Centre for Internet and Society

Indian Government Quietly Brings In Its 'Central Monitoring System': Total Surveillance Of All Telecommunications

praskrishna — 2013-07-02T09:12:49Z

There's a worrying trend around the world for governments to extend online surveillance capabilities to encompass all citizens -- often justified with the usual excuse of combatting terrorism and/or child pornography.

The blog post was published in tech dirt on June 8, 2013. Pranesh Prakash is quoted.

The latest to join this unhappy club is India, which has put in place what sounds like a massively intrusive system, as this article from The Times of India makes clear:

The government last month quietly began rolling out a project that gives it access to everything that happens over India's telecommunications network -- online activities, phone calls, text messages and even social media conversations. Called the Central Monitoring System, it will be the single window from where government arms such as the National Investigation Agency or the tax authorities will be able to monitor every byte of communication.

This project has been under development for two years, but in almost total secrecy:

"In the absence of a strong privacy law that promotes transparency about surveillance and thus allows us to judge the utility of the surveillance, this kind of development is very worrisome," warned Pranesh Prakash, director of policy at the Centre for Internet and Society. "Further, this has been done with neither public nor parliamentary dialogue, making the government unaccountable to its citizens."

That combination of total surveillance and zero transparency is a dangerous one, providing the perfect tool for monitoring and controlling political and social dissent. If India wishes to maintain its claim to be "the world's largest democracy", its government would do well to introduce some safeguards against abuse of the new system, such as strong privacy laws, as well as engaging the Indian public in an open debate about what exactly such extraordinary surveillance powers might be used for.

For more details visit http://editors.cis-india.org/news/tech-dirt-june-8-2013-indian-govt-quietly-brings-central-monitoring-system

Indian government defends Internet blocking

praskrishna — 2012-08-28T10:07:50Z

India on Friday defended itself against accusations of heavy-handed online censorship, saying it had been successful in blocking content blamed for fuelling ethnic tensions.

Published by AFP on August 23, 2012. Pranesh Prakash is quoted.

The government over the past week has ordered Internet service providers to block 309 webpages, images and links on sites including Facebook, Twitter, Wikipedia, news channel ABC of Australia and Qatar-based Al-Jazeera.

The orders were an effort to halt the spread of "hateful" material and rumours that Muslims planned to attack students and workers who have migrated from the northeast region to live in Bangalore and other southern cities.

"We have met with success. These pages were a threat to India's national security and we demanded their immediate deletion," Kuldeep Singh Dhatwalia, a spokesman for India's home ministry, told AFP.

"Spreading rumours to encourage violence or cause tension will not be tolerated. The idea is not to restrict communication."

The government has blamed Internet activity for fanning fears that resulted in tens of thousands of migrants fleeing back to the northeast last week from Bangalore and elsewhere.

But Twitter users, legal experts and analysts criticised the government's approach, which appeared to have resulted in only partial blocking of material, much of which was still accessible.

"The officials who are trusted with this don't know the law or modern technology well enough," Pranesh Prakash, programme manager at the Centre for Internet and Society research group, told AFP.

"I hope that this fiasco shows the folly of excessive censorship and encourages the government to make better use of social networks and technology to reach out to people."

Among the blocked content were photographs by AFP and other news agencies from Myanmar in the British Daily Telegraph, a parody Twitter account pretending to be from Prime Minister Manmohan Singh and dozens of YouTube videos.

ABC issued a statement saying it was "surprised by the action" after content on its website about unrest in Myanmar between Muslims and Buddhists was included on the blocking list.

India's Home Minister Sushil Kumar Shinde insisted in a statement the government was "only taking strict action against those accounts or people which are causing damage or spreading rumours."

Shinde added that the government sought to block the Myanmar online photos because they were "disturbing the atmosphere here in India."

The government said photographs of clashes in Myanmar were circulating on the Internet with fake captions claiming the scenes were from the northeastern Indian state of Assam, where 80 people have died in recent ethnic violence.

Vivek Sood, senior Supreme Court lawyer and an author on Internet legalisation, called the government's step "a gross abuse of power."

"It's completely illegal under the Indian IT Act," he told The Economic Times.

Indian journalist Kanchan Gupta, who is often critical of the government, had his Twitter account targeted by a government blocking order in a move he called a "political vendetta".

Al Jazeera webpages on the blocking list, including a report on the exodus from Bangalore, appeared unaffected by the government orders, the channel's Delhi bureau chief Anmol Saxena told AFP.

Ministers earlier complained they had not received cooperation from websites and social network groups.

The government on Thursday said Twitter had agreed to remove six fake accounts parodying Prime Minister Singh.

The prime minister's office issued a statement on Friday quoting Twitter that they have "removed the reported profiles from circulation due to violation of our Terms of Service regarding impersonation".

United States State Department spokeswoman Victoria Nuland said as India "seeks to preserve security, we are urging them also to take into account the importance of freedom of expression in the online world".

The above was carried in the following places as well:

The National (August 25, 2012)
MSN News (August 24, 2012)
StarAfrica.com (August 24, 2012)
Jakarta Globe (August 24, 2012)

For more details visit http://editors.cis-india.org/news/afp-com-aug-23-2012-indian-govt-defends-internet-blocking

Indian government at second position after U.S.A for demanding user data from Google

praskrishna — 2012-11-30T05:05:01Z

The Indian government has secured 2nd position in the list of the governments demanding for Web user information. It is behind only from the United States government.

This blog entry was published in WHDI Reviews on November 22, 2012. Pranesh Prakash is quoted.

This fact came to light in the ‘Transparency Report’ published by web services major. The report covers the time period from January to June in the present year. During this time period, the Govt. of India has asked Google for user information 2,319 times over 3,647 user accounts.

This has been done by the way of court orders and requests made by police. Google has allowed the disclosure of the information sometimes partially and sometimes completely. The U.S.A government on the other hand requested for more information 7,969 requests over 16,281 accounts. The compliance rate by Google to Indian and U.S requests was 64% and 90% respectively. The report gives details about two categories of interactions: firstly to divulge data and secondly to pull down content. India now ranks 7th in the list of countries which had made requests to pull down data. India could have achieved even a better rank but owing to the lack of any constitutional power which backs its action, it has to be satisfied with the seventh position. According to Pranesh, (policy director with Bangalore-based Centre for Internet and Society) these requests for pulling down data are an attempt made by the government so that its criticism is not able to reach a wide audience.

Google (which is banned in China) supports the cause of disclosure of the information related to governments. The other net service providers which put out similar transparency reports are twitter, Linkedin and Cloud storage service Dropbox. These content pull down request made by the government is not healthy for a democratic country like India.

For more details visit http://editors.cis-india.org/news/whdi-reviews-nov-22-2012-indian-government-at-second-position-after-usa-for-demanding-user-data-from-google

Indian Express Article

praskrishna — 2015-12-29T01:54:33Z

Indian Express Article

For more details visit http://editors.cis-india.org/home-images/IndianExpressMangaluruDec122015.jpg

Indian experts doubt government ban on porn sites will be effective

praskrishna — 2016-07-01T15:00:32Z

The Indian government directed service providers to block 240 websites but doubts have surfaced over the legality of such an order.

This was published in ZDNet on June 20, 2016.

Last year, the Indian government identified more than 850 websites that provided escort services but action has been initiated only with respect to 240 such websites after a Mumbai court issued an order to ban them last week.

These sites were banned under the provision of Section 79(3)(b) of the Information Technology Act, 2000 -- as their content relate to morality and decency as given in Article 19(2) of the Constitution of India -- on June 13 after a committee of experts in the Indian Home Ministry recommended action against them.

But experts doubt whether the government can proscribe them in view of a lack of adequate legislation. Jaspreet Grewal, programme officer with the Centre for Internet and Society, said that though the websites offering escort services may potentially be in violation of the law, they cannot be banned under the existing provisions of the IT Act.

Even the government appears to be in a dilemma, as although it notified internet service providers to disable 857 websites on July 31, 2015, it modified the orders four days later, saying that the service providers were free "not to disable" any of the 857 sites if they did not have child pornographic content.

Following an uproar, with netizens lashing out at the government on the social media platforms such as Reddit and Twitter saying that it was trying to impose censorship and also curb freedom of expression, the government decided to rescind its July 31 directives.

According to a report in Delhi-based English daily Hindustan Times, Indian Minister for Communication and Information Technology Ravi Shankar Prasad rejected that the present government was a Talibani government, as being said by some of the critics. "Our government supports free media, respects communication on social media, and has respected freedom of communication always," he said.

The minister, while making a statement in Parliament last month, admitted that it was a significant challenge to filter the sites with pornographic content as most of the pornographic sites were hosted outside the country, where viewing pornography is legal.

"These websites keep on changing the names, domain addresses, and hosting platforms from time to time, making it difficult to filter or block such websites using technical tools available in the market," he added.

The minister also said that the government was asking the service providers regularly to upgrade their infrastructure and technology to effectively address the shortcomings with regard to identifying and blocking encrypted websites. "The government is also in regular touch with social networking sites, having their offices in India, to disable objectionable contents at the source from their websites," he added.

However, the government seems to be treading cautiously and an indication to this effect was given by a senior official in the Department of Electronics and Information Technology (DeitY). "Though a debate is taking place for a long time, the government is now taking a calibrated approach," DeitY Joint Secretary Rajiv Bansal said at an ICANN event held in Delhi on Thursday.

He also felt that banning the websites was not a solution as new sites were sprouting to replace the blocked ones.

For more details visit http://editors.cis-india.org/internet-governance/news/zdnet-vl-srinivasan-june-20-2016-indian-experts-doubt-government-ban-on-porn-sites-will-be-effective

Indian Court Strikes Down Section of Law Punishing Offensive Posts

praskrishna — 2015-03-26T15:40:06Z

The Indian Supreme Court on Tuesday struck down a section of a law that allowed the authorities to jail people for offensive online posts, in a judgment that was regarded as a landmark ruling on free speech in India.

The blog post by Nida Najar and Suhasini Raj was published on the website of NDTV on March 25, 2015. Sunil Abraham gave his inputs.

The law stipulated that a person could be jailed for up to three years for any communication online that was, among other things, "grossly offensive," "menacing" or "false," and for the purpose of causing "annoyance," "inconvenience" or "injury." The provisions, which led to highly publicized arrests in recent years, had been roundly criticised by legal experts who called them vague and argued that they had been used in some cases to stifle dissent.

Calling the wording so vague that "virtually any opinion on any subject would be covered by it," the court said "if it is to withstand the test of constitutionality, the chilling effect on free speech would be total."

Sunil Abraham, the executive director of the Center for Internet & Society, which is based in Bangalore, called the decision "amazing."
"It is in continuation of a great tradition in India: that of apex courts consistently, over the years, protecting the citizens of India from violations of human rights," he said.

India is considered by some to be one of the world's most freewheeling democracies, but the law reflected the ambivalence with which Indian officials have sometimes treated freedom of expression, occasionally citing the Constitution's allowance of "reasonable restrictions" on free speech in order to ban books, movies and other material about subjects like sex, politics and religion.

The government recently blocked the screening in India of the BBC documentary "India's Daughter," about the Delhi gang rape in 2012 that made international news.

The law, the Information Technology (Amendment) Act, was passed by parliament shortly after the three-day terrorist attacks on Mumbai in 2008. It granted the authorities more expansive powers to monitor electronic communications for reasons of national security. That section was not a part of the court case.

In the past, critics have been particularly worried that the section of the law that was struck down was ripe for misuse at the hands of police officials often beholden to political parties.

Last week, a young man in the northern Indian state of Uttar Pradesh became one of the latest people to be arrested under the law when the police said he incorrectly attributed a polarizing statement to the lawmaker Azam Khan on Facebook.

Other highly publicized cases include the arrest in 2012 of a professor accused of sharing cartoons mocking the chief minister of West Bengal state on Facebook and the arrest of two young women after one shared a Facebook post criticizing the virtual shutdown of Mumbai following the death of a revered right-wing political leader there. The professor is still contesting his case in court, while the case against the two young women was dropped in 2013, according to the Press Trust of India.

In a separate part of the Supreme Court judgment, the justices made it harder to force websites to take down content, although a legal expert said it remained to be seen how much of an impediment the ruling would be to blocking content.

For more details visit http://editors.cis-india.org/internet-governance/news/ndtv-nida-najar-and-suhasini-raj-march-25-2015-indian-court-strikes-down-section-of-law-punishing-offensive-posts

Indian companies need to boost encrpytion adoption rate: experts

praskrishna — 2016-08-10T14:36:05Z

Most banks do not follow Reserve bank of India’s standard 64/128-bit encryption policy due to laxity and unavailability of funds.

The article by Koustav Das was published in the Deccan Chronicle on August 9, 2016. Sunil Abraham was quoted.

A recent report by security software firm Sophos highlighted the increasing number of online attacks on Indian businesses, suggesting strong encryption policies can change the existing scenario.

As per a SophosLab research, India’s threat exposure rate has been pegged at 16.7 per cent, ranking fifth in terms of highest percentage of endpoints exposed to malware attack.

The research said cyber-criminals have developed a keen sense of luring organisations on the basis of location, language and disguise, leading to an acute increase in the number of targeted attacks.

Global Experts have explained that digital attackers have taken the aid of advanced malware including deadly ransomwares, which involve locking or capturing an organisation’s valued data and demanding money to unlock it.

In future, ransomware have been predicted to become deadlier, allowing hackers to take control of an organisation’s entire network security.

Not only financial and IT companies but Government websites also face similar obstructions due to lack of updated security tools.

Mohit Puri, Head of Pre-sales, Sophos India and SAARC, said, "India faces increased risk from cyber-criminals due to its high economic growth, which has left several companies to re-think their security strategy."

Reactive to attacks, not proactive

Though Puri mentioned that Indian enterprises have been trying to prevent such attacks, large fissures in network security have made the task easier for online criminals.

One of the major reasons for companies failing to prevent advanced cyber-attacks can be attributed to the lack of pragmatic solutions, albeit their awareness about the situation.

Puri said, “While companies are aware about security threats to our systems, we are still not there in terms of how we are trying to mitigate these threats.”

According to Sunil Abraham, Director of The Centre For Internet and Society (CIS), there are manifold issues that have led to the scenario of India’s poor online security.

He said that Indian businesses and financial organisations recognize the situation but do not want to allocate budget for updating their security infrastructure.

“The problem with cyber-security is just like smoking; people are aware of it but they do not care about the warnings. Companies know about the looming threats but need an episode to make a move towards updating their network infrastructure,” Abraham added.

Enterprises also struggle due to the absence of sufficient cyber-security professionals in the country. Abraham said, “There are uncountable software professionals in India but the story is totally opposite when it boils down to cyber-security professionals.”

Weak encryption adoption

According to technology enthusiast Blaise Crowly, Co-Founder & Head Of Security Design Gladius & Schild, "Cryptography—a broader form of encryption—can be defined as a branch of mathematical algorithms that can be used to securely protect data."

Crowly added, “It is the one of the strongest form of all defence mechanisms against cyber attacks.”

However, a Sophos assessment—State of Encryption Today—where 1,700 Indian IT managers were surveyed, showed the ignorance of companies towards integrating strong encryption tools.

Out of the total number of participants, 61 per cent felt encryption holds significant importance in protecting a company’s proprietary data.

Others had peculiar reasons—18 per cent felt that encryption would help avoid incurring additional costs after a breach and 23 per cent just wanted to avoid negative publicity of the company.

Even in case of banks, reports suggested that most banks do not follow Reserve bank of India’s (RBI) standard 64/128 bit encryption policy due to laxity and unavailability of funds.

“Indian organisations need to take a second look at their security posture and deploy up-to-date synchronized security solutions that are able to combat today’s threats as well as tomorrows,” said Puri.

Government’s role

A 2015 CIS study, titled “How India Regulates Encryption” mentioned that under section 84A of the IT Act, the government has the sole authority to prescribe modes and methods of encryption.

Though the government has not yet issued any rules in exercise of these powers, it had released earlier released a draft encryption policy on September 21, 2015. However, it failed to pass it due to wide-spread criticism regarding certain mandates in the draft.

In addition, the Internet Service Providers (ISP) License Agreement, between the Department of Telecommunication (DoT) and Internet Service Providers (ISP), limit the use of encryption up to 40-bit key length in symmetric algorithms—an extremely weak standard.

Although it cannot be enforced if organisations employ third-party encryption systems, it becomes extremely expensive for them. In such a scenario, companies hesitate in using better encryption standards.

CIS Director Sunil Abraham said, “To solve the issue, the government should work towards incentivising and enforcing strong security infrastructure which will help companies get these features at a lower price.”

Adding to the aforementioned statement, Crowly highlighted that current security standards set by the government cannot adeptly counter advanced threats.

“OpenSSL, LibNaCl and similar protocols provide free implementation of encryption schemes that companies can use. The only issue is that companies and government agencies should show proper diligence in hiring experts in this field,” Crowly concluded.

For more details visit http://editors.cis-india.org/internet-governance/news/deccan-chronicle-koustav-das-august-9-2016-indian-companies-need-to-boost-encryption-adoption-rate

Indian civil liberties groups are now geared to fight the draconian IT Rules

praskrishna — 2011-05-11T09:49:26Z

There is a price for liberty and that is eternal vigil against forces that seek to grab it from you. Civil Liberties groups are now coming to terms with the recently issued Information Technology Rules 2011 of the Government of India, which they fear would curtail the freedom of expression of Internet users in the country, writes Akash Bisht. This article was published in the Weekend Leader.com, Vol 2 Issue 18, 6 - 12 May, 2011.

The People’s Union for Civil Liberties (PUCL) is taking steps to bring the issue to public attention. Recently, Pushkar Raj, general secretary of PUCL, forwarded a mail that contained a couple of links of published articles on the subject to his contacts.

The Rules aim to restrict web content that can be considered ‘disparaging', ‘harassing', 'blasphemous' or 'hateful'. “We want to bring this issue to public attention,” Pushkar said.

India’s new IT Rules has already caught the attention of the international media, which sees it as an attempt to curb freedom of expression of internet users. The New York Times ran a story with the headline, ‘India puts tight leash on Internet free speech.’

The article pointed out that the new rules “allow officials and private citizens to demand that Internet sites and service providers remove content they consider objectionable on the basis of a long list of criteria.”

Lurking danger: Oblivious to many internet users, the IT Rules 2011 seeks to restrict their online freedom (Photo: Senthil Kumaran)

Pushkar expressed concern about these new rules and its impact on the debate and discussion on the internet that is gaining popularity among the estimated 100 million internet users in the country.

According to one of the rules, internet intermediaries – for example, internet publishers or popular websites like Facebook, You Tube etc - have to respond to any demand made by any individual or group to take down content that they consider offensive within 36 hours. “It is a dictatorial directive. Anybody can interpret this to his liking and demand any website to take down such ‘offensive content’,” says Pushkar.

According to the new rules, the objectionable content also includes anything that “threatens the unity, integrity, defense, security or sovereignty of India, friendly relations with foreign countries or public order''. An article in www.medianama.com reacted to this clause stating: “didn’t the Jan Lokpal protests threaten public order, and wasn’t a lot of the commentary online anti-government? Who decides whether ‘anti-government’ statements are ‘anti-national, or for that matter, statements criticizing a particular politician or political family?”

Centre for Internet and Society is also critical of these rules. “There are many areas of concern and it is a disservice to the freedom of expression. There is a clause wherein cybercafé owners can fine somebody watching pornography. Only courts can decide what is offensive and not cyber café owners,” says Sunil Abraham, Director, Centre for Internet and Society.

Pushkar sums it up: “Democracy helps nations evolve into greater civilisations, but once you restrict thoughts there is no possibility of going ahead. These new set of rules are problematic and can have wider interpretations and thus need to go. ”

Read the article published by the WeekendLeader.com here

Sunil Abraham has been misquoted in this article.

For more details visit http://editors.cis-india.org/news/a-fight-against-draconian-IT-rules

Indian businesses crave IP certainty, but better patent values are tempting them overseas

praskrishna — 2015-05-05T02:27:57Z

Indian corporate leaders view a strong and sustainable IP system as key to furthering their country’s economic development and attracting continued foreign investment, a recent study suggests. A lack of confidence that this is currently the case – and the perceived higher value attached to IP assets in other markets – is driving some of the brightest high tech prospects to build their businesses abroad rather than at home.

This was published in iam magazine. Sunil Abraham gave his inputs.

Research and advocacy firm Strategic Partners Group (SPAG) surveyed executives in a number of major Indian and multinational companies across six broadly defined sectors: healthcare, pharmaceuticals and diagnostics (life sciences); information technology, fast-moving consumer goods and telecommunications (IT/telecoms); legal services; music and entertainment; academic/research institutions; and industry associations. Ninety-nine percent of respondents to the survey agreed that intellectual property plays an important role in their industry. When asked if they believed India has a ‘sound IP policy’, 70% of life sciences, 79% of IT/telecoms and 80% of industry association respondents gave a negative answer. The group that most frequently answered in the affirmative was legal services providers, who were split 50/50 between those content with India’s current IP policy and those wanting to see improvements. While 29% of survey respondents felt that India’s policy makers are doing enough to establish a strong IP rights regime in the country, 65% thought otherwise.

India is all too often thought of by foreign companies as being a highly problematic place in which to own, manage and enforce intellectual property, due to what they see as inefficient infrastructure and misguided policy. The country’s treatment of pharmaceutical patents has been of particular concern to outsiders in recent years. As such, the resulting environment is seen to be somewhat biased in favour of alleged infringers. As a result, foreign rights holders and governments (the United States, in particular) have called on the country’s authorities to review its laws and regulations to bring them into line with what they would argue are international norms.

But the findings of the SPAG survey highlight that it is not just IP owners from overseas who feel they are missing out because of the country’s challenging IP regime. India has one of the most pronounced brain-drains of any country in terms of inventor emigration. And worryingly for the government, several high-profile start-ups have decided to move out of India in recent times in order to take advantage of better appreciation of the value of their intellectual property in other jurisdictions.

Sriram Kanuni, founder of IT consultancy Arteria Technologies, told the Economic Times recently that he had relocated much of his company’s IP holdings to the United States in an effort to get a better valuation for its next round of funding. “Global investors seem to value companies with patents in the United States much higher,” he said. “Therefore, it makes more sense to shift patents out of India, in case you're looking to raise money or exit.”

According to the Times, e-commerce company Flipkart, mobile advertising firm InMobi and customer engagement solutions provider Capillary Technologies all decided to incorporate in Singapore rather than their native India; while data protection start-up Druva opted to make California its new home. Mobile marketing and analytics firm ZipDial also incorporated in the city state; if it had remained in India, its chances of being acquired by Twitter for a reported sum of between $30 million and $40 million back in January may have been significantly lower.

At least part of the issue lies in a lack of certainty surrounding the Indian court system’s treatment of IP rights. “Indian courts aren't uniform when it comes to developing jurisprudence around copyright and patent infringement,” Sunil Abraham, executive director of the Centre for Internet and Society, told theTimes. He opined that judges lacking in IP-related experience may sometimes grant injunctions too readily. “Then the loss of six months… can be quite expensive, because in six months' time your competitor might eat into all of your market.”

According to the SPAG report, Indian courts are yet to award damages in a patent case. They have allocated damages in 72% of trademark cases, 27% of copyright cases and 1% of publicity rights cases, though the approximate average amount awarded is a rather paltry-sounding $1,000.

It sounds like IP policy-shapers in India – whether in government, the judiciary or business – have plenty of work on their hands in order to keep its brightest innovation prospects in the country. India has a lot to offer which may make it more attractive to many foreign rights holders than other developing IP markets. But without an IP system that effectively addresses the value of IP assets, multinationals will continue to be apprehensive to increase their investments in the country – and emerging domestic players may feel they have little choice but to make their IP-related investments elsewhere.

For more details visit http://editors.cis-india.org/a2k/news/iam-media-jack-ellis-april-28-2015-indian-businesses-crave-ip-certainty-but-better-patent-values-are-tempting-them-overseas

Indian biometric ID plan faces court hurdle

praskrishna — 2013-10-03T10:58:31Z

Supreme Court in India rules -- for now -- against plan to make biometric ID mandatory for receiving services.

This article by John Ribeiro was published in Computer World on September 25, 2013. Pranesh Prakash is quoted.

A controversial biometric project in India, which could require people to produce their biometric IDs to collect government subsidies, has received a significant setback from the country's Supreme Court.

The court ruled this week in an interim order that people cannot be required to have the controversial Aadhaar identification to collect state subsidies, even as the Unique Identification Authority of India (UIDAI), the government agency that manages the project, has been trying to promote the Aadhaar number as proof of identity for a variety of services including banking.

The UIDAI has said that the scheme is voluntary, but some states and agencies have attempted to link the identification to the implementation of programs such as cash subsidies for cooking gas that benefit even the middle and richer classes.

"I signed up for Aadhaar only to ensure that I continue to get a gas cylinder at reasonable rates," said an executive in Bangalore who had queued up a few months ago for an Aadhaar number. The state of Maharashtra, for example, aims to be the first state in the country to roll out Aadhaar-linked subsidy transfers to LPG (liquified petroleum gas) consumers across all the districts in the state.

Pending a final order, the court ruled that "....no person should suffer for not getting the Adhaar card inspite of the fact that some authority had issued a circular making it mandatory...."

UIDAI Chairman Nandan Nilekani did not immediately agree to discuss the court order.

The Aadhaar project is the result of an executive order, and is not backed by a law passed by India's Parliament, so its legality can be in question, said Pavan Duggal, a cyberlaw expert who practices before India's Supreme Court. The project could be in violation of the country's Information Technology Act and rules which cover collection, handling and processing of sensitive personal data, he added.

Aadhaar, though said to be voluntary, could also be in violation of fundamental rights of the Indian constitution relating to right to life and privacy, as a perception is being created that the ID will be required for subsidies and benefits, Duggal added.

The government should have considered getting an enabling law passed by Parliament for the data collection as also a strong privacy law to prevent misuse of Aadhaar related data and collation of multiple databases using Aadhaar, because of the privacy issues involved and its implications on fundamental rights, said Pranesh Prakash, Policy Director at the Centre for Internet and Society in Bangalore.

The biometric project, which collects 10 fingerprints, iris scan and other information such as name, date of birth and address, has been criticized by a number of privacy groups who worry that the data could at some point be misused by the government. There is also a risk that such large databases could be hacked, putting at risk information of people. It is not clear what are the measures taken by UIDAI to protect the authenticity and correctness of the biometric information, and prevent access by foreign powers, Duggal said.

The Aadhaar number now allows different agencies including private organizations to collect and exchange data between them, which may be useful to marketers, for example, Prakash said. Previously, it wasn't practical as the agencies would have difficulty ensuring that the information was about the same person, he added.

The Supreme Court has also ruled that illegal immigrants should not be enrolled under the Aadhaar program, which is meant to facilitate subsidized services to Indian citizens. The Aadhaar, which does not collect citizenship information, is likely to be misused by illegal migrants, activists have said.

One of the many challenges facing the Aadhaar program is that village-level politicians and influence peddlers cook up data to enroll under subsidy schemes people who are not eligible for benefits, or people who are nonexistent. The traditional paper ration card scheme and voter rolls are usually stuffed with nonexistent people or people who do not typically qualify for benefits.

Aadhaar was expected to remove these discrepancies by more accurate collection of data on people who enrolled under the scheme. But a number of users have complained that the Aadhaar cards they have received have errors in their names, addresses and other details. One newspaper reported that an Aadhaar applicant received a card that had the face of a dog in place of his photograph.

UIDAI aims to provide 600 million Aadhaar numbers to residents by 2014.

For more details visit http://editors.cis-india.org/news/computerworld-september-25-2013-john-ribeiro-indian-biometric-id-plan-faces-court-hurdle

India: The New Front Line in the Global Struggle for Internet Freedom

praskrishna — 2012-06-18T07:10:21Z

The government tussles with Internet freedom activists in the world's largest democracy.

This article was published in the Atlantic on June 7, 2012

This Saturday, Indian Internet freedom advocates are planning to stage a nation-wide protest against what they see as their government's increasingly restrictive regulation of the Internet. An amorphous alliance of concerned citizens and activist hackers intend to use the streets and the Internet itself to make their opposition felt.

Over the last year, as Americans were focused on the domestic debates surrounding the Stop Online Piracy Act (SOPA) and the Protect Intellectual Property Act (PIPA), or on the more brazen displays of online censorship by mainstays of Internet restriction like China, Iran and Pakistan, India was rapidly emerging as a key battleground in the worldwide struggle for Internet freedom.

The confrontation escalated in April 2011, when the Ministry of Communications and Information Technology introduced sweeping new rules regulating the nature of material that Internet companies could host online. In response, civil liberties groups, Internet freedom supporters, and a growing assembly of online activist hackers have been fighting back, initiating street protests, organizing online petitions, and launching -- under the banner of the "Anonymous" hacker group -- a torrent of distributed denial of service (DDoS) attacks against Indian government and industry web sites.

The April 2011 rules, an update to India's Information Technology Act (IT Act) of 2000 (amended in 2008), popularly known as the "intermediary guidelines," instruct online "intermediaries" -- companies that provide Internet access, host online content, websites, or search services -- to remove, within 36 hours, any material deemed to be "grossly harmful, harassing, blasphemous," "ethnically objectionable," or "disparaging" by any Internet user who submits a formal objection letter to that intermediary. Under the guidelines, any resident of India can compel Google, at the risk of criminal and/or civil liability, to remove content from its site that the resident finds politically, religiously, or otherwise "objectionable."

Information Technology Minister Kapil Sibal -- the intermediary guidelines' most important government evangelist, and the head of the agency responsible for administering the guidelines -- even instructed Internet companies to go one step further and start pre-screening content for removal before it was flagged by concerned users. This requires companies like Facebook, in effect, to determine what material might offend its users and thus violate Indian law, and then remove it from the website. With over 100 million Internet users in India, no company could possibly monitor all its content through human intervention alone; web companies would have to set up filters and other mechanisms to take down potentially objectionable content more or less automatically.

India's constitution, in large part crafted in response to the modern country's harrowing history of religious and communal violence, allows for "reasonable restrictions" on free speech. Indian officials have at times banned certain books, movies, or other materials touching on such sensitive subjects as religion and caste.

Left with little choice but to comply or risk legal action, Google, Yahoo!, and other Internet companies acquiesced and began pulling down webpages after receiving requests to do so. Yet many companies refused to remove all the content requested, prompting Mufti Aijaz Arshad Qasm, an Islamic scholar, and journalist Vinay Rai, respectively, to file civil and criminal suits against 22 of the largest Internet companies operating in India. The targets, including Google, Yahoo!, Facebook, and Microsoft, were accused of failing to remove material deemed to be offensive to the Prophet Mohammed, Jesus, several Hindu gods and goddesses, and various political leaders.

The companies have had some success in the litigation: Google India, Yahoo!, and Microsoft have all been dropped from the civil case after the court heard preliminary arguments; the Delhi High Court recently dismissed Microsoft from the criminal case. Otherwise, both cases are still ongoing.

India has taken its Internet regulation internationally, asking the United States government to ensure that India-specific objectionable content is removed from sites such as Facebook, Google, and YouTube, and suggesting that these companies should be asked to relocate their servers to India in to order better to regulate the content locally.

The Indian government's state-centric view of Internet regulation and governance is also clear in their approach to international governance. Citing the need for more governmental input in the Internet's development and what happens online, India formally proposed the creation of the Committee for Internet Related Policies (CIRP) at the 2011 United Nations General Assembly. The CIRP would be an entirely new multilateral UN body responsible for coordinating virtually all Internet governance functions, including multilateral treaties.

To be fair, some Indians see these as efforts not to impose censorship but to allow a greater degree of Indian and international control over a system considered by many in India and elsewhere to be under the thumb of the U.S. government.

Yet some Internet experts in both India and the West are criticizing the CIRP proposal as part of "thinly masked efforts to control or shape the Internet," as one Indian official put it. They warn that a state-centric system of Internet governance could lead to serious restrictions on the type of information available online, and damage the Internet's potential for innovation.

India's Internet freedom advocates are straining to keep up with the rapid pace of the last year. But, now, they're gathering some steam. Online petitions against the intermediary guidelines, the IT Act, and censorship in India in general have appeared on Change.org and Facebook; protest videos are popping up on Youtube. The Centre for Internet and Society, a web-focused think tank, released an extensive report highlighting the intermediary guidelines' effects on freedom online. The Internet Democracy Project organized a day-long training program on freedom of expression and censorship for bloggers entitled "Make Blog not War." FreeSoftware Movement Karnataka organized a protest of hundreds of students in Bangalore, India's IT hub. And Save Your Voice activists held a sit in outside Delhi's Jantar Mantar monument to pressure lawmakers.

Yet, not all the opposition has been so civil. Hackers, operating under the umbrella of the techno-libertarian hacker community, "Anonymous," are waging their own, less lawful fight against the government as well as the Internet companies that have, in their view, too readily complied with the government's censorship demands.

On May 17, Anonymous hackers attacked a number of Indian government websites, including the Indian Supreme Court, the Reserve Bank of India, the ruling Congress Party and its coalition partners, as well as the opposition Bhartiya Janata Party (BJP), making them all inaccessible for several hours.

Moreover, just this past week, Anonymous broke into the websites and servers of a number of Internet Service Providers, including Reliance Communications, seemingly to punish them for complying with government orders to block file-sharing hosts such as Pirate Bay and Vimeo. Once in the ISPs' servers, the hackers accessed their lists of blocked sites -- which they then distributed to media outlets. They also redirected people who tried to reach Reliance's site to an Anonymous protest page.

Building on the momentum of these attacks, and on the anti-censorship outrage growing across India, Anonymous has called for a national day of protest in 11 Indian cities this Saturday, and an additional series online attacks against government and industry websites. The occupy-style protests -- which Anonymous insists will be non-violent -- are to include awareness campaigns on Facebook and other social networking sites. Protesters are being asked to don the Guy Fawkes mask, a symbol now associated with Anonymous, among other protest movements, both in the streets and on their Facebook profiles.

It's unclear how much support the June 9 protest will receive, or how serious the planned Anonymous attacks with be, but given the attention that the announcement has attracted in the Indian media, it seems likely that people will at least be paying attention. And even if this weekend the protest fails to attract the type of large and vocal response protest organizers are hoping it will, that it's come so far is an indication that neither side looks ready to back down.

Still, the government has given some small signs recently that it is reconsidering its position on the "intermediary guidelines," if not on Internet regulation more generally. Information Technology Minister Sibal, under pressure from the political opposition and after Parliament Member P. Rajeeve tabled a motion to seek rescission of the new rules, indicated that he would reconsider his previous positions, and the government has agreed to reexamine the rules.

This is an encouraging sign, although it's unlikely that any government action will come in time to forestall this weekend's protests. But even if the intermediary guidelines are ultimately rescinded, India will likely continue its soul-searching on how it deals with the Internet.

As the world's largest democracy and a model for much of the developing world, and with an Internet population anticipated to surpass that of the United States in the next few years, India is an important, maybe the most important, test case for the future of Internet freedom globally. Should India continue down a course of restriction, other nations eager to restrict online speech could see precedent to impose their own technical and political barriers to free expression online. It would be a tragic irony if India, as one of the developing world's greatest beneficiaries of the information revolution, ended up curbing those same free flows of information and ideas.

For more details visit http://editors.cis-india.org/news/india-the-new-front-line-in-the-global-struggle-for-internet-freedom

India: Social Media Censorship to Contain ‘Cyber-Terrorism'?

praskrishna — 2012-08-27T03:36:37Z

This is the second post in the 2-part series about the perceived role of social media in the wake of the Assam clashes that spilled across the country and threatened to upset the nation's peace.

Written by Aparna Ray. This post was published in GlobalVoices on August 24, 2012. Pranesh Prakash's analysis is quoted in this. The first post can be found here.

As the Indian government sought to block bulk SMS, MMS, webpages and specific social media urls, justifying its step as an attempt to control viral rumor-mongering and “cyber-terrorism”, there was a lot of discussion on the mainstream media (MSM) about how social media was fast becoming a “double-edged sword” and how the recent events brought out the “mischief potential of social media in full play“. These MSM opinions, some of which offered tacit support the idea of reigning in social media, did not go unnoticed by netizens. For example, Media Crooks asked:

So what’s with the rant against the Twitterati and social media by these media celebs?

Blogger Amrit Hallan at Writing Cave wondered if the MSM had an underlying motive for creating a hype around the ‘dangers' of social media. He wrote:

People in the mainstream media have always been at loggerheads with the free spirit of social networking websites that empowers everybody to express opinions and spread ideas…(they) have been gleefully recommending the curtailment (of social media). Social networking and blogging continuously make their job hard. The moment they try to spread some misinformation, it is countered by Twitter or blogs with factually correct information, often posted by people close to the ground.

Tweets too expressed similar concerns and sentiments:

Priya James (@james_priya): I think by now, MSM coverage volumes of 'social media terrorism' has now surpassed even their basic coverage of Assam situation!

Gaurav Sabnis (@gauravsabnis): Politician-MSM nexus in India so blatantly clear with blame for NE rumors laid squarely at social media's doors.

Rajeev Nagpal (@rajeevnagpal): In #India the #MSM can't tolerate any one challenging their hold. No wonder they support censoring social media #HandsOffTwitter

Things have been moving very quickly. The ISPs have been sent official communication to block webpages and twitter handles, including those ofsome journalists plus fake profiles created with the purpose of lampooning the Indian Prime Minister. Curiously, the Pakistani blogger Faraz Ahmed Siddiqui, who was the first to break the news about the morphed photos being used to incite communal tensions, also came under the ambit of censorship and his post was inaccessible on some ISPs.

AEIdeas, a blog from the American Enterprise Institute commented on the issue:

The Indian government ought to have given Mr. Siddiqui a medal for his investigative work. Instead it has blocked his post.

Social media users in India have been following the government actions closely and there is muchdebate and discussion about whether the crack down on social media is censorship of free speech in the guise of rumor control.

Some have termed the government's action as Orwellian/dystopian. Others have seen merit in the government's ‘intent' to curb inflammatory content but have been disappointed with the ineffective way the government went about the task - acting as “Net nannies” and “blocking communications, curbing speech, and banning websites”.

At CIS India, Pranesh Prakash did an analysis of the social media content blocked in India since August 18, 2012. Here are the results:

Strong reactions are pouring in on Twitter via trending hashtags such as #GOIBlocks, #IndiaBlocks,#Emergency2012 etc. [There is some debate over the use of the word ‘Emergency' and the attempt to draw parallels between the present block and the state of emergency of 1975, which saw suspension of civil liberties and persecution of journalists in the name of battling threat to national security].

Indian Rebellion (@reBel1857): today they r blocking ur twitter account, tomorrow ur bank account and then will lock u in ur home … #GOIBlocks #Emergency2012

Pranesh Prakash (@pranesh_prakash): If you oppose #censorship, more power to you! I do too. But calling this #Emergency2012 is ridiculous! #IndiaBlocks #netfreedom

Madhavan Narayanan @madversity): Social media is a modern challenge and a modern opportunity. Government attempts to police it smacks of outdated feudal style #GOIblocks

Raheel Khursheed(@Raheelk): Everything ██ is █████ ████ ████ fine ███ █ ████ love. ████ █████ the ███ UPA ███ ████ Government ██ #GOIBlocks #Twitter

Sunanda Vashisht (@sunandavashisht): First they ignored us, then they argued with us, then they blocked us #emergency2012

Babar (@6a6ar): The only thing left for us to do is block all media and Govt. handles in protest. Let's start a #VirtualRevolution #IndiaBlocks

Abhijit Majumdar (@abhijitmajumder): Govt of #India is just testing #socialmedia waters by blocking spoof PMO accounts. Prepare for greater censorship on #Twitter and #Facebook

Amit Agarwal (@labnol): The Indian govt can force ISPs to block individual Twitter profiles but everything will still be available through web apps like Tweetdeck

Humour and sarcasm too weren't in short supply. For example:

Mahesh Murthy (@maheshmurthy): Now that Govt has solved North East crisis by limiting SMS, it will fight malnutrition by banning food pics on Instagram

Kalyan Varadarajan (@itzkallyhere): My nose blocked. But I didn't poke my nose in Govt matters! My nose isnt a handle. Damn! #GOI

Ramesh Srivats (@rameshsrivats): I've a few SMSs to spare from today's quota. If you mail me recipient's number, message & a cheque, I can send an SMS for you.#BusinessIdea

However, not everyone is amused. Amrit Hallan asks:

Are we going to follow the footsteps of Pakistan and China and turn into a Blockistan? No matter how much it makes some of the English-speaking mainstream journalists happy, blocking isn’t possible, at least sustained blocking. The Internet has empowered the silent majority and there is going to be a big backlash if the government, or another agency tries to take this power back. In what form this backlash is going to manifest? It remains to be seen.

In a guest post on Trak.In, blogger Prasant Naidu suggests how the government could use social media positively. He says:

instead of banning social media, the government can use it in its favor controlling the crisis of NE. The virality feature that our politicians are scared of can be used for killing rumors. Can’t the government get in touch with Facebook and Google India to find out ways to use social media in a better way? Can’t the Government start a social media campaign to “Save NE and Save India”?

Twitter is one of the tools that the government can use. A brilliant example is how Nirupama Rao, India’s Foreign Secretary used Twitter during the evacuation of Indians at the time of the Libyan crisis.

Social Media is not rocket science; it is about communicating with humans and for that you need to have the will to evolve and change. Banning social networks is not a solution to combat rumors but it is a half backed measure to cover the lid on the growing tensions.

The government, on it's part, issued social media guidelines to be followed by government agencies. It remains to be seen how the situation develops on the ground and what impact the current stand-off between government and social media has on cyber-control policies in the days to come.

For more details visit http://editors.cis-india.org/news/global-voices-online-org-aparna-ray-aug-24-2012india-social-media-censorship-to-contain-cyber-terrorism

India: Privacy Bill will likely reflect EU Directive

praskrishna — 2014-03-05T11:45:37Z

The Indian Centre for Internet and Society (CIS) called for comments - on 25 February 2014 - on a draft Privacy Protection Bill ('the Bill'). The draft Bill comes after a series of roundtable discussions in 2013. The last CIS roundtable on the Bill, on 19 October 2013, included Jacob Kohnstamm, Chairman of the EU Article 29 Working Party and the Dutch data protection authority, and Christopher Graham, the UK Information Commissioner.

The article was published in DataGuidance on March 3, 2014.

"In its eventual form, I expect [the Bill] will be modelled to a great extent on the European Data Protection Directive (95/46/EC)," Rodney Ryder, Partner at Scriboard, told DataGuidance. "The European Directive is an important model as India moves forward." Data protection in India is currently regulated by the Information Technology Act 2011, however, if enacted, the Bill would introduce the country's first comprehensive privacy regime. In 2013, the European Commission assessed India's data protection regime and decided not to award adequacy recognition at that time.

"If the Bill is introduced in the Winter Session, […] it is likely to […] come into effect either at the end of the year or early in the next year"

The draft Bill regulates collection, storage and processing of personal data, with both monetary and penal penalties yet to be determined for anyone who 'collects, receives, stores, processes or otherwise handles any personal data [except in conformity with the provisions of the Act].' It also establishes an Indian Data Protection Authority (DPA), with the power to investigate data processing and to 'give such directions or pass such orders as are necessary.'

"[Moving forward,] we expect more clarity on the role and functioning of the DPA," Ryder stated. "In the past, the Government of India has not been clear on the role of the DPA. Will this 'authority' have the independent powers and stature of the European Privacy Commissioners? [Additionally,] the complaint mechanism under the Bill requires greater clarity, precision and structure."

Divya Sharma, Legal Director at Bird and Bird LLP, commented, "Considering that India has parliamentary elections scheduled to take place in April 2014, this bill is unlikely to progress further until a new Government takes office in May 2014. […] Any legislation of this nature is unlikely to progress during this Government's tenure."

"If the Bill is introduced in the Winter Session, after due consideration, it is likely to be passed by the end of the Year and come into effect either at the end of the year or early in the next year," said Ryder.

For more details visit http://editors.cis-india.org/news/data-guidance-march-3-2014-india-privacy-bill-will-likely-reflect-eu-directive

India: obscene pics of gods require massive human censorship of Google, Facebook

praskrishna — 2012-01-17T09:46:25Z

It's hardly the sort of Internet policy statement one hopes to hear from judges in major democracies. "Like China, we can block all such websites [who don't comply]," Justice Suresh Cait told Facebook and Google lawyers in India yesterday. "But let us not go to that situation."

No, let's not. But it's what the government wants if Internet companies won't start screening and censoring all user-generated material on social network and user-generated content sites. And they'd better do their screening by hand, not with machines.

The New York Times reported last December that India's Telecommunications and Human Resources Development Minister, Kapil Sibal, has been battling hard with Internet companies on pre-emptive screening and censorship.

About six weeks ago, Mr. Sibal called legal representatives from the top Internet service providers and Facebook into his New Delhi office, said one of the executives who was briefed on the meeting.

At the meeting, Mr. Sibal showed attendees a Facebook page that maligned the Congress Party’s president, Sonia Gandhi. “This is unacceptable,” he told attendees, the executive said, and he asked them to find a way to monitor what is posted on their sites.

In the second meeting with the same executives in late November, Mr. Sibal told them that he expected them to use human beings to screen content, not technology, the executive said.

The Internet companies insist that they can't possibly pre-screen everything that goes up. If something truly is illegal under local laws, they are generally willing to take it down when a court rules.

The main concern is obscenity (though criticism of government officials appears to touch a sore spot, too); in the current case against Facebook, Google, and others, the obscenity involves pictures of gods, goddesses, and Mohammed.

"At present it's obscene images of Gods and Goddesses, tomorrow it can be an image of someone in your family posted online. There has to be some control," Justice Cait said at yesterday's hearing. He allowed the case against the Internet companies to proceed.

Who's pressing for the court case? A journalist. NDTV has a new interview with him, in which the man presses for quick action. (Note: the actual interview portion is not in English.)

Can we censor dissent while we're at it?

Between January and June 2011, India requested that Google remove 358 bits of content by filing 68 different complaints. One was from Google Maps (for "national security"); almost every other was from YouTube, social network Orkut, and Google's Blogger platform. Almost none came with a court order.

"We received requests from state and local law enforcement agencies to remove YouTube videos that displayed protests against social leaders or used offensive language in reference to religious leaders," Google explained.

"We declined the majority of these requests and only locally restricted videos that appeared to violate local laws prohibiting speech that could incite enmity between communities. In addition, we received a request from a local law enforcement agency to remove 236 communities and profiles from Orkut that were critical of a local politician. We did not comply with this request."

This is hardly an inspiring track record. While in public the companies are criticized for obscenity, Google's most recent records show only 3 requests to remove pornographic material. Government criticism and defamation were actually the two largest categories of requested material.

As the Financial Times "beyondbrics" blog notes, the Internet companies are coming under increasing attack for content they host, despite the vagueness of the demands for censorship. For instance, "Last month, a lower court had ordered the sites to remove all 'anti-social' or 'anti-religious' content by February 6. As Sunil Abraham, executive director of the Bangalore-based Centre for Internet & Society, told beyondbrics last month, it’s difficult to establish exactly what is anti-religious: for example, the Hindu profession of belief in multiple gods is blasphemous to Muslims, Christians and Jews."

Photograph by Diganta Talukdar

The blog post by Nate Anderson was published in ars technica on 14 January 2012

For more details visit http://editors.cis-india.org/news/obsecene-pics-of-gods-require-massive-human-censorship

India’s vanishing fingerprints put UID in question

praskrishna — 2011-10-26T10:05:13Z

A curious situation has come to light at the UID (unique identity) enrolment centres. Call it the phenomenon of vanishing fingerprints. You see, our unique fingerprints don’t necessarily last a lifetime and they can be damaged or destroyed and, in some cases, even non-existent. And that is not the best scenario for the first-of-its-kind project that endeavours to create a unique identity for India’s billion-plus population based on fingerprints and iris scans (or biometric data).

To find out more, Firstpost visited five UID centres in the North West district, which incidentally has the highest enrolments (619,571 and counting) among Delhi’s nine districts since the show hit the road in February 2011, and one centre in North Delhi.

The officials at the Unique Identification Authority of India (UIDAI) will tell you that there is no overemphasising the importance of the quality of biometric data to the success of the super ambitious UID, now known as Aadhar project. If the quality of a person’s biometric data is poor, it automatically compromises the authentication of that data by him when he wants to access a service based on his UID.

So what happens when the data – fingerprints, for instance – are inherently unreliable on account of various biological and socio-economic reasons, some of which are especially relevant to the Indian context.

The UIDAI’s Committee on Biometrics in a December 2009 was rather forthright about its reservations on the fingerprint reliability. Titled Biometrics Design Standards For UID Applications (page 4, para 4), it stated, "….two factors however, raise uncertainty about the accuracy that can be achieved through fingerprints. First, retaining efficacy while scaling the database size from fifty million to a billion has not been adequately analysed. Second, fingerprint quality, the most important variable for determining de-duplication accuracy, has not been studied in depth in the Indian context." (Emphasis added).

The findings on the ground were revelatory. Operators and technical experts at the UID enrolment centres confirmed to Firstpost that they routinely came across cases where fingerprints had been damaged/destroyed/underdeveloped. And such cases, they said, were more common among senior citizens, those involved in manual labour (who handle rough objects, for instance) and children (mostly below 10 years of age).

Here is an example that Firstpost observed.

Batuli, 72, arrived at around noon at the Basti Vikas Kendra, now also a UID centre, in Mangol Puri to get herself a ‘smart card’ everyone has been talking about. (The 'Aadhar' brand name hasn’t caught on in these parts of Delhi, with everyone insisting on calling it the 'smart card'.)

The helpful operator with the fancy gadgets helps Batuli to her seat. After her photo is taken, Batuli is asked to place four fingers — one hand at a time — on a green-lit device. Right hand, then left hand.

She is, however, asked to repeat the exercise a second time for the left hand. The operator explains. "In some case, we have to scan the fingerprints and Iris multiple times. If it doesn’t pass the required quality percentage of 70 per cent (the quality is indicated in percentage terms on the computer screen that is connected to the fingerprint machine, see pic), we repeat the exercise up to four times."

Batuli’s hands are then wiped using a cloth and placed back on the device. The exercise is repeated a fourth and final time. But still the same result. 'Fail', declares the reading on the operator’s computer.

An operator at the next station, says, "In the case of senior citizens, Iris scans also sometime fail. It registers weakly when the retina is damaged."

(Enrolment centres are run by private companies on contracts given by registrars chosen by the UIDAI. Strategic Outsourcing is one such company and it runs many of centres in the North West and South West districts of Delhi.)

The project coordinator of the UID enrolment centre working out of the Destitute Welfare Trust, an NGO in Sultanpuri, too, confirmed that he was aware of the problem of damaged fingerprints and the challenge it posed in getting good quality fingerprint data.

"The hands of children are very soft and in some cases fingerprints are not yet fully developed. Also, children tend to have sweaty hands and this can interfere with the quality of fingerprints. Extremely dry hands also pose problems. We have to often, wipe the hands or provide lotion to improve the quality of fingerprints," said a technical expert working with Strategic Outsourcing.

While the number of attempts, as prescribed by the UIDAI, to get a stronger finger print when the result reads 'fail' is four, operators report that sometimes attempts go up to 10 to 15. (The machine picks up the strongest impression of the attempts made). They say they didn’t anticipate such a problem and it was only when they started enrolments in January that they were confronted with such a scenario. “Now, of course, everybody knows about it."

'Everybody' implies those who are directly involved in collecting biometric data. An operator from another private company Smartchip working in a JJ (slum) colony in the North Delhi district of Model town, revealed similar problems on being probed. "A fingerprint strength of 70 percent or more is pass. About 10 per cent of the cases we get every day register the 'fail' reading. What can we do? In the case of stone cutters, for instance, the fingers are completely smooth, the fingerprints are completely wiped out."

So what are the implications of poor quality fingerprints for the UID project? The UIDAI admitted that it could provide challenges to authentication.

In an email response to Firstpost, Sujata Chaturvedi, UIDAI’s Deputy Director General for the Delhi region said, "It could provide some challenges in de-duplication although that has been mitigated to a large extent by the decision of the UIDAI to go in for iris an additional de-duplication factor… Also to be noted is the fact that normally not all fingers are equally de-graded. So UIDAI is evolving a protocol to inform the residents about their good quality fingerprints as part of the Aadhaar letter so that they are aware of the finger to use for authentication."

But not everyone is convinced. Sunil Abraham is the executive director of Centre for Internet and Society (CIS), which has written seven open letters to the Standing Committee on the Finance Branch (before which is the National Identification Authority of India Bill, 2010) asking the committee to consider their research on the UID project and change aspects of the Bill and the project.

The seventh letter sent last week, says Abraham, provides statistical analysis that demonstrates how the UID will never be able to create a unique database.

"In CIS’s seventh open letter to the finance committee, statistical analysis reveals that UIDAI tender specification is 1,000 times less accurate than it should be to have a reasonable chance of building a truly unique database. This analysis depends on high quality biometrics. With poor biometric quality the problem of de-duplication is compounded."

When UIDAI was asked what the percentage of the population enrolled (all India and Delhi) had recorded below-standard fingerprint quality, no specific data was forthcoming.

Chaturvedi wrote, "Currently the population with very poor quality fingerprints is a very small percentage. It must also be remembered that this population is scattered all over the country."

In India, even a small percentage translates to millions of people. "Small percentage could mean absolutely anything. Why can’t they be more specific? One percent in the Indian context is 12 million people," said Abraham.

On how the UIDAI was dealing with challenge of poor fingerprint quality, Chaturvedi said, "Even amongst the populace that has damaged/destroyed/underdeveloped fingerprints, chances are very high that they would have at least one good fingerprint that could be used for authentication. Second, UIDAI is also starting to actively develop iris authentication ecosystem. Fingerprint authentication and iris authentication could supplement each other to ensure a universal coverage."

She added that Aadhaar authentication will supplement and work in conjunction with existing authentication systems to strengthen the overall authentication rather than replace completely the existing authentication systems.

That begs the question, as Abraham puts it, "If the UIDAI is not going to replace existing forms of authentication it is not clear why the government is spending all this money on unproven biometric technology."

Chaturvedi, however, maintained that the initial PoC (proof of concept) study that was taken up in Andhra Pradesh, Karnataka and Jharkhand collected about 60,000 enrolments indicated that the biometric accuracy levels necessary for de-duplication of all residents of India are achievable.

"The PoC results also indicated the time needed for capture of biometrics in typical rural conditions is small enough to support large scale enrolment. Over and above the initial PoC, the UIDAI has currently completed over 5 crore enrolments for which Aadhaars have been generated. This experience reinforces the initial PoC results that the de-duplication accuracy is sufficient and sustainable to enrol the rest of the population."

The original article is written by Pallavi Polanki. It was published in Firstpost on October 24, 2011 and can be read here.

For more details visit http://editors.cis-india.org/news/vanishing-fingerprints-put-uid-in-question