of the Act the Police officer concerned has to necessarily be prima facie satisfied that there is an infringement of copyright in the manner complained of. In other words, merely on the receipt of the information or a complaint from the owner of a copyright about the infringement of the copyrighted work, the Police is not expected to straightway effect seizure. Section 52 of the Act enables the person against whom such complaint is made to show that one or more of the circumstances outlined in that provision exists and that therefore there is no infringement. During the preliminary inquiry by the Police, if such a defence is taken by the person against whom the complaint is made it will be incumbent on the Police to prima facie be satisfied that such defence is untenable before proceeding further with the seizure.(emphasis added)[8]

This decision significantly tempers the severity of possible searches and seizures conducted by the police under Copyright Law. It advances the cause of privacy by reining in the power of the state to arbitrarily intrude on citizens.

Parallel to the attempt at ‘hedging in’ of police powers in criminal enforcement by this High court, there has been a move to expand powers of investigative bodies in civil suits. The next sub-section looks at two innovations by courts – Anton Piller Orders and John Doe orders – which are mechanisms unwarranted by civil procedural law, but crafted by high courts specifically to deal with copyright investigation.

'Anton Piller' orders and 'John Doe' Orders

In addition to the extensive police powers under the Copyright Act mentioned above, plaintiffs have other, equally intrusive powers at their disposal. In the past decade it has become common for copyright owners and owners-associations to employ civil procedure to emulate the same kind of invasiveness. This is done via the mechanism of so-called ‘Anton Piller’ orders - orders obtained unilaterally ‘ex-parte’ (in the absence of the defendant) from civil courts which permit court-appointed officers, accompanied by representatives of the plaintiffs themselves, to search premises and seize evidence without prior warning to the defendant. Frequently, courts have also issued ‘John Doe’ orders[9] –orders to search and seize against unnamed/unknown defendants - which virtually translates into untrammelled powers in the hands of the plaintiffs, aided by court-appointed local commissioners, to raid any premises they set their eyes on.

Although the authority of the courts under Indian law to grant these orders is suspect[10], they have virtually been regularized in practice over the past decade through routine issual by the High Courts, especially the Delhi High Court. This has led to a widespread phenomenon of powerful copyright owning groups such as the Business Software Alliance and the Indian Performing Right Society Limited managing to successfully assume for themselves almost plenary powers of search and seizure as they go about knocking on the doors of small businesses and demanding to be allowed to audit their software. An anonymous post on the popular Indian Intellectual Property Weblog ‘Spicy IP’ graphically conveys the invasiveness inherent in the execution of these orders:

Ghost Post on IP (Software) Raids: Court Sponsored Extortion?[11]

Picture this:

You are working in your office one day, when all of a sudden, a group of people arrive unannounced brandishing a court order. The order allows them to walk into your office and conduct an audit of all your office computers to collect evidence of the use of unlicensed software in your office.

This group consists of a court-appointed commissioner, lawyers representing the plaintiff, and technical persons who will carry out the actual software audit.

Knowing that to disobey the order will amount to a contempt of court, you allow the group to carry out the audit.

The audit lasts several hours and continues well into the night. Needless to say, it is physically and emotionally draining on you as your work has come to a stand-still. Everyone around you knows there is some court proceeding going on. You have already lost face with your employees, and possibly even clients who have visited your office during the audit.

As you have several dozen computers purchased over a period of time, and the audit is conducted unannounced, you may not have the time to gather documentation and invoices demonstrating the purchase of licensed software.

While the court order allows you to back up your valuable client and business data, the plaintiff’s lawyers don’t allow you to do so, stating that documents/ data found on machines that contain any unlicensed software may not be backed up.

All computers found with copies of what the plaintiff’s lawyers are calling unlicensed software are seized and sealed. You do not have the time, presence of mind or legal representation to argue that such copies may be backup copies allowed under the law, or that therefore several, or all of the seized machines are not liable to be seized, or that such copies are actually allowed under the software license.

Even more importantly, your licensed servers are seized because they are found to contain back-up copies of software, allowed under the law, but deemed infringing by the plaintiff’s lawyers.

At the end of the audit, you are informed that your computers contain copies of unlicensed software to varying degrees. You are made to sign a report prepared by the commissioner, along with sheets that represent the software audit of each computer in your office.

Most of your computers and servers are seized and sealed. You are told that you cannot touch them till the court allows you to. You are not even allowed to separate the hard drives of those machines that contain the alleged unlicensed software, for the purpose of seizure, so as to enable you to continue using the rest of the machine, even though the court order clearly states that only storage media containing the unlicensed software is to be seized.

In a 2008 case, Autodesk Inc vs. AVT Shankardass[12], the Delhi High Court – which happens to be the most enthusiastic issuer of Anton Piller orders[13] –issued guidelines on the considerations which judges should weigh before granting such orders in software piracy cases. Worryingly, the guidelines stipulate that "The test of reasonable and credible information regarding the existence of pirated software or incriminating evidence should not be subjected to strict proof". Instead the court prescribes that "It has to be tested on the touchstone of pragmatism and the natural and normal course of conduct and practice in trade."

The Court also included a few guidelines meant to safeguard the defendant. These include the possibility of requiring the plaintiff to deposit costs in the court "so that in case pirated software or incriminating evidence is not found then the defendant can be suitably compensated for the obtrusion in his work or privacy." Although on the face of it, these guidelines threatened to open up the floodgates for the granting of Anton Pillar orders, in fact, these fears seem not to have been realized. The privacy-invasive ambitions of IP owners have been subverted by a combination of the security requirements stipulated in the Autodesk guidelines above, the judiciary’s own inefficiency/inconsistency and a greater assertiveness and defiance on the part of defendants. The following passage from the 2011 Special 301 India Country Report on Copyright Protection and Enforcement[14], prepared by the IIPA, records the industry’s frustrations in obtaining Anton Pillar orders from the courts over the past year:

Unfortunately, in 2010, such enforcement efforts have become much less effective due to judges imposing conditions on such orders.

With periodic changes to the roster of judges on the Original Side Jurisdiction of the Delhi High Court (which is done as a matter of routine and procedure where the roster changes every 6 months), BSA reports: 1) the imposition of security costs on Plaintiffs; 2) the grant of local commission orders without orders to seize and seal computer systems containing pirated/unlicensed software; 3) granting the right to Defendants to obtain back up copies of their proprietary data while at the same time ensuring that the evidence of infringement is preserved in electronic form; 4) assigning a low number of technical experts for large inspections, making carrying out orders more time-consuming and raising court commissioners’ fees; and 5) ineffective implementation and lack of deterrence from contempt proceedings against defendants who disrupt or defy Anton Pillar orders.[15]

Notwithstanding this temporary setback, Anton Piller orders and John Doe orders remain powerful weapons in the arsenal of large copyright owners who continue to use it in ways that are extremely intrusive. These orders exemplify an instance of how courts rarely reflect on the privacy implications of the orders that they themselves issue –similar action undertaken by the executive would have most likely invited the court’s consideration on whether they violate privacy.

In the next section we move on to private ‘technological’ measures of enforcing copyright which are likely to receive statutory sanction.

Technological Measures

In the light of the industry’s perception of a weakening of its enforcement options due to the judiciary’s waning enthusiasm, it remains to be seen what new manoeuvres they would make to strengthen enforcement. One foreseeable arena of conflict would be the new measures proposed to be included in the Copyright Act that criminalise the circumvention of ‘technological protection measures’ (TPMs) built into software by manufacturers. The proposed new Section 65A criminalises the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act," "with the intention of infringing such rights”. This is punishable with imprisonment up to two years and a fine. However the section also creates a vast list of exceptions including research, testing, national security etc which make it a comparatively soft tool in the hands of prosecutors. Among the list of exceptions is a clause that enables the circumvention of TPMs in order to facilitate purposes that are 'not expressly prohibited' – including, conceivably, to exercise fair dealing rights under Section 52. Although this is a welcome provision, it requires, as a condition of its exercise, that the person ‘facilitating the circumvention’ maintain a record of the persons for whose benefit this has been done. This has led to apprehensions of violations of privacy especially from disability rights groups, who would potentially be the biggest users of this section as it would enable them to make electronic content more widely accessible. However, the lawful exercise of this right would mean that each instance of use of electronic content – say an e-book – by a disabled person would be recorded, which could deter them from accessing content. It would also clearly amount to a violation of their privacy compared to other analog users who are not required to similarly maintain logs each time they share books, for instance.

On the whole, despite the effect these measures have of diminishing absolute control over our electronic resources, the fact that the IIPA - which has been one the most rapid ‘defenders’ of IP - has consistently complained about their inadequacy in its Special 301 Reports[16] gives us some cause for optimism that the privacy invasions it could occasion would not be too severe.

Meanwhile, in a first of its kind, in 2005 the High Court of Andhra Pradesh permitted the prosecution, under the Copyright Act, of persons accused of having circumvented technological protection measures in mobile devices.

In Syed Asifuddin and Ors. v The State of Andhra Pradesh [17] the accused had altered the software on the mobile handsets provided by one service provider (Reliance), so that the same handset could be used to access the network of a rival provider (Tata Indicom). The Court observed that "if a person alters computer programme of another person or another computer company, the same would be infringement of the copyright." The matter was then relegated to the trial court to receive evidence on whether in fact such alteration had occurred.

This ruling, if correct, effectively negates the need for any amendment to the law since circumvention of technological measures typically involves an unauthorized alteration of copyrighted code. Of course it would always be open to the defendant to assert his fair dealing rights in defence, but that issue was not deliberated upon by the High Court in this instance.

Portents

With the terrain of copyright infringement increasingly shifting from ‘street piracy’ to online piracy, it remains to be seen how innovations in copyright enforcement impact privacy. Three events are particularly interesting in this context.

In August 2007, a techie from Bangalore was arrested on charges of having posted incendiary images of a popular folk hero on a website. He had been traced based on the IP Address details provided by a leading ISP. It later turned out that the IP address information was incorrect. By the time the error was noticed, he had already been held in jail illegally for a period of 50 days.[19] Shocking as this incident is, it offers a portent of the gravity of the possible privacy abuses that we are likely to witness in the years to come as copyright owners begin to hunt down infringers on the Internet.
In 2006, the Delhi High Court the pioneer among the Indian Judiciary in issuing John Doe orders added another feather to its cap by permitting the filing of a suit against an IP address. In a case of defamation by email from an unknown sender, a company was able to successfully file a suit against the IP address and obtain an order against the ISP to track down the user who was later impleaded as a party to the suit. This case and the growing number of John Doe orders issued, indicates that the judiciary in India has been quite willing to partner with litigants in their fishing expeditions. While it cannot be gainsaid that this has aided the legitimate interests of litigants, this has come at the price of a callous disregard for the interests of consumer privacy in India, which, as the incident described above highlights, could easily descend into a full blown human rights violation.
With the arrest in November 2010 of a four-member gang from Hyderabad for uploading media content – including popular film titles - on Bittorrent, the popular online file sharing tool, the industry has signalled its capacity and willingness to take the battle over copyright to the Internet.[20] New rules notified under the Information Technology Act make it mandatory for 'intermediaries' (ISPs) to co-operate in locating and removing ‘infringing content’ that is stored or transmitted by them.[21] This will facilitate untrammelled access to users by copyright industries.

Although it is too early to predict the future for the Internet that these developments will result in, they are definitely a source of apprehension from the perspective of privacy.

Copyright and Confidential Information

Although the protection of 'confidential information' and 'copyright' occupy distinct realms in the law[22], they converge occasionally, and copyright has been used as an instrument by people and organisations to protect their confidential information. In fact it has become quite routine for written pleadings by plaintiffs in cases to assert the omnibus infringement of their ‘copyrights, confidential information, trade secrets, trademarks designs etc’ without specifying which of the claims is urged. For instance in Mr. M. Sivasamy v M/S. Vestergaard Frandsen[23] a case before the Delhi High Court, the plaintiffs claimed that. "Defendants are violating the trade secrets, confidential information and copyrights of the plaintiffs.”; Similarly in Dietrich Engineering Consultant v Schist India & Ors , before the Bombay High Court, the plaintiffs contended"..the suit is filed to prevent unauthorized and illegal use of the plaintiffs confidential information and infringement of the 1st plaintiffs Copyright".[24]

In one of the earliest cases of this kind, Zee Telefilms Ltd. v Sundial Communications Pvt. Ltd, the Bombay High Court delivered a ruling in favour of the plaintiffs on both grounds of copyright infringement and confidential information. Here the employees of the plaintiffs – a company engaged in the business of producing television serials - had developed the concept for a program which they had registered with the Film Writers Association. Subsequently, they made a confidential pitch of the concept to the representatives of the defendants, a well known TV channel. Although initially the defendants appeared reluctant to take the concept forward, they proceeded later on, without the authorization of the plaintiffs, to produce a TV serial that closely mirrored the ideas contained in the show conceived by the plaintiff. In an action seeking to restrain the defendants from proceeding with their production, the High Court agreed with the plaintiff’s claims both on the count of copyright infringement and confidentiality. Curiously, the determination of both issues turned on the similarities between the plaintiff’s and defendant’s concepts – which is traditionally a determination relevant only to copyright cases. On the issue of confidentiality, the court held "Keeping in view numerous striking similarities in two works and in the light of the material produced on record, it is impossible to accept that the similarities in two works were mere coincidence...the plaintiffs' business prospect and their goodwill would seriously suffer if the confidential information of this kind was allowed to be used against them in competition with them by the defendants."

Although a clear line is demarcated between the claims of confidentiality and copyright in this case, this distinction is less sharp in other cases of the same nature.

In a more recent case Diljeet Titus, Advocate v Mr. Alfred A. Adebare & Ors[25] four associates of the plaintiff’s law firm quit together to start their own practice. While leaving they took documents they had drafted including agreements, due diligence reports and a list of clients along with them. The plaintiff filed a suit for injunction, asserting both that this material was confidential and that he owned the copyrights over them. The Delhi High Court agreed and issued an injunction restraining the defendants from “utilizing the material of the plaintiff forming subject matter of the suit and from disseminating or otherwise exploiting the same including the data for their own benefit.” What is interesting in this case is the conflation of confidentiality and copyright – both in the allegations of the plaintiff and the rebuttals of the defendant who sought to resist claims of confidentialty on grounds that they had themselves authored the papers in question.

Curiously, where copyright and confidentiality claims coincide, it would appear that the parameters of determining copyright infringement end up determining the issue of confidentiality as well.

In the next section we move on to the last copyright/privacy issue that we had flagged in the introduction – the invocation of copyright in aid of the ‘right to publicity’ of individuals which can be read as a kind of privacy claim.

Copyright and Publicity

Do we have a copyright over our identities – our names, our appearances, our life histories, our reputation and our bodies - so that we have an actionable interest in preventing their deployment in public without our express authorization?

This question has arisen in a limited set of cases in India that raise interesting questions. As with the confidentiality cases discussed above, the lines separating ‘defamation’ actions from ‘copyright’ claims is not brightly drawn in these cases. Neither is the line linking copyright to the protection of privacy clearly evident. All one can say with confidence is that copyright and privacy are two words tossed into the plaints by the plaintiffs while asserting their claims.

In one of the most high-profile cases of its kind, Phoolan Devi v Shekhar Kapoor[26] the Delhi High Court was faced with the question of whether ‘public figures’ are entitled to any degree of control over the representation of their lives. Here the petitioner, Phoolan Devi, a reformed bandit, had 'licensed'[27] the production of a biopic on her life to the defendant, a film director of note, who was to consult the plaintiff’s own writings and those of her authorised biographer in making the film. However, the defendant – the director of the biopic – had exceeded this mandate and also depicted incidents that emerged from various newspaper accounts – including a graphic gang rape scene where the plaintiff was the victim, and a massacre which she had allegedly orchestrated. Although generally well-known, neither of these incidents were either admitted to by the plaintiff herself or mentioned in the plaintiff’s own writings and those of her biographer. Even worse, the film had not been shown to her even several months after it had been released to national and international audiences.[28] In Arundhati Roy’s moving words the producers of the film “[R]e-invent her life. Her loves. Her rapes. They implicate her in the murder of twenty-two men that she denies having committed. Then they try to slither out of showing her the film!”[29]

One of the contentions that the petitioner’s advocate had advanced was that the defendant had no right “to mutilate or distort the facts as based upon prison diaries” and that any such distortion would fall afoul of her right under Sec 57 of the Indian Copyright Act. This section confers certain ‘special rights’ on the author including the right to claim authorship and to restrain any distortion/mutilation or modification of the work that would be prejudicial to his/her honour or reputation.[30]

These rights survive any assignment of the copyright made by the author i.e. they can e asserted by the author above any contract entered into by her with third parties such as the producer in this case. The Court framed the question it was faced with in these terms:

[T]he question before me is whether such person like the plaintiff has no right to defend when someone enlarges the terrible facts, enters the realm of her private life, depicts in graphic details rape, sexual intercourse, exhibits nudity, portrays the living person which brings shame, humiliation and memories of events which haunts and will go on haunting the plaintiff, more so the person is still living. Whether the plaintiff has no right and her life can become an excuse for film makers and audience to participate in an exercise of legitimate violence with putting all inhibitions aside.

Ultimately, the High Court sided with the petitioner and issued an injunction restraining the defendant from exhibiting his film.[31] This decision was based more on a consideration of constitutional right to privacy principles than an evaluation of the plaintiff’s case under Copyright law. However, it does provide an interesting factual matrix for the exploration of the way in which protection of copyright and privacy might overlap.

In a contrasting case before the Bombay High Court, Manisha Koirala v Shashilal Nair & Ors [32] an injunction was sought against the release of a film in which the petitioner, a noted actress, was depicted in the nude through the device of a ‘body double’. Here the plot was entirely fictional and the plaintiff, a noted actress, had agreed to perform in the film with ‘substituted shots’ during the scenes in the story that involved nudity. Subsequently, she appears to have reconsidered this decision and objected to the very inclusion of these scenes in its final version. In her petition before the court, she alleged defamation and malicious injurious falsehood, arguing that the exhibition of the film would result in a violation her right to privacy "as the objectionable shots, attempt to expose the body of a female which is suggested to be that of the plaintiff". She contended that “the right to portray her on screen can only be exercised in a manner, which is subject to the fundamental principle that such portrayal can only be with her unconditional consent." "The present rendition" of her part in the film, she alleged was “an invasion of privacy as it is embarrassing and will cause irreparable damage to her reputation which remains untarnished thereby causing irreparable loss and injury”. Although Copyright is not invoked in this case by the petitioner, there is an audible echo of some of the reputational anxieties that had animated Phoolan Devi’s case mentioned above. The difference, however, is that in this case the petitioner’s claim was not grounded in a quest for control over her biography, but over the image of her body. Unlike the previous case, here the Court was unsympathetic to the petitioner’s claims. The court treated her previous ‘consents’ as determinative of all issues and dismissed her case holding:

"The Court ...cannot be a moral guardian in this context. ..It is.. clear to my mind that once having agreed to act in the film it will be too late for the plaintiff .. to hold that a case of defamation has been made out.. To maintain a case of malicious falsehood it must be held out that the statement was false. In the instant case what is sought to be contended is that the scenes involving the film artist would result in an action of malicious injurious falsehood or malicious falsehood by associating the plaintiff's with the scenes which she had not enacted.. The plaintiff was prima facie aware as earlier held and that the scenes formed part of the story board have been enacted by a double and consequently it cannot be said that in the present case the plaintiff has been able to establish a case of malicious falsehood."[33]

One of the facts that was relevant in the court’s decision was that the defendant, as the ‘holder of the copyright in the film’, had incurred vast expenditure in publicising its release. Here, in a reversal of the Phoolan Devi case, copyright is held up as a shield against a competing privacy claim. The issue of the extent of overlap between copyright and privacy however remains unsettled in law. In April 2007, the Madras High Court granted a temporary injunction against the publishers of an unauthorised biography of former Tamil Nadu Chief Minister Jayalalitha. In her petition she alleged that the biography “had been written without any verification of facts. Such a publication would spoil her image and damage her status in politics and public life.” Her petition contended that “No one has a right to publish anything concerning personal private matters without consent, whether truthful or otherwise, whether laudatory or critical.[34]

Although it does not reference Copyright law, this case is another illustration of the enduring relevance of the question of whether we are entitled to the exclusive authorship of our private life-stories.

The Private under the Copyright Act

In its various sections, the Copyright Act inscribes certain spaces and actions as either public or private. Specified activities are labelled public even though they are conducted within the domestic confines of one’s home. Similarly, activities that infringe copyright are nevertheless immunised from prosecution due to the fact that they are conducted for a ‘private’ purpose. In this concluding section of this paper, we try to piece together a narrative of privacy and the private domain that emerges from a combined reading of various sections and decisions under the Copyright Act.

We begin, here, by collating the Copyright Act’s various articulations of the ‘public’ and ‘private’. By treating them as intertwining, mutually constitutive terms, we proceed to analyse these various articulations in the Copyright Act with a view to seeing what account of the private realm may emerge.

Public/Publish

One of the key rights that most owners of copyrights enjoy is the exclusive right to "publish" or "communicate their work to the public".

The Act defines "publication" to mean “making a work available to the public by issue of copies or by communicating the work to the public”. Significantly, in case of dispute, if the issue of copies or communication to the public is “of an insignificant nature” it is deemed not to constitute a publication [Section 6]. This signals that the notions of publicity and publication under the Copyright Act are in some senses moored to the magnitude of the receiving public. The ‘private’ then is constituted, reciprocally, as the ‘insignificant public’.

Under the Indian Copyright Act, "communication to the public" occurs when a person makes any work “available for being seen or heard or otherwise enjoyed by the public directly or by any means of display or diffusion other than by issuing copies of such work”. Such communication occurs “regardless of whether any member of the public actually sees, hears or otherwise enjoys the work so made available.”[Section 2(ff)][35]

Private

The word ‘private’ is expressly referenced in four provisions of the Copyright Act.

Section 39 declares that “the making of any sound recording or visual recording for the private use of the person making such recording, or solely for purposes of bona fide teaching or research” would not violate the broadcast reproduction right or performer's right;
Section 51 which stipulates when copyrights are infringed declares that the “imports into India, any infringing copies of the work” would constitute an infringement except if it is only a single copy of any work that is imported “for the private and domestic use of the importer”.
Section 52(1) of the Copyright Act lists certain acts as not infringing of copyright. These include:

(a) a fair dealing with a literary, dramatic, musical or artistic work, not being a computer programme, for the purposes of private use, including research. A proposed amendment to this section seeks to extend this protection to all ‘personal’ uses in addition to ‘private uses including research[36]. ‘Personal use’ has been interpreted in non-copyright contexts to include the family members of the person living with him.[37] The definition of ‘person’ under the General Clauses Act includes a “company or association or body of individuals, whether incorporated or not”. Although the case law on the point is scant[38], it would be interesting to see if ‘personal use’ can be read to include the use by companies internally, thereby casting a shroud of privacy on corporations for the purpose of copyright.
(p) the reproduction, for the purpose of research or private study or with a view to publication, of an unpublished literary, dramatic or musical work kept in a library, museum or other institution to which the public has access.

In addition to the provisions listed above, Section 52 the Act also shields certain spaces and occasions as immune from the charge of copyright infringement (although they are not specially designated as ‘private’). These include educational institutions[39], non-profit clubs, societies[40], religious institutions[41] and religious ceremonies including marriages.[42]

Perhaps the most elaborate calibration of the boundaries between the 'private' and 'public' under the Indian Ccopyright Act by the judiciary occurs in the case Garware Plastics and Polyester vs Telelink & Ors[43]., decided by the Bombay High Court in 1989. The case called for the determination of whether films transmitted via neighbourhood cable networks and viewed in the privacy of customers’ homes would constitute an unauthorised ‘communication to the public’ under the Copyright Act. Here the defendants had purchased video tapes of popular films and begun transmitting them over cable networks owned by them. For this they charged a monthly maintenance fee from their customers. Under the Copyright Act then in force, ‘communication to the public’ was defined simply as "communication to the public in whatever manner, including communication through satellite.” After an extensive review of English law on the subject, the court ruled that this did constitute an unauthorised communication to the public:

"Whether a communication is to the public or whether it is a private communication depends essentially on the persons receiving the communication. If they can be characterized as the public or a protein of the public , the communication is to the public…From the authorities the principal criteria which emerge for determining the issue are(1) the character of audience and whether it can be described as a private or domestic audience consisting of family members or members of the household, (2) whether the audience in relation to the owner of the copyright can be so considered…Applying the test of the character of the audience watching these video films , can this audience be called a Section of the public or is this audience a private or domestic audience of the defendants ? In the present case it cannot be said that the audience which watches video films shown by the defendants consists of family members and guests of the defendants. The video film may be watched by a large Section of the public in the privacy of their homes. But this does not make it a private communication so as to take it our of the definition of "broadcast" under the Copyright Act, 1957.

It is true that the network operates through the connection of a cable to all these various apartments or houses. But this cannot in any way affect the character of the audience. The viewers are not members of one family or their guests. They do not have even the homogeneity of club members of one family or their guests. They do not have even the homogeneity of a club membership.[44] (emphasis added)

A central feature emerging from this case that distinguishes public form private in Copyright law is homogeneity or affiliation: that space is marked ‘private’ where a pre-affiliated group – united either by kinship or association in pursuit of a common goal – comes together in pursuit of a non-commercial common interest. Conversely, ‘Public’ is where the unaffiliated congregate. On the face, this accords with the spirit of the various fair dealing rights under the Copyright Act which carve out immunised spaces for institutions that correspond to these definitions – educational institutions, religious institutions and ceremonies, amateur clubs etc are immune from infringement actions because, one could say, their activities are ‘private’.

In 1994 the Copyright Act was amended to fortify this conclusion by expanding the definition of ‘communication to the public’ to include ‘communication through satellite or cable or any other means of simultaneous communication to more than one household or place of residence including residential rooms of any hotel or hostel shall be deemed to be communication to the public;” (Sec 2(ff), Explanation)

Conclusion

I would like to conclude this paper with some reflections on the assertion I made in the introduction about copyright law being both an instrument for the protection and violation of privacy. From the discussion in the previous sections, it follows:

Firstly, that 'property' – as embodied by copyright law – is, at best, an unreliable guarantor of privacy. It works when bussed along with dignity claims– for instance the Phoolan Devi case where the petitioner’s suffering underlay her property claim– but fails when asserted as ‘property’ per se (as in Manisha Koirala’s case[45]). One does not (under the Indian Copyright Act, at least) have a reliable ‘property’ interest in one’s life story, bodily representation, name etc. This stands in contrast with other regimes such as the US where several states have enacted ‘Right to publicity’ statutes or have recognised publicity rights through common law processes.[46]

These rights can be read to offer people a 'property' means for protecting their privacy (by preventing unauthorised publicity) in those jurisdictions. Analogous claims are unavailable in India.

Secondly, that ‘property’ operates frequently as a license for the violation of privacy with impunity. This emerges most clearly from the cases of copyright investigation that we examined in Section 1.2 above. Pecuniary copyright interests appear to completely overwhelm any regard for competing privacy concerns.

Thirdly, that, notwithstanding the preceding two points, the copyright act does protect privacy in limited ways. Chiefly these are a) By conferring limited copyright on 'unpublished works', it enables authors to restrict their publication except on terms acceptable to them. b) The Act grants a very wide “Performer’s right” to performers and no sound or visal recording may be made of them without their express consent. No such recording can broadcast or communicated to the public without their consent. This gives a very powerful weapon of control in the hands of performers to restrict the extent to which representations of them are publicised. C) As mentioned above in the penultimate section of this paper, various fair dealing exceptions carve out spaces of privacy where infringing acts are granted immunity – for instance private uses, uses in educational institutions and libraries, etc.

Lastly, with the arena of copyright infringement shifting gradually to the internet, it is foreseeable that the IT Act will be employed with greater frequency in the coming years to do the work of copyright enforcement. The legal regime already supports this change through provisions in the IT Act which preserve all existing rights available under the Copyright Act [Section 81 (proviso) of the IT Act] and put new powers of take-down [see Intermediary Guidelines] in the hands of Copyright Owners. Thus on the one hand, copyright owners would be able to lawfully hack into potential infringers’ computers while enjoying immunity under the IT Act. On the other hand, ‘intermediaries’ would be legally bound to co-operate in copyright enforcement including, conceivably, handing over a number of personal details of those accused of copyright infringement. In other jurisdictions, such as the EU, such ‘co-operation’ is heavily policed by judicial oversight where personally identifiable information is involved[47]. Contrastingly, in India, with its diminished concerns for privacy and limited awareness of how IP address data can seriously imperil privacy, there is a very real threat that these provision will license the wholesale violation of online privacy.

Notes

[1]Anon, 2005. Towards Knowledge Societies, Paris: UNESCO. Available at: http://unesdoc.unesco.org/images/0014/001418/141843e.pdf [Accessed April 20, 2011].

[2]Sundaram says "Temporal acceleration was a significant part of the imaginary of developmentalism - this was inherent in the logic of 'catching up' with the core areas of the world economy by privileging a certain strategy of growth that actively delegitimized local and 'traditional' practices."

[3]This aspiration underlies several of the policy documents prepared in India in the last decade – Illustratively, the report submitted by the National Task Force on Information Technology (NTFIT) in 1998 captures this sentiment well: “For India, the rise of Information Technology is an opportunity to overcome historical disabilities and once again become the master of one's own national destiny. IT is a tool that will enable India to achieve the goal of becoming a strong, prosperous and self-confident nation. In doing so, IT promises to compress the time it would otherwise take for India to advance rapidly in the march of development and occupy a position of honor and pride in the comity of nations” Tiwari, Ghanshyam et al. Government of India. Central Advisory Board of Education, Ministry of Human Resource Development .Report of the Central Advisory Board of Education Committee On Universalisation of Secondary Education. New Delhi: 2005

[4]There is some ambiguity on whether offences under the Copyright Act punishable with imprisonment “which may extend to three years” are 'cognizable' or not. The Code of Criminal Procedure 1973 classifies all offences which prescribe a penalty of three years and above as cognizable and non bailable [First Schedule]. Offences which are punishable with imprisonment of less than three years are classified as ‘non-cognizable’ and ‘bailable’. In the absence of a definitive ruling from the Supreme Court on this issue, different High Courts have offered conflicting interpretations. See Singh, S. & Aprajita, 2008. Insight into the nature of offence of Copyright Infringement. Journal of Intellectual Property Rights, 13(6), pp.583-589. Available at: http://nopr.niscair.res.in/bitstream/123456789/2433/1/JIPR%2013%286%29%20583-589.pdf [Accessed May 12, 2011]. See also Agarwal, D.K., 2010. Arrest under the customs act ? Bailable or non-bailable offence. Translation Interpreting Services. Available at: http://translation-tech.com/blog/213/arrest-under-the-customs-act-bailable-or-non-bailable-offence/ [Accessed May 12, 2011]. The determination of this issue would have wide ranging implications since the police have a wider assortment of powers with respect to interrogation, arrest, search and seizure in the course of investigating cognizable offences than they have with respect to non-cognizable offences.

[5]"Where Director of Inspection or Commissioner in consequence of information in his possession, has reason to believe that any person having in possession of any money, etc.." has not disclosed it for purposes of Income Tax.

[6]AIR 1997 Raj 78 < http://indiankanoon.org/doc/661363/>

[7]Event and Entertainment Management Association v. Union of India (Delhi HC) Order dated 2nd May 2011 <http://courtnic.nic.in/dhcorder/dhcqrydisp_o.asp?pn=84697&yr=2011>. Harkauli, S., 2011. HC nullifies police circular on copyright issue. The Pioneer. Available at: http://www.dailypioneer.com/336974/HC-nullifies-police-circular-on-copyright-issue.html [Accessed May 9, 2011].

[8]Ibid

[9]As recently as April 2011, the Delhi high court restrained “cable operators nationwide from telecasting matches of the Indian Premier League (IPL) without authorization from MSM Satellite (Singapore) Pte Ltd, which owns the broadcasting rights. See Bailay, R., 2011. Cable operators can’t telecast IPL without authorization, says HC. Livemint. Available at: http://www.livemint.com/articles/2011/04/27212449/Cable-operators-can8217t-te.html?atype=tp [Accessed May 13, 2011]. For an early history of John Doe orders in India, see Krishnamurthy, N. & Anand, P., 2003. India Trade marks in a state of change. Managing Intellectual Property. Available at: http://www.managingip.com/Article/1321770/India-Trade-marks-in-a-state-of-change.html [Accessed May 13, 2011].

[10]These orders are granted by the Court supposedly under Section 75 read with Order 26 of the Code of Civil Procedure which empowers the court to appoint “Local Commissioners” to record evidence in special cases. I have stated my opinions elsewhere on why I believe these powers may not be invoked for the purpose of effecting routine searches and seizures in the manner as is currently being practiced by the higher judiciary – especially the Delhi High Court. See Iyengar, P., 2009. BSA’s response on Spicy IP – in perspective. Original Fakes. Available at: http://originalfakes.wordpress.com/2009/04/04/bsas-response-on-spicy-ip-in-perspective/ [Accessed May 10, 2011].

[11]Anon, 2009. Ghost Post on IP (Software) Raids: Court Sponsored Extortion? SPICY IP. Available at: http://spicyipindia.blogspot.com/2009/03/ghost-post-on-ip-software-raids-court.html [Accessed May 10, 2011].

[12]Autodesk Inc Vs. AVT Shankardass, Available at: http://delhicourts.nic.in/Jul08/Autodesk%20Inc%20Vs.%20AVT%20Shankardass.pdf [Accessed May 10, 2011].

[13]The 2011 Special 301 Country Report on India prepared by the IIPA specifically cites the Delhi High Court in this context, statng “The industry enjoys a very high success rate with respect to the grant of such orders at the Delhi High Court”. According to this report, the Business Software Alliance was able to obtain 34 such orders in 2009.

[14]Anon, 2011. Special 301 Report on Copyright Protection and Enforcement: 2011 India Country Report, International Intellectual Property Alliance. Available at: http://www.iipa.com/rbc/2011/2011SPEC301INDIA.pdf [Accessed May 9, 2011].

[15]Ibid at. Pp 41-42.

[16]The 2010 Special 301 Country Report lists the following defects of the proposed Section 65A: “(a) does not cover access controls and is limited only to TPMs protecting the exercise of exclusive rights; (b) covers only the “act” of circumvention and does not also cover manufacturing, trafficking in, or distributing circumvention devices or services; (c) does not define an “effective technological measure”; (d) contains an exception which would appear to permit circumvention for any purpose that would not amount to infringement under the act (thereby almost completely eviscerating any protection); (e) creates other overbroad exceptions; and (f) provides for only criminal and not civil remedies."

[17]Syed Asifuddin And Ors. v The State Of Andhra Pradesh, 2005 CriLJ 4314 (Andhra Pradesh HC ).

[18]Ibid.

[19]Holla, A., 2009. Wronged, techie gets justice 2 yrs after being jailed. Mumbai Mirror. Available at: http://www.mumbaimirror.com/index.aspx?page=article&sectid=2&contentid=200906252009062503144578681037483 [Accessed March 23, 2011]. See also Nanjappa, V., 2008. “I have lost everything.” Rediff.com News. Available at: http://www.rediff.com/news/2008/jan/21inter.htm [Accessed March 23, 2011].

[20]Pahwa, N., 2010. Hyderabad Police Arrests Torrent Uploaders - MediaNama. MediaNama. Available at: http://www.medianama.com/2010/11/223-hyderabad-police-arrests-torrent-uploaders/ [Accessed May 12, 2011].

[21]GSR 314(E) Dated 11 April 2011: Information Technology (Intermediaries guidelines) Rules, 2011 http://www.mit.gov.in/sites/upload_files/dit/files/GSR314E_10511(1).pdf [Accessed May 12, 2011].

[22]See Zee Telefilms Ltd. v Sundial Communications Pvt. Ltd., 2003 (5) BomCR 404 (Bombay High Court 2003).

[23]Mr. M. Sivasamy v M/S. Vestergaard Frandsen (Delhi High court 2009).< http://indiankanoon.org/doc/916718/>

[24]Dietrich Engineering Consultant v Schist India & Ors (Bombay High Court, 2009) < http://indiankanoon.org/doc/1634545/>

[25]Mr. Diljeet Titus, Advocate vs Mr. Alfred A. Adebare And Ors, 130 DLT 330 (Delhi High Court 2006).

[26]Phoolan Devi v Shekhar Kapoor And Ors. (1994). DLT (Vol. 57 (1995), p. 154). Retrieved from http://indiankanoon.org/doc/793946/

[27]The conditions under which this license were obtained speak eloquently to the ills of the current copyright system. According to Phoolan Devi’s lawyer, the noted advocate Indira Jaisingh, the contract was signed by Phoolan Devi while she was behind prison bars. She did not speak or understand Hindi or English and only spoke in a local dialect. The copyright contract was written entirely in English and gave her a paltry sum or Rs. 2 lakh – which was a pittance considering the budget and projected returns from the film. Jaisingh, I., 2001. Supreme Court lawyer Indira Jaisingh pays tribute to Phoolan Devi. Available at: http://www.rediff.com/news/2001/jul/26spec.htm [Accessed June 10, 2011]. Arundhati Roy’s two superb critiques of the film and its director movingly capture why this is not a simple case of copyright assignment. See Roy, A., 1994. The Great Indian Rape Trick - I. Sawnet. Available at: http://www.sawnet.org/books/writing/roy_bq1.html [Accessed June 10, 2011].; Roy, A., 1994. The Great Indian Rape Trick - II. Sawnet. Available at: http://www.sawnet.org/books/writing/roy_bq2.html [Accessed June 10, 2011].

[28]Ibid, Roy, A., 1994. The Great Indian Rape Trick - I.

[29]Ibid, Roy, A., 1994. The Great Indian Rape Trick - II

[30]Section 57 of the Act reads “Author’s Special Rights: ‘Independently of the author's copyright and even after the assignment either wholly or partially of the said copyright, the author of a work shall have the right-

(a) to claim authorship of the work; and
(b) to restrain or claim damages in respect of any distortion, mutilation, modification or other act in relation to the said work which is done before the expiration of the term of copyright if such distortion, mutilation, modification or other act would be prejudicial to his honour or reputation:”

[31]The case was later settled out of court with Phoolan Devi being able to secure a substantially higher compensation. Ultimately, the case was not about the depiction of rape generally, but primarily about Phoolan Devi’s sovereign right to decide the terms on which her own life would be represented.

[32]Manisha Koirala v Shashilal Nair & Ors. (2002). BomCR (Vol. 2003 (2), p. 136). Retrieved from http://indiankanoon.org/doc/1913646/

[33]Ibid

[34]Anon, 2011. High Court Grants Injunction Till June 7 Against Publishing Book on Jayalalithaa. The Hindu, p.01. Available at: http://www.hindu.com/2011/04/27/stories/2011042762360100.htm [Accessed May 12, 2011].

[35]For a more dispersed account on the concept of the ‘public’ under Indian law, See Iyengar, P, ‘Where the private and the public collide’, iCommons Lab Report, September- October 2007, pp. 7-8, Icommons.org, < http://archive.icommons.org/articles/what-is-public> last visited May 2011

[36]Copyright (Amendment) Bill 2010 http://prsindia.org/uploads/media/Copyright%20Act/Copyright%20Bill%202010.pdf

[37]See Sivasubramania Iyer v. S.H. Krishnaswamy AIR 1981 Ker 57 , a case under Kerala Buildings (Lease & Rent Control) Act 1965.

[38]Goods purchased for the private use of a corporation would be goods purchased for the ”personal use” of the corporation. 158 IC 703.

[39]52(1)(g), (h) and (i)

[40]52(1)(k) and (l)

[41]52(1)(l)

[42]52(1)(za)

[43]AIR 1989 Bom 331, 1989 (2) BomCR 433, (1989) 91 BOMLR 139 <http://indiankanoon.org/doc/858705/>

[44]Ibid.

[45]At first glance this distinction may seem facile since even Manisha Koirala invoked ‘reputational harm’ as a prop to buttress her property claim. However, I believe this case was complicated by the fact that the court had to consider whether the display of someone else’s body could have implicated Manisha Koirala’s privacy/dignity. Koirala was, in effect, arguing that she had absolute ‘proprietorial’ control over all representations of her body – a property argument which the court was unwilling to concede.

[46]See Footnote 90 and accompanying text in Samuelson, P., 2000. Privacy as Intellectual Property? SSRN eLibrary; Stanford Law Review. Available at: http://ssrn.com/paper=239412 [Accessed on June 14, 2011].

[47]Lebatard, F.-R., Copyright Enforcement and the Protection of Privacy in France. Translegal. Available at: http://www.translegal.com/feature-articles/copyright-enforcement-and-the-protection-of-privacy-in-france [Accessed June 14, 2011].

For more details visit https://cis-india.org/internet-governance/blog/privacy/copyright-enforcement

Re-thinking Key Escrow

natasha — 2011-08-22T11:44:21Z

Would you make duplicates of your house keys and hand them over to the local police authority? And if so, would you feel safe? Naturally, one would protest this invasion of privacy. Similarly, would it be justified for the government to have a copy of the private key to intercept and decrypt communications? This is the idea behind key escrow; it enables government ‘wiretapping’.

The evolution of technology has allowed for increased communication and interconnectedness among people, markets and institutions all over the globe. This has increasingly facilitated the transaction and exchange of all kinds of information. However, this has raised major ethical concerns surrounding the privacy of communication and security of information. Key encryption is an important tool developed to preserve an individual’s privacy. It involves transforming information, so as to ensure that it is unreadable. The need for encryption is irrefutable.

Governments and authorities are concerned with the difficulties associated with accessing and intercepting the encrypted communication. For lawful interception a recovery key is escrowed with a trusted third party. Key escrow is controversial as it is vulnerable to lawful interception and has the potential to threaten the security of sensitive and personal data. In India, key escrow is a requirement under the Indian Internet Service Provider (ISP) license. This means that an ISP, a law enforcement agency, or other party has the potential to partake in covert surveillance and maliciously use the key, thereby compromising the data.

In a short video Jim X. Dempsey, Vice President of Public Policy at the Centre for Democracy and Technology in Washington, DC reviews the public policy battle over key escrow in the United States that took place in the 1990's. At the time the U.S government’s approach to encryption technology involved the use of key escrow in communication devices. One danger of using key escrow in this way was that it allowed for the commercial use of encryption technology, provided that a copy of the private key is held in escrow by the U.S. government. The use of key escrow also permitted the U.S. government to decrypt all data transmitted across communication networks. The risks associated with the use of key escrow led to widespread dissatisfaction from the private sector in the U.S., which ultimately led to the rejection of encryption technology by the President and Congress. In response to the strong negative feedback given by different stakeholders, the US government lifted the controls on encryption technology thereby allowing it to become widely available.

The use of key escrow in India should be seriously reconsidered. Foremost, it subverts basic constitutional practices by violating various freedoms and civil liberties guaranteed in the fundamental rights. Secondly, it threatens the security of personal information. Lastly, it could significantly hinder the growth of e-commerce, transactions, and purchases made over the Internet. The Indian government should take into consideration the failed attempt in implementing the system of key escrow in the United States when deciding on whether or not to implement the use of key escrow in India.

Please see Jim Dempsey’s account on the Short History of Key Escrow.

For more details visit https://cis-india.org/internet-governance/blog/privacy/key-escrow

CCTV in Universities

merlin — 2011-09-01T09:50:09Z

Basic Closed Circuit Television (CCTV) Infrastructure is used to observe movements from a central room, and consists of one or more video cameras that transmit video and audio images to a set of monitors or video recorders.

A Brief History of CCTV's

Video surveillance as a means of policing gained prominence in the 1950s when the UK police installed two pan-tilt cameras on traffic lights to monitor traffic near the Parliament. Since then the United Kingdom has become the country with the most number of surveillance cameras.[1]

The proliferation of CCTVs has been attributed to the growing radicalization of human behaviour wherein organized groups terrorized entire nations and threatened their internal security. The 1985 terror attack on the then Prime Minister of Britain by the IRA and many such instances thereafter have led many countries to adopt CCTV as a means of policing. In India, terror attacks on the Mumbai stock market and successive instances have pushed the Indian Government to install CCTVs in prominent public areas so that it is possible to monitor suspicious movements.[2]

CCTVs and Public Perspective

Since the 1950'sCCTVs have become ubiquitous and ever present, monitoring our daily movements, and infringing into our personal space. Though governments believe CCTVs are essential security instruments, the public is less convinced. The early anxiety to be safe from an unseen danger has given way to a new unease amongst the people, that of constantly being watched by an unseen eye.

CCTVs in Educational Institutions

CCTVs are typically used by the government or private agencies for surveillance in areas frequented by the public that need monitoring. Recently though, universities across the length and breadth of the country have resorted to the use of CCTVs for policing campus activities and to keep the students in check and under control. Huge budgets are set to wire campuses with CCTV infrastructure, t causing students to protest as well as laud the initiative by the administration. The debate on CCTVs has gained momentum in recent years with students staging huge rallies both in support of and against it.

Example 1:

The most prominent of the agitations against CCTVs was staged by the students of Jadavpur University in Kolkata on the administration’s decision to install 16 CCTVs on the four main exit points of the campus and other strategic locations.[3] The installation cost Rs.20 lakh. The students protested loudly against the decisions and ‘gheraoed’ the office of the vice chancellor for 52 hours. The students claimed that the administration was curbing their individual freedom and robbing the campus of it’s democratic atmosphere. The administration refused to remove the cameras, and claimed that the move was necessitated for the security of the students and to prevent any unforeseen incident.

Example 2:

The girl’s residing in the Women’s Hostel of The University of Pune protested against the setting up of CCTV cameras’ in the entrances of the hostel to check for unauthorized visits from boyfriends and friends. The girl’s vandalized the camera and claimed that they were an infringement to their privacy. The hostel authorities insisted that the cameras did not infringe on the privacy of the women, and were only installed at the entrance gates to keep a tab on visitors.[4] The authorities claimed that this step was taken in congruence with the hostel’s policy of not allowing visitors to stay the night.

Example 3:

The girls of the Churchgate’s Government Law College succeeded in getting the CCTV camera removed from the Girl’s Common Room, as it was seen as an infringement to their privacy. The MNS stepped up the agitation in favor of the students which led the college administration to finally take notice and remove the camera from the common room.[5]

The Flip Side

The issue of CCTVs in campuses takes an interesting turn when the students support the move to install cameras in campuses.

Example 1:

Delhi University installed CCTV cameras in their campuses after the Delhi Police issued an advisory for the same. They claimed that the advisory issued was to monitor the instances of on campus ragging. The Delhi Police also helped fund the setting up of CCTVs in the college. This move was lauded by the students, and the colleges took instant measures to wire their campuses.[6]

Example 2:

Recently, after the murder of a Delhi University student named Radhika Tanwar in broad day light, many student union groups assembled for a candle light vigil. They demanded CCTV cameras near the Satya Niketan bus stop where Radhika was killed which is an isolated stretch of a road. The massive agitation of almost a week brought the National Commission of Women into the foray who seconded the demand put forth by the student body.[7]

Example 3:

The recent instance of an RTI exposing inflated bills for setting up CCTVs in the Punjab University Campus also throws light on an interesting facet to this debate as the students do not mind the CCTVs in their campus. The student’s union of the university demanded the authorities to look into the discrepancies of the budget, and also expressed anger as the CCTVs installed did not work. The students claimed that the rising violence in the campus is because of disinterested security men and non working CCTV cameras.[8]

Conclusion

The decisions to use CCTVs as a means of surveillance evokes mixed responses. On one side of the debate they are seen as a deterrent to crime while on the other side of the debate they are seen as beinggross infringements on privacy. CCTV surveillance remains as a bone of contention amongst students. If they feel that their personal space is being invaded by these cameras then it needs to be addressed by the administration in a manner which appeases their fear. Universities randomly adopt the policy of CCTV surveillance, disregarding any voice of dissent. Kashmir University put up CCTVs in it’s campus to shoo away lovebirds and the Aligarh Muslim University has installed 57 CCTV cameras in it’s campus to keep a check on students. The rise of the CCTVs in colleges relates to not the actual crime but to the fear of crime. Therefore, CCTVs have become a tool of re-assurance [9]which feeds a notion of safety and security to the authority in charge.

There is no black and white regarding the implementation of CCTVs in universities. A policy can only benefit both sides when decisions are taken with the students, and not on behalf of them. Indian Universities have no guidelines and policies regarding the implementation of CCTVs and students remain unaware of any decisions in this regard. The Universities should clearly spell out their take on CCTVs including:

University policy regarding CCTVs policies
The reasons for introducing CCTVs
The proposed uses of CCTV infrastructure
Which areas in the campus will be kept under surveillance
How will the data collected be stored
How long will the data be retained
How will the data be deleted[10]

The Universities should address all these issues to dispel fear from the minds of the students, and the student unions should be included in the discussions regarding the implementation of CCTVs.

Notes

[1].Webster,William; CCTV policy in the UK: Reconsidering the evidence base; sueveillanceandsociety.org.

[2].Norris, Clive;MC Cahill, Mike;Wood, David; The Growth of CCTV: A Global Perspective on the international diffusion of video surveillance in publically accessible space; surveillance-and-society.org.

[3].Timesnow.tv/jadavpuruniversity, www.haata.com.

[4].http://www.ndtv.com/article/cities/female-hostellers-damage-cctv-cameras-to-protect-privacy-83889, http://toostep.com/debate/is-it-right-to-install-a-cctv-in-girls-hostel-to-stop-unauth.

[5].http://www.mumbaimirror.com/index.aspx?page=article§id=2&contentid=201101212011012104560935753ecb888, http://ibnlive.in.com/news/cctv-cameras-in-hostel-rob-pune-women-of-freedom/142681-3.html.

[6].http://www.expressindia.com/latest-news/after-delhi-police-advisory-du-to-install-cctv-cameras/761421/.

[7].http://www.indianexpress.com/news/women-constables-cctv-cameras-in-girl-stude/766083/.

[8].http://www.punjabcolleges.com/5526999-itemdisplay-Misappropriation-of-funds-on-CCTV,-RTI-exposed-it-Chandigarh.htm.

[9].www.surveillance-and-society.org/ojs/index.php/journal/article/view/prozac/prozac.

[10].www.ucl.ac.uk/estates/security/documents/cctvpolicy.doc, http://www.wustl.edu/policies/cctv-monitoring-and-recording.html.

For more details visit https://cis-india.org/internet-governance/blog/privacy/cctv-in-universities

The Digital Identification Parade

Aayush Rathi and Ambika Tandon — 2019-07-30T00:19:25Z

NCRB’s proposed Automated Facial Recognition System impinges on right to privacy, is likely to target certain groups.

The article by Aayush Rathi and Ambika Tandon was published in the Indian Express on July 29, 2019. The authors acknowledge Sumandro Chattapadhyay, Amber Sinha and Arindrajit Basu for their edits and Karan Saini for his inputs.

The National Crime Records Bureau recently issued a request for proposals for the procurement of an Automated Facial Recognition System (AFRS). The stated objective of the AFRS is to “identify criminals, missing persons/children, unidentified dead bodies and unknown traced children/persons”. It will be designed to compare images against a “watchlist” curated using images from “any […] image database available with police/other entity”, and “newspapers, raids, sent by people, sketches, etc.” The integration of diverse databases indicates the lack of a specific purpose, with potential for ad hoc use at later stages. Data sharing arrangements with the vendor are unclear, raising privacy concerns around corporate access to sensitive information of crores of individuals.

While a senior government official clarified that the AFRS will only be used against the integrated police database in India — the Crime and Criminal Tracking Network and Systems (CCTNS) — the tender explicitly states the integration of several other databases, including the passport database, and the National Automated Fingerprint Identification System. This is hardly reassuring. Even a targeted database like the CCTNS risks over-representation of marginalised communities, as has already been witnessed in other countries. The databases that the CCTNS links together have racial and colonial origins, recording details of unconvicted persons if they are found to be “suspicious”, based on their tribe, caste or appearance. However, including other databases puts millions of innocent individuals on the AFRS’s watchlist. The objective then becomes to identify “potential criminals” — instead of being “presumed innocent”, we are all persons-who-haven’t-been-convicted-yet.

The AFRS may allow indiscriminate searching by tapping into publicly and privately installed CCTVs pan-India. While facial recognition technology (FRT) has proliferated globally, only a few countries have systems that use footage from CCTVs installed in public areas. This is the most excessive use of FRT, building on its more common implementation as border technology. CCTV cameras are already rife with cybersecurity issues, and integration with the AFRS will expand the “attack surface” for exploiting vulnerabilities in the AFRS. Additionally, the AFRS will allow real-time querying, enabling “continuous” mass surveillance. Misuse of continuous surveillance has been seen in China, with the Uighurs being persecuted as an ethnic minority.

FRT differs from other biometric forms of identification (such as fingerprints, DNA samples) in the degree and pervasiveness of surveillance that it enables. It is designed to operate at a distance, without any knowledge of the targeted individual(s). It is far more difficult to prevent an image of one’s face from being captured, and allows for the targeting of multiple persons at a time. By its very nature, it is a non-consensual and covert surveillance technology.

Potential infringements on the right to privacy, a fundamental right, could be enormous as FRT allows for continuous and ongoing identification. Further, the AFRS violates the legal test of proportionality that was articulated in the landmark Puttaswamy judgment, with constant surveillance being used as a strategy for crime detection. Other civil liberties such as free speech and the right to assemble peacefully could be implicated as well, as specific groups of people such as dissidents and protests can be targeted.

Moreover, facial recognition technology has not performed well as a crime detection technology. Challenges arise at the stage of input itself. Variations in pose, illumination, and expression, among other factors, adversely impact the accuracy of automated facial analysis. In the US, law enforcement has been using images from low-quality surveillance feed as probe photos, leading to erroneous matches. A matter of concern is that several arrests have been made solely on the basis of likely matches returned by FRT.

Research indicates that default camera settings better expose light skin than dark, which affects results for FRT across racial groups. Moreover, the software could be tested on certain groups more often than others, and could consequently be more accurate in identifying individuals from that group. The AFRS is envisioned as having both functionalities of an FRT — identification of an individual, and social classification — with the latter holding significant potential to misclassify minority communities.

In the UK, after accounting for a host of the issues outlined above, the Science and Technology Committee, comprising 14 sitting MPs, recently called for a moratorium on deploying live FRT. It will be prudent to pay heed to this directive in India, in the absence of any framework around data protection, or the use of biometric technologies by law enforcement.

The experience of law enforcement’s use of FRT globally, and the unique challenges posed by the usage of live FRT demand closer scrutiny into how it can be regulated. One approach may be to use a technology-neutral regulatory framework that identifies gradations of harms. However, given the history of political surveillance by the Indian state, a complete prohibition on FRT may not be too far-fetched.

For more details visit https://cis-india.org/internet-governance/blog/aayush-rathi-and-ambika-tandon-indian-express-july-29-2019-the-digital-identification-parade

Roundtable with the WhatsApp leadership

Admin — 2019-07-30T00:33:15Z

Will Cathcart, WhatsApp's new global head, visited India and invited Sunil Abraham for a discussion on 26 July 2019 at the Mountbatten, The Oberoi, New Delhi. Sunil met with some other people from WhatsApp leadership.

Discussions took place on the changing policy landscape in India. The event was a free flowing off the record discussion for about an hour between Will Cathcart and representatives of leading civil society organizations.

For more details visit https://cis-india.org/internet-governance/news/roundtable-with-the-whatsapp-leadership

Facebook Data for Good in New Delhi

Admin — 2019-07-31T02:10:23Z

When data is shared responsibly with the communities that need it, it can improve well being and save lives. Anubha Sinha participated in a session organized by Facebook on 29 July 2019 at University of Chicago Center in New Delhi.

Click to download the brochure

For more details visit https://cis-india.org/internet-governance/news/facebook-data-for-good-delhi

Facebook Data for Good in Bangalore

Admin — 2019-07-31T02:14:06Z

When data is shared responsibly with the communities that need it, it can improve well being and save lives. Shweta Mohandas participated in a session organized by Facebook on 25 July 2019 at Indian Institute of Science in Bangalore.

For more details visit https://cis-india.org/internet-governance/news/facebook-data-for-good-in-bangalore

Comments to the ID4D Practitioners’ Guide

Yesha Tshering Paul, Prakriti Singh, and Amber Sinha — 2019-08-08T10:25:13Z

This post presents our comments to the ID4D Practitioners’ Guide: Draft For Consultation released by ID4D in June, 2019. CIS has conducted research on issues related to digital identity since 2012. This submission is divided into three main parts. The first part (General Comments) contains the high-level comments on the Practitioners’ Guide, while the second part (Specific Comments) addresses individual sections in the Guide. The third and final part (Additional Comments) does not relate to particulars in the Practitioners' Guide but other documents that it relies upon. We submitted these comments to ID4D on August 5, 2019. Read our comments here.

For more details visit https://cis-india.org/internet-governance/blog/comments-to-the-id4d-practitioners2019-guide

The Appropriate Use of Digital Identity

amber — 2019-08-08T10:24:40Z

As governments across the globe implement new, foundational, digital identification systems (“Digital ID”), or modernize existing ID programs, there is dire need for greater research and discussion about appropriate uses of Digital ID systems. This significant momentum for creating Digital ID in several parts of the world has been accompanied with concerns about the privacy and exclusion harms of a state issued Digital ID system, resulting in campaigns and litigations in countries such as UK, India, Kenya, and Jamaica. Given the very large range of considerations required to evaluate Digital ID projects, it is necessary to think of evaluation frameworks that can be used for this purpose.

At RightsCon 2019 in Tunis, we presented working drafts on appropriate use of Digital ID by the partner organisations of this three-region research alliance - ITS from Brazil, CIPIT from Kenya, and CIS from India.

In the draft by CIS, we propose a set of principles against which Digital ID may be evaluated. We hope that these draft principles can evolve into a set of best practices that can be used by policymakers when they create and implement Digital ID systems, provide guidance to civil society examinations of Digital ID and highlight questions for further research on the subject. We have drawn from approaches used in documents such as the necessary and proportionate principles, the OECD privacy guidelines and scholarship on harms based approach.

Read and comment on CIS’s Draft framework here.

Download Working drafts by CIPIT, CIS, and ITS here.

For more details visit https://cis-india.org/internet-governance/blog/the-appropriate-use-of-digital-identity