Centre for Internet and Society

Open Spectrum

praskrishna — 2012-06-25T04:02:43Z

For more details visit http://editors.cis-india.org/home-images/apc.jpg

Open Source India 2015

praskrishna — 2015-12-15T07:46:46Z

The twelfth Open Source India event organized by EFY Group was held at NIMHANS Convention Centre in Bangalore on November 19 and 20, 2015. Subhashish Panigrahi attended the event for the first day.

Open Source India (OSI) is the premierconference in Asia targeted at nurturing and promoting the Open Source ecosystem in the subcontinent. Started as LinuxAsia in 2004, OSI has been at the helm of bringing together the Open Source industry and the community in the last 11 years. The 12th edition of OSI this year aimed to take this event a notch higher by focusing on the Open Source ecosystem in Asia, and more specifically, in India.

For more information see the brochure of the event. Schedule of the event on Day 1 here and Schedule of the event on Day 2 here.

For more details visit http://editors.cis-india.org/openness/news/open-source-india-2015

Open Source

praskrishna — 2021-11-29T15:08:33Z

Open Source

For more details visit http://editors.cis-india.org/home-images/OpenSource.png

Open sesame

praskrishna — 2015-09-25T01:31:49Z

The government’s email is shockingly vulnerable.

The article was published in the Hindu on September 22, 2015. CIS research on private email accounts is mentioned.

As the Centre moves towards smart cities and a Digital India, some critics have cited the country’s increased vulnerability to cyber attacks. To be sure, cyber threat groups could disrupt our infrastructure by taking control of many systems. Such attacks could be quite damaging. Yes, they are rare today, but are much more likely to arise in conjunction with traditional armed conflicts. Cyber criminal groups target Indian organisations on a daily basis.

Almost two years ago, the IT minister’s office triggered national outrage when it used a public email service for official communication. There was much hand-wringing about security practices in a ministry responsible for setting the technology direction (secure email policy) for the country. Then in December 2013, the Centre for Internet and Society revealed that up to 90 per cent of Indian government officials used private email accounts for professional purposes.

A big deal

Between then and now, we’ve read about a new email policy and revelations of several cyber attacks on government officials. And FireEye revealed a decade-long cyber espionage operation by a group we call ‘APT30’, which is likely to be sponsored by China. How did they break in? By sending targeted ‘spear-phish’ emails with malware attached.

Email doesn’t sound like a big deal. Most of us have been using it for over a decade, and think we know how to use it right. But when you’re in a position of authority with access to sensitive information, you shouldn’t leave it to chance.

Today, state-sponsored attackers craft these spear-phishing emails after considerable research. APT30 carefully researched their targets and crafted mails which would appear extremely relevant, with interesting content. The moment a victim would open an attachment, an exploit would secretly install a backdoor. Through that backdoor, groups can compromise the employee’s entire network and extricate sensitive data. Groups bent on destruction can deploy malware to destroy the data. They could also take control of systems managing infrastructure or industrial processes and create havoc.

Spear-phishing has an open rate of 70 per cent, while regular mass emails had an open rate of just 3 per cent. Email is the front- door for today’s threat groups. That’s why governments around the world are improving the security of their email systems to fend off these spear-phishing threats.

Public concerns

When government employees use webmail for official business, they trade away their security for convenience. The emails they receive are no longer screened by cyber security solutions, which detect advanced targeted email attacks before they reach the inbox. In addition, because people typically retrieve their webmail in a browser, attackers have a larger attack surface to exploit when carrying out their attacks. For example, attackers can coax victims to click on a link to a website, which delivers an exploit via Adobe Flash.

Webmail opens the door to threats that would otherwise have been intercepted. When our government employees use webmail for official business, they leave the front door wide open to threats. One of the best steps we can take towards improving our government’s cyber security defences is abandoning public email services.

The writer is a software architect at the cyber security firm FireEye

For more details visit http://editors.cis-india.org/internet-governance/news/the-hindu-september-22-2015-atul-kabra-open-sesame

Open Science Presentation at ICFOSS

praskrishna — 2014-12-28T01:41:37Z

For more details visit http://editors.cis-india.org/openness/blog-old/open-science.ppt

Open Page

praskrishna — 2012-11-03T10:58:51Z

Open Page

For more details visit http://editors.cis-india.org/home-images/openpage1low.png

Open Licensing Policy Guidelines

praskrishna — 2014-05-30T05:55:25Z

For more details visit http://editors.cis-india.org/openness/blog-old/open-licensing-policy-guidelines.pdf

Open Letter to the Finance Committee: UID and Transactions

praskrishna — 2011-02-24T13:35:11Z

Since official documentation from the UIDAI is very limited, we assume that data pertaining to transactions would comprise of the Aadhaar number, identifier of the authenticating device, date-time stamp, and approval/rejection/error code. Recording and maintaining of data pertaining to transactions is very important because it increases transparency and accountability through an audit trail. However, storage of such sensitive data creates many privacy risks, because more often than not metadata gives you as much intelligence as raw data.

For example – even if you didn’t have access to the Radia recordings – just knowing who she called, when, how frequently, in what order, and for how long, will give quite a comprehensive picture. Thus, we believe that such data should not be fully stored in a central database. By way of an open letter, we suggest three alternative ways of storing and securing data relating to transactions, so that transparency and accountability is preserved without enabling surveillance or profiling of individuals.

Partial storage of data relating to transactions

Once a transaction is processed, half of the UID number is stored in the central database, while the other half of the number is stored with the service provider. Thus, for an agency to reconstruct the audit trail they must seek consent from the service provider and the UIDAI for information regarding a specific transaction. The process would follow steps like these:

Send part of the Aadhaar number to the CIDR
Service provider stores part of the Aadhaar number locally.
Law enforcement and intelligence agencies seeking transaction data securing required approvals from the Home Ministry and then request data from the UIDAI and service provider
Data is provided by UIDAI and the service provider and combined to reconstruct the audit trail.

Storage of the public keys with a custodian

Similar to the model followed in the new wiretapping regulations1, the transaction details in the central database is secured using several custodians. Thus, no single entity has complete knowledge of access to the database. And if the transaction details are leaked to the public, the custodian can be held responsible for negligence. Thus, for an agency to reconstruct the audit trail they must seek approvals and request encrypted data. The process would follow steps like these:

Encrypt transaction data with the public key of the ‘custodian’
Store encrypted data in CIDR
Law enforcement and intelligence agencies seeking transaction details require approvals from the Home Ministry, and then request encrypted data from the UIDAI.
The custodian on receipt of the necessary approvals decrypts the data using his/her private key, and then the audit trail becomes available.

Complete storage of transaction details at the service provider level

After a transaction is processed, the information is encrypted and stored in a de-centralized manner with the service provider, thus agencies or individuals can only access information regarding a specific transaction at a specific organization. The process would follow steps like these:

Encrypt transaction data
Store encrypted data at service provider level
Law enforcement and intelligence agencies seeking transaction details require approvals from the Home Ministry, and then request encrypted data from each service provider. Audit trail is reconstructed by merging data sets from different service providers.
The CIDR will only hold Aadhaar number, date-time stamp, and approval/rejection/error code.

Note

1 http://timesofindia.indiatimes.com/india/Tapping-norms-Govt-will-erase-private-talk/articleshow/7407633.cms

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/uid-and-transactions

Open Letter to the Finance Committee: UID Budget

praskrishna — 2011-02-17T11:18:16Z

This note presents the aspects of the UID project, which have not been considered or incorporated into the UID’s budget. The costs include re-enrollment, loss in human time, and the cost of the audit function.

Cost of re-enrollment
In the report 'Biometrics Design Standards for UID Applications' 1 a pilot study in India concluded that about two to five per cent of the people did not have viable biometric data. These data have not been taken into account when setting the program budget. Over time biometrics modify, thus re-enrollment will be required. The UIDAI states that given the changing nature of biometric data – biometrics would be collected every five years for children and every ten years for adults. The current project does not give us a clear picture as to what extent the re-enrollment will be required, and how the additional costs will be accounted for.
Cost of loss in human time
A time motion study is a tool used to enhance business efficiency and ensure cost effectiveness by reducing the number of motions in performing a task. In their budget, the UIDAI has accounted for the salaries of individuals associated directly with the UIDAI. The UIDAI has not accounted for the loss in human time that will take place by individuals whose daily routine will be impacted by the UID. If a time motion study were to be done only on the UID project, one would find that individuals not paid by the UIDAI, lose potential wages due to the unpaid time they must dedicate towards the scheme – or that businesses will be forced to compensate for the extra time required for each transaction by providing additional personnel. For example: On a train the number of train masters present is calculated according to how many individuals each ticket master can check and process. With the UID, in order to prevent fraud around subsidized train tickets , individuals on the train will have their biometrics checked and authenticated. The below diagram demonstrates how authenticating an individual by their UID and biometric incurs a loss in human time, and thus, the process of collecting train tickets will require more train masters to complete.
Current Process:
- Present ticket to train master
- Train master checks identity card and identity on ticket
- Train master ticks ticket, and ticks his list to indicate verification
Process with biometrics:
- Present Aadhaar number, fingerprint , and ticket to train master
- Train master takes a reading of your fingerprint and sends it to the central database
- Train master waits for approval from the CIDR
- The CIDR gives a yes or no response
- If the answer is no – the train master swipes your finger five times, and then finds alternate forms of identification
- Train master provides proof of verification
Cost of audit function
The bulk of the UID enabled transactions will have financial implications. Every financial transaction involves three or four parties: the person who collects the payment, the person who prepares the documentation, the person who approves the documentation, and finally the person who audits the documentation. In such a context the technology can play the role of the person who: collects, prepares, and approves each transaction. The role of auditing the transaction cannot be played by technology. The audit function is human, and the audit function needs to be worked into the project budget.

1 “Biometrics Design Standards for UID Applications" pg.22

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/uid-budget

Open Letter to the Finance Committee: Operational Design

praskrishna — 2011-02-17T10:02:46Z

The objective of the UID project is to provide identity infrastructure that is not susceptible to fraud or error. This note highlights parts of the operational design of the project, which are flawed. We plead that each point be taken into consideration and that the design be suitably revised.

Flawed aspects of the operational design

During enrolment: false identities

Initial proof of one’s identity is best proved through multiple, standardized documents. The UID lists seventeen acceptable documents.1 Acceptance and verification of only one of these identities is necessary for enrolment. This is a lower standard than existing forms of identity such as the Passport or the PAN card.2

During transactions: technology will not solve corruption

In every transaction that requires the use of the Aadhaar number, there are four points where corruption is possible and delivery of services will not take place:

The technology fails, and does not perform authentication;
The authority fails and delivers a false positive or false negative;
The local administrator fails to deliver the service after authentication;
The biometric fails due to biological changes, and thus the individual is denied benefits; and
Fraudulent use of face biometrics at the transaction level.

During transactions: high cost of centralization with limited benefits

Verifying unique identity for every transaction will introduce an unnecessary authentication overhead. In the UID Bill, there is provision for standardized authentication fees.3

At some point service providers will pass on the authentication cost through a required authentication fee to the residents. This will take place with no entitlement of any service or guarantee against fraud.

During redressal: no guarantee of quick and adequate remedies

The delivery of services is guaranteed only when there is an optional way for transactions to be completed. If an Aadhaar number holder attempts to complete a transaction, and the UIDAI rejects it, the individual can make a request for re-verification with the registrar.4

If the UIDAI still rejects the request, the individual must file a complaint to the UIDAI contact centre and wait for appropriate remedial action,5 yet the UIDAI is not liable for the loss of service.

During upgrades of the system: patchwork approach to data protection

It is more secure to have pro-active data protection than re-active data protection. The data protection legislation that is meant to secure data processed in the UID project will be established only after the UID bill becomes law. One can only assume that the UID will respond to every new policy development in a patchwork fashion.

1http://uidai.gov.in/index.php?option=com_fsf&view=faq&Itemid=206&catid=24

2 http://passport.nic.in/, http://nrisharejunction.com/pan.aspx

3 Chapter 3, Section 23 (2) (o): The National Identification Authority of India Bill 2010

4 http://uidai.gov.in/UID_PDF/Front_Page_Articles/Documents/Strategy_Overveiw-001.pdf

5 http://uidai.gov.in/images/FrontPageUpdates/aadhaarhandbookver1.2.pdf pg.18

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/operational-design

Open Letter to the Finance Committee: Finance and Security

praskrishna — 2011-02-17T11:57:42Z

This note explores the three connections between finance and security and demonstrates the cost implications of operating a centrally designed identity management system as proposed by the UID. In doing so, it shows how the monitoring, storing, and securing of transactional data in a centralized database fall short of meeting the project's objectives of authentication, and thus is an additional cost. Further, it is argued that the blanket monitoring of the transaction database is not an effective method of detecting fraud, and is an expensive component of the project.

Operating a centralized identity management system that requires the use of a remote database for every transaction is always more expensive than a decentralized identity management system that could optionally use a local database.

Centralized database costs

Both public and private keys must be centrally stored
All transactions require connectivity for the sending and receiving of authentication of data, and have an associated connectivity cost
Securing all data at a central database has augmented costs

Decentralized database costs

Only the public key must be centrally stored
Some transactions require connectivity for the sending and receiving of authentication data

The cost of building an identity management system that includes recording, monitoring, and securing each transaction is more than the cost of building only an identity authentication system. The goal of the project is to identify a person. Recording each transaction will add unnecessary cost.

Cost of identity authentication system
Cost of monitoring transactions	> Cost of identity authentication system
Cost of securing transaction data

Increasing security or fighting fraud can be done in two ways - having a targeted approach or through blanket monitoring. The UID scheme, through the monitoring of the transaction database featuring trillions of transaction by 1.2 billion people is a blanket approach, and will provide lower return on investment than a targeted approach.

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/finance-and-security

Open Letter to the Finance Committe: Biometrics

praskrishna — 2011-02-17T13:12:22Z

This note points out the weaknesses inherent in biometrics and the pitfalls in using them. It recommends procedural safeguards that should be adopted by the UID in order to make the use of biometrics more secure and inclusive.

Biometrics are not centrally stored and are used only for identification

Biometrics, as our first letter notes 1 are better suited for identification, and are inappropriate for authentication. Therefore, the central server need not store biometric information, and need only store the public key of each citizen's digital signature.2 Biometrics on a smart card for authentication will allow service providers to determine if the card is being carried by the right person. This configuration of biometrics has many positives. It is :
- Cost effective
- More secure
- Places the control of biometric information in the hands of the data subject
Use encrypted data, rather than live data

The UID scheme has stated that biometrics will be encrypted, but has not provided further details. 3
It is recommended that biometrics are:
- Encrypted whenever it is used, stored and transferred;
- A biometric should be encrypted to such a degree that it is not possible to reconstruct the biometric data; and
- After an encrypted version of the biometric is made, the original biometric should be deleted.
In order to perform an identification check – the biometrics presented should be encrypted and then compared to the encrypted version stored on the card. If the card is stolen – the thief would not be able to harvest biometrics.
Security clearance for all associated entities and personnel

UID registrations and transactions will be handled by 'registrars' or in other words personnel who work at organizations not directly under the control of the UIDAI. A clear process associated with who can perform transactions and a proper audit system is needed to prevent 'insider' attacks.
Clearly defined alternate identification factors

There are many situations in which a biometric cannot be accepted in a transaction. For example, when the biometric changes, is misread, or is unreadable. The UID has recognized this possibility and has stated: “In case of authentication, the operator needs to find an alternate method of authentication if fingerprint verification fails. The operator/application would not know the cause of verification failure. A timeout will be implemented in service after five attempts.”4
The alternative identity factors that will be accepted need to be clearly defined and articulate.
Standards for acceptance of biometric as authentication factor

The UIDAI has proposed a whole range of authentication factors – pin, password, partial biometrics, full biometrics, mobile phone and combination's thereof. 5 Some of these authentication factors may also be presented by the data subject over the Internet. As our previous letters have stated – some authentication factors are more secure than others. Therefore, the UIDAI should publish standards for acceptance of different authentication factors based on the security requirements of different types of transactions. Even if biometrics are used as an authentication standard – in our opinion it should only be used for trivial transactions without major financial or citizenship implications.

Footnotes:

1http://www.cis-india.org/advocacy/igov/privacy-india/letter-to-finance-committee

2 Distinguish and separate the authentication process from the identification process: Identification is a comparison of one set of biometric data against all sets of collected biometrics in one central database to verify the identity of the owner of the biometric data. Authentication is a comparison of a biometric against a stored template to validate the existence of that specific biometric

3 http://uidai.gov.in/index.php?option=com_fsf&view=faq&Itemid=206&catid=7

4 Biometric Design Standards for UID Applications: pg 37

5 UIDAI Strategy Overview. Creating a Unique Identity Number for Every Resident in India. Pg. 28

For more details visit http://editors.cis-india.org/internet-governance/blog/privacy/biometrics

Open letter from CIS to PM Modi on Intellectual Property Rights issues on his Visit to US

praskrishna — 2015-09-24T02:48:32Z

Centre for Internet and Society, through its Policy Director Mr. Pranesh Prakash and Programme Officer Nehaa Chaudhari has addressed an open letter to Prime Minister Narendra Modi on the intellectual property right issues concerning his visit to the United State of America in September, 2015.

The article by Apoorva Mandhani was published by LiveLaw on September 23, 2015. CIS Open Letter here.

The letter makes a two-fold request: first, that the Government of the USA be requested to ratify the Marrakesh Treaty for visually impaired persons and second, that the Indian Government should not enter into any negotiations around the Trans-Pacific Partnership trade agreement.

The letter relies on the statistics released by the World Blind Union, according to which 90% of all published material is not accessible to blind or print disabled people. The severity of the ‘book famine’, it says, was highlighted by India in its Closing Statement at the Diplomatic Conference convened to conclude the Marrakesh Treaty.

India was the first country to ratify the Marrakesh Treaty in June, 2014. However, the Marrakesh Treaty will come into effect only after 20 Member States have ratified it or acceded to it. As per information available from the World Intellectual Property Organization, only 9 countries have ratified or acceded to the treaty and USA is not one of it. The letter therefore requests Mr. Modi to request USA ratify the Marrakesh Treaty at the earliest.

It says, “The USA is home to some of the largest publishers of both academic and other/leisure material including Penguin Random House, Harper Collins, John Wiley & Sons, the RELX Group, McGraw-Hill Education, Scholastic and Cengage Learning to name a few. It accounts for a large volume of the world’s book and other print material export. The active participation of the USA through the ratification of the Marrakesh treaty is critical if the treaty is to be truly effective.”

With regard to the Trans-Pacific Partnership trade agreement, the letter communicates its concern regarding the secrecy of negotiations as well as the content of the chapter on intellectual property in the TPP.

Provisions sought to be imposed through the TPP mandate the inclusion of TRIPS plus provisions in national laws, envisage possible extensions in term of protection on patents, restrict copyright exceptions and limitations, extend copyright protection terms and impose a higher liability on intermediaries. All these provisions, it says, “would be disastrous for an emerging economy such as India’s, which is a heavy user of intellectual property and not a heavy producer of the same.”

Highlighting CIS’s concerns, the letter requests that any engagement in TPP negotiations be preceded by national consultations on the same, soliciting input from various stakeholders with diverging interests, including academia, civil society, industry associations, large Indian corporations, small and medium enterprises and multi- national corporations, rights holders associations and other interest groups.

For more details visit http://editors.cis-india.org/a2k/news/live-law-apoorva-mandhani-september-23-2015-open-letter-from-cis-to-pm-modi-on-intellectual-property-rights-issues-on-his-visit-to-us

Open Knowledge Festival 2014

praskrishna — 2014-07-28T10:17:38Z

Subhashish Panigrahi represented India as the India Ambassador of OpenGLAM local in Berlin. The event was organized by Google, Omidyar, et.al., in Berlin from July 15 to 17, 2014.

Click to read the details on the website here. See the official programme here. Download Subhashish's presentation at this page.

Subhashish presented on the following:

Situation in India

Wikimedia India chapter and WMF's India program working on first India GLAM project
Good traction of image contribution through Wiki Loves Monuments photo contest
Mass communication and other media institutes slowly taking interest in open audio library
Digitization is a priority across government departments, with funding available
Majority of GLAMs lack knowledge about open culture, need for outreach
Relicensing and book digitization have gained public interest
Goals of the survey
Data
Mapping the sector
Encourage institutions to think beyond their digital strategy
Show institutions what is there for them

What we have done so far

Started filing Right to Information (RT) asking state government departments for lists of institutions
Reached out to WMIN (Wikimedia India chapter) for help in creating a list
Difficulty with getting people and contact details

Collaborative Presentation

OKFest2014 glam-survey_workshop_20140717 from Beat Estermann

For more details visit http://editors.cis-india.org/news/ok-festival-2014

Open Knowledge Day in Mysore (Media Coverage)

praskrishna — 2014-07-24T07:01:16Z

For more details visit http://editors.cis-india.org/openness/blog-old/open-knowledge-day-mysore-media-coverage-zip