Centre for Internet and Society

Daunting task ahead for investigative agencies with WhatsApp's end-to-end encryption

praskrishna — 2016-04-09T09:45:12Z

Messaging service WhatsApp's decision to roll out end-to-end encryption for over 1 billion subscribers has been hailed as a positive step by users across the world, although things are set to get tougher for law enforcement and investigative agencies in India seeking to track terrorists.

The article by Neha Alawadhi was published in Economic Times on April 8, 2016. Sunil Abraham was quoted.

"It was anyway difficult to get any kind of data from WhatsApp and now it is going to be even more difficult," said a person familiar with the working of these agencies who did not wish to be identified.

Encryption scrambles data such as text messages, photos and documents and makes them unintelligible for unintended recipients. A service that is encrypted end-to-end cannot be monitored or intercepted. No one, except the people or group communicating with each other, can access the data. If telecom companies, Internet providers or even companies that run messaging services try to intercept the message, all they would get is garbled data.

While chats will not be accessible, associated information known as metadata will be available, such as when the conversations took place, the identities of senders and recipients, their locations, mobile numbers, profile photos and address books, which may be useful for security agencies.

"Definitely for law enforcement it means a big headache, but the metadata is there and with metadata, if you have a couple of other bits of information, you can piece it together," said Sunil Abraham, executive director at Bengaluru-based research organisation Centre for Internet and Society. "Agencies can get the metadata, but they won't get the payload unless they're able to compromise the device. And that intelligence agencies like NSA (National Security Agency of the US) have been able to do in the past."

While encryption offers privacy and security to users, it is the bane of law enforcement agencies globally, as exemplified most recently and notably by the Apple-FBI dispute in the US. The Federal Bureau of Investigation FBI asked Apple to weaken its encryption to access a dead terrorist's iPhone data and after the company refused, hacked into the device with help from a third party.

In India, it is difficult to bring US-based companies to the negotiating table. "We have had minimum cooperation from WhatsApp. All the data is controlled in the US and they rarely hand over the data that we request. We don't ask them for content. We only ask for metadata," said another person familiar with the process who declined to be identified.

While the Indian IT Act gives wide-ranging powers to the government to ask for access to encrypted information, very few requests for information, very few requests for information take the legal route. One reason is the long time that it takes to process such requests - on average, over three years - and the other, especially in the case of WhatsApp, is little or no cooperation, according to government officials.

WhatsApp, based in Mountain View, California, did not respond to an email request for comment. The messaging company was acquired by Facebook in 2014.

How security and investigative agencies in India use the data they access is also a grey area. "We do not have a privacy legislation here which will take care of the concerns that people have with respect to use of data. If the government needs to have access to communications, they also need to ensure there are adequate safeguards in place," said Prasanth Sugathan, counsel at Software Freedom Law Centre.

"In practice, end-to-end encryption will bring the end user and the device into focus, rather than WhatsApp or any particular messaging service. This should be a trigger for greater clarity on India's data protection policy," said Arun Mohan Sukumar, who heads the cyber security and internet governance initiative at think tank Observer Research Foundation.

In India, requests for information from companies such as WhatsApp and Google are handled by the Ministry of Home Affairs or the Indian Computer Emergency Response Team. Emails to both were unanswered at the time of going to print.

The Indian government was involved in a long-standing dispute with BlackBerry over access to encrypted data on its messenger and corporate email service. BlackBerry set up servers in Mumbai to comply with local regulations, but said it could not access encrypted data on its enterprise servers.

For more details visit http://editors.cis-india.org/internet-governance/news/economic-times-april-8-2016-neha-alawadhi-daunting-task-ahead-for-investigative-agencies-with-whatsapp-end-to-end-encryption

Datawind

praskrishna — 2012-11-02T15:14:03Z

Datawind

For more details visit http://editors.cis-india.org/home-images/ubslife.png

Data Xgen launches paid Hindi email service

praskrishna — 2016-08-30T02:35:03Z

Jaipur based Enterprise email provider Data Xgen Technologies has launched a paid email service in Hindi Devnagari script. This is especially for .bharat domain names, but can also be used for other domains. As of now, the company offers email packages starting at Rs 99, Rs 499, Rs 999 and Rs 1,499, which look like monthly plans.

The blog post by Sneha Johari was published in Medianama on August 29, 2016.

Ajay Data, the company’s founder and CEO told MediaNama that it plans to launch an app for sending free email in Indic language, starting with Hindi. Data said that he was hopeful about Hindi email adoption given the vast majority of the population in India was rural and did not understand English. “People get left out of communication streams because they do not understand English. But they can still get onto the internet and communicate with all of us. Mobile companies are also selling phones in Indian languages, marketing as Hindi phones.. And this is the right time (for Indic email) since the segment is being created,” he added.

Earlier this month, the Indian government told email service providers to provide users with addresses in Indian languages, starting with Hindi. It also wanted ‘sufficient local language content and tools to access it’ in order to increase internet penetration and push higher rural adoption. This was needed because English speakers and readers in the country were low (10.35%), according to Rajiv Bansal, Joint Secretary at the Ministry of Electronics and IT.

Wikipedia Indic efforts

About 3 weeks ago, Wikipedia launched in Tulu, the 23rd Indian language Wiki. In September 2013, the Goa University had entered into a 3 year MoU with the Centre for Internet and Society (CIS) for building the Konkani Wikipedia, which was launched 6 months later. In August 2014, former Bihar CM Nitish Kumar launched the ‘Bihar on Wikipedia’ campaign inviting people of the state to write about their villages, towns, culture, history, development over the years, etc. Note that in 2012, Wikipedia editors were digitizing Indian language, out-of-copyright texts online, trying to address the comparative paucity of Indic language texts online.

As of June 2016, Wikipedia had 16 million page views per month on the Hindi wiki, with overall 106,844 articles. This is not a significant increase. According to this August 2011 report, there were 0.1 million Hindi articles on the platform, and 9 million overall views.

Indian mobile handsets need to support Hindi: BIS

In June, the Bureau of Indian Standards reportedly said that mobile handsets in India would need to support typing in Hindi and English, and reading in all 22 official Indian languages. We’d pointed out at the time that this was essential for growth of access to the internet for handsets in order to access content in users’ local languages.

For more details visit http://editors.cis-india.org/a2k/news/data-xgen-launches-paid-hindi-email-service

Data Visualization Session

praskrishna — 2017-05-20T02:32:55Z

For more details visit http://editors.cis-india.org/internet-governance/files/data-visualization.pdf

Data Swiss Army Knives

praskrishna — 2012-02-14T09:41:05Z

For more details visit http://editors.cis-india.org/home-images/swiss.jpg

Data Security Laws in India and Data Protection

praskrishna — 2013-06-27T02:50:44Z

For more details visit http://editors.cis-india.org/a2k/blogs/data-security-laws-india.pdf

Data protection experts slam state for sending mass SMSes

praskrishna — 2012-03-27T03:46:00Z

Experts in the field of data protection, privacy law and media have criticised the West Bengal government's mass SMS sent to individuals, companies and media houses through private mobile networks last Friday. Lara Choksey reports this in an article published in the Statesman on March 25, 2012.

The government's use of private data in order to spread political messages is ethically dubious and dangerous, say some. The SMS indirectly refers to The Telegraph's publication of the Poonam Pandey tweet, warning against the transmission of “provocative and indecent photographs for hurting the religious sentiments of people and disrupting communal harmony.” It urges recipients to “frustrate the designs of … unscrupulous people and maintain peace and communal harmony,” and is signed by “Mamata Banerjee, Chief Minister”.

Speaking to The Statesman on Saturday, Mumbai-based media lecturer Ms Geeta Seshu identified two issues with the government sending out political messages through mobile phone networks.

Firstly, from an ethical standpoint, the unchecked freedom of mobile phone companies to hand out private data is “completely wrong”, she said.

Secondly, the use of government funds for such dissemination needs to be transparent. If the state government has used public funds to distribute its message through a mobile phone network, then this information should be readily available, said Ms Seshu.

The Telecom Regulation Authority of India's (Trai) unsolicited commercial communications regulations allow unsolicited advertising through mobile phone networks.

Mr Apar Gupta, partner of Delhi-based law firm Advani and Co., explained, “The regulations are not wide enough to prohibit communications from a political party.” He observed, “Using SMS messages is a very efficient propaganda tool because so many people have access to mobile phones.”

Mobile phone networks such as Vodafone make it clear in their privacy policies that the personal data of its customers “may be used for inclusion in any telephone or similar directory or directory enquiry service provided or operated by us or by a third party” (source Vodafone website).

Any third party ~ governmental or corporate ~ can therefore access the company's directory of private mobile numbers at the discretion of the network in question.

It is not yet clear which government department coordinated the SMS, or what funds were used to cover the costs. Representatives from the ministry of information and cultural affairs were not able to shed a light on the matter. “I know that a message was sent out,” said the I & CA director Umapada Chatterjee, "But it was not sent from this department. I do not know that information.”

Some commentators did not condemn the government's SMS. Delhi High Court lawyer and cyber law expert, Mr Praveen Dalal, criticised the publication of the Poonam Pandey tweet on the grounds of it violating the due diligence guidelines of the Cyber Law of India. He commented, “If casual and careless publications … continue, there would be no other option left for the government but to regulate their affairs in a more intrusive manner.”

However, executive director of the Centre for Internet and Society, Mr Sunil Abraham, called the state government's use of unsolicited SMS a “clear abuse of the powers afforded by elected office.” Mr Abraham explained that elected representatives would be justified in such measures, and in utilising public funds, in the event of a disaster, or when public order, public health or national security are compromised.

“However in this case, the government is abusing the provisions of the law and using this incident as a pretext to threaten media professionals with surveillance and to intimidate for the purposes of reigning in free speech,” he told The Statesman. The chief minister was unavailable to make a comment on the matter.

Read the original published in the Statesman

For more details visit http://editors.cis-india.org/news/data-protection-experts-slam-state-for-sending-mass-smses

Data Privacy Day, Chennai

praskrishna — 2014-02-04T07:05:30Z

For more details visit http://editors.cis-india.org/internet-governance/blog/data-privacy-day-chennai.pdf

Data Privacy Day 2016

praskrishna — 2016-01-29T15:34:18Z

The Bangalore chapter of Data Privacy Day was organized by Data Security Council of India on January 28, 2016 at Electronic City in Bangalore. Sunil Abraham was a panelist.

Agenda

For more details visit http://editors.cis-india.org/internet-governance/news/data-privacy-day-2016

Data Privacy Day 2014

praskrishna — 2014-02-04T05:34:59Z

January 28 is annually celebrated as Data Privacy Day (DPD). Data Security Council of India (DSCI) organized the annual meeting J N Tata Hall, Bldg 1, Infosys Campus, Infosys Ltd., Electronics City, Bangalore. Elonnai Hickok was a panelist.

Programme Details

2:30 - 3:00 p.m.: Keynote address by Srinath Batni, Member of the Board, Infosys
3:00 - 4:30 p.m.: Panel Discussion on "Privacy today and tomorrow in Indian and Global Context"

Panelists:

M D Sharath, Deputy Superintendent of Police, Cyber Crimes Division, CID Headquarters, Karnataka Police
Srinivas Poosarla, Associate Vice President and Head (Global), Privacy & Data Protection, Infosys Ltd
Joshi Joseph, Senior Information Risk Manager, ING Vyasa Bank
Na.Vijayashankar (Naavi), Information Assurance Consultant
Elonnai Hickok, Policy & Advocacy Associate, Centre for Internet & Society (CIS)

IT Product / Internet services company

Panel will be moderated by Rahul Jain, Principal Consultant, DSCI

4:30- 5:00 p.m.: Presentation on Privacy by Rahul Jain, Principal Consultant, DSCI
5:00- 5:30 p.m.: High Tea

For more info on the event see here.

For more details visit http://editors.cis-india.org/news/data-privacy-day-2014

Data Policy

praskrishna — 2018-05-29T15:14:45Z

Data Policy

For more details visit http://editors.cis-india.org/home-images/DataPolicy.jpg

Data in the Cloud: Where Do Open Standards Fit In?

praskrishna — 2011-04-05T03:59:02Z

The Centre for Internet and Society is co-organising a workshop on Data in the Cloud: Where do Open Standards Fit In? on 16 September, 2010 at the Internet Governance Forum.

Two of the major concerns of recent times have been opening up of government data online and ensuring control over personal data. Interoperability play an important role in both.

When it comes to government data it is necessary to ensure that the data are in formats that citizens can make use of that data. Similarly, when it comes to personal data online, it is important to ensure that such data can be migrated from one service provider to another. While the former will aid in governance, the latter is necessary to ensure fair competition.

These two issues are proposed to be looked at in this best practices forum.

Which of the five broad IGF Themes or the Cross-Cutting Priorities does your workshop fall under?
Emerging Issues / Cloud Computing

Have you organized an IGF workshop before? Yes
If so, please provide the link to the report:

http://www.intgovforum.org/cms/index.php/component/chronocontact/?chronoformname=Workshopsreports2009View&curr=1&wr=94

Provide the names and affiliations of the panellists you are planning to invite:
1. Daniel Dardellier (World Wide Web Consortium)
2. Jeremy Malcolm (Consumers International)
3. Karsten Gerloff (Free Software Foundation of Europe)
4. Vinton Cerf (Father of the Internet)
5. Viviana Munoz (South Centre)

Biographies: