Centre for Internet and Society

Is CMS a Compromise of Your Security?

praskrishna — 2013-07-15T06:27:05Z

By secretly monitoring and recording all Indians through a Central Monitoring System, our government will end up making citizens and businesses less safe.

This article appeared in the Forbes India magazine of 12 July, 2013. Sunil Abraham is quoted.

Are you reading this article on your PC or smartphone? No? Do you own a smartphone? Surely a phone then?

If you also happen to live in Delhi, Haryana or Karnataka, then from April this year nearly all your electronic communication—telephony, emails, VOIP, social networking—has been sucked up under an innocuous sounding programme called the Central Monitoring System, or CMS.

There’s no way to tell if you are being watched really, because telecom service providers aren’t part of the set-up. In most cases, they may not even be aware which of their users is being monitored. Neither can you approach a government agency or court to find out more, because there’s practically very little oversight or disclosure. What the government does with the data—how it is stored, secured, accessed or deleted—we don’t know.

Unlike the US and other Western democracies where even for a large scale programme like Prism (leaked recently by 29-year-old whistleblower and now fugitive Edward Snowden), surveillance orders need to be signed by a judge. But in India most orders are signed by either the Central or state home secretary, says Sunil Abraham, executive director for Centre for Internet and Society, Bangalore. This leads to a conflict of interest as the executive branch is both undertaking law enforcement and providing oversight on its own work.

In most cases, the officials are overwhelmed with other work, and don’t have the time to apply their minds to each request. “There is supposed to be an oversight committee that reviews the decisions of home secretaries, but we don’t have any idea about that committee either,” says Abraham.

Meanwhile, government bodies like the R&AW, Central Bureau of Investigation, National Investigation Agency, Central Board of Direct Taxes, Narcotics Control Bureau and the Enforcement Directorate will have the right to look up your data. Starting next year, all mobile telephony operators will also need to track and store the geographical location from which subscribers make or receive calls.

“I see it as the rise of techno-determinism in our security apparatus. Previously, our philosophy was to avoid infringing on individual privacy, and monitor a small set of individuals directly suspected of engaging in illegal activities. Now, thanks to the Utopianism being offered up by ‘Big Data’ infrastructure, putting everybody under blanket surveillance seems like a better way to serve our security and law enforcement agendas more effectively,” says Abraham.

There is a real risk that CMS and the numerous other monitoring programmes that will subsequently connect to it will end up harming more Indians than protecting them.

The biggest risk is that these programmes will turn into lucrative ‘honey pots’ for hackers, criminals and rival countries. Why bother hacking individuals and companies if you can attack the CMS? We’ve seen private corporations and government agencies in the US, Israel and the UK getting hacked. So let’s not have any illusions that India is going to fare much better.

Another consequence is that sooner or later innocent citizens will be wrongly accused of being criminals based on mistaken data patterns. While searching for matches in any database with hundreds of millions of records, the risk of a ‘false positive’ increases disproportionately because there are exponentially more innocents than there are guilty. And in the near-Dystopian construct of the CMS, it will take months or years for such errors to be rectified.

As more Indians become aware of these programmes, they will adopt encryption and masking tools to hide their digital selves. In the process, numerous ‘unintended consequences’ of failing to differentiate law-abiding citizens from criminals will be created. What answer will a normal citizen offer to a law enforcement official who wants to know why he or she has encrypted all communications and hosted a personal server in, say, Sweden?

But arguably the biggest threat of 24x7 surveillance is to businesses. Security and trust are the foundations atop which most modern businesses are built. From your purchase of a gadget on an ecommerce site to a large conglomerate’s secret bid in a government auction to discussions within a company on future business strategies to patent applications—everything requires secrecy and security. All an unscrupulous competitor, whether it be a company or a country, has to do to go one-up on you is to attack the CMS and other central databases.

“The reason why the USA historically decided not to impose blanket surveillance wasn’t because of human rights, but to protect its businesses and intellectual property. Because while we may be able to live in a society without human rights, we cannot be in one without functional markets,” says Abraham.

He goes on to say that the recent disclosures around the various spying programmes run by the US have made the private surveillance and security industry very happy. “Each incident becomes a case-study to pit one country against another, forcing each one to cherry-pick the worst global practices in a dangerous race to the bottom. Civil society and privacy activists don’t have the resources to fight large vendors and so the only thing that will stop this is the leak of large databases, like that of 9 million Israeli biometric records a few years back.”

Recollecting the news about a family-business break-up some years ago, where two brothers agreed to split their businesses, the net result was one brother opted out of telephony services offered by the other. All of that is now moot. “There are no more shadows now. Nobody will have refuge and everybody will be exposed,” says Abraham.

For more details visit http://editors.cis-india.org/news/forbesindia-article-real-issue-july9-2013-rohin-dharmakumar-is-cms-a-compromise-of-your-security

Tenders, EOI and Press Release

praskrishna — 2013-07-15T05:56:07Z

For more details visit http://editors.cis-india.org/internet-governance/blog/tenders-eoi-press-release.zip

RTI on Officials and Agencies Authorized to Intercept Telephone Messages in India

praskrishna — 2013-07-15T05:23:54Z

In an RTI mailed on April 17, 2013, the Centre for Internet and Society sought comprehensive information on the officials and agencies authorized to intercept telephone messages in India.

A portion of the RTI still awaits response, as it was redirected to the Department of Electronics and Information Technology. But on May 23, 2013 Rakesh Mittal of the Ministry of Home Affairs responded in brief and directed us to the 2007 Amendment to the 1885 Indian Telegraph Act.

Referring to rule 419-A of the amendment and the Ministry of Home Affairs website, we find that within central government the power to order communications surveillance is normally reserved for Union Home Secretary, a position held by Shir Anil Goswami as of June 30, 2013 (previously R.K. Singh). The amendment goes on to say, “In unavoidable circumstances,” however, such an order can be commanded by a Joint Secretary who has been authorized by Union Home Secretary Goswami. On the federal level, the Ministry of Home Affairs includes nearly 20 such Joint Secretaries able to be authorized for making interception commands.

A listing of the original question requests are given below:

Please provide a list containing name, rank and office address of the officers/agencies authorized by the Central Government to issue an order for interception under section 5(2) of the Telegraph Act, 1885
Please provide a list containing name, rank and office address of the officers authorized to issue interception orders under Rule 419A(1) of the Telegraph Rules, 1951 in unavoidable circumstances when such orders cannot be issued by the secretary to the Government of India, Ministry of Home Affairs.
Please provide a list containing the name, rank and office address of the officers/agencies designated as “competent authority” in terms of the Rule 419A(1) proviso of the Telegraph Rules, 1951.
Please provide a list of the agencies authorized by the Central Government to intercept, monitor, decrypt any information generated, transmitted, received or stored in any computer resource under section 69(1) of the Information Technology Act, 2000.
Please provide a list of the agencies authorized by the Central Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource under section 69-B of the Information Technology Act, 2000.
Please provide a list containing name, rank and office address of the officers/agencies authorized to issue interception orders under Rule 3, first proviso, of the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009.
Please provide a list of the agencies authorised to intercept, monitor, decrypt any information generated, transmitted, received or stored in any computer resource under Rule 4 of the Information Technology (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules, 2009.

For more details visit http://editors.cis-india.org/internet-governance/resources/rti-on-officials-and-agencies-authorized-to-intercept-telephone-messages-in-india

Redirected to DEITY for Response to RTI

praskrishna — 2013-07-15T05:04:30Z

Ministry of Home Affairs redirected to the Department of Electronics and Communication Information to respond to the RTI filed by CIS regarding information on the officials and agencies authorized to intercept telephone messages in India.

For more details visit http://editors.cis-india.org/internet-governance/blog/redirected-to-deity.pdf

Response from Ministry of Home Affairs

praskrishna — 2013-07-15T04:34:10Z

Rakesh Mittal's reply received by the Centre for Internet and Society.

For more details visit http://editors.cis-india.org/internet-governance/blog/response-from-ministry-of-home-affairs.pdf

Public Interest Litigation for Protection of Indian Internet Data, Action Against Foreign Internet Providers

praskrishna — 2013-07-15T04:19:26Z

For more details visit http://editors.cis-india.org/internet-governance/blog/pil.pdf

A Telugu Wikipedia Meet-up @ CIS, Bangalore

praskrishna — 2013-07-12T04:58:39Z

Telugu Wikipedians are having their monthly meet-up at the Centre for Internet and Society in Bangalore on Saturday, July 13, 2013, from 2.00 p.m. to 5.00 p.m.

Click to read the event page on Wikipedia

వికీపీడియా:సమావేశం/బెంగుళూరు/13 జూలై 2013

బెంగుళూరులో రెండవ (సాధారణ) తెలుగు వికీపీడియన్ల సమావేశం

కార్యక్రమ వివరాలు

తేదీ: 13-జూలై-2013 (రెండవ శనివారం)
సమయం: మధ్యాహ్నం గం: 2.00 నుండి సాయంత్రం గం: 5.00 వరకు
వేదిక: సెంటర్ ఫర్ ఇంటర్నెట్ అండ్ సొసైటీ, నెం. 194, రెండవ సి క్రాస్, దొమ్మలూరు, రెండవ స్టేజీ, బెంగుళూరు - 560071 (ఫోన్: +91 80 4092 6283),గూగుల్ మేప్ తో సహా వివరాలు

చర్చాంశాలు

సా2:00:
- స్వాగతం .. శశి
- పరిచయాలు.. అందరు
- తెవికీ పరిచయం..శశి
సా 3:00
- అరవిందుల రచన సావిత్రి గురించి పరిచయం.. డా. టి రామకృష్ణ (ప్రత్యేక అతిథి)
సా4:00
- తెవికీ ప్రాజెక్టు తెలుగు ప్రముఖులు పురోగతి,సమస్యలు .. ప్రాజెక్టు సభ్యులు
- బెంగుళూరు లో తెవికీ కార్యక్రమాలు, సభ్యుల వృద్ధి.. అందరు
- తెవికీలో సమస్యలు పరిష్కారాలు.. అందరు
- తెలుగువారి కుటుంబాలలో సంబంధబాంధవ్యాలు.. అందరు
- <విషయం చేర్చండి>

వక్తల పరిచయం:

డా.టి.రామకృష్ణ జీవసాంకేతిక రంగంలో ఆచార్యుడిగా, శాస్త్రవేత్తగా అపార అనుభవం గడించారు. ప్రస్తుతం శ్రీఅరవిందో మానవీయ విలువల విద్యా కేంద్రం (Sri Aurobindo Centre for Education in Human Values) లో పరిశోధన మరియు అభివృద్ధి సంచాలకునిగా పనిచేస్తున్నారు. అరవిందులు రచించిన సావిత్రి నవల చదివి ప్రభావితమై ఆ నవలను తెలుగులోకి అనువదించారు.

సూచనలు: బెంగుళూరులో వున్న వారు తప్పక నోట్ బుక్ లేక టాబ్లెట్ కంప్యూటర్లు తెచ్చుకుంటే ప్రత్యక్షంగా సమస్యల పరిష్కారానికి వీలవుతుంది.
ప్రత్యక్షంగా పాల్గొనలేనివారికోసం గూగుల్ హేంగౌటు ప్రయత్నించబడుతుంది. వివరాలకు సమావేశసమయానికి వెబ్ ఛాట్ లో #wikimedia-in చానల్ లేక ఇదే పేజీలో చూడండి.

సమావేశ నిర్వహణ నేపధ్యం భారతదేశంలో వికీమీడియా చాప్టర్ జనవరి 3, 2011 న బెంగుళూరులో నమోదైంది. ముంబయి సముదాయంతో కలసి వికీ కాన్ఫరెన్స్ ఇండియా అనబడే జాతీయ స్థాయి సమావేశాన్ని నవంబరు 18-20 , 2011 లలో నిర్వహించింది. గత రెండేళ్లలో అనేకచోట్ల వికీ ప్రచార కార్యక్రమాలు దిగ్విజయంగా నిర్వహిస్తున్నది. కార్యక్రమాలను మరింత చురుకుగా చేయటానికి మరియు విస్తరించటానికి, మరియు కార్యనిర్వహక జట్టులోని సభ్యుల నేతృత్వంలో నగర మరియు భాషా ప్రత్యేక ఆసక్తి జట్టులు పనిచేస్తున్నాయి. బెంగుళూరులోని తెలుగు ప్రత్యేక ఆసక్తి జట్టు సభ్యులు మరియు సెంటర్ ఫర్ ఇంటర్నెట్ అండ్ సొసైటీ, బెంగుళూరు వారి జ్ఞానాన్ని చేరువచేర్చు జట్టు (Access to Knowledge)తో కలసి నెలవారీ సమావేశాలు ప్రతి నెల రెండవ శనివారం నాడు నిర్వహిస్తున్నది. దీనిలో ప్రముఖ తెలుగు వక్తల ఉపన్యాసాలతో బాటు తెలుగువికీ పరిచయం మరియువికీ పనిని సులభంచేసే ప్రాజెక్టులుమరియు సాంకేతికాంశాలపై ప్రసంగాలు మరియు వికీసమస్యలకు పరిష్కారాలుంటాయి. మరిన్ని వివరాలకు శశిధర్ లేక రవిచంద్రను సంప్రందించండి.

ఇవీ చూడండి

జూన్ నెల సమావేశం పేజి

సమావేశానికి ముందస్తు నమోదు

(నమోదు తప్పనిసరికాదు కాని నిర్వాహకులకు సహాయంగా మరియు ఇతరులకు ప్రోత్సాహంగా వుంటుంది. పైన మార్చు నొక్కి మీ పేరు చేర్చవచ్చు)

తప్పక

-- శశి (చర్చ) 06:01, 29 జూన్ 2013 (UTC)
--అర్జున (చర్చ) 06:27, 29 జూన్ 2013 (UTC)
--రవిచంద్ర (చర్చ) 11:57, 29 జూన్ 2013 (UTC)
--రహ్మానుద్దీన్ (చర్చ) 04:59, 4 జూలై 2013 (UTC)
<పై వరసలో పేరు చేర్చండి లేక సంతకం చేయండి>

బహుశా

<పై వరసలో పేరు చేర్చండి లేక సంతకం చేయండి>

పాల్గొనటానికి కుదరని

ఇదే రోజు CIS-A2K, IISc మరియు ఇతర ఉన్నత విద్యాసంస్థలు భాగస్వామ్యం వహిస్తున్న ఇంకొక కార్యక్రమంలో పాల్గొనడంవలన మన ఈ సమావేశానికి రాలేకపోతున్నాను. సమావేశం విజయవంతం కావాడానికి CIS-A2K నుండి అన్ని విధాలా సహాయసహకారాలు అందింపచేయడానికి నా వంతు కృషి చేస్తాను. -- విష్ణు (చర్చ)06:13, 11 జూలై 2013 (UTC)
<పై వరసలో పేరు చేర్చండి లేక సంతకం చేయండి>

స్పందనలు

<పై వరసలో స్పందించండి>

For more details visit http://editors.cis-india.org/openness/events/telegu-wikipedia-meet-up-july-13-2013

CIS Gets ITU-D Membership Certificate

praskrishna — 2013-07-11T10:08:57Z

For more details visit http://editors.cis-india.org/accessibility/blog/itu-d-membership-certificate.pdf

India-EU Proposed FTA

praskrishna — 2013-07-10T08:49:44Z

For more details visit http://editors.cis-india.org/a2k/blogs/india-eu-proposed-fta.pdf

dna exclusive: Geeks have a solution to digital surveillance in India: Cryptography

praskrishna — 2013-07-15T06:24:40Z

While you were thinking of what next to post on Twitter, the government has stealthily put an ambitious surveillance programme in place that tracks your every move in the digital world — through voice calls, SMS and MMS, GPRS, fax communications on landlines, video calls and emails.

The article by Joanna Lobo was published in DNA on July 7, 2013. Pranesh Prakash is quoted.

The programme, conceived in 2011, has now been brought under one umbrella referred to as the centralised monitoring system (CMS). It is the death of privacy.

But as concerned citizens argue for the need to formulate policies and laws to protect privacy, there's a simpler solution in sight for now: a CryptoParty.

At this 'party', an informal gathering of people, non-geeks can learn how to legally encrypt their digital communications and how to store data without the fear of anyone snooping in. Encryption is a process of encoding messages so that it can only be read by authorised parties.

What is it?
"A CryptoParty educates people in the domain of cryptography. It's usually about the basics: how to send encrypted email, how to protect your hardware and how to use free and open source software," says Satyakam Goswami, a free software consultant associated with the Software Freedom Law Centre (SFLC), Delhi (remove this). Goswami was one of the 72 participants at the CryptoParty organised on Saturday at Institute of Informatics & Communication (IIC), Delhi University South Campus On June 30, a CryptoParty organised at the Centre for Internet and Society (CIS) in Bangalore had 30 people in attendance. "We were taught about the what, how and who is watching us. We were also taught how to encrypt emails, chat, video calls or instant messaging,” says Siddhart Prakash Rao, a computer science graduate and a free software and open source enthusiast who is about to pursue a Masters in Cryptography.

The topics may be a mouthful for non-geeks but CryptoParty advocates maintain that all this is taught in the simplest way possible. The choice of subject depends on the composition of the group — if it is a gathering of geeks, like at the Bangalore event, then the topics are more technical.

How can it help?
CryptoParties started in August 2012 by an Australian woman (who goes by the pseudonym Asher Wolf) after a conversation on Twitter about The Australian Parliament's new cybercrime bill that allowed law enforcement to ask Internet Service Providers to monitor and store data.
Attending a CryptoParty is a good way to learn how to overcome government snooping legally.

“Citizens should use encryption to safeguard their private communications against both corporations and the government. Encryption is one of the best ways to react to CMS along with increased civic vigilance and democratic questioning of our government and parliamentarians,” says Pranesh Prakash, policy director, CIS, and one of the frontrunners in the fight to formulate a policy to safeguard privacy in India.

"In India, people tend to be rather ignorant. They are not aware of the kind of surveillance they are subjected to once online. It's a lack of understanding," says Sumandro Chattapadhyay, a researcher with Sarai, a programme of the Centre for the Study of Developing Societies, Delhi.

Bernadette Langle, who also works at CIS has been instrumental in organising the handful of CryptoParties in the country. When dna spoke to her, she was on her way to Delhi after participating in the Bangalore event. Langle will also be part of a CryptoParty being planned for October in Mumbai. "Ten years ago, you had to be a geek to be able to encrypt and protect yourself online. Now, you need software and it's much easier," she says.

The advantage is that the privacy tactics taught at such parties is completely legal. All knowledge is in the public domain. “A government will only deny its citizens basic communications privacy if it is authoritarian,” says Pranesh. “So while it can try social engineering and other means to gain access to what you've encrypted, it simply cannot 'decode' it as long as you have chosen a strong pass phrase and keep that protected, or they create quantum computers capable of breaking your encryption.”

The CIS is currently working on revisions of the Privacy (Protection) Bill 2013 with the objective of contributing to privacy legislation in India. Till that bill becomes an Act and till there's a better way to overcome needless government surveillance, attending a CryptoParty could possibly be the wisest solution for those concerned about privacy.

(For more details on CryptoParties, visit www.cryptoparty.in)

How to encrypt:
SMS: Make content secure by using software like TextSecure (Android) or CryptoSMS (Symbian). However, SMS metadata (who you are sending the message to and at what time) can still be tracked.

Instead of Whatsapp, install Jabbir and add off the record encryption.

For email, you can use OpenPGP in conjunction with Thunderbird to encrypt mails you send from Gmail/Yahoo Mail/Live Mail accounts so that even Google, Yahoo and Microsoft can't read them

For web browsing, use a VPN (which will hide your traffic from your ISP), or Tor (which will help anonymise your traffic, but will slow down your connection slower).

For more details visit http://editors.cis-india.org/news/report-dna-july-7-2013-joanna-lobo-geeks-have-a-solution-to-digital-surveillance-in-india-cryptography

Political Economy, Activism and Alternative Economic Strategies

praskrishna — 2013-08-05T05:59:45Z

The fourth annual conference in political economy was organized by the International Institute of Social Studies, Erasmus University of Rotterdam at the Hague from July 9 - 13, 2013.

Nishant Shah participated as a speaker and presented the paper on Citizen Action in the Time of Network. Click to read the full details of the conference here.

About the Conference

The financial crisis revealed its first signs over five years ago, on August 9, 2007, when BNP Paribus suspended payment on three of its funds. It has since morphed into the deepest US and then world economic crisis since the Great Depression. The “green shoots” of recovery of some Third World economies, that the IMF had acclaimed in 2010, had withered within a year. By 2012 it was admitted that the “world recovery had stalled”, as even the handful of large, better-performing, developing economies slowed. But, ever upbeat except when imposing adjustment, the IMF predicts not only an improved 2013 but continual yearly growth over the following four years as well.

Yet, the world’s largest economy remains stuck. While even the weak economic growth in the USA looks good by comparison with Europe, measured unemployment remains around 8%. Home loss, homelessness, poverty and hunger remain at their highest levels in decades. Nor is there a prospect of a recovery across Europe. The northern economies, and especially Germany, that until now have performed better in the core- periphery division of the continent, have stagnated, inevitable perhaps given the prolonged implosion of the economies of their most important foreign customers. There is a particularly severe crisis of youth unemployment. And the stagnation of the economies of the First World has caused a sharp slowing of growth in their BRIC counterparts and the few other better-performing Third World economies that the recovery Pollyannas had projected for several years as the engines that would drive the world rebound. Popular discontent has manifested itself in varieties of ways, from the Arab Spring to the renewal of Latin American left radicalism. In the global North, it has erupted in the form of the movements of the Indignados in Spain, Occupy Wall Street in the USA, and popular resistance in Greece. Whilst the Greek political system has been transformed beyond recognition but without resolution of the ongoing economic and political crisis, action in the rest of the North has appeared to have limited lifespan and effects, even with polls showing very high dissatisfaction with the current economic and political situation. It is striking how no broadly supported political movements have arisen, successfully promoting and engaging in a struggle for alternative economic policies. And, in their absence, finance has slowly , if not rapidly, and surely restored its economic, political and ideological hegemony over everything from our daily lives to our longer-term prospects, from the environment to our social and economic prospects.

The ongoing economic and political crises place two related questions on history’s agenda. In the face of the dismal failure of the continuing, mostly overt neoliberal policies to resolve the deep problems, what alternative economic strategies should be pursued? And a more radical form of that same question, are alternative economic structures and an entirely different system of economic structures and practices necessary? The second question is concerns the sorts of actions that must be engaged to move the political process on to a path of alternative outcomes, from mild reforms to major transformation (and the connection between the two).

The 2013 Annual Conference of IIPPE will focus on these questions. In doing so, it will need to acknowledge: the breadth and depth of discontent and the more or less spontaneous protest and conflict against the consequences of the crisis; how struggles have been conditioned by the crisis and the failure to resolve it without either determining their form and strength, their diversity and their complex dependence on non-economic factors; and the lack of strength, unity and coherence of oppositions and posing of alternatives. In this light, the conference will bring together scholars from all strands of political economy and heterodox economics, in seeking to engage debate with political parties and other progressive organisations in order to explain the incidence of struggles and how they might best be supported in bringing about broader, deeper and more unified responses to the crisis. In particular, it will be necessary to interrogate how continuing general conceptualisations, such as financialisation and neoliberalism, can (or cannot) be put to these purposes, when set against the diverse experiences of, and response to, the crisis.

Read the original published at the IIPPE website.

For more details visit http://editors.cis-india.org/news/iippee-july-8-2013-fourth-annual-conference-in-political-economy