Centre for Internet and Society

Why the Internet is Making India Furious

praskrishna — 2016-02-28T03:01:59Z

The Centre for Internet and Society (CIS) in Bangalore is a kind of hacker club for wonks and lawyers obsessed with issues of digital rights and global development. Not exactly the mainstream kids’ lunch table. But the Center was brought into sudden relief this week, thanks to … Mark Zuckerberg.

Read Sanjena Sathian's blog post published by Ozy on February 19, 2016

In a splashy bit of news, India’s telecom authority rejected a program called Free Basics, which the Facebook team had been promoting as a way to get free Internet to the masses. (Here on the subcontinent, more than 300 million people use the Internet — but that’s only about a quarter of the population.) The idea: Facebook would allow free access to a handful of websites (the “basics”) to everyone; users would pay for further content. The objections: On the dramatic end came comparisons to colonialism; on the wonkier, objections based on the principles of net neutrality, or the idea that all Internet content should be treated the same. The threat the critics saw in Free Basics was that of the Web as a two-lane highway — the free stuff for the poor folks, and the good stuff for those who can afford it.

Mumbai-based Sanjena Sathian spoke to CIS cofounder and policy director Pranesh Prakash about the changing landscape of web rights that led up to the news.

OZY:

Tell us what you’re thinking in the wake of India’s decision.

Pranesh Prakash:

The order seemed to fix the issue with a sledgehammer rather than a scalpel. It over-regulates and bans things that are beneficial along with that that aren’t. They should have aimed for discriminatory pricing, but they’ve instead eliminated all differential pricing, even when it’s not discriminatory.

What should come next, in my opinion — it is imperative to ensure that governmental resources are used to provide free access to the Internet. If you’ve taken away something that could have helped and said no, no, no, it’s not good for you, then you are under an obligation to provide a replacement.

OZY:

How do you think the larger political conversations going on in India right now seep into the debates about digital rights?

PP:

Many people think the largest divider is between those who are from a developing country or a developed country. I think the larger divide is between those who are politically skeptical of states — more libertarian — versus those who are more trusting of states and see states as having a role to play in Internet governance. How you think the poor in India should get Internet — should that be provided by government or by market mechanisms — well, your political philosophies will play a role. In India, one tends to find fewer free-market fundamentalists than one would meet in, say, San Francisco.

OZY:

I think, increasingly, post-Snowden in particular, people think of digital rights as human rights. Where do you see things going wrong on a rights front here in India?

PP:

Oh, wow … so many ways. In India we have a situation where, right now, more than 3,000 websites were blocked by the government, but no one knows what these sites are. No one knows whether they were blocked through mechanisms that ensure accountability. There is no transparency around any of these. And this is just the visible tip of the iceberg. And how do I know this? I sent a right-to-information request to the government and they gave me this answer. But beyond this, they put in place a few years ago a law which allows for websites and any kind of web content to be censored by anyone. And all they have to do is send a request to any “intermediary,” which could be anything from your ISP to your web host to your DNS provider.

OZY:

Wait, so what does that mean? I get annoyed at a site — where do I go to lodge my complaint?

PP:

All these websites are required by the law to appoint a particular person as a “grievance redressal officer.”

OZY:

What a title!

PP:

Yes … and there are more than 40 grounds for grievances that have been listed in the law, including things such as “causing harm to minors” and certain speech being “disparaging.” Now, I engage in disparaging speech at least 12 times a day. And that’s perfectly legal under Indian law!

OZY:

Eep. Any good news, though?

PP:

A case went all the way up to the Supreme Court, [involving a young woman named] Shreya Singhal. There was a section 66A, quite an odious provision, that allowed for any kind of “offensive” or “annoying” speech to cause that person to be put in prison for up to three years.

Two teenage girls in Maharashtra, upon the death of a politician, put out a comment on social media. The death had caused a bandh, a curfew of sorts in Mumbai, and done not officially by the government but by political party workers. One girl said on Facebook, sure, go ahead, respect this politician, but why inconvenience so many citizens? Her friend liked this. And a case was launched against them. Similarly, some cartoons by an anticorruption activist were challenged and he was imprisoned briefly and released on bail.

OZY:

It’s always the cartoonists.…

PP:

Yes, and one professor in Calcutta — for forwarding a cartoon, he was placed under this law too. Many cases of perfectly fine political speech were made illegal thanks to this law. Eventually, though, in a landmark decision, the Supreme Court struck down this law, and this is the first time in almost three decades that the Supreme Court has struck off an entire law for being unconstitutional.

But, yes. Mostly? It’s not been pretty.

For more details visit http://editors.cis-india.org/internet-governance/news/ozy-february-19-2016-sanjena-sathian-why-internet-is-making-india-furious

Why piracy is tough to rein in

praskrishna — 2011-04-02T10:16:50Z

“Video market is being treated as a poor cousin of the film industry”

Armed with a shoulder-strung carry bag, Meeran (name changed) walks into an apartment block that he frequents. By the time he comes out, he has sold nearly 10 pirated DVDs. His brother runs a shop which makes a business of Rs.1,000 to Rs.1,500 a day. But regular customers can avail themselves the privilege of his visit to their homes.

Film buffs like Madhankumar Subbiah, who buys DVDs, say the proliferation of multiplexes means a significant number of people cannot afford to go to the cinema regularly. “On the other hand, a whole family can watch the movie spending just Rs.30 on a pirated DVD. I feel that this trend would continue unless ticket prices are reduced,” he adds.

Depending on which side of the copyright debate you are on, Meeran is either a pirate who is a making a dent on the film industry's profits or a trader who is trying to take advantage of a backlash against monopolistic tendencies in the entertainment industry.

According to sources in the Video Piracy Wing of the Central Crime Branch, Puducherry is the headquarters of the illegal piracy business. Multiple copies are made using the master prints from the overseas rights agreement and distributed to various parts of Tamil Nadu.

CCB's Video Piracy Wing, in the last one year, has booked 234 cases and arrested 279 persons, of which 23 have been booked under the Goondas Act.

To understand piracy, it has to be placed in context. G. Dhananjayan, Chief Operating Officer, Moser Baer Entertainment, says the opportunity is not there for the consumer to buy the original. “Tamil cinema is not encouraging other modes of revenue generation. Unlike anywhere else in the country, producers get into agreements with satellite networks to release it on television before a DVD release.”

The DVD release window is usually six months after the release in theatres. According to him, the video market is being treated as a poor cousin of the industry. Kerala, for example, he says has a thriving video market because the release window is 90 to 100 days after the release in theatres.

Though movies are meant to be viewed in theatres, digital technologies have enabled a segment of movie watchers who prefer to enjoy the experience through on-demand or even streaming content.

Nishant Shah, Director, Centre for Internet and Society, says that attempts at controlling piracy are futile. The digital technologies that we are working with are intuitively designed for copying, dissemination and sharing.

According to him, copyright is not a pre-given frame of reference. It arose, historically and culturally, with the industrialisation of information and came into being so strongly because of the possibilities and limitations of analogue technologies.

He says media conglomerates that “try to imagine the consumer as monolithic and unchanging, and accuse them of piracy and theft, will only alienate the audience.” It is a move that fails to recognise the changing dynamics of cultural economies, he adds.

Read the original in the Hindu

For more details visit http://editors.cis-india.org/news/piracy-tough-rein

Why is the UIDAI cracking down on individuals that hoard Aadhaar data?

praskrishna — 2016-04-17T16:16:26Z

Private firms' offer to print Aadhaar details on plastic card a breach of law.

The article by Alnoor Peermohamed was published by Business Standard on April 13, 2016. Sunil Abraham was quoted.

The billion-strong citizen identification system, Aadhaar, has given rise to businesses keen on illegal harnessing of this private data, say the authorities.

Outfits are offering services to print the Aadhaar details on plastic cards, something the Union information technology ministry warned against on Monday. These entities charge anywhere between Rs 50 and Rs 600, and are listed on e-commerce websites, apart from own online presence.

Under the Aadhaar law, collecting and storing of the data by private companies without the user’s consent is a crime. Monday’s warning from the ministry to e-commerce marketplaces such as Amazon, Flipkart and eBay to disallow merchants from collecting and printing such details was a result of this.

This newspaper could not find any listings of Aadhaar printing services on Flipkart but there was one on Amazon (taken down) and no less than five such listings on eBay.

PrintMyAadhaar is one of the more well organised outfits operating in this space. “Get your E-Aadhaar printed on a PVC card for easier handling,” reads their website. Users are prompted to fill their Aadhaar details on the website, pay Rs 50 and have the card sent to their houses. PrintMyAadhaar even offers discounts for bulk orders.

“Collecting such information or unauthorised printing of an Aadhaar card or aiding such persons in any manner may amount to a criminal offence, punishable with imprisonment under the Indian Penal Code and also Chapter VI of The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016,” read the statement from the ministry.

Currently, Aadhaar stores a person’s name, date of birth, sex and address, apart from their biometric data.

While the biometric data isn’t available to these PDF printing shops, the rest of the information is, according to Srikanth Nadhamuni, chief executive officer of Khosla Labs and a former head of technology at the Unique Identification Authority of India. However, collecting this data poses no security risk to the Aadhaar infrastructure, he added.

“Allowing somebody to accumulate large amounts of data from Aadhaar users in general is not a good practice. We should ensure that the Aadhaar details of people remain private and it should only be up to the discretion of the end-user to share this,” said Nadhamuni.

Some security experts say Aadhaar does pose a security risk, as it makes available an individual's details in the public domain. Several institutions are treating Aadhaar just like any other proof of identity.

“Transactions that should have been conducted using biometric authentication are being conducted just by presentation of paper documents. What is happening most commonly is that people are giving a printout or photocopy of their Aadhaar acknowledgement as their proof of identity to get a SIM card. The risk here is that somebody can get a mobile number against your name,” said Sunil Abraham, executive director of the non-profit Centre for Internet and Society.

He says the other technical issue with Aadhaar is the lack of a smart card that stores a person’s information, as in a digital signature. Due to the lack of this, people don’t know what information to keep private and what to make public. Conventional security techniques would have had a person keeping their PIN private (as with a bank account). If this personal PIN would have been saved on a smart card, which users wouldn’t have had much to worry about.

“In the case of Aadhaar, the authentication factor and the identification factor are in the public domain, because many people might have your UID number and people release their biometric data everywhere. Due to this broken technological solution, we are now through policy putting band-aids, saying people should not disclose their UID number unnecessarily,” added Abraham.

For more details visit http://editors.cis-india.org/internet-governance/news/business-standard-alnoor-peermohamed-april-13-2016-why-is-uidai-cracking-down-on-individuals-that-hoard-aadhaar-data

Why Indians are turning down Facebook's free internet

praskrishna — 2016-01-17T16:25:10Z

Imagine a billion of the world’s poorest gaining overnight access to health information, education, and professional help — for free. Add to this one rich man who wants to make that dream a reality.

The article by Nimisha Jaiswal was published in the Global Post on January 13, 2016. Sunil Abraham was quoted.

That’s the invitation that Facebook has sent to India. Many there, however, are rejecting such benevolence.

Facebook has introduced its Free Basics project in 36 countries. The company claims that the app acts as a stepping-stone to the internet for those who are otherwise without access, by providing them with a few essential sites — or “basics” — to get started.

“We know that when people have access to the internet they also get access to jobs, education, healthcare, communication… We know that for India to make progress, more than 1 billion people need to be connected to the internet,” wrote Facebook CEO Mark Zuckerberg in a recent op-ed for a major Indian newspaper. “Free Basics is a bridge to the full internet and digital equality.”

However, net neutrality researchers and activists in India define it quite differently.

“Free Basics is a zero-rated walled garden that gives users a tiny subset of the world wide web,” Sunil Abraham, executive director of the Bengaluru-based Centre for Internet and Society, told GlobalPost.

The Free Basics app is part of Facebook’s Internet.org, a “zero-rating” internet service that provides limited access for no charge to the consumer. The original Internet.org was heavily criticized in India for violating net neutrality, the principle that all content on the web should be accessible to consumers at the same speed, without discrimination by providers.

Last spring, as part of a homegrown Save The Internet movement, over 1 million people wrote to the Telecom Regulatory Authority of India (TRAI) to protest services that disrupt net neutrality by providing only a small fraction of the internet to their users.

India’s Department of Telecommunications has already recommended that such platforms be disallowed. Before it makes its own recommendations this month, the TRAI asked concerned citizens for another round of input on zero-rating apps. The criticism has been so loud that, at the end of December, Free Basics’ local telecom partner was ordered to take the service down until a decision is reached.

Though Free Basics does not require payment from the websites it shares, Facebook’s competitors are unlikely to participate and provide user data to their rivals. And while there are currently no advertisements on Free Basics, Facebook reserves the right to introduce them in the future to garner revenue from their “walled-in” clients.

According to Abraham, such a platform harms free speech, privacy, innovation and diversity by adding another layer of surveillance and “censoring” the internet.

Mahesh Murthy, a venture capitalist who is part of India’s Save The Internet movement, puts it more bluntly.

“What Facebook wants is our less fortunate brothers and sisters should be able to poke each other and play Candy Crush, but not be able to look up a fact on Google, or learn something on Khan Academy, or sell their produce on a commodity market, or even search for a job on [Indian recruitment website] Naukri,” said Murthy.

Zuckerberg and Facebook’s India team have vigorously rebutted net neutrality activists in India, including Murthy, challenging their criticism of Free Basics and accusing activists of deliberately trying to prevent the masses from gaining internet access.

“Critics of the program continue to spread false claims — even if that means leaving behind a billion people,” wrote Zuckerberg in his Times of India op-ed.

According to Abraham, this is a misleading assertion. “They are falsely framing the debate, they are making it look like we have only two choices,” he told GlobalPost. “The choice is not between less people on the internet and unregulated [Free Basics].”

Several alternatives are being proposed. Abraham does not advocate a complete ban on Free Basics, instead suggesting a “leaky” walled garden where users would be given 100 MB of full internet access for every 100 MB of Free Basics consumed.

The Save the Internet campaign, however, wants Free Basics barred altogether. It proposes returning to previously implemented schemes like providing data on the purchase of a phone, or letting users access the full internet after watching an ad. The Universal Service Obligation Fund, set up by the Department of Telecommunications to provide affordable communication technology in rural areas, could also be used to finance free data packs.

While Facebook could potentially contribute to such funds to promote its connectivity goals, the millions of dollars it has spent loudly defending Free Basics in India suggest that the company is deeply attached to its own scheme.

Facebook has claimed that “more than four in five Indians support Free Basics,” according to a survey that it paid for. Indian users of the social network have received notifications encouraging them to send a template letter to the regulator in support of Free Basics. Even users in the US were “accidentally” notified to add their backing to the Indian campaign.

Some of the company's critics suggest that it is driven less by philanthropy, more by guaranteeing itself a stream of new users.

Murthy points out that a large number of the world’s population not yet on the internet are in India and China — and Facebook is banned in China. “So who becomes essential to Mark Zuckerberg’s balance sheet? Enter us Indians.”

While Indian activists agree that connectivity is an important goal, they insist that Free Basics in its current form is not the solution or even the only option right now. All it does is whets the appetite of the consumer, according to Abraham.

“You can compare Free Basics to when you go through the mall: You see the people selling cookies, and the aroma fills the whole mall,” he said. “That’s what Free Basics does — it gets you interested in the cookie. But it doesn’t solve the affordability question.”

For more details visit http://editors.cis-india.org/internet-governance/news/global-post-nimisha-jaiswal-why-indians-are-turning-down-facebook-free-internet

Why India’s attempt to police digital maps and satellite images is a ‘dumb’ idea

praskrishna — 2016-05-08T13:05:48Z

Are we back to the license raj?

The story was published by the News Minute on May 6, 2016. Pranesh Prakash gave inputs.

In a move which is receiving widespread criticism from technology and policy experts, the Indian government has proposed the Geospatial Information Regulation Bill that seeks to regulate the use of ‘geospatial information’ of India. Any violation of the proposed act could attract a penalty of up to 7 years in prison and Rs. 1 crore in fines, and the extreme punishments proposed have also been criticised.

So what is Geospatial information?

Geospatial Information has been defined in the act as

any imagery or data acquired through space or aerial platforms such as satellites, aircrafts, airships, balloons, unmanned aerial - vehicles or graphical or digital data depicting natural or man-made physical features, phenomenon or boundaries of the earth or any information including surveys, charts, maps and terrestrial photos.

To put it simply, any imagery of anything on earth (in India) recorded using machines in the sky will be under the purview of the law.

The law forbids any ‘incorrect representation' of the Indian map. For instance, not showing Pakistan Occupied Kashmir as a part of India will now be illegal and attract a fine and jail-term.

Here’s what the draft bill says,

"No person shall depict, disseminate, publish or distribute any wrong or false topographic information of India, including international boundaries through Internet platforms or online services or in any electronic or physical form."

And further states,

"Whoever acquires any geospatial information of India in contravention of the law shall be punished with a fine ranging from Rs 1 crore to Rs 100 crore and/or imprisonment for a period up to seven years."

And it doesn’t end here.

In what is reminiscent of India’s license raj era, the law also mandates that any person or institution acquiring or disseminating any geospatial imagery will have to first seek permission and license from a government authority. So Google Maps, Wikipedia, OpenStreetMap and others can operate in India only with a specific license from the Indian government.

The government authority will also run “sensitivity checks” on the imagery to protect India’s security and sovereignty.

Technology and policy experts are openly gunning for the bill and are holding no punches back.

“This proposed bill is as dumb as the draft encryption bill of last year which would have made WhatsApp illegal. It is unenforceable and will only serve to make India look like a backward, despotic country,” says Kiran Jonalgadda, founder of HasGeek and a social technologist.

Pranesh Prakash, Director of the Centre for Internet and Society, is of the view that this bill goes against the philosophy of Digital India and is regressive in nature. “It bears semblance to the conditions that prevailed in the License Raj. The bill is a clear over-reaction to legitimate security concerns. The government ought to encourage open mapping and should have limited the security restrictions to a set of officially declared security installations across India,” he says.

While the government's motive may be in the best interest of maintaining national security in order to prevent the misuse of sensitive data, such stringent measures may hinder the operations of navigation services and other applications that rely on geospatial information, and it will be the smaller players who will be affected the most. “Every map maker has to create different maps for different countries and hope they're not shown in the wrong country. Google Maps can afford to do this. OpenStreetMap and Wikipedia cannot. They will effectively become illegal,” adds Jonalgadda.

These stringent rules are not entirely unexpected and the government has cracked down on institutions in the past for ‘wrong’ geographical depiction of India.

The government had taken harsh rebuke against Twitter earlier this year for showing parts of Jammu and Kashmir in Pakistan and China. In another such instance, Al Jazeera was banned from broadcasting by the Information and Broadcasting Ministry because of repeatedly using a wrong map of India and was accused of cartographic aggression. The RSS too carried an inaccurate map of India (without some parts of Jammu and Kashmir) in its mouthpiece, Organiser and later apologised for its inadvertent error.

Nikhil Pahwa of Medianama has an exhaustive explanation and critique of the bill, and tells you how you and your businesses will be affected if the law is enacted. Read his piece here.

Here are his final comments from his piece, and they are pretty scathing.

This looks like a policy made for policing Google maps that has ended up throwing out the baby with the bathwater.

The people involved in drafting this have absolutely no clue about how users and businesses use geospatial data to make users lives easier, and how integral it is to every day life. Data is changing and increasing every single minute, and it is impossible to police it.

Collection and dissemination of realtime data and its utility is what makes location information useful and special. This kills realtime information.

It looks at location information from the myopic viewpoint of businesses and platforms, and ignores crowdsourced information, and indeed, independent crowdsourced maps.

A separate policy regarding just security establishments and their removal from mapping information, as well as the depiction of national boundaries of India was all that is needed.

It’s hypocritical of a government that promised “maximum governance, miminum governance” to try and enforce a License-raj.

Interestingly, even as the government wishes to impose punitive measures on erring private bodies, government organisations will not be regulated by the Geospatial Information Regulation Bill.

For more details visit http://editors.cis-india.org/internet-governance/news/the-newsminute-may-6-2016-why-indias-attempt-to-polic-digital-maps-and-satellite-images-is-a-dumb-idea

Why India snubbed Facebook's free Internet offer

praskrishna — 2016-02-27T07:49:08Z

The social media giant wanted to give the people of India free access to a chunk of the Internet, but the people weren't interested.

The blog post by Daniel Van Boom was published by Cnet on February 26, 2016. Sunil Abraham was quoted.

Mark Zuckerberg's ambitious mission to provide free Internet access to rural India was rejected by the people it was intended to help long before the country's regulators banned it earlier this month.

Around the country, farmers, labourers and office workers scorned Facebook's offer. Called Free Basics, it provided only limited access to the Internet through a suite of websites and services that, unsurprisingly, included Facebook. They felt the limited service didn't follow the open nature of the Internet, where all sites and online destinations should be equally accessible, so they organized real-world protests and an online Save The Internet campaign, with the message that Zuckerberg's efforts weren't welcome.

You might think people would jump at the opportunity to access Facebook for free, especially since more than a billion people use the social network every day. But it's that hitch -- that they can't access everything else -- which is precisely the problem, said Sunil Abraham, the executive director of the Centre for Internet and Society India. "Even if somebody spends 90 percent of their time on Facebook, that 10 percent is equally as important."

Indian regulators sided with popular opinion and cut off Free Basics in the world's second-most populous country on February 8. The ruling by the Telecom Regulatory Authority of India (TRAI) forbids all zero-rating plans, meaning anyone offering customers free access to only a limited set of services of sites are banned. It was championed as a victory for Net neutrality, the principle that everyone should have equal access to all content on the Internet.

The decision was undoubtedly a blow for Facebook, which says it wants to connect the billions of have-nots around the world to the Internet through the program. While more than half the world's online population uses Facebook each month, the company's efforts to connect with the developing world -- with Free Basics also being available in over 30 other countries, such as Kenya and Iraq -- could be a boon for business.

"[The Internet] must remain neutral for everyone, individuals and businesses alike. Everyone must have equal access to it," said Rajesh Sawhney, a Mumbai-based tech entrepreneur, in support of TRAI's decision to reject Free Basics. He believes the zero-rating scheme can be misused by telcos and other companies to create divisive ecosystems, where certain brands or companies are included and others aren't.

The package wasn't without its supporters though, with some being disappointed with the government's intervention in the marketplace.

"It is generally assumed that there is something sinister behind violations of Net neutrality...but that is not always true," says software engineer Shashank Mehra. "ISPs trying to match consumer demand isn't something sinister, it is a market process."

The social media giant further defends itself by pointing out that Free Basics is open to any and all developers, including competitors Twitter and Google, as long as they meet the program's technical standards. This evidently wasn't enough to convince much of India.

The problem persists

Facebook disputes claims that its interest in India is commercial, saying its efforts are humanitarian. In speeches over the past few months, Zuckerberg has painted Internet access as a tool for global good. "The research has shown on this that for every 10 people who get access to the internet, about one person gets a new job, and about one person gets lifted out of poverty," he said at a Townhall Q&A in Delhi last October. "Connecting things in India is one of the most important things we can do in the world."

Zuckerberg appears to have taken the loss in stride. During a keynote address at the Mobile World Conference in Barcelona earlier this week, he admitted to being disappointed by the ruling, but added, "We are going to focus on different programs [in India]...we want to work with all the operators there." A Facebook spokesperson said the company "will continue our efforts to eliminate barriers and give the unconnected an easier path to the Internet and the opportunity it brings."

Those ideals could certainly help in India, where around 68 percent of its population -- about 880 million people -- live in rural conditions or poverty. The promise of free access to health, education, local and national news through an Internet connection could potentially improve quality of live. So what's the problem?

The service providers would also be granting free Facebook.

Peggy Wolff, a volunteer coordinator at education NGO Isha Vidhya, says Facebook is just the latest in a long line of international companies hoping to crack rural India, where the bulk of the country's poor live.

While admitting that low cost or free Internet is imperative in rural areas, that "smart villages" are needed to help ease the human burden on India's increasingly overcrowded cities, she says, "Free basics is just a bit suspicious to most people. There's just too much vested interest."

"The big question." Sawhney says, "is how do we give fast and free Internet to a large section of society in India?"

There are alternatives. United States-based Jana, for instance, developed an Android app called mCent that allows its growing userbase of 30 million to earn data by downloading and using certain apps or watching advertisements from sponsors. Unlike Free Basics, that data can be expended on any online destination.

Jana's CEO Nathan Eagle, like Zuckerberg, says his mission is to bring Internet connectivity to the next billion people. "Today, Internet connectivity in emerging markets is much more an issue of affordability, rather than access," he explains. "1.3 billion people in emerging markets now have Android phones...it's the cost of data that is prohibitive."

For more details visit http://editors.cis-india.org/internet-governance/news/why-india-snubbed-facebooks-free-internet-offer

Why Geospatial Bill is draconian and how it will hurt startups

praskrishna — 2016-07-02T04:57:35Z

Last week, the Indian government rejected Google’s plans to map Indian cities, tourist spots and mountain ranges, using the 360-degree panoramic Google Street View feature.

The article was published in Indian Express on June 13, 2016

Last week, the Indian government rejected Google’s plans to map Indian cities, tourist spots and mountain ranges, using the 360-degree panoramic Google Street View feature. The government officials cited “national security” as a reason for not granting permission to Google. It is expected that the Google’s Street View permission would be relooked at, once the draft Geospatial Information Regulation Bill, 2016, is enforced as law. Many however feel that this draft bill is draconian and will have serious repercussions on the startup ecosystem.

The Geospatial Bill seeks to make creating, accessing and distribution or sharing of map related information, illegal and that every company will have to take prior permission and license from the government for the same. Wayback in 2011, Google had announced the introduction of Street View for Bangalore, on Google Maps. But the project ran into trouble with Bangalore Police stopping Street View cars from plying in the city, citing security reasons.

Google Street View, launched in 2007, is popular in San Francisco, Las Vegas, Denver, New York and Miami, which allows users to navigate virtual streets from photographs gathered from directional cameras on special vehicles. While the service has been hugely successful it has caused problems of privacy in some countries.

In 2010 almost 250,000 Germans told Google to blur pictures of their homes on the Street View service, while Czech government also banned Google from taking any new photos for the service. In Switzerland, the matter went to the court and it was accepted that Google would be obliged to pixelate 99% of images to blur faces, vehicle registrations and that it would not be filming certain sensitive places such as schools, prisons and shelter homes.

This adds to the list of recent controversies on Google Earth, and the draft Geospatial Information Regulation Bill, on adoption of mapping technology in India. Commenting on the development, Sumandro Chattapadhyay, research director at the Centre for Internet and Society said, the key country where the Google Street View faced legal challenge, and was fined too, is Germany. This legal challenge, however, was not based on the concern for national security but on that for the privacy of the citizens. However, it was eventually allowed to roll out Street View in Germany provided that it asks for consent from the house owners before images of any house.”

“One of the crucial concerns with the draft Geospatial Information Regulation Bill remains its vast scope of application. Not only initiatives like Google Street View may be regulated under it (for capturing geo-referenced imagery from the street level) but absolutely any mobile application that requires the user’s geo-location (either automatically detected, or manually entered by the user) would be within the purview of this Bill. This evidently creates a great pressure upon the entire ICT-enable product and service sector in India,” Chattapadhyay added.

This would mean that, any company, particularly the new age startups, those in the food tech, fintech and e-commerce space, which uses geo-location to identify the customer location to either deliver goods, food products, or the likes of Ola and Uber which uses maps to pickup and drop customers, will have to obtain license from the government.

Raman Shukla, director—strategy and product, Medikoe, said, “At Medikoe we are helping users to locate the nearest healthcare service provider with the available technologies. Google Maps is one of key feature our company banks on. Though we understand the country’s security concerns, the draft bill, if implemented, would be a violation of independent internet. We believe that a much better solution can be identified to solve security concerns.”

Venu Kondur, founder of LOBB, the online truck booking platform said, “Geostatial data is a very important data for our business. Customers booking truck through LOBB platform get real-time track & trace facility. Our customers rely heavily on this data for their day-day activity. Startups like us depend largely on maps data for real-time tracking of consignment. Lot of our business intelligence data is drawn out of it.”

In case, if the draft gets implemented, many startups will be forced to change the business model and while it will also increase the product delivery time. A group of 15 volunteers created a SaveTheMap.in portal to educate the readers about the draft bill and also give complete information on how the bill have an impact on the citizen and users of certain application. Sajjad Anwar one of the volunteer, said, through the portal about 1700 mails have been sent to the ministry of home affairs airing their view on why they do not support the draft Bill.

Comparing with other countries, Chattapadhyay further said, “At first, other countries deal with the question of display of security establishments in publicly available maps through direct interactions with large mapping companies, and does not turn this into a financial and political burden for the entire economy. Secondly, it is the concern about privacy of the citizens that should frame the Indian government’s response to products and services like Google Street View, and not concerns regarding national security.”

What the draft bill says

No person shall, in any manner, make use of, disseminate, publish or distribute any geospatial information of India, outside India, without prior permission from the security vetting authority under the Central government.

Penalty

Whoever acquires any geospatial information of India in contravention to the rules, shall be punished with a fine ranging from Rs 1 crore to Rs 100 crore and /or imprisonment for a period upto seven years.

Application for license

Every person who has already acquired any geospatial imagery or data of any part of India either through space or aerial platforms such as satellite, aircrafts, airships, balloons, unmanned aerial vehicles or terrestrial vehicles shall within one year from the commencement of this Act, make an application along with requisite fees to the security vetting authority.

For more details visit http://editors.cis-india.org/internet-governance/news/financial-express-prabhu-mallikarjunan-june-13-2016-why-geospatial-bill-is-draconian-and-how-it-will-hurt-startups

Why experts are worried about Aadhaar-based authentication

praskrishna — 2016-08-07T02:16:29Z

As private companies are increasingly using Aadhaar data, is the privacy and security of personal data really at risk? What do those defending Aadhaar have to say?

The post was published in Citizen Matters on August 2, 2016. Amber Sinha was quoted.

The Unique Identification numbers of Aadhaar card holders are being extensively used by government and private agencies for authentication purposes, as we have already seen in an earlier article.

There are 246 registered Authentication User Agencies in India, both government and private, which are helping organisations and individuals in executing the authentication process. In simple terms, they help the organisation that has placed the authentication request, to confirm the identity of a person during hiring, lending loans or while implementing welfare schemes.

But all does not seem well with the Aadhaar authentication process. Concerns have been raised about the privacy and security aspects and, loopholes in the law.

The amended Aadhaar Bill (now, Aadhaar Act) has a clause that allows the UIDAI to respond to any authentication query “with a positive, negative or any other appropriate response.” This move has drawn a lot of criticism from the activist fraternity. They have questioned the government on framing an Act that places the security and privacy of individual citizens at risk.

Even before the Bill was passed, legal scholar Usha Ramanathan had, in an article published in Scroll.in, expressed concern over private agencies using the Aadhaar database for authenticating the identity of an individual.

“Very little was heard about the interest private companies would have in this information data base. It is not until the 2016 Bill was introduced in Lok Sabha that we were told, expressly, that just about any person or company may draw on the Aadhaar system for its purposes. There are no qualifications or limits on who may use it and why. It depends on the willingness of the Unique Identification Authority of India, which is undertaking the project, to let them become a part of the Aadhaar system,” she wrote.

What’s crucial in the entire process is how the government is allowing private players to use Aadhaar-based information, putting the privacy of Aadhaar-holders at stake. The government is technically allowed to share the Aadhaar information with other agencies, only if the holder has given consent to sharing his information, during enrollment.

The guidelines for recording Aadhaar demographic data states: “Ask resident’s consent to whether it is alright with the resident if the information captured is shared with other organisations for the purpose of welfare services including financial services. Select appropriate circle to capture residents response as - Yes/No.”

In 2011, Citizen Matters had published a report on how people wanting to register for Aadhaar were not asked if they would agree to share their personal information. Citizens seemingly were unaware of the provision for sharing information with a third party and data operators had reportedly not asked them for their consent before marking ‘yes’ for the consent option.

There remains a regulatory vacuum

In less than four months of the enactment of the Aadhaar Act, the number of private agencies using Aadhaar database for identity authentication too has grown long. Amber Sinha, Programme Officer at the Center for Internet and Society expresses concern over the privacy implications that a project of this magnitude would lead to.

“The original idea of Aadhaar was to use it for providing services under welfare schemes. But the Aadhaar Act lets private agencies avail the Aadhaar authentication service. The scope of the Act itself doesn’t envisage sharing the data with private parties, but if any third party wants to authenticate the identity of an individual, they can use the UIDAI repository for the purpose,” he points out.

In the process, Amber says, the CIDR has to send a reply in ‘yes’ or ‘no’ format, for any request seeking to confirm the identity of an individual. The new legislation gives scope for the authorities to respond to a query with a positive, negative or any other appropriate response.

“The Aadhaar enrollment information includes demographic and biometric details. So at this stage, we do not know what that “other appropriate response” stands for. Further, while there are requirements to take the data subject’s consent under the Act, there is lack of clarity on the oversight mechanisms and control mechanisms in place when a private party collects information for authentication. The UIDAI is yet to frame the rules and the rules will probably determine this. Until the rules are framed, some of the issues will exist in regulatory vacuum,” Amber observes.

Under the current circumstances, Amber says, the responsible thing to do for UIDAI is not to make such services available until the rules are framed.

But why has the Authority then started the authentication process even before the rules have been framed? Assistant Director General of the Authentication and Application Division of UIDAI, Ajai Chandra says the rules when framed will have retrospective effect, from the date the Act was enacted.

Activists have also questioned the UIDAI for allowing private agencies to use and authenticate Aadhaar data, when the Supreme Court has restricted the use of Aadhaar. In its last order dated 15 October 2015, the Apex Court allowed the government to use Aadhaar in implementing selective welfare schemes such as PDS, LPG distribution, MGNREGS, pension schemes, PMJDY and EPFO. It makes no mention about the UIDAI using the Aadhaar data repository to provide services to private agencies.

“When the Supreme Court has restricted the use of Aadhaar number to a few specific government programmes only, how can UIDAI allow the data to be used for any other programmes, let alone by private agencies?” Amber asks.

In a very brief conversation, Reena Saha, Additional DG, UIDAI told Citizen Matters that UIDAI was acting as per the Supreme Court’s order dated October 15th. “We aren’t sharing the data with private agencies,” she said.

‘Authentication happening only with consent’

Srikanth Nadhamuni, CEO of Khosla Labs - a registered Authentication User Agency, who was also the Head of Technologies at UIDAI, rejects the accusations on the security aspect, saying that the authentication system is completely secure and foolproof.

“We have made a secure system so that there is no man in the middle taking the biometric information. The biometric information shared on the application is encrypted and neither the AUA nor the Authentication Service Agency (an intermediary between the AUA and the CIDR) can open it. Both the AUA and ASA will sign on the packet and forward it to the data repository as it is. There is no way that we can figure out what is inside the packet. Once the request reaches the data repository, they will unlock the signatures, run the authentication and reply in ‘yes’ or ‘no’ or with an error code,” Srikanth explains.

ADG Chandra says that at present the CIDR is replying to authentication requests in an “yes/no” format. “We aren’t sharing the data with any agencies. Upon receiving the request for authentication, be it demographic, biometric or one time pin (OTP), a notification is sent to the registered mobile / email address of the Aadhaar holder,” he says. So if the Aadhaar holder has changed the address, phone number, email ID etc after Aadhaar enrollment, he/she should update the data with UIDAI by placing a request online or through post. This will avoid any confusion that may occur during the authentication.

Ajai Chandra further clarifies, “the private agencies seeking authentication (the Authentication User Agency) are not given direct access to the database. On receiving the request, the intermediary Authentication Service Agencies first examine the format of the authentication request. The request is forwarded to the CIDR only if it complies with the format.”

Apart from authentication, the eKYC (Know Your Customer) option also allows companies to retrieve eKYC data of the Aadhaar holder. This data includes photo, name, address, gender and date of birth (excludes mobile number and email ID). But in this case too, “eKYC data can be retrieved only with the consent of the Aadhaar card holder, the person has to be adequately informed about the retrieval and the data cannot be shared with a third party,” says Chandra.

Though Aadhaar Act allows the UIDAI to perform authentication of Aadhaar number, subject to the requesting entity paying the fee, UIDAI at present is providing the service free of cost. “We will provide free service till December 2016 and may levy the fee thereafter,” the ADG says.

For more details visit http://editors.cis-india.org/internet-governance/news/bangalore-citizen-matters-august-2-2016-akshatha-why-experts-are-worried-about-aadhaar-based-authentication

Why Does Mainstream Indian Discourse On Digital Inclusion Leave Out Disability?

praskrishna — 2017-05-19T10:10:26Z

India’s crusade for digitisation and digital inclusion has failed millions of Indians with disabilities. Will the Rights of Persons with Disabilities Act change that?

The article by Dorodi Sharma was published in the Wire on May 9, 2017.

One of the strongest mandates of the newly enacted Rights of Persons with Disabilities Act, 2016 is on the issue of accessibility. The public discourse around accessibility for persons with disabilities has more or less been limited to the physical environment – ramps and a disable-friendly toilet. The issue of digital inclusion – be it websites, technology, information and media, which is equally critical, has not found much traction.

Therefore, it is perhaps not surprising that the buzz around the new disability rights law – whether welcoming or critical – hardly mentions the new provisions for information and communication technologies (ICT) and digital inclusion for persons with disabilities.

The new law requires all content available in audio, print and electronic media to be in an accessible format; electronic goods and equipment that are meant for everyday use to be made available in universal design and ensuring access to television programmes with sign language interpretation or subtitles. Additionally, all service providers – whether government or private – will have to provide accessible services within a period of two years from the notification of the law.

This is significant on several levels. While globally the World Wide Web Consortium (W3C) published the Web Content Accessibility Guidelines (WCAG) in 1999 to make web browsers more accessible to persons with disabilities, it was only in 2009 that India got its own policy on this issue. In January 2009, the Guidelines for Indian Government Websites (GIGW) were formulated to require all government websites to comply with WCAG 2.0. It may be mentioned that the new law also comes at an opportune time as the W3C is now working on WCAG 2.1.

Then in October 2013, the central government came out with the ‘National Policy on Universal Electronic Accessibility’ to facilitate equal access to electronics and ICTs for persons with disabilities. It covered the entire gamut of software as well as hardware.

Implementation of both these policies, however, leave a lot to be desired. In 2012, a survey of ten government websites by the National Centre for Promotion of Employment for Disabled People and BarrierBreak revealed none met even the basic accessibility standards. A recent audit of 22 of the most popular Indian applications by the Centre for Internet and Society found that they were not fully compliant with web accessibility guidelines. What this basically means is that while a majority of the population can file their income tax returns online, make online transactions, book flight tickets and order food, millions of people with disabilities still cannot.

Digital inequalities

These findings are important particularly when seen in light of the rapid movement towards digitisation of services and opportunities. By 2050, 70% of the world’s population will live in cities. By 2020, 50 billion devices will be connected to the ‘Internet of Things’. Technology is changing how citizens interact with their environments. Our services – education, employment, health, recreation and commerce – is moving towards digital platforms. There is a proliferation of smart cities worldwide. But the discourse, astonishingly, excludes the impact these developments will have on the lives of persons with disabilities. A survey of about 250 global experts on smart cities conducted by the Global Initiative for Inclusive ICTs and World Enabled revealed that while a majority recognise the benefits of accessible smart cities, more than half do not know of any smart city initiative with an explicit focus on ICT accessibility. If this is not rectified immediately, all our future cities risk excluding millions of persons with disabilities.

India’s Internet growth rate was four times the global rate in 2015. There is also a huge rush towards creating a digital ecosystem for citizen engagement – be it the Digital India campaign, the Startup India campaign or even the recent move towards a cashless and digital economy. But these campaigns also need to ensure that persons with disabilities are benefited as well. It is thus important for policymakers, technology giants and citizens to talk about digital inclusion for persons with disabilities.

India is home to 26.8 million persons with disabilities. With the increase in the number of specified disabilities from the previous seven to 22, this number is expected to grow manifold.

With the Rights of Persons with Disabilities Act, 2016, increasing the number of specified disabilities from the previous seven to 21, this number is expected to grow manifold. Digital inclusion of persons with disabilities not only stands to benefit the millions living with disabilities but also older persons and persons with limited language skills. It is not common knowledge but several popular mainstream technologies were actually developed for persons with disabilities. For instance, predictive text on cell phones was developed as a solution for people with communication difficulties. Today, it is a feature enjoyed across all segments of the population.

But the strongest motivation should be that access to ICTs is a human right and excluding an entire population group will hinder millions of people from being equal citizens. The Rights of Persons with Disabilities Act can very well be the first step towards ensuring that equality is ensured in the digital realm as well.

For more details visit http://editors.cis-india.org/accessibility/news/the-wire-may-9-2017-dorodi-sharma-why-does-mainstream-indian-disclosure-on-digital-inclusion-leave-out-disability

Why did Nandan Nilekani praise a Twitter troll?

praskrishna — 2017-06-12T01:34:53Z

As the Supreme Court upholds the linking of ‘Aadhar’ with PAN, questions around ex-UIDAI chairman Nandan Nilekani praising iSPIRT head Sharad Sharma Twitter troll and ‘Aadhar’s privacy properties will continue to be asked.

The article by Kiran Jonnalgadda was published in the Indian Express on June 10, 2017.

Last month, Sharad Sharma, the head of the Indian Software Product Industry Round Table (iSPIRT) Foundation, an organisation that promotes Aadhaar to industry, was outed as the operator of at least two anonymous Twitter troll accounts that viciously harassed and defamed critics of Aadhaar. The shocking revelation was first met with denial by iSPIRT, and then followed by what may be understood as a reticent apology from Mr Sharma.

In a bizarre sequence of events, the apology received praise from several quarters. iSPIRT’s Guidelines and Compliance Committee (IGCC) investigated Mr Sharma and the ‘Sudham’ team that coordinated the trolling campaign. Two members of the investigating committee subsequently resigned, although only one confirmed.

The committee’s findings, confirming that Mr Sharma was responsible, were summarised for the public by Mr Sharma himself, who then announced that his role as a public spokesperson would now be handled by Sanjay Jain. Mr Jain was once with the Unique Identification Authority of India (UIDAI), launched by Nandan Nilekani, is currently a director at Nandan Nilekani’s EkStep Foundation, and a close confidante of Mr Sharma. The two have often pitched iSPIRT’s IndiaStack initiative together.

In an internal email questioning this decision, an iSPIRT member asked whether Mr Jain was a part of the ‘Sudham’ team, and whether he was also “at least partially culpable for the [troll] campaign and the violation of the code of conduct.”

The victims of the trolling have received no report, and the two apologies posted by Mr Sharma were both for having “condoned uncivil behaviour”, but not for personally orchestrating the attacks. Among those who praised him was Nandan Nilekani, former chairman of UIDAI and chief mentor of iSPIRT.

Critics have been pointing out for years that Aadhaar lacks sufficient checks and balances, and that claims of benefits are overstated. These concerns have been met with denial, condemnation of critics, and often outright refusal to engage in debate. This has unfortunately only served to alienate an even larger section of the population, turning ordinary citizens into activists.

We can gain an insight into how Aadhaar is promoted by examining iSPIRT. The organisation was founded in 2013 by volunteers who had been working together on the sidelines of the NASSCOM Product Conclave. These volunteers felt the need for an independent grassroots organisation to represent tech entrepreneurs who were building products for India and the world. iSPIRT has grown phenomenally influential over its few years, largely by the work of volunteers who were truly interested in building a mutual assistance community.

Level playing fields are a recurring topic. Just as there is a desire to lower bureaucratic hurdles to give every entrepreneur a fair chance, there is also the question of how a startup can compete against a foreign competitor that has the advantage of a stronger home market.

Flipkart and Ola are two prominent examples in their fight to defend their market share against Amazon and Uber, competitors armed with global experience, more capital, and better trained talent. iSPIRT’s take is that for Indian companies to thrive they must have a supportive ecosystem that enables rapid growth, and so iSPIRT must step up as an “activist think tank”.

One aspect of this activism is IndiaStack, which seeks to help startups by promoting a suite of ‘public goods’: Aadhaar and eKYC for id verification, eSign and Digilocker for digital contracts and certificates, and UPI for payments. If one accepts at face value that these services are well intentioned, then IndiaStack is on a noble quest. The details, unfortunately, are less pristine.

iSPIRT is a private non-profit, but its volunteers include several former members of UIDAI. The guidance and compliance committee (IGCC) investigating the trolling included a current member of government. iSPIRT helped build and evangelise the UPI (United Payments Interface) platform and BHIM app for NPCI, but the level of involvement and terms of the agreement are not public.

For an organisation that claims to champion public goods, iSPIRT is opaque on the level of influence they wield with government (Mr Sharma once claimed some influence but no control), and on who exactly built the various components of IndiaStack, within or outside of government.

They showed a remarkable degree of influence when foisting UPI on a change-resistant banking sector. They have funding from four banks (IDFC, SBI, Bank of Baroda and Axis Bank) and from fintech startups. Despite this level of responsibility, they also have no accountability since they are a pro bono volunteer force, allowing them to distance themselves from failures (UPI failures are NPCI’s problem and Aadhaar failures are UIDAI’s problem, etc) and unpleasant incidents such as the ‘Sudham’ trolling project. (No one has accepted responsibility for operating a troll account.)

At the core of IndiaStack is ‘Aadhaar’, which as it currently stands has serious concerns from its technical architecture to institutional safeguards. Aadhaar lacks publicly verifiable audits, a data breach disclosure policy, or an engagement process for researchers to report concerns.

For reasons best known to them, the promoters of ‘Aadhaar’ are in a tearing hurry to impose it everywhere, in every aspect of an Indian’s life, out of an apparent fear that it will die if adoption slows down. This is eerily reminiscent of startup mantras like “fake it till you make it” and “move fast and break things”.

But ‘Aadhaar’ already has a billion enrollments and the backing of legal measures pushed by the Union Government. There is no threat of imminent demise. And yet, as the Twitter trolling shows, this fear continues to exist for ‘Aadhaar’s proponents, so much so that critics must be silenced at any cost.

Where trolling failed to work, subtler attacks are sure to follow. There have been some in the recent past.

The Centre for Internet and Society (CIS) is facing one such attack for its report on the leak of 130 million Aadhaar numbers. The report received wide coverage and was followed by new rules from MEITy (ministry of Electronics & Information Technology) regarding the handling of Aadhaar numbers, but instead of commending CIS for its role in improving safeguards, UIDAI is accusing it of hacking, demanding the identity of the researcher so that he or she may be individually prosecuted.

When Sameer Kochhar demonstrated that previously captured fingerprints were being reused because Aadhaar’s API lacked technical safeguards, UIDAI responded by prosecuting him. A News18 journalist was also prosecuted for demonstrating how double application for enrollment was possible using different names.

As of September 30, 2017, ‘registered’ devices will be mandatory as the current devices are not secure against fingerprint reuse, and an unknown number of fingerprints have already been captured and stored. This sort of forced technological upgrade will happen again as more problems surface into public consciousness, with more researchers and critics harassed for pointing these out.

‘Aadhaar’ pursues inherently contradictory goals. The process of ‘inorganic seeding’, for instance, allows a database to be seeded with ‘Aadhaar’ numbers, to help a service provider identify and eliminate duplicates without the individual’s cooperation. (Inorganic seeding is an official UIDAI scheme.) And yet, the law prohibits using and sharing ‘Aadhaar’ numbers without the individual’s consent.

‘Aadhaar’ aims to be an inclusive project, providing an identity for everyone, and yet easily lends itself to being an instrument of exclusion. There is technical exclusion when biometrics fail to match, and there is institutional exclusion when Aadhaar is made mandatory and an individual is then blacklisted from a service or denied Aadhaar enrollment.

Aviation minister Jayant Sinha recently announced a proposal to use digital id for just this purpose. ‘Aadhaar’ in its current state makes it extraordinarily simple for an organisation to demand it for authentication, but what of the necessary safeguards to protect an individual’s rights? Or of ensuring that grievance redressal mechanisms are in place and actually functional? These are not solved by a technical API integration.

Just as we’ve seen with nuclear power, weak institutions which are sensitive to criticism and fail to ensure effective oversight amplify the risks of the underlying technology. Aadhaar’s supporting institutions, whether government bodies like UIDAI or private bodies like iSPIRT, are immature for the mandate they carry. All technology improves with time, but weak institutions hamper their benefit to society.

As the leading promoter of Aadhaar, founding chairman of UIDAI, and chief mentor of iSPIRT, Mr Nilekani must step up and commit to improving the institutions he commands, and take responsibility for their failures. Condemning critics instead does not help build institutions.

For more details visit http://editors.cis-india.org/internet-governance/news/indian-express-kiran-jonnalgadda-june-10-2017-why-did-nandan-nilekani-praise-a-twitter-troll

Why did India fail to discover the ISIS Twitter handle?

praskrishna — 2014-12-27T03:27:16Z

India's surveillance system fails to track the servers of internet giants like Google or Facebook because these do not have servers in the country, says a leading cyber law expert.

The article by Anita Babu was published in the Business Standard on December 26, 2014. Sunil Abraham gave his inputs.

Back in 2009, after the investigation team, probing into the 26/11 Mumbai terror attacks, almost cracked the case, it was the US’s Federal Bureau of Investigation (FBI) which connected the missing links by arresting David Headley, the mastermind.

Five years later, India is staring at a similar situation, when Bengaluru-based Mehdi Masroor Biswas, was allegedly found to be operating a pro-ISIS (Islamic State) Twitter handle. It was a British broadcaster, Channel 4, which blew the lid off Biswas’s activity. Soon after the report, Indian authorities swung into action. Last year, when communal violence broke out in some parts of Uttar Pradesh, a Pakistani news organisation reported that a fake video was being circulated to fan sentiments.

But, why have Indian agencies failed to detect such activities which pose a threat to the national security? A senior government official said intelligence agencies in the country scan the internet for leads. But, in the light of increased threats, systems need to be beefed up significantly. Perhaps, as a first step towards this, the home ministry on Wednesday formed a committee to prepare a road map for tackling cyber crimes in the country.

It will give suitable recommendations on all facets of cyber crime, apart from suggesting possible partnerships with public and private sector, non-governmental organisations and international bodies.

According to Sunil Abraham, executive director of a Bengaluru-based research organisation, the Centre for Internet and Society, it’s time we move closer towards intelligent and targeted surveillance, rather than mass surveillance. This will require monitoring a selected accounts or profiles, instead of tapping information from across the population. Old-fashioned detective work is also very important, as it has helped zero in on Biswas.

Another problem the country faces is that a lot of data is being pooled in by multiple agencies, but of little use. “We must free up our law enforcement agencies and intelligence services from the curse of having too much data,” Abraham adds. Since most of the internet companies are headquartered outside India, the authorities face a lot of difficulties in accessing information from these networks.

“India’s surveillance system fails to track the servers of internet giants like Google or Facebook because these do not have servers in the country. Our system is only confined within the country,” says Pavan Duggal, a leading cyber law expert.

Since the US has the capability to access information from telecom companies, service providers such as Twitter and Facebook and the consortia that run submarine cables, these companies cooperate in a much more effective and immediate manner, adds Abraham. “But these are things that we will never be able to do in India,” he adds.

For instance, India follows the mutual legal assistance treaty procedure, to gather and exchange information in an effort to enforce public laws or criminal laws. However, this is a time-consuming process and often takes up to two years before we get any data from these companies.

But due to the threat of cyber-terrorism being shared by both companies and governments, companies such as Google, Twitter and Facebook are cooperating more than before, experts say.

Internet and Jurisdiction Project, an international group that works towards ensuring digital coexistence, tries to get a procedural law between two countries in a harmonised manner and includes collection, storage, handling and processing of evidence.

More lubricating efforts should be undertaken internationally on these lines, say experts. Hopefully, the new committee will take steps in this direction.

For more details visit http://editors.cis-india.org/internet-governance/news/business-standard-december-26-2014-anita-babu-why-india-failed-to-discover-the-isis-twitter-handle

Why aren’t Indians using Wikipedia to hold the government to account?

praskrishna — 2016-02-14T11:07:49Z

Despite its popularity, the site's benefits are going unutilised.

Madhav Gadgil's post was published by Scroll.in on February 6, 2016. CIS work was quoted.

Thanks to modern science and technology, the treasury of human material as well as intellectual and cultural wealth is overflowing. Enormous quantities of information are exchanged today at lightning speed, and incredible numbers of people separated by great distances are in constant touch with one another. Two contrasts characterise this world: on the one hand, disparities are growing in material wealth, and on the other, there is growing equality in access to informational and cultural resources.

The inequities in material wealth has accelerated the rate of degradation of the natural world, but at the same time progressive laws flowing from equality in intellectual wealth are helping people combat the degradation. This is one reason why, as much as ever, a well-informed citizenry is the lifeblood of social progress. Ensuring that citizens have ready access to reliable information is the prime responsibility of all of us, including obviously of our governments.

Wayward rulers

Regrettably, the government machinery is failing to discharge its responsibility.

Consider, for instance, Maharashtra’s irrigation scam, in which thousands of crores were siphoned off or wasted on dud irrigation projects. The statistics provided at various times by the state’s agriculture and irrigation departments are inconsistent. It is probable that none of them reflect the ground reality. Most rivers in Maharashtra are polluted well beyond legally permissible levels, yet the Maharashtra Pollution Control Board hardly acknowledges this sorry state of affairs. Such pollution often results in mass deaths of fish, but neither the fisheries department nor the Pollution Control Board maintains reliable records.

Or consider these two examples. After the people of Kerala succeeded in moving the government machinery, a committee of the legislature reported that 90% of the stone crushers in the state were operating without permission from local panchayats or without registering with district collectors. Another time, when the Central government-appointed Western Ghats Ecology Expert Panel revealed similar irregularities with solid evidence, the Centre first suppressed its report and then, pushed by a Delhi High Court order, made only an English version available. To top it all, the Maharashtra government uploaded on its website a Marathi summary full of distortions.

Clearly then, with the government machinery failing, people must work on their own to bring to light the true state of affairs. Fortunately, our media provides a good deal of reliable information on issues of public interest. For instance, it was newspaper reports that forced the Goa Forest Department to accept the presence of tigers in the state. It is again the media that often records large-scale fish deaths in our rivers.

Such information gets recorded on social media too, but this remains scattered, barring systematic efforts like as the one launched by the Hyderabad-based “Save Our Urban Lakes” coalition. Besides, much of the material on social media like Facebook is often self-centred and prejudiced, making it difficult to ascertain the veracity. On the other hand, newspapers and TV channels are continually exposed to sceptical public scrutiny, ensuring that, by and large, they deliver reliable information.

On balance then, people at large can wean genuine, reliable information only by carefully collating it from newspapers and TV channels, official documents and scientific studies and systematically organising it through some responsible social media.

Starting a discussion

Wikipedia is just such a reliable social medium. It is an entirely voluntary, cooperative, web-based enterprise aimed at freely and readily delivering all the knowledge in the world to all the citizens of the world in their own languages. The platform started off in 2000 with a call to experts to contribute articles on the pattern of Encyclopaedia Britannica, but without any remuneration. When experts showed little interested, Wikipedia was thrown open to citizens in 2001, converting it into an anyone-can-edit enterprise. After all, experts too acquire much of their knowledge reading what others have written.

Wikipedia operates on the understanding that laypeople may make mistakes, but these can be eliminated by ensuring open scrutiny and giving full scope for additions, deletions and corrections. That this system has resulted in material of a quality on a par with expert-written encyclopaedias has been established by studies by respected scientific journals. Moreover, not being constrained by the page limits of a printed encyclopaedia, it has generated greater amount of material with a broader scope.

All this has been achieved due to the dedication of 50,000-odd voluntary editors improving existing and writing new articles. This community of editors follow a set of conventions arrived at over the years through consensus. It has been decided that Wikipedia will not include material based on original observations, but instead verifiable information compiled from published studies or reports. Wikipedia believes in a “neutral point of view” presenting the different perspectives, provided these are supported by good evidence. Besides reliability, Wikipedia articles aim for speed (Wiki means quick). For instance, the article on the December 2004 tsunami was composed in two days through contributions of some 1,000 editors largely relying on newspaper and TV reports.

Every Wikipedia article is accompanied by a “discussion” page, on which a variety of issues can be explored without the strict constraints of neutrality and verifiability. This is in addition to the “discussion” page accompanying the “User” page that automatically gets assigned to anyone who registers on the website as a user. On all these debating platforms the site imposes only one major discipline – that they will not be used for self-promotion or abusing others.

Because of these noteworthy conventions, the information on Wikipedia has acquired a special significance. For instance, in Europe and the United States, it has served to subject the performance of political leaders to careful scrutiny. Biographical articles on leaders often include documentation of the promises made before election and the extent to which these were fulfilled. In the past, whenever agents of these leaders tried to delete unfavourable content, they were caught out quickly because Wikipedia preserves all versions of any article, including a record of the IP address of the computer employed to make changes.

The grassroots

Since Wikipedia is unconstrained by governmental control and cannot be subjected to commercial pressures because of its donation-based ad-free model, it is an outstanding medium to document what is happening on the ground. This information can be accumulated through incremental, asynchronous micro-contributions. In India, it presents an excellent instrument for common citizens to document their experiences and issues of concern on the English and the 21 Indian language editions.

The articles could deal with specific geographical localities such as cities (e.g. Pune), wards in a city (e.g. Kothrud in Pune), villages (e.g. Warkhand in Pedne taluka of Goa), talukas (e.g. Dodoamarg in Maharashtra), districts (e.g. Kolhapur or North Goa), rivers (e.g. Panchaganga, Mula-Mutha, Zuari). All we need is some official information source to initiate such articles. The 2011 Census of India is one such excellent database. Every census locality in this database is assigned a unique Census Location Code.

To explain with an example: each of the many villages named Loni, Wadgaon or Mendha in Maharashtra has a different Census Location Code. Similarly, there is a district and a city in Madhya Pradesh as also a town and a taluka in Karnataka, all sharing the name Sagar. Again, these are assigned four different Census Location Codes. This facility permits us to refer unambiguously to any geographical locality at various spatial scales such as district, taluka or city or village. In addition, on their Wikipedia entries, one could readily add the latitude, longitude and altitude off Google Earth.

As it happens, there exists a code – developed by Prashant Pawar – to automatically generate base articles on census localities. Three such Marathi articles, on villages Haladi (Karavir), Rukadi (Hatkangale) and Parite in the Panchaganga basin of Kolhapur district, have been uploaded on the Marathi Wikipedia.

No less than 40,000 such articles were automatically uploaded on the English Wikipedia around 2003-’04 and were then quickly developed further by other interested citizens. However, that was not the norm. While Bollywood celebrates Wikipedia with Shah Rukh Khan singing Mere bareme Wikipediape padh lo, Indians participate little in editing or creating new Wikipedia articles. For instance, an article on the Pune Bus Rapid Transit System on the English Wikipedia is merely based on an official pamphlet. It ignores the vigorous discussion on the subject, including the many news reports in the past several years. The discussion page accompanying the article is almost blank. Surely, the more aware citizens of Pune could put the powerful medium to good use to provide a more detailed and balanced account of their city’s Rapid Transit System.

Bonding across languages

We could, of course, follow the American pattern of automatically generating articles on all Indian localities covered in the 2011 Census. But Wikipedia is not just an encyclopaedia – it is a community, and in the absence of awareness about the enterprise, this approach might not be fruitful. The communal effort was visible when the residents of Haladi in Maharashtra initiated a base article on their locality.

Besides creating base articles, interested citizens can upload photographs, audio and video clips on Wikimedia Commons under a Creative Commons license, permitting anybody to freely use or modify the material after giving due credit to the original creator. Aside from this, citizens can also augment information on issues of their concern through Right to Information queries or enquiries from forums like zilla parishads, municipalities, state legislatures or the Parliament. The Centre for Internet and Society has developed excellent resource material to support citizens taking up Wikipedia-related activities. A group of volunteers led by Subodh Kulkarni is also promoting this participation, as is Goa University.

Much could be accomplished if Indians become active participants on Wikipedia. People could use their articles and their discussion pages to draw the attention of journalists or scholars to their concerns. For instance, people in the command area of a dam could call attention to the fact that no canals have been constructed to bring water to them. A journalist could then investigate the issue and develop a news story, which in turn could provide a verifiable reference for a Wikipedia article. Such interaction could constitute an effective and transparent social audit. One can visualise an array of topics for a social audit, ranging from the status of wage payments in rural employment guarantee works, pending forest rights claims, encroachment of real estate on river beds, privatisation of public beaches, and availability of public toilets for women.

The newly emerging facility of Wikidata can strengthen this social audit. Wikidata permits integration of data not only from English but from multiple languages, such as Hindi, Marathi, Malayalam and Kannada. For instance, sacred groves – forest fragments that are communally protected – constitute a traditional conservation practice not only in India, but also in Bhutan, Myanmar and even Nigeria. This tradition is still relevant – indeed, new sacred groves have recently been constituted in villages granted Community Forest Rights such as Pachgaon in Chandrapur district of Maharashtra.

Using Wikidata and keywords such as Devari (Marathi), Devpan (Konkani), Nagarbana or Devarakadu (Kannada), Sarpakavu (Malayalam), Oran (Hindi), one can quickly compile quantitative information on this practice, helping bring together people from across the country. Similarly, using keywords in different languages for a phenomenon such as mass fish mortalities, one may compile systematic information on this phenomenon that Pollution Control Boards deliberately ignore.

Of course, the objective of the Wikipedia enterprise is to compile objective, verifiable information from a neutral point of view and the Wikipedia community will not be involved in any activism. Nevertheless, such an exercise of putting together information could serve a useful function of organising a social audit. This could help, say, scattered members of fishing communities that are adversely affected by pollution-related fish mortalities to organise themselves.

Democratic approach

This is a golden age for those fascinated by knowledge. And Wikipedia is a triumphant manifestation of the age, a progressive enterprise of good-faith collaboration with the noble objective of making all knowledge available to people all over the world. The English Wikipedia has taken giant strides towards such a goal. The key to this success of science has been the rejection of all authority other than empirical facts and logical inferences, and its aim is to engage all those interested in knowledge regardless of their social, economic or educational background. It is this democratic approach that has facilitated the rapid accumulation of knowledge. Yet there are continual attempts by so-called experts to monopolise knowledge.

It is the duty of true lovers of knowledge to resist such attempts. Knowledge has a vast canvas. Our environment, our social settings are legitimate subject matters of knowledge and every citizen can be involved in nurturing it. Wikipedia is an important step in the direction of bringing on board all citizens in the pursuit of knowledge. The ability of the Wikidata facility to bring together knowledge scattered in multiple Indian languages is one manifestation of this progressive development. All of us Indians should join hands in developing a reliable understanding of the nature around us and of our society, polity and economy. This enterprise of taking Wikipedia to the grassroots would be a worthy contribution to the cause of nation building.

For more details visit http://editors.cis-india.org/a2k/news/scroll.in-february-6-2016-madhav-gadgil-why-arent-indians-using-wikipedia-to-hold-the-government-to-account

Why Aadhaar leaks should worry you, and is biometrics really safe?

praskrishna — 2017-05-12T15:48:48Z

What’s worrying is that the UIDAI seems to always be in denial mode over security concerns.

The blog post was published by the News Minute on May 4, 2017. Amber Sinha was quoted.

If you’ve paid the slightest bit of attention to news about Aadhaar, you’ll have heard about a series of leaks of Aadhaar data from multiple government websites. Some of the latest government websites to leak Aadhaar and demographic data, were the Jharkhand Directorate of Social Security and the Kerala government’s pension department.

Shockingly, a report by The Centre for Internet and Society (CIS) revealed that the Aadhaar details along with demographic details and financial information of around 135 million people in the country has been leaked by four government portals. And this could just be the tip of the iceberg.

However, the public response to these revelations has been muted. The government and the UIDAI, the authority behind Aadhaar, have retreated behind the defence that only Aadhaar numbers have been leaked, and not biometric details, and hence there is no major problem.

However, experts warn that Aadhaar numbers by themselves pose a sufficient risk when leaked, and that the UIDAI has been consistently underplaying the risks of such leaks and overplaying the security of biometric identification.

Amber Sinha, who co-authored the CIS report, points out that it’s not just Aadhaar numbers that have been leaked on government websites, but also demographic information as well as financial details. Various such bits of data can be aggregated by fraudsters and used to steal identities and commit financial fraud online or through phones.

“We see a lot of examples of social engineering techniques where fraudsters collect data from various sources and impersonate people,” he says. The report points out that one of the most common techniques is to call persons impersonating bank officials requiring sensitive information, and provide Aadhaar and demographic details to make the bid for this information convincing.

Amber also points out that in online and phone verifications, it is possible to impersonate other persons with such information.

“Somebody can call the bank pretending to be me, and he could also authenticate himself as me if he has all the data about me. The bank will ask him some four questions and if he has all that information, then the bank has no reason to believe that he is not me,” he explains.

Co-Founder of HasGeek, Kiran Jonnalagadda, an active voice on net neutrality, freedom of speech and privacy, points out that one of the main problems is that the Aadhaar system assumes biometric verification in every transaction, but Aadhaar cards are often used as identity documents without biometrics particularly for many non-financial transactions.

“Somebody can apply for a SIM card with your Aadhaar number, and if the place that is issuing the SIM card didn't do a biometric verification then your card is good enough, because now they can do anything they want in your name,” Kiran said. In such cases, he points out, impersonation is almost ridiculously easy because the Aadhaar card, just a colour printout with no security features, can be faked by almost anyone.

He points out that, particularly in cases of online verifications, the problem of fraud is acutely heightened. “The thing is that if they have your number and your demographic details, if the government does a verification online, the details will match. Which means that the ID is not fake. It's just that you didn't actually authorise any of this. In a perfect world, everybody would do biometrics. The problem is that that does not exist right now.”

One of the major flaws of the current security practices of Aadhaar is that the UIDAI only takes responsibility for the security of data stored within its Central Identities Data Repository. However, explains Amber, over the last five years, the UIDAI has proactively seeded Aadhaar data across multiple government databases. However, the UIDAI has not exercised strict disclosure controls on these government databases, and there are no clear standards for publicity of information.

The CIS report points to the example of the Andhra Pradesh portal of the NREGA, which carries information on Aadhaar numbers and disbursal amounts on a simple text file, with no encryption or other security measures. The report argues that this system could easily be exploited to transfer illegal sums of money into these accounts, making beneficiaries liable for them.

Importantly, Amber points out that the recent publications of Aadhaar details cannot properly be called leaks. A leakage occurs, he points out, when information is treated as secret and stored accordingly and then breached from the outside or leaked by abusing access.

“Here the websites that we looked at are designed in such a way that anybody without any technical knowledge can access information. They are available for download as spreadsheets, how much simpler could it get?” he asks.

Even with the much-vaunted infallibility of biometric verification, experts warn, there are some scarily large loopholes present. While the UIDAI regularly goes to town with the claim that the biometric data stored in the CIDR is well protected behind multiple firewalls, detractors point out that biometric data collected at each transaction point is not similarly secure.

Other kinds of financial transactions such as card transactions , explains Amber, use two-factor authentication (a physical card and a pin number or card details and an OTP, for instance). With Aadhaar, however, authentication is possible with just biometrics.

This is risky because biometric data is not duplication-proof. When biometric data is collected for authentication, he says, there are ways in which this data can be stored for re-use. “At the end of the day, the way the biometric authentication works is by comparing two images. There is a copy of an image which is collected at the time of enrolment which is stored by the UIDAI, and every time you authenticate yourself you give a fresh image. As far as the CIDR is concerned, it has nothing to do with how that image is being created at that stage,” says Amber.

This can and has led to what is called a “replay attack”, where stored biometric images are used to complete transactions without the presence of the actual owner of the biometric data. This is what happened in the case involving Axis Bank, Suvidha Infoserve and eMudhra in February.

Such situations arise, says Kiran, because Aadhaar confuses two very separate functions–authentication (establishing that I am who I am) and authorisation (certifying that I want an action done in my name). “It’s the difference between signing a cheque and showing a photo ID to prove that you are who you are,” explains Kiran. The problem with biometrics is that both processes are combined in one, and there is nothing to verify that the person to whom the biometrics belongs to is actually present for each transaction.

While the UIDAI has now proposed registered and encrypted biometric devices to overcome this problem, some detractors argue that a way around this is not impossible to find either.

“The larger problem is that the UIDAI constantly plays a game of denial and catch up. They keep pretending like other people are stupid and their system will never be broken. And other people keep pointing out that they've forgotten the most obvious things about security in any information system. They are currently in denial mode, where they insist such things are not possible until after it happens, and then they say oh it's happening, let's go do something to fix it,” Kiran says.

What’s more, Kiran and Amber point out that biometrics can even be physically duplicated. On iris scans, Amber argues, “Now, with a lot of CCTV cameras, if their resolution is high enough it is possible to capture things like an iris scan. So the means for biometric authentication can be used covertly, and that is a technological truth,” he asserts.

Duplicating fingerprints, says Kiran is even easier, pointing out to attendance fraud carried out by students of the Institute of Chemical Technology in Mumbai. These students used a resin adhesive to make copies of their fingerprints, which their friends used to give them proxy attendance in the biometric attendance system.

“Lifting fingerprints is ridiculously easy. Anything you touch will leave fingerprints on it. All it requires is some cello-tape to make a copy of your fingerprints. And then you can apply some wax to it and you get an actual impression of your finger. You can go place that on any fingerprint reader and it'll be fooled,” says Kiran.

It’s not as if such duplication is not possible with devices like credit cards. However, says Kiran, there are two key differences. Firstly, credit card companies have built up elaborate checks and balances over years to tackle fraud. Secondly, and far more importantly, credit cards that have been compromised can be cancelled. “Revocability is a feature in the credit card system. In Aadhaar you can't revoke anything. If fraud happens, you are stuck with fraud for the rest of your life,” explains Kiran.

For more details visit http://editors.cis-india.org/internet-governance/news/the-news-minute-rakesh-mehar-may-4-2017-why-aadhaar-leaks-should-worry-you-and-is-biometrics-really-safe

Whose Data is it Anyway?

praskrishna — 2012-04-28T04:12:15Z

Tactical Technology Collective and the Centre for Internet & Society invite you to the second round of discussions of the Exposing Data Series at the CIS office in Bangalore on 24 January 2012. Siddharth Hande and Hapee de Groot will be speaking on this occasion.

Like countless others, this title is a convenient adaptation of a 1972 play by Brian Clark, Whose Life is it Anyway?, a meditation on 'euthanasia' and the extent to which governments or the law can determine the private life of an individual. In a similar sense we use the title to help frame the second set of conversations in the Exposing Data Series, to zero in on the idea of data and who has the right to decide what happens with it. Philosophically, and also at the level of code, computing and the law, the ownership of data can be a somewhat odd and a contentious thing to grapple with. The only other understandings of 'ownership' we really have are those of property and identity and these get imputed onto the intangibility of data. And, in some senses now, many aspects of one's identity exist as data.

There are a range of experiences of data ownership that we talk about and experience daily. On the one hand you can hoard hard disks with favourite content to retrieve memories and experiences. On the other end of things, you can aggregate your experiences and memories with that of thousands of others, that then gets treated almost like a private hard disk belonging to some mysterious X. Who is this Mysterious X? Is there a Y? Or an XY? What is the trajectory of data in its movement from the individual to a larger, shadowy infrastructure that harvests it? What happens to our idea of data in its reconfiguration from intangible code to an idea of politics and rights? To introduce another provocation, do our existing ideas of data ownership objectify individuals? What does this objectification imply for the notion of personal privacy? For example, does the fetishization of 'things' called data obfuscate the idea of personal privacy?

One of the ways in which we may consider looking at open data initiatives for transparency and accountability is to assess it as discourse, and in relation to what happens when communities aggregate data. Open Government Data usually involves a top-down approach in terms of how it is aggregated, collated, shared, whilst community based approaches are more particular, contextual and local. What do these different approaches give us when we bring them to the same table?

The second event in the Exposing Data Series will focus on data ownership, looking into open government data and community-based data aggregation, to explore the various levels of data collection, the movement of data and its exchange, its representation, and dissemination in different contexts.

Speakers

Siddharth Hande, Transparent Chennai
Hapee de Groot, Hivos, Netherlands

This event is free and open to everyone. However, we would appreciate a confirmation of attendance ahead of time so as to ensure that your space is reserved. To confirm your attendance please write to: yelena.gyulkhandanyan@gmail.com

Photo Source: http://www.freedigitalphotos.net/images/view_photog.php?photogid=2000

VIDEOS

For more details visit http://editors.cis-india.org/internet-governance/whose-data-is-it

Whose Change is it Anyway?

praskrishna — 2013-07-02T15:41:46Z

For more details visit http://editors.cis-india.org/digital-natives/blog/whose-change-is-it-anyway.pdf