Centre for Internet and Society

Govt cracks down on cyber jehad network, blocks access to 32 websites

praskrishna — 2015-01-03T03:29:21Z

The Modi government is starting the New Year with the resolve to wipe out terror and it has cracked down on websites that have been carrying anti-India views and spreading the propaganda of the Islamic State (IS).

The article published in India Today on January 1, 2015 quotes Pranesh Prakash.

Reacting to an alert from the antiterror squad of a state police department, the Department of Telecom (DoT) has blocked access to 32 websites. The DoT order that was tweeted by Pranesh Prakash, policy director of the Bangalore-based research organisation, said that 32 URLs have been blocked under section 69 of the Information and Technology Act, 2000.

The order was reportedly issued on December 16 and it was shared on Twitter on Wednesday. GitHub, Archive.org, Imgur, Vimeo, Daily Motion, Pastebin, sourceforge, justpaste, cryptbin were among the sites that were blocked.

As reports emerged on the ban of these sites, there was outrage on Twitter on the issue of internet censorship. However, most of the websites mentioned in the list that were to be blocked were accessible. Pastebin and Internet Archive, two websites that have reportedly been blocked, tweeted their views.

"If you are from India and unable to visit Pastebin, please email us," Pastebin tweeted on December 19. Internet Archive tweeted on December 31 that they too received complaints from users in India who can't access its website.

Reacting to the outrage, Arvind Gupta, national head of the BJP IT Cell took to Twitter and said that these sites have been blocked after an alert from an anti-terrorism squad that most of them were carrying anti-India content from the Islamic State (IS).

"We should congratulate the government for taking a preventive and precautionary step in a proactive manner based on an advisory," Gupta told Mail Today.

He added that he does not have any details of the Department of Telecommunications (DoT) order and only reacted to the Twitter debate on the subject.

Intelligence agencies have been struggling to monitor terror activities on cyber space. There have been reports of terror groups using social media to attract young minds to jehadi ideology.

The recent arrest of Bangalore-based executive Mehdi Masroor Biswas, who was operating a Twitter handle under the the name @ShamiWitness and promoting the views of the Islamic State, has come as a wake-up call for security agencies. Biswas, an engineer working as a "manufacturing executive" with ITC Foods, was nabbed from his rented oneroom apartment after a news report stated that his was the most popular IS Twitter account with close to 17,000 followers, and his tweets were getting viewed over two lakh times a month.

Sources said there are close to 30,000 such Twitter handles and other social media forums along with websites that are spewing venom, and little can be done to monitor all of them and act on time. With cyber threat becoming a clear and present danger, the Centre has decided to set up a highlevel committee to only monitor social media and cyber space. Counter-terror officials believe that the jehadi nexus has a huge bearing on India as youth active on social media are vulnerable to the propaganda being carried out online.

Other than @ShamiWitness, there are Twitter handles such as @MagnetGas with radical views and pro-IS tone that are now under the lens. What is disturbing is that many such sites are India-specific and some are believed to be handled by Indians.

"If there is misuse of Internet and social media, it needs to be dealt with legally. The Internet is like a public place, so if there are extreme views, the state needs to exercise its powers," says D.C. Pathak, former chief of the Intelligence Bureau.

This is not the first time that the DoT has clamped down on websites for promoting "objectionable" content. In June 2013, 39 websites that allowed users to share pornographic content were reportedly blocked.

For more details visit http://editors.cis-india.org/internet-governance/news/india-today-january-1-2015-govt-cracks-down-on-cyber-jehad-network-blocks-access-to-32-websites

Govt blocks 32 websites, including Vimeo and Github

praskrishna — 2015-01-02T16:09:24Z

The websites that have been blocked were based on an advisory by Anti Terrorism Squad, and were carrying anti-India content from ISIS.

The article by Moulishree Srivastava was published in Livemint on December 31, 2014. Pranesh Prakash gave his inputs.

The Indian government has blocked access to 32 websites based on the advice of an anti-terrorism team. The blocked URLs (uniform resource locator, an address to any website on the Internet) include files, videos and source code-sharing websites such as dailymotion.com, github.com, vimeo.com and archive.org.

In an order, tweeted by Pranesh Prakash, policy director at the Bengaluru-based research organization Centre for Internet and Society on Wednesday, the department of telecom said the 32 URLs had been blocked under Section 69 of the Information Technology Act, 2000, and under Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009. “The websites that have been blocked were based on an advisory by Anti Terrorism Squad, and were carrying anti-India content from ISIS (Islamic State of Iraq and Syria),” Arvind Gupta, head of the ruling Bharatiya Janata Party’s information technology cell, said in a message on Twitter.

His tweet came in response to a backlash to the move from Internet users. “The sites that have removed objectionable content and/or cooperated with the ongoing investigations, are being unblocked,” he added. If Internet service providers (ISPs) don’t comply with the demand, they are liable to being penalized, the order said.

The rules give the central government powers to block access to information if it is in the interest of the “sovereignty and integrity of India, defence of India, security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence relating to above.” Intermediaries failing to comply with the rules are punishable with fines and prison terms of up to seven years, it notes. “Pastebin is still blocked in India.

We are getting many reports about this. The Indian government has blocked us...,” said one of the source code sharing websites, Pastebin.com, in a tweet. This is not the first time the government has cracked down on websites. A recent report by Freedom House, an independent watchdog, said the information ministry received a total of 130 court orders to block Web content between February 2009 and December 2013.

In February 2014, the then minister of communication and information technology told Parliament that 62 URLs were blocked in 2013 under Section 69A for hosting objectionable information with the potential to disturb public order. As many as 82 URLs were blocked on 18 September 2013 in addition to 26 blocked a week earlier after violence escalated between Hindu and Muslim communities in Muzaffarnagar district of Uttar Pradesh. A total of 362 URLs were blocked in response to communal violence in the northeast, the report said. “The problem isn’t just about the specific sites that are blocked; the prob(lem) always about the bad law...,” tweeted Prakash. “The 69A rules don’t allow for transparency, accountability, time-limits on blocks, etc. So easily misused by govt. + courts + individuals.”

For more details visit http://editors.cis-india.org/internet-governance/news/livemint-december-31-2014-moulishree-srivastava-govt-blocks-32-websites

Govt and BlackBerry firm wait for the other to hang up

praskrishna — 2011-04-02T10:46:54Z

Sunil Abraham speaks to Archna Shukla on the stand-off between the Government of India and RIM. The news was published in expressindia.com.

What is the current stand-off between the government and RIM all about?

The current logjam is with regards to BlackBerry messenger, email and web traffic. Around two years ago, the government had asked BlackBerry to allow it to monitor the text messages (SMSes) and phone calls exchanged through its platform. The government has since then been monitoring these services with the help of telecom service providers. It, however, still doesn’t have any means to monitor, intercept or decrypt BlackBerry’s messenger, email and web exchanges. The government wants to put in place a surveillance infrastructure to monitor these services and is asking BlackBerry to cooperate.

What is unique about BlackBerry services? Why doesn’t the government have a similar problem with Nokia or Apple?

Companies such as Apple do not provide email and messenger services in India. They only sell their handsets in the country. Nokia recently started providing such services under the Nokia Messaging Services Platform. The service, which includes enterprise solutions, consumer services and Nokia’s own messaging solution Ovi mail, is still in beta format. Nokia’s India spokesperson said the company will set up servers for its various services inside India whenever it kickstarts the functions in a full fledged manner.

Canadian firm Research in Motion (RIM), makers of BlackBerry, on the other hand, provides all these services alongside selling its handsets. It also manages all its data and traffic on its own without giving the access to anybody. The servers for these services are installed outside India. The government is concerned that keeping servers outside the country will give access to foreign authorities to monitor its local traffic and information. In the US, for instance, this kind of monitoring will be possible under the provisions of the Patriot Act.

Is BlackBerry the only one to use strong encryptions?

The use of strong encryption in information technology is prevalent in both the wireless industry and Internet platforms. BlackBerry, however, uses a superior encryption that is highly reliable and secure and it owes its popularity in the world markets to this feature mainly. According to Sunil Abraham, the Executive Director of Bangalore-based advocacy group Centre for Internet and Society, BlackBerry uses strong encryption with 256 bit keys. In comparison, gmail.com and Citibank.co.in use only 128 bit keys.

“If you have encryption on while visiting citibank.com or when using an offline mail client like MS Outlook Express, the government can identify the encrypted service that you are using and the recipient of your encrypted messages. Then they can launch a targeted brute-force attack to intercept and decrypt specific communications,” he says, adding that with the BlackBerry, the government can only see that you are having an encrypted transaction with the BlackBerry servers. They cannot identify the recipients and web services. This makes the brute-force attack difficult as a lot of time is spent decrypting unimportant messages.

What is the problem that RIM is facing in UAE and Saudi Arabia?

In UAE, it is facing the same problem as in India. In Saudi Arabia, BlackBerry will instal computer servers, which would allow the government some access to user’s data.

Can the Indian government and RIM meet half-way?

Unlikely. Though, as per PTI reports,

BlackBerry has made an attempt to break the logjam by offering metadata and relevant information to security agencies which will enable them in lawful interception, it has has failed to enthuse them. At a meeting between government officials and RIM, company’s representatives said that “they can provide the metadata of the message like the Internet Protocol address of BES and PIN and International Mobile Equipment Identity of the BlackBerry mobile”, sources said. Metadata is loosely defined as data about data. It provides information about a certain item’s content like how large the picture is, the colour depth, the image resolution when the image was created, and other data. A text document’s metadata may contain information about how long the document is, who the author is, when the document was written, and a short summary of the document. However, sources said the RIM, which has nearly one million subscribers across India, failed to enthuse the security agencies who want an uninterrupted access to the messaging services on BlackBerry platform. The security agencies apprehend that BlackBerry services in the present format pose a serious security threat.

The government may argue that if surveillance is allowed in some countries, it should have the same access, too.

So far, RIM’s public stand has been that its security architecture was specifically designed to provide corporate customers with the ability to transmit information wirelessly while providing them with the necessary confidence that no one, including RIM, could access their data.

Abraham of the Centre for Internet and Society says there is a possibility of a compromise behind the doors and the citizens may never get to know that a surveillance regime and infrastructure have been put in place to monitor their communications.

Click to read the original.

For more details visit http://editors.cis-india.org/news/govt-and-blackberry

Govt

praskrishna — 2012-02-14T12:54:34Z

For more details visit http://editors.cis-india.org/home-images/govt.jpg

Government's stand on internet governance draws applause from civil society organisations

praskrishna — 2015-06-29T15:40:07Z

India's decision to support the multistakeholder model of internet governance has drawn mostly applause from civil society organisations and individuals who have been following the issue, even as they cautioned that implementation will determine the success of the model.

The article by Neha Alawadhi was published in Economic Times on June 24, 2015. Sunil Abraham gave his inputs.

A day after communications and IT minister Ravi Shankar Prasad said India will support the multistakeholder model, reactions poured in on Tuesday, largely hailing the move to break the longstanding status quo on the issue.

"What matters now is how the approach articulated by the minister is translated into coordinated action across various fora, including ICANN, BRICS, and perhaps most crucially the UN WSIS+10 Review Process, which culminates in the meeting of the UN General Assembly in December 2015," said Vinay Kesari, a lawyer specialising in ICT and internet governance.

Not just at international fora, India also needs to figure out tistakeholder stand within the country, said Arun Mohan Sukumar, senior fellow at the Centre for Communication Governance, National Law University. "Multistakeholderism is very attractive in principle but, as the ICANN experience shows, it is susceptible to concerns like elite capture and lack of accountability to the general public," he said.

Prasad made the announcement in a video address during the opening ceremony of the Internet Corporation for Assigned Names and Numbers (ICANN)'s 53rd public meeting in Buenos Aires on Monday. ICANN manages the Domain Name System (DNS), which helps organise the internet with the allotment of domain names such as .com, .org and .net and has often come under the scanner for not being transparent enough.

The multistakeholder model involves all stakeholders such as businesses, civil society, governments, research institutions and non-governmental organisations in the dialogue, decision-making and implementation of policymaking and governance.

The external affairs ministry, telecom department and the department of electronics and IT have long held divergent views on issues of internet governance, with no clear stand being made at international platforms. While welcoming the announcement, Sunil Abraham, executive director at the Centre for Internet and Society, said the minister could have explained in greater detail, especially the ongoing transition of internet governance control from US government to a multistakeholder model.

"He also spoke about government being responsible for security and human rights over the internet, which adds to the confusion over whether India will really let the internet be a fair and free medium," he said.

Prasanth Sugathan, counsel for the Software Freedom Law Centre, said the government should seek the views of other stakeholders as well on the issue. "When you talk of multistakeholderism, it should not be only at an international level. It should also happen at a national level. The government should have other parties also contributing to issues of internet governance," he said.

For more details visit http://editors.cis-india.org/internet-governance/news/economic-times-june-24-2015-neha-alawadhi-govts-stand-on-internet-governance-draws-applause-from-civil-society-organisations

Government washes hands of Google's new privacy policy

praskrishna — 2012-04-10T09:40:55Z

The government has more or less washed its hands of internet giant Google's new privacy policy that is being criticised in Europe and elsewhere, but wants Indian residents to watch out for themselves, writes Jayadevan in this article published in the Economic Times on April 10, 2012.

Google's new privacy policy provides information on how personal information is collected, processed and secured, as required by relevant Indian laws. "The end users, however, need to fully understand the privacy policy of Google, the consequences of sharing their personal information and their privacy rights before they start using online services," Sachin Pilot, India's minister for information technology, stated in Rajya Sabha on March 30.

Ever since Google came out with a unified privacy policy in January, it has been facing criticism from many users and privacy advocates, especially in Europe where privacy is a fundamental right. The new policy unified separate privacy polices relating to nearly 60 of Google's services.

The new policy also lets the separate Google services, such as Gmail, Google Search or Youtube, share data among each other. In Europe, Google is facing potential sanctions or even fine over its new privacy policy.

Section 43A of the India's amended Information Technology Act (2000) has established a legal framework for data privacy protection in the country. The rules notified last year explain security practices to be followed and the need for guarding sensitive personal information. The Act also requires Indian corporations to publish a privacy policy.

"Google has published a Privacy Policy on their website," said the minister. "Any change in the privacy policy is not within the purview of amended Information Technology Act 2000," Pilot added. Venkatesh Hariharan (Venky), head of public policy and government affairs at Google India, has left the company last month and did not want to comment.

According to the Pilot, while France's independent privacy watchdog, the CNIL (nationale de I'informatique et des libertes) has said that the changes to Google's privacy policy do not comply with the European law, rectification of conflict between Google, an American company and European directive on data protection is not within the purview of the Indian government.

CNIL, the data protection watchdog in France had asked Google to answer 69 questions including what it does with the data collected from users and how long it is retained to better understand the consequences of the new policy for Google users.

Experts agree Google privacy policy is in compliance with Sec 43A of IT Act but cautioned that it may not be enough. "Section 43A does not have all the privacy safeguards that exist for citizen in developed countries," said Sunil Abraham, executive director at the Centre for Internet and Society.

Abraham advocates the creation of a privacy commissioner. "It is important to have a independent and autonomous regulator who can respond on a proactive basis when confronted with evidence of abusive practices," he said.

Legal provisions will have to enable the creation of such a regulator, says cyber law expert Vakul Sharma. "You can not create a regulator out of thin air. You should have legislation for privacy. In India we do not have any such legislation," said Sharma.

The IT act classifies information into two - personal information and sensitive personal information. Safeguards under the section 43A and rules apply to sensitive personal information which includes biometric information, information related to health, passwords, sexual orientation and financial information among others.

"Users must be aware that Google's new policy does not have room for categorization according to Indian laws," says Sharma. "It is a plain vanilla document. The users need more," he added.

Read the original published in the Economic Times on April 10, 2012. Sunil Abraham is quoted in it.

For more details visit http://editors.cis-india.org/news/govt-washes-hands-of-google-privacy-policy

Government to hold talks with stakeholders on Internet censorship

praskrishna — 2012-09-04T03:39:32Z

In an unprecedented move, the government, through the Department of Telecommunications and the Department of Electronics and Information Technology, has agreed to initiate dialogue on Internet censorship with mega Internet companies, social media giants such as Google and Facebook, members of civil society, technical community, media, ISPs and legal experts.

This article by Shalini Singh was published in the Hindu on September 4, 2012. Pranesh Prakash's analysis is quoted.

The triggers for the discussion, which will be held on Wednesday, are the riots in Assam, Mumbai and Uttar Pradesh, as well as the mass exodus of north-east Indians from Bangalore, which resulted in bringing the government, civil society organisations and the media to a flashpoint.

Two of India’s seniormost officers in the area of Internet censorship, DoT Secretary R. Chandrashekhar and Director General, CERT-IN, Gulshan Rai will engage with a range of stakeholders in a two-hour meeting titled ‘Legitimate Restrictions on Freedom of Online Speech: The need for balance – from Deadlock to Dialogue.’

Other panellists include representatives from Google and Facebook; Pranesh Prakash from the Centre for Internet and Society (a civil society group); Prabir Purkayasta, Delhi Science Forum (technical community); Paranjoy Guha Thakurta, president, Foundation for Media Professionals; Rajesh Chharia, president, Internet Service Providers Association of India; and Apar Gupta, an advocate dealing with cyber issues.

One analysis by the CIS has shown that 309 specific items, including URLs, Twitter accounts, IMG tags, blog posts and blogs were blocked. Complaints arose when blocking a page resulted in the blocking of an entire website — which has scores or hundreds of web pages. The government maintained that this was necessary as there was a sense of crisis. Home Minister Sushil Kumar Shinde insisted that the government was “taking strict action only against those accounts or people which are causing damage or spreading rumours.” However, the collateral damage of the move was the Twitter accounts of several people, including journalists like Kanchan Gupta, being blocked.

“Mass censorship is like killing a fly with a sledgehammer. Rather than blocking the sites, the government should have used the same media, Facebook, Twitter and Google to counter terrorism and hate speech. I am glad that they are now open to dialogue,” says Mr. Thakurta.

“It is an extremely productive move as it will generate awareness among content providers, government and users. In the absence of any dialogue, everyone was just sticking to their own positions without listening to the other stakeholders’ point of view,” says Mr. Chharia.

The meeting is to bring several stakeholders in dialogue on a single platform.

Nearly 50 other experts from industry, mobile service providers, Internet companies, intermediaries, academia and some international organisations as well as multilaterals are expected to join the conference, which will be held at 2.30 p.m. on September 4 at FICCI.

While this is seen as a brave attempt by some, there are an equal number of sceptics who believe that the discussion may not yield the desired result given the national security objectives governing law enforcement agencies on the one hand and the desire of users, media and civil society to preserve free speech on the other. Clearly, ISPs, Internet companies and social media are in a tough spot since they face legal obligations on legitimate orders for blocking on one hand while needing to protect their user privacy and rights to unhindered access to information.

If successful, it is possible that this dialogue will ensure that legitimate restrictions do not slide into illegitimate censorship.

For more details visit http://editors.cis-india.org/news/www-the-hindu-com-shalini-singh-sep-4-2012-govt-to-hold-talks-with-stakeholders-on-internet-censorship

Government representation across regions

praskrishna — 2017-02-19T14:32:54Z

Government representation across regions

For more details visit http://editors.cis-india.org/home-images/GovtRepresentation.jpg

Government may tieup with global police, Interpol to fight child pornography

praskrishna — 2015-09-27T10:25:44Z

International partnerships, including with the global police network Interpol, could be the basis for India's strategy to counter child pornography after the government's move to ban websites peddling smut backfired last month.

The article by Surabhi Agarwal was published in the Economic Times on September 3, 2015. Sunil Abraham was quoted.

The new approach by the ministry of communications and information technology mirrors the system adopted by developed countries, government officials said, representing a targetted attack on child pornography instead of the recent fiasco when the authorities backtracked in the face of protests after banning 857 websites.

Once it comes on board as a partner, the International Criminal Police Organization will alert India about production, distribution or broadcast of child pornographic content regularly. India will also have access to an Interpol database known as the 'worst of ' list of domains with content containing child sexual abuse.

"The country is not divided on the issue of child pornography and the government has made a policy statement that it will deal with the problem firmly. So that will be guiding the entire action," a senior government official said. The person said that the government is still studying the model and a call will be taken soon.

A partnership with the UK-based Internet Watch Foundation, which maintains a database on child pornography and collaborates with the British government, is also being considered.

Interpol manages a database which uses sophisticated image comparison software to make connections between victims and places. The foundation also maintains a similar database which is constantly updated. It sends alerts to members twice each day.

"That's the global best practice," said Sunil Abraham, executive director of Bangalore based advocacy group Centre for Internet and Society. "There is no reason for us to reinvent anything; we should just adopt the best practice with some improvements." For a long time, the government and Internet service providers have been passing the buck to each other on this issue, arguing that they don't have the wherewithal to create a database on such content and block it. "This is because as per the Indian laws, anyone who looks at such content even with the motive of blocking it is committing a punishable offense," said Abraham. In August the government said it was banning 857 pornographic websites, only to backtrack amidst widespread criticism and a rap from the Supreme Court. Almost all the websites have been unblocked now with the exception of a few which allegedly contain child pornographic content.

During the hearing in the Supreme Court, the Internet Service Providers Association of India (ISPAI) said that it is impossible for an ISP to block pornographic sites without orders from the court or department of telecom and that the task of identifying such websites should not be the domain of internet service providers. A decision on the issue will work in the government's favour since the next hearing in the matter is slated for October. "Once the country has access to some list which is authentic and verified, regular action can be taken," a government official said.

As per initial discussions, the dominant point of view is for ISPAI to be the point of contact between the government and international organisations. It will be tasked with vetting the list and receiving blocking orders from the telecom department so that further action can be taken.

For more details visit http://editors.cis-india.org/internet-governance/news/economic-times-september-3-2015-surabhi-agarwal-govt-tie-up-with-global-police-interpol-to-fight-child-pornography

Government keeps experts out of cyber security discussions

praskrishna — 2016-04-24T05:03:34Z

The article by Amrita Madhukalya was published in DNA on April 23, 2016. Pranesh Prakash was quoted.

During India's closed-door discussions on cyber security and Internet policies at the recently-concluded Russia-India-China (RIC) convention, Internet experts fear that the government may be trying to leave out discussions with social stakeholders like social activists, businessmen or the academia. It must be borne in mind that telecom minister Ravi Shankar Prasad in an ICAN meet last year stressed on the role of the government in cyber-security policy measures, despite the need to have an Internet largely unregulated by the government.

Anja Kovacs of the Internet Democracy project feels that India has given away too much, and that India's multi-stakeholder approach in the context of the role of the International Telecommunication Union (ITU) is not too clear. "Russia and China have traditionally, since the 90s, wanted a bigger role for the ITU, despite a pushback from the West. The ITU has had a positive role in the recent past. Yet, when they mention multilateralism, the scope for developing nations is not too wide. The US may have the scope to include several stakeholders from the business community, civil society and academia, but how much scope does a developing country have," says Anja, adding that the mention of internationalising, too, is problematic.

The grouping of the three countries could also be to signal an alliance to counter the US's efforts to ensure the exemption of the UK from the mutual legal assistance treaty (MLAT) system which is headquartered in the United States, says Chinmayi Arun, policy director at the Centre for Communication Governance at NLU Delhi. Under the MLAT process, any request about data that originates in case of a criminal breach from a country is usually routed via US's department of justice, which takes time while following due processes.

"The concerns expressed, understandably, on the growing concerns of cyber terrorism and the efforts to deal with it are needed, but there is no need to exclude other stakeholders in the process," said Chinmayi. "Russia and China have also been pushing for a growing role of the state in policing the government, and are keen to use the UN to facilitate that."

Nikhil Pahwa of Medianama, who steer-headed the net neutrality movement by engaging several stakeholders, says that the government's stance is unclear, as it speaks of both multilateralism and multiple stakeholders, as both are contradictory.

Pranesh Prakash of the Centre for Internet and Society says that he is sceptical of the sentiments expressed on internationalisation of internet governance.

"For instance, there's been a two-year process via which the US's oversight over ICANN and the IANA functions are nominally being removed. But Russia, India, and China have not really pushed for internationalisation, and ICANN and the Internet's root zone system is going to remain subject to US jurisdiction, including US sanctions. If the ministers truly meant what they say, they should intervene in that process and say that we need to internationalise ICANN in practice and spirit, not just in name," he said.

For more details visit http://editors.cis-india.org/internet-governance/news/dna-amrita-madhukalya-april-23-2016-government-keeps-experts-out-of-cyber-security-discussions

Government invites comments on Draft National Encryption Policy, attracts controversy

praskrishna — 2015-09-27T14:34:02Z

The Department of Electronics & Information Technology (DeitY) has posted a Draft National Encryption Policy on its website inviting comments from the public. The purpose of the policy is to frame rules under Section 84A of the Information Technology Act, 2000, regarding use of encryption methods.

You can access the full text of the Draft National Encryption Policy on the DeitY website. The blog post by Soumyadip Choudhury was published by IBN Live on September 20, 2015. Pranesh Prakash was quoted.

However it is interesting to note that, apart from the document itself, there are no other easily accessible mentions of the draft policy on the DeitY website or other related government websites.

The vision of the draft policy is "to enable information security environment and secure transactions in cyber space for individuals, businesses, government including nationally critical information systems and networks." And the mission is "to provide confidentiality of information in cyber space for individuals, protection of sensitive or proprietary information for individuals and businesses, ensuring continuing reliability and integrity of nationally critical information systems and networks."

While the premise of the draft policy appears to be widely acceptable, it is in the details that discontent lurks.

Pranesh Prakash, policy director at the Centre for Internet and Society calls the policy "monumentally misguided."

In addition to government agencies, public sector undertakings, academic institutions and businesses the draft policy also brings in common citizens under its purview.

"Government must take note that the knowledge and expertise of common citizens may be inadequate to understand the nuances of encryption," says cyber law expert Na Vijayashankar. "Though the citizens will be indirectly impacted by the policy as implemented by the government or business users, citizens cannot at this point of time assume the responsibility for direct compliance of this policy since their ignorance would be exploited by intermediaries for business gain."

According to the draft policy, the government would require users and companies to store plain text and encrypted text pairs for at least 90 days and make them available to law enforcement agencies when they are legally asked to.

"Expecting users and companies to store plaintext/ciphertext combination is equal parts ridiculous and dangerous," observes Sandesh Anand, a software security professional. "Ridiculous because this means terabytes of data has to be stored and retrieved on request. Dangerous because the point of encryption (sometimes) is to ensure the 'plaintext' is not accessible, unless decryption is performed. Hence, in cases where encryption is used to store sensitive data securely, the terms of this policy weakens the security."

The proposal says that service providers using encryption technology or those providing such services in India "must enter into an agreement with the government for providing such services in India."

This means thousands of companies around the world providing such services will be required to enter into an agreement with the Indian government, something that experts think is unrealistic.

"The provision to require service providers using encryption technology to register and enter into an agreement with a body of the Government of India is redundant and unenforceable as a part of this policy," says Vijayashankar. "Since there is a large number of services today which use encryption (even accepting the fact that SSL/TLS users are exempted), this policy may require thousands of websites to enter into agreement with the Government. Already there is a provision in Section 69 of ITA 2008 which is a statutory law."

Also all encryption products need to be registered with the government and Indian users will be allowed only to use encryption products registered in India and violation of this, according to the draft policy, can attract "appropriate action as per law of the country."

The encryption algorithms and key sizes prescribed by the government have also met with criticism.

"India wants to become a police state," says a Reddit thread discussing the draft policy.

Mahendra Palsule, an editor at Techmeme, a popular technology new aggregator, feels that "India's draft National Encryption Policy could very well be a draft of the NSA/GCHQ vision statement."

But not everyone is in opposition to the proposals. "The government is not asking you to unconditionally handover all your private info. If there is any suspicion, it will ask you to produce unencrypted content," tweets software engineer Krupakar Manukonda. "Can government decide encryption rules? Yes, as per IT Act it can. I don't see how security agencies can function without some control over communication," he says.

The draft policy also seeks to encourage "development of indigenous algorithms and manufacture of indigenous products for encryption, hashing and other cryptographic functions."

Comments on the Draft National Encryption Policy have to be sent in by October 16, 2015.

For more details visit http://editors.cis-india.org/internet-governance/news/ibn-live-september-20-2015-soumyadip-choudhury-govt-invites-comments-on-draft-national-encryption-policy-attracts-controversy

Government blocks over 60 websites including github & sourceforge on anti-terror advisory

praskrishna — 2015-01-02T14:22:58Z

Over 60 websites and links, including popular online tools like Github and Sourceforge used by thousands of programmers have been blocked in India, triggering angry protests by Internet users.

The article by P.K. Jayadevan and Neha Alawadhi was published in the Economic Times on December 31, 2014. Pranesh Prakash gave his inputs.

The websites were blocked for hosting content that is pro terrorist group ISIS and not cooperating with government investigations, officials said.

Arvind Gupta, the head of IT Cell, BJP Tweeted: "The websites that have been blocked were based on an advisory by Anti Terrorism Squad, and were carrying Anti India content from ISIS. The sites that have removed objectionable content and/or cooperated with the on going investigations, are being unblocked."

Based on an order issued by the country's telecom department, in a letter dated December 17 and a subsequent letter on December 19, over 60 websites have been blocked by various internet service providers in the country.

While some internet service providers are yet to block these websites, many users have been reporting frequent outages in these web services over the last two weeks.

Websites like Pastebin don't host any content but are a platform for users to paste text. Popular video networks like Vimeo and Dailymotion are among the websites that have been blocked.

Officials from the department of Information Technology and the department of telecom were not available for comment. "These are all providing very dangerous kind of cut and paste services..You can take code, cut it, paste it, remove it, delete it," said one government official who requested anonymity.

The government has invoked section 69A of the Information technology Act (2000) and Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules ("Blocking Rules") to ban these websites.

Many websites have been blocked in India from time to time on various grounds. In September, following the Muzaffarnagar riots, over 80 websites and links on social media were blocked.

However, the inclusion of services like Github and Sourceforge that host code for open source software are causing much anger among the developer community. "Sometimes they might need to block specific URLs, but blocking the entire website is wrong or they haven't thought through it," said Thejesh GN, the co-founder of Datameet and an open source developer.

"There is also a lack of transparency where people don't get to know why their sites were blocked," he added.

"We're aware of reports of connectivity issues in India. We're looking into it, and will update with more information when we have it," a Github spokesperson said.

In June 2014, the Delhi High Court ordered a block of 472 file sharing websites including Google Docs and Pirate Bay following a complaint filed by Sony Entertainment. The entertainment company was hacked and contents from its servers were shared by hackers on various file sharing websites. In earlier instances, many websites have been blocked for copyright infringement as well.

"Courts unfortunately are not exercising restraint and are indulging ignorant copyright lawyers," said Pranesh Prakash, Policy Director at the Centre for Internet and Society. Prakash said that most of the sites on the list don't host copyrighted material themselves and a case can not be made against them.

For more details visit http://editors.cis-india.org/internet-governance/news/economic-times-december-31-2014-jayadevan-neha-alawadhi-december-31-2014-govt-blocks-over-60-websites

Government blocks 32 websites to check ISIS propaganda

praskrishna — 2015-01-02T13:37:39Z

The Centre has blocked 32 websites, including vimeo.com, dailymotion.com, pastebin.com and github.com, in an effort to curb ISIS propaganda, prompting a wave of online protests.

The article by Kim Arora was published in the Times of India on January 1, 2015. Pranesh Prakash gave his inputs.

An Indian "hacktivist" group, Anonymous India, has threatened reprisal. By Wednesday evening, however, websites that had complied with the government order to remove objectionable content had been unblocked, sources said.

A confidential department of telecom order, dated December 17, instructing all internet service licensees to block the websites appeared online on Wednesday. When contacted to verify the news, Dr Gulshan Rai, director of the Indian Computer Emergency Response Team (CERT-In), told TOI the directions had been issued to internet service providers following a Mumbai additional chief metropolitan magistrate's November order directing the government's Department of Electronics and Information Technology (DeitY) to implement the same.

He added that Mumbai's Anti-Terrorism Squad (ATS) had approached the judiciary after interrogating Arif Majeed, a 23-year-old ISIS recruit from Kalyan. More recently, Bengaluru professional Mehdi Biswas was arrested for allegedly spreading ISIS propaganda on Twitter. "These websites were being used to invite youths to join ISIS. We had contacted the websites sometime back and asked for the removal of the objectionable content. At that time, our communications were ignored. Some of them have now agreed to work with the government. The websites that have complied are being unblocked," Rai told TOI.

The move met with opposition from the online community. While the tech community opposed the Github ban, others were upset about video-sharing websites like dailymotion.com and vimeo.com being taken down. "By blocking vimeo and dailymotion along with other websites, India is walking in the footsteps of Pakistan," tweeted @baawraman.

The list of websites in the DoT document was heavy on large text-sharing and collaboration websites, like Github and Pastebin, popular with coders and software developers. Many objected to the blocking of entire websites instead of specific URLs hosting problematic content. However, Rai explained that individual URLs could not be blocked because of the "high mobility of content" on the websites. "It can just be removed and pasted elsewhere. There are no checks and balances," he said.

Hacktivist group Anonymous India tweeted, "One fine morning, Indian government decided to block sites like Github. Now now, it is time to wake-up. Government of India, Expect Us," a tweet from their handle @opindia_revenge said.

As questions began to be raised on social networks, BJP IT cell head Arvind Gupta tweeted, "The websites that have been blocked were based on an advisory by the Anti-Terrorism Squad, and were carrying anti-India content from ISIS. The sites that have removed objectionable content and/or cooperated with the ongoing investigations, are being unblocked."

The sustainability of counter-measures like blanket blocking to contain threats is being questioned. Prasanth Sugathan, counsel at Software Freedom and Law Center, said such a move is short-sighted. "If you block one website, terrorists can always use another one. Or they will move to using encrypted channels, peer-to-peer communication or even telephones. One can't block everything. In my opinion, such a move only inconveniences the daily users and doesn't solve the long-term purpose," said Sugathan. The sentiment was echoed by common Twitter users as well.

Prime Minister Narendra Modi's tweet from August 2012 condemning blanket blocking of websites was pulled out for recirculation. "As a common man, I join the protest against crackdown on freedom of speech! Have changed my DP. 'Sabko Sanmati De Bhagwan.' #GOIBlocks," Modi had tweeted on August 24, 2012.

Pranesh Prakash, policy director at Bengaluru-based Center for Internet and Society, questioned the lack of transparency around the practice of blocking websites under the Indian law. "Qn for govt: Why does the law require secrecy of web blocking orders when it doesn't allow such secrecy for books, films? #GoIBlocks," he tweeted, adding, "The 69A Rules don't allow for transparency, accountability, time-limits on blocks, etc. So easily misused by govt. + courts + individuals." The websites were blocked under section 69 A of the IT Act, 2000 and the IT (Procedure and sdafeguards for Blocking of Access of Information by Public) rules, 2009.

Currently, the Supreme Court is in the middle of hearing a clutch of petitions challenging several IT Act provisions, including blocking and takedown of websites.

For more details visit http://editors.cis-india.org/internet-governance/news/the-times-of-india-jan-1-2015-kim-arora-government-blocks-32-websites-to-check-isis-propaganda

Government asks Twitter to block fake 'PMO India' accounts; site fails to respond

praskrishna — 2012-09-04T12:24:52Z

A standoff between the government and microblogging service Twitter, that has got India's online community up in arms, continues, as Twitter is still to act on India's requests to block some of the fake 'PMO India' accounts.

This article was published in the Economic Times on August 23, 2012. Sunil Abraham is quoted.

India's Minister for Communications and Information Technology Kapil Sibal said, "Twitter has not responded to our requests in a satisfactory manner. The fake accounts are still there. The government of India is contemplating what action should be taken against Twitter and this will be announced as soon as we have finalised our response," he said.

Sibal further added that the government received a response from the US Department of Justice, which also agreed that the content on the sites India sought to ban was inappropriate.

Twitter's operating code allows for parody accounts to be allowed as long as such accounts clearly identify as parody. The accounts in question - including @Indian_pm, @PMOIndiaa, @dryumyumsingh, @PM0India- do so.

Unlike other popular parody accounts of world leaders, though, some of these accounts make no attempt to 'spoof' tweets from the Prime Minister. The user of the @PM0India handle, with over 11 thousand followers, has changed their handle to @thehinduexpress, and tweeted "When I've to parody PM, I'll use the other a/c and RT that. For countering media and Congress, this ID will be used. To hell with censorship."

An email by ET to Twitter Inc, received no response at the time of going to press. However, news agency PTI quoted sources saying that Twitter has communicated to the PMO that it would be locating the "unlawful content". "India is important to us and we would like to have clearer communication in these matters in future," PTI quoted Twitter as saying. Official spokesperson for Indian Prime Minister's Office Pankaj Pachauri confirmed that Twitter is looking into the matter.

Over the past few days, the government has blocked around 300 websites which it blames for spreading rumours that triggered the exodus of people from the North East from several cities. Google and Facebook on Tuesday told ET they were working with India in removing content which can incite violence.

"There is clear evidence that these social networks have caused harm and disruption. However, they need to be clearer about the way they go about blocking sites and other links. The block order contained around 20 accounts and over 80 Youtube videos.

It also had several mainstream media reports and a few Pakistani sites," Sunil Abraham, executive director of Bangalore-based Centre for Internet and Society said. Analysts do not rule out the possibility that Twitter itself will be blocked in India if it does not act.

For more details visit http://editors.cis-india.org/news/articles-economictimes-indiatimes-com-govt-asks-twitter-to-block-fake-pmo-india-accounts-site-fails-to-respond

Government

praskrishna — 2014-04-22T11:38:19Z

Government

For more details visit http://editors.cis-india.org/home-images/Government.png