Centre for Internet and Society

Social

praskrishna — 2011-11-14T06:38:37Z

For more details visit http://editors.cis-india.org/home-images/social.jpg

Snooping technology: Will CMS work in India?

praskrishna — 2013-07-22T07:19:02Z

The Indian government plans to spend $132 million on setting up its brand new Central Monitoring System this year.

Pierre Fitter's article was published in FirstPost on July 17, 2013. Pranesh Prakash is quoted.

Several articles have raised valid questions about privacy violations, including this one by Danish Raza. Elsewhere, Pranesh Prakash has raised important points about how CMS may actually violate several laws and at least one Supreme Court verdict.

I ask a much more basic question: will CMS work? Can it really help security agencies eavesdrop on criminals and terrorists, despite several known technical hurdles?

	Encryption In 2008, a prominent Brazilian banker and investor named Daniel Dantas was arrested and charged with money laundering and tax evasion along with a former mayor of Sao Paulo. For five months, the Brazilian National Institute of Criminology tried to read the contents of his hard drive but failed to crack it. Dantas had encrypted his data using a free program called Truecrypt. The INC sent the hard drive to the FBI in the US, which spent a whole year trying to crack it; it too failed. Dantas’s use of encryption likely helped him escape the money laundering and tax evasion charges. He was ultimately convicted of attempting to bribe a police officer.

Encryption

In 2008, a prominent Brazilian banker and investor named Daniel Dantas was arrested and charged with money laundering and tax evasion along with a former mayor of Sao Paulo. For five months, the Brazilian National Institute of Criminology tried to read the contents of his hard drive but failed to crack it. Dantas had encrypted his data using a free program called Truecrypt. The INC sent the hard drive to the FBI in the US, which spent a whole year trying to crack it; it too failed. Dantas’s use of encryption likely helped him escape the money laundering and tax evasion charges. He was ultimately convicted of attempting to bribe a police officer.

This story illustrates a fundamental loophole at the heart of CMS. A criminal, using free and easy-to-use software, can protect his data from even the most advanced surveillance tools available in law enforcement. NSA whistle blower Edward Snowden himself used encrypted email to communicate with journalists at the Guardian. In an online chat where he took questions from the public, Snowden noted that encryption was “one of the few things that you can rely on” to protect you from the eavesdropping behemoth created of the NSA.

It should hardly be surprising then, that terror groups have been encrypting their emails and data for at least the last five years. In fact Al Qaeda developed its own encryption software called ‘Mujahideen Secrets’, to encrypt emails, chat sessions and files. Version two of Mujahideen Secrets even included a tool to delete files securely so that they could not be recovered using special software if the computer was captured. Al Qaeda’s links to several terror groups operating in India has been widely reported in the past. It is not inconceivable that they have shared their encryption software with their comrades-in-arms.

Over the years it has become easier to encrypt one’s communication. YouTube tutorials train even novice users to set up email encryption within minutes. Phone calls, text messages and online chats can also be encrypted with free, easy-to-install apps.

The biggest problem with encryption is that it is virtually impossible to break the code in a time frame that’s useful for law-enforcement purposes. Without getting too technical, modern encryption relies calculating the prime factors of very, very large integers. In 2009, a group of some of the world’s best-known mathematicians and cryptographers reported that it took them four years to factor a 768-bit integer. They estimated it would take 1,000 times longer to factorise a 1024-bit integer. GPG, which is the most widely-used email encryption software, allows users up to 4096-bit encryption. Unless you have the password to the encrypted files, it would take you a very long time to crack the encryption.

Here’s an example to help you understand why encryption makes CMS redundant. Let’s say the system intercepts an encrypted email sent by a LeT handler in Karachi to a sleeper cell in Mumbai. The email contains instructions to detonate a bomb in a specific market at a specific time four days from now. Even if India’s intelligence agencies managed to link up every computer they had available to process the encryption, they would still not be able to crack it in time to learn the details and stop the attack.

What about ‘Metadata’?

It should be noted that encryption only protects the body of the email. The metadata, including the sender’s and receiver’s email addresses remain unencrypted, else the service provider would be unable to send the email to its destination. Law enforcement agencies often partner with email providers to track down the exact computer on which tell-tale emails were read.

However, this method of tracing criminals has a limitation. Programs such as TOR and Hotspot Shield disguise the IP address of a user’s PC. For example, when I use TOR, Facebook will often ask me to confirm my identity as it sees me as logging in from an unfamiliar location. TOR has thousands of servers around the world through which it bounces your data before sending it to its destination.

There is another limitation to using metadata. Due to obvious legal hurdles, CMS will only be deployed to capture communication within India. If terrorists were planning an attack from elsewhere in India’s neighbourhood (as happened with 26/11), we would have to rely on that country’s intelligence services for an alert. Good luck with that!

To make untraceable phone calls, terrorists have been known to use “burner” phones. These are pre-paid phones that are easily available in the US and other countries that do not require an ID for such mobile connections. They can be topped up using cash, which makes their prolonged using even more untraceable.

Even if CMS allowed spooks to listen to these calls, it would not be able to tell who was talking to whom. From details that emerged following the Abbottabad operation that killed Osama bin Laden, we also know that terrorists have been trained to turn off their phones and remove the battery to prevent being tracked even while not on a call.

So what is CMS good for?

If terrorist communications can easily be hidden from CMS, you have to wonder why the government is going through all the effort and expense to set up such a system. What good can come off the mass hoovering of data of ordinary citizens’?

Imagine if CMS intercepted a ‘BBM chat’ between two businessmen, who were discussing a contract that could affect the business interests of a government MP.

Imagine the government getting access to emails exchanged between a journalist and a source in the IAS who wants to expose a major corruption scandal involving a cabinet minister.

Imagine if the government had access to phone calls between two opposition politicians discussing election strategies.

What if CMS tracks a PhD candidate who is researching Naxal terror and has downloaded Naxal pamphlets? What if this researcher has been able to establish contact with Naxals for an interview. Can the government use such data to charge him with participating in a Naxal conspiracy, even if his only intention was to research their motivations? In a country where chief ministers label their critics as “Naxals” for merely raising questions, are we certain we want such unmitigated power in the government’s hands?

These are all questions well worth asking, especially since the ostensible reason for setting up the CMS—monitoring terrorists and criminals—is a fool’s errand at best.

For more details visit http://editors.cis-india.org/news/firstpost-pierre-fitter-july-17-2013-snooping-technology

Snooping Can Lead to Data Abuse (PDF)

praskrishna — 2011-06-09T12:09:54Z

An article by Sunil Abraham in Mail Today on June 9, 2011.

For more details visit http://editors.cis-india.org/internet-governance/publications/snooping-data-abuse.pdf

Snoopgate

praskrishna — 2013-11-19T09:03:27Z

Snoopgate

For more details visit http://editors.cis-india.org/home-images/Snoopgate.png

Snehashish Ghosh

praskrishna — 2012-10-04T09:12:05Z

Snehashish Ghosh

For more details visit http://editors.cis-india.org/home-images/Snehashish.jpg

Snehashish

praskrishna — 2014-08-13T01:09:48Z

Snehashish

For more details visit http://editors.cis-india.org/home-images/copy_of_Snehashish.jpg

Sneha Raman

praskrishna — 2012-01-16T05:20:13Z

For more details visit http://editors.cis-india.org/home-images/DP9.jpg

Sneha

praskrishna — 2014-08-13T00:32:01Z

Sneha

For more details visit http://editors.cis-india.org/home-images/Sneha.jpg

Snapshot

praskrishna — 2016-04-05T15:56:55Z

Snapshot

For more details visit http://editors.cis-india.org/home-images/Snapshot.jpg

Snapshot

praskrishna — 2017-05-03T15:57:51Z

Snapshot

For more details visit http://editors.cis-india.org/home-images/copy_of_Snapshot.jpg

SMTP Server

praskrishna — 2013-03-18T07:11:42Z

SMTP Server

For more details visit http://editors.cis-india.org/home-images/E2.png

Smriti Irani brings back focus on voyeurism prevailing in our country

praskrishna — 2015-05-08T00:59:30Z

The case of Union minister Smriti Irani finding a CCTV camera at Goa's Fab India has again brought back the focus on digital voyeurism and how a critical issue like surveillance can be exploited. Irani's case comes days after a woman found a mobile phone strapped to a changing room door of a Van Heusen store in Lajpat Nagar's Central market, a popular shopping hub.

The article by Amrita Madhukalya was published in DNA on April 6, 2015. Pranesh Prakash gave his inputs.

Bangalore girl Sumitra (name changed) remembers the day in 2009 she saw a camera when trying on a skirt at Palika Bazaar. "I looked around the tiny changing room and saw a camera with a dipping red light. I quickly rushed out and accused the shopkeeper. But, Palika is not a place of great repute, and my friend who was accompanying me asked me to forget the matter," she says, and that's what she did. She was a degree student at Delhi University, and being relatively unaware of the city, decided to keep mum. "But look at what has happened: if they can film a Union minister at a Fab India store, they will film anyone. We need stringent action."

One of the first cases of digital voyeurism was reported in Pune in 2003 when a peon in an establishment at Sahakar Nagar installed a web camera in a changing room. In 2005, landowner Mohan Kulkarni from Navi Peth was arrested for filming women tenants. In 2007, two MMS clips from the changing rooms of a renowned departmental store in Kolkata started making the rounds. In one, a girl was shown changing clothes while in the other a couple was shown having sex. Then a year later, shop assistant Sunil Kumar Jha was found filming women in a clothes store from below the trial room door in Kolkata.

Debarati Halder, advocate and founder of the Centre for Cyber Victim Counselling, feels that had it not been a politician like Irani, the case would not have been highlighted at all. "People would have brushed off the incident had it been another woman. It is hard to escape the amount of negative publicity a case like this garners," she says. This is reflected in the case of a woman who was filmed in a leading store in Mumbai and was scared to approach the police, as she and her father did not want to go through the "legal hassles" of the case. The woman spoke of her story to a journalist of a leading daily and the ensuing report eventually led to the arrest of the shop assistant.

Cyber security expert Pranesh Prakash says that digital voyeurism is a huge problem in India and elsewhere. "There is a mismatch between privacy protection provided in the IT Act against non-consensual sharing of certain forms of sexual images, and the utter disregard for privacy in other parts of the law. Given that cybercafes have often been places where users are secretly filmed, the law should seek to crack down on such invasions of privacy. Instead, the law doesn't prohibit that, and in fact the Cybercafe Rules, encourage cybercafe owners to photograph all users, including minors. The rules say that untrustworthy cybercafe owners keep these records for a minimum period of one year, but there is no maximum period," says Prakash.

Section 66E of the Information Technology Act, 2000, amended in 2008, deals with digital voyeurism. And section 354 (C) of the Indian Penal Code (IPC) deals with voyeurism in general.

But, there are many loopholes. "When the footage is shot by a government-run establishment, then the clause of surveillance is a cover, like in an MMS of Delhi Metro (where a couple was shown making out)."

For more details visit http://editors.cis-india.org/internet-governance/news/dna-april-6-2015-amrita-madhukalya-smriti-irani-brings-back-focus-on-voyeurism-prevailing-in-the-country

Smitha Signature

praskrishna — 2013-03-20T11:08:22Z

Smitha's Signature

For more details visit http://editors.cis-india.org/home-images/SmitaSignature.png

Smari McCarthy

praskrishna — 2014-02-26T08:30:08Z

For more details visit http://editors.cis-india.org/openness/blog-old/smari-talk.pdf

Slow internet driving you nuts? Here is how your service provider is fleecing you

praskrishna — 2016-07-01T15:32:58Z

June 20 was World Wifi Day — an occasion to celebrate speedy, reliable internet connections. India, although a major internet market and the fastest growing now, is a very odd place for such celebration. Average internet speed in India is lower than all other countries in BRICs and lower than most other emerging economies.

The article was published in the Economic Times on June 23, 2016. Sunil Abraham was quoted.

Plus, wired broadband speeds available to 17 million paying consumers in India are far below what service providers promise when they charge end users for particular data services. A data service package that promises 8 Mbps will typically max out at 5 Mbps (Mbps is megabits per second, a measure of internet speed). Wireless connections are even more patchy.

Still worse, the Telecom Regulatory Authority of India (Trai) and consumer advocacy groups haven't made much headway and service providers are ready with a set of arguments. Trai, which will release a consultation paper on promoting WiFi in public places, has a fairly conservative definition of broadband — that download speed should not fall below 512 kbps (kilobits per second; 1Mbps equals 1,000 kbps).

The end result: high-paying consumers suffer.

In a wired broadband service used at homes, few factors determine performance. First, the contention ratio, a key metric that measures the number of internet users sharing a fixed amount of data capacity or 'bandwidth' in a location at the same time. If the number of such users is large, the contention ratio will be high and real internet speed low.

Third is per capita spectrum usage/holdings in a country and India's is far below that of Western countries and major emerging economies.

In India, a low bandwidth availability country to begin with, wired broadband services typically have high contention ratio and/or high latency. Service providers Bharti Airtel, RCom and BSNL did not reply to ET's queries on internet speed.

Bijender Yadav, chief technology & information officer at Sistema Shyam Teleservices, another service provider, told ET data download speeds could fall below contracted levels in case of improper network planning and bandwidth distribution, or if there are glitches in the transmission link between a service provider's internet gateway and the home broadband user's premises.

A senior executive of a leading wired broadband service said, on the condition of anonymity, that companies do make certain assumptions.

Say, 10 customers are sold 2 Mbps connections, which means 20 Mbps should be available. But the company may provide only 5 Mbps for these 10 customers, assuming not all customers will be using their internet connections heavily at the same time. Therefore, the guaranteed internet speed is not 2 Mbps, but just 500 kbps.

Many telco executives ET spoke to said while the contention ratios are high given bandwidth availability, since bandwidth is a "scarce resource" it must be "optimised" to keep prices low for consumers. These executives spoke off record.

Consumer advocacy groups are however sceptical of this argument. They say companies are simply maximising data connection sales without offering good network quality.

"Telcos are selling bandwidth way beyond the optimum capacity of their networks and compromising on speed. Could they have done this if bandwidth was a tangible resource like cars or machines...imagine selling more cars than you've manufactured," asks Hemant Upadhyay, advisor (telecom and IT) at Consumer Voice, a leading telecom consumer group.

Consumer groups have recently urged the telecom regulator, Trai, to ensure an app that can continuously monitor bandwidth availability should be in use.

Sunil Abraham, executive director of Bengaluru-based research organisation, Centre for Internet and Society, argues Trai must ensure mandatory disclosure of contention ratios by service providers. "If such disclosures become mandatory, home broadband users can buy wired internet connections more judiciously with a better sense of what data speeds to expect from telcos and the possible quality of their experience."

Trai did not offer any comment on the call for mandatory disclosure of contention ratios by wired broadband operators.

A top executive of a leading operator, speaking off record, dismissed the proposal, saying "it wouldn't make sense to mandate service providers to make such disclosures as contention ratios vary from place to place".

Some experts are optimistic that WiFi networks may offer better services to high-paying data consumers. Bharti Airtel, Vodafone and new entrant Reliance Jio Infocomm are deploying WiFi networks.

Airtel and Vodafone have also launched WiFi hotspots apps. Jio is slated to do the same after its expected launch later this year.

But WiFi in public places hasn't taken off so far. Cumbersome authentication procedures and challenges around monetising services have been hurdles.

The speed of internet in the world's fastest growing internet market will likely remain below world average in the near future.

Second, the latency of a network, a measure of the delay a user experiences when his/her computer tries to access an internet server. If a service provider runs a low latency network, internet speed will be better.
Third is per capita spectrum usage/holdings in a country and India's is far below that of Western countries and major emerging economies.