surveillance

Lahore High Court Asked to Intervene in ISI Phone Tapping Row

According to the petition, the federal government issued a notification permitting the ISI to tap phone calls without any legal framework or safeguards in place.

New Delhi: A controversial decision by the Pakistan federal government to grant the Inter-Services Intelligence (ISI) agency the authority to tap phone calls has been brought to the attention of the Lahore high court. A concerned citizen, Mashkoor Hussain, has filed a writ petition arguing that this move is a serious invasion of individual privacy and a violation of constitutional rights, Dawn reported.

According to the petition, the federal government issued a notification permitting the ISI to tap phone calls without any legal framework or safeguards in place.

The petitioner’s counsel, advocate Nadeem Sarwar, argued that this decision is a blatant disregard for the privacy of citizens and contravenes Article 4 of the Pakistani constitution, which guarantees the right to life, liberty, and security of person, the report mentioned.

The petition highlighted the vulnerability of telephone conversations in the face of advanced communication technology and the need for protection against abuse. It emphasised that the right to privacy is an inalienable right of every citizen, and any infringement upon this right must be in accordance with the law.

Furthermore, the petitioner pointed out that the rules for Section 54 of the Telecom Act, which pertains to the tapping of phone calls, have not been formulated yet. Therefore, the power vested in the federal government cannot be delegated to any person or agency without framing the necessary rules, the report added.

The petitioner has requested the court to declare the notification unconstitutional and order the federal government to formulate the rules for exercising the powers delegated under Section 54 of the Telecom Act. The case has sparked concerns about privacy and surveillance in Pakistan, with many citizens expressing fears about the potential misuse of this authority.

Meanwhile, a policy activist and the daughter of an Opposition politician in India have received messages by Apple, alerting them of the possibility of having been targeted by a Pegasus-like spyware, The Wire reported on Wednesday (July 10).

Late last year, several Indian Opposition leaders and journalists had received notifications from Apple warning them that their phones could have been targeted by “state-sponsored attackers”. The message read: “Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID.”

Three New Laws Give the Govt Extraordinary Powers Over Journalism, Entertainment and Internet

These legislations come at a time when journalists and filmmakers face greater pressure than ever to conform to government narratives, said experts at a Digipub conference.

New Delhi: Three new legislations give the Union government power to censor news content, imperil encrypted communication, make it easier to shut down the internet, and intercept communications with minimal accountability.

These views were put forth by leading experts at a meeting organised on December 20 by Digipub, which represents over 60 digital news media, independent journalists and commentators.

These legislations include the Telecommunications Bill of 2023, the draft Broadcasting Services (Regulation) Bill of 2023, and the Digital Personal Data Protection Act of 2023.

The Lok Sabha passed the Telecom Bill on December 20 and the Rajya Sabha on December 21, and it will become an Act after the President’s assent.

Anything can be censored under the new Broadcasting Bill

The legislation aimed at regulating online content, including news, were “extremely broad” and “vague”, said Ritu Kapur, CEO and co-founder of The Quint. There is currently a “complete lack of clarity” on what can lead to a punishment, interception, investigation, inquiry, or censorship, said Kapur.

She said the provision for content evaluation committees (CECs) in the draft broadcasting bill, asking broadcasters to broadcast only those programmes self-certified through these CECs, would be difficult for news media to follow.

“There is a reason news organisations have editors,” said Kapoor. “Why do we need this content evaluation committee?”

Digital news content creator Meghnad S spoke about how the difference between journalists and content creators has been blurred in recent legislation.

Meghnad said anyone making social commentary online – including comedians, Instagram meme pages, even those running WhatsApp communities – could face the same restrictions proposed for news media in the Broadcasting Bill.

He was referring to the broad definition of “news and current affairs programmes” prescribed in the draft of the Bill, which requires such programmes to adhere to advertising and programme codes prescribed by the government.

Meghnad said these codes restricted programming for a variety of supposed transgressions, such as “snobbish behaviour (…), decency, public morality”.

It is unclear if the government will continue with the existing codes.

Meghnad expressed concern over the requirement of verifiable biometric-based identification for users of telecom services in the telecom bill. For journalists, he said, this could mean that their sources can no longer be anonymous when they share news.

Meena Kotwal, the founder of the news website The Mooknayak, said these laws could be used for “selective targeting” of people speaking on issues that the government did not want to discuss.

Also read: Control + All or Delete: The Draft Broadcast Bill Is a Blueprint for Censorship

She said, “Since things are in the hands of the government, it can decide what is right or wrong. There are a lot of ministers in the government who put out wrong information, but no one will target them. And even if our information is correct, it is very easy to target us”.

Aslah Kayyalakkath, the founding editor of Maktoob, shared his experience of how he landed in trouble with the Kerala police because of a 30 October story by a freelance journalist alleging anti-Muslim bias by the Kerala police. The police filed a first information report (FIR) against the freelancer, and his phone was seized. Kayyalakkath was made a potential accused in the FIR and interrogated for several hours.

Several such instances of harassment and arrests of journalists publishing stories critical of the government and its institutions have been recorded in the past few years. This not only discourages journalists but also instils a feeling of fear that leads to self-censorship.

Surveillance and privacy concerns in Telecom Bill

Advocate Apar Gupta said there were major concerns related to surveillance and interception, internet shutdowns, encrypted services, and duties of users in the Telecom Bill, 2023 (which the Lok Sabha passed with 95 of its MPs suspended), in a political economy “where there is a growth” of chosen companies and increased government control.

Referring to internet shutdowns, Gupta said, “Long periods of Internet shutdowns have caused grave amounts of economic and social injury to people in Jammu and Kashmir and Manipur, almost reducing them to a barbaric sort of existence during Covid”.

“The department of telecommunications still refuses to make a centralised repository of internet shutdowns, thereby reducing transparency,” said Gupta. “We are completely ignoring the central core of telecommunication rules that are required.”

Gupta said the interception provisions in the new bill were worse than those in a previous 2022 avatar, which was released for public consultation in September of that year. The department of telecommunications did not release the comments that were made.

The new Telecom Bill states that the Union government can ask for messages to be disclosed in an “intelligible format”.

“What that means is that if there is an interception order, and it’s a WhatsApp message given to WhatsApp, [then] WhatsApp needs to decrypt it and give it to a law enforcement officer,” said Gupta. “And how will it do it if it’s implementing end-to-end encryption?”

WhatsApp currently claims to provide end-to-end encrypted messaging services, which means that no one except those communicating with each other can read the messages being exchanged, not even WhatsApp. Asking WhatsApp to decrypt its messages could affect the privacy rights of Indians.

“The hope is always obviously if you’re coming out with a new law, you would want policy to improve,” said Gupta. “You wouldn’t want it to just replicate the existing provisions.”

Advocate Vrinda Bhandari spoke about how search-and-seizure powers granted under the Telecom Bill were of concern. The bill allows any officer authorised by the Union government to search any place where “unauthorised” telecom equipment is kept and seize it, or, for certain offences, such as unlawful interception and “causing damage to telecommunication network”.

Bhandari said the government’s powers under the bill were “very broadly defined” and provided no safeguards against interception. The new Bill would allow any social media messages on Manipur violence to be blocked for “inflaming tensions,” she added.

The Bill allows the central government to intercept messages communicated via “any telecommunication equipment” for reasons like “public emergency or in the interest of public safety”.

Another controversial aspect of the Bill is the definition of “telecommunication services”. Bhandari argued that the current definition is still very broad and has the scope to include “any content” under its ambit. This could cover services like WhatsApp, PayTm and Google Pay, she added.

Including internet-based services in the definition of “telecommunication services” would make them vulnerable to the government’s power to restrict and suspend their services.

Also read: Telecommunications Bill Lays the Ground for Totalitarian Control of the Internet

Advocate Shreya Singhal said the Telecom Bill allowed all telecom services to be suspended for any “public emergency”. The government would have the power to ban not only the internet but also mobile services.

Censorship powers of the Broadcasting Bill

Journalist Anna M.M. Vetticad referred to growing self-censorship in the Hindi entertainment industry, describing it as “mind-boggling”.

“If an actor is outspoken, they will not cast that person” because there’s potential for controversy, said Vetticad. Self-censorship was evident even with script-writers and financiers, she added.

Vetticad discussed the film “Bheed,” which draws connections between the Covid crisis and India’s 1947 partition. When the film’s director, Anubhav Sinha, ran into trouble with the censor board, the producer distanced himself from the project and had his own name removed from the credits, Vetticad said.

“Multiple filmmakers have told me that the scripts of their shows and their films are being looked at for [to check if] there’s anything that would offend the government [or if there] is there anything that would offend Hindutva,” said Vetticad.

She also raised concerns with the provisions for content evaluation committees (CECs) in the broadcasting bill. The bill requires broadcasters to self-certify content before publication. The CEC, she said, would be another layer above existing censorship.

The broadcasting bill seeks to regulate broadcasting services over television, internet, and radio, allowing the government to regulate or censor content. The bill empowers the union government to delete or modify programmes.

Lawyer Alok Prasanna, co-founder and lead of Vidhi Centre for Legal Policy, Karnataka, described the broadcasting bill as a completely “confused approach” to regulating OTTs.

Abhinandan Sekhri, co-founder and CEO of Newslaundry, said it was important to remember that government regulations also applied to the media. “I myself have faced in court in five different cases, three against income tax authorities, one against The Times of India, one against India Today,” he said.

Vibodh Parthasarathi, associate professor Jamia Millia Islamia, said that the broadcast regulations have been “unclear” in finding the “object of regulation”. For instance, he said, “I see a lack of state capacity in stipulating the methodology for audience measurement”, a task that falls under the ambit of the central government under the broadcasting bill.

Akshit Chawla is an independent journalist based in New Delhi.

Why CERT-IN’s Investigation Into Apple Security Notifications Is Going Nowhere

A bureaucratic body under MeitY, CERT-IN is clearly not an independent institution and has no history of actually conducting serious forensic audits.

India is rapidly digitising. There are good things and bad, speed-bumps on the way and caveats to be mindful of. The weekly column Terminal focuses on all that is connected and is not – on digital issues, policy, ideas and themes dominating the conversation in India and the world.

The Indian Computer Emergency Response Team (CERT-IN) has been tasked to make Apple explain the security notifications on “state-sponsored” attacks early this month, but can it follow through with due process and actually do its job? CERT-IN’s mandate is to provide response to computer emergencies under India’s Information Technology Act. It has never delivered on this promise and has become yet another government agency sleeping on its job.

The security notifications sent by Apple to several Members of Parliament, politicians, journalists and others has raised concerns yet again of unregulated surveillance activities by India’s intelligence agencies. Apple’s security notifications point towards state-sponsored actors and, for the sake of argument, could mean any nation state including an enemy state out there, making it a classic case of computer emergency.

The Ministry of Electronics and Information Technology (MeitY) has written a letter to Apple asking the firm to cooperate with CERT-IN and Apple has co-operated by bringing in its experts to work with CERT-IN. CERT-IN guidelines mandate that every organisation must report security incidents within six hours of the incident and Apple was reminded of this. Apple clearly has not followed this, violating some of CERT-IN’s rules.

CERT-IN similarly sent notices to WhatsApp in 2019, when WhatsApp alerted select individuals of being targeted by Pegasus. WhatsApp notified CERT-IN about the security issue in its systems without giving further details of people early into its incident response, even before it notified people who were affected. CERT-IN did not follow through on the issue until the scale of it was publicly disclosed by WhatsApp.

An Indian Express report about the investigation into Apple’s security notifications pointed out how CERT-IN is now investigating Chinese government-linked agencies, as the place of production of most iPhones is China. CERT-IN is now investigating which nation state actor could be behind these attacks, while the minister for electronics and information technology denied it could be Indian agencies and rubbished the opposition for the claims.

CERT-IN’s past actions show us that these notices that it issues to private companies have never been translated into any meaningful regulatory actions. Neither did CERT-IN follow through with WhatsApp about Pegasus, nor did it carry out an independent investigation which most cyber security agencies in different countries carried out. As a regulatory body responsible for cyber security, CERT-IN has never investigated any data breaches, nor has it provided any actual incident response.

Also read: Seizing Devices Needs Due Process. So Does Remote Accessing Via Spyware

A bureaucratic body under MeitY, CERT-IN is clearly not an independent institution and has no history of actually conducting serious forensic audits. The organisational capacity to even conduct an investigation necessary for state-sponsored attacks is probably not available to CERT-IN. Most of CERT-IN’s capacity is within India’s privately regulated cybersecurity industry. CERT-IN decides who can conduct cybersecurity audits by empanelling private organisations.

From a digital evidence perspective, no private organisation’s forensics are considered valid unless that organisation is empanelled by CERT-IN. This gives CERT-IN and the Government of India more power to reject any forensic evidence just because the organisations ‘can’t be trusted’. Even if Apple provides evidence there were indeed state-sponsored attacks, with no actual conclusive proofs attributing exact actors, Indian authorities are likely to reject it or deflect the blame.

It has been a long pending demand for CERT-IN to actually conduct forensic investigations of cyber incidents and to publish its findings. The only major reports that are published by CERT-IN are its annual reports with details of its activities like training and workshops it has conducted. As a cybersecurity regulator, CERT-IN is as bad as the rest of the regulators in the country, with no interest in seriously regulating the sector.

For the sake of argument, if it were indeed Chinese actors who were involved in targeting the Indian opposition and journalists, even then CERT-IN has no capacity to respond to this. The National Critical Information Infrastructure Protection Centre (NCIIPC), a unit of the National Technical Research Organisation (NTRO), has relatively more experience in tackling nation state actors targeting our critical infrastructure. When it comes to cybersecurity, NCIIPC still responds to threats and provides incident response, which CERT-IN has largely ignored.

While the CERT-IN is basically a regulatory organisation responsible for directing the industry to adopt cybersecurity practices, NCIIPC is more of a hands-on organisation that has in-house capacity to handle threats. If the Government of India is really serious about addressing nation state actors targeting Indians and is concerned with the safety of Members of Parliament and others, it would comprehensively address this problem.

Also read: Apple Is Not the First Tech Company To Allege Government Role in Misuse of Spyware

India needs more transparency on how its security apparatus and its regulators operate. This is unlikely to happen by itself and with the parliament and its committees unable to function under the current political climate, one needs to wait for political change. One could only hope that actually happens and the situation doesn’t get worse with the usage of state surveillance against the opposition.

For the people who have been affected by this and want more answers from Apple, it is unlikely to be revealed in India. If one is looking to follow through on this and want Apple to provide more details, they should legally proceed against Apple in the United States. Any litigation around this in India is unlikely to result in any positive response from any of the actors. Apple sued the NSO Group in the US for targeting its users and to curb abuse of nation state actors. If Apple is really serious about the privacy of its users, it will respond positively and give further details, but may be unlikely to do so in India with pressure from Indian authorities.

Srinivas Kodali is a researcher on digitisation and a hacktivist.

Is it Time to Call India a Digital Dystopia?

It is time to renew efforts to de-mystify technology with the aim of surveillance reforms, before this Digital Dystopia becomes a permanent future.

Monday night’s alerts from Apple to politicians and journalists about “state-sponsored attacks” pointed to an increasing trend of using surveillance towards the suppression of the political opposition. Digital India is being hailed as the government’s flagship contribution to nation building, with technology determining our lives everyday. This utopian imagination is being hailed by many, from the World Bank to Bill Gates. But is it time for us to question whether Digital India has actually become a Digital Dystopia?

Digital India as an official Government of India programme was launched in 2014 by Narendra Modi, and digitisation has been an important agenda for this government. The BJP gave all the push necessary to build Nandan Nilekani’s imaginations of India, one where technology determines the lives of every Indian. It forced Aadhaar, UPI, GST and a host of digital technologies in a bid to formalise the economy. But this digitisation process also powered the surveillance and policing infrastructures like CCTNS, NATGRID, CMS and ICJS that were set in motion in the aftermath of the 26/11 Mumbai attacks.

The surveillance infrastructures that were being developed were always directed towards the citizenry, under the garb of enumeration exercises, which was not immediately clear to the population. The Ministry of Home Affairs historically policed us through secretive systems and any push towards reforms in policing and intelligence has not been a priority. The idea of surveillance and 360-degree profiling were always part of the imaginations of the Aadhaar programme, specially with agreements between the UIDAI and MHA to share biometrics, to create tge National Population Registry and the requirement of unique IDs to link databases for creation of NATGRID.

The possibility of active surveillance of any individual through spyware was always a demand from our intelligence agencies. But this reality is far more concerning with no accountability in these agencies. Surveillance infrastructures have always been part of societies, from surveillance of telegraphs, posts to telecom networks. But unrestricted access to these systems by rogue institutions and actors has brought us here. The current reality is being cheered by the population, which has been sold this reality as a Hindutva utopia by media networks.

The techno-utopian imagination that were sold to us was that technology in the form of Aadhaar would eradicate fraud, corruption and economically make every Indian rich using their personal data. This imagination, while being utopian, could only be enforced through technology and was forced on the entire population which had no option other than fitting itself into the imaginations of a billionaire whose entire claim was that technology will fix everything.

The imagination that was sold to us was not complete and was never entirely explained to us, while rubbishing any critical questions around it. It should be clear to any individual that the early experimentation of Aadhaar on welfare schemes was just an excuse to build and test software that could be finally used for building credit profiles and a data economy. The language of fraud and duplicate Indians in welfare that was forced on us is leading us towards a witch-hunt to search for illegal citizens in the country with biometrics.

Nilekani was always silent about the surveillance aspects of his imaginations, while claiming there are no privacy issues with Aadhaar. According to Nilekani, Aadhaar linking with voter IDs will remove duplicate voters, but he won’t talk about the dangers of centralising elections and risks of online-voting which Aadhaar is expected to power. This technocracy powers the entire techno fascist machinery of the current regime. It is a symbiotic relationship for the Bangalore Ideology as Mila Samdub calls, “For the engineers of Bengaluru and their allies in neoliberal think tanks, the BJP’s Hindutva politics is the necessary condition to put their designs to work.”

Also read: Modi Government in Damage Control Mode As Apple Spyware Alert Revives Ghost of Pegasus

This system of technology architectures that are being termed “digital public infrastructures” and are highly centralised and unaccountable are turning governance invisible. Black box governance is a feature of this imagination, where people are not told why something works or fails, with a sense of mysticism associated with technology. The Aadhaar failures and non-functional apps that are mandatory on welfare systems are being forced with an excuse of fraud prevention, while we clearly see the dismantling of social welfare infrastructure. There are claims that are associated with this setup that have started in 2008 and continue to exist.

These black boxes and techno-utopian imaginations need to be demystified for the general public. While there has been a decade of work around this, the control of reality with media narratives has been a challenge to expose the under-workings of these systems. Any language of criticism that was used by the citizenry was co-opted and was used against them to dissolve the criticism. The editorial decisions of media houses to not be critical of Aadhaar or Nilekani has already unfolded in the form of technology driven violence, that could have been prevented.

New frameworks of critical thinking and de-mystification of technology need to be evolved to make the citizenry aware of the violence being pushed with utopian claims. India is being shown as a utopian society where technology has transformed our economic lives primarily with dematerialisation of documents. But the realities of the material world are being hidden with clever marketing strategies where any discussion over fraud, corruption or poverty is replaced with UPI.

We need alternate imaginations to counter the existing narratives of techno-utopians who have sold us a dystopia while they profit from this enterprise. For a software engineer who builds these technology systems, a broken app doesn’t affect his life and he sees these technology systems as utopian solutions to a problem that doesn’t actually exist. Meanwhile this becomes a technological nightmare for the working class dependent on social welfare. Dystopias and utopias are relative in class societies and can co-exist simultaneously with different narratives among the population.

Privacy has been turned into a non-issue for people, with opposition from the economic actors who advocated against it. Digital India isn’t what it is being claimed, the reality is different on the ground. It is time to renew efforts to de-mystify technology with the aim of surveillance reforms, before this Digital Dystopia becomes a permanent future.

Srinivas Kodali is a researcher on digitisation and a hacktivist.

The Most Dangerous Software Known to Humankind

Laurent Richard and Sandrine Rigaud’s book diligently documents not just the ghastly consequences of state surveillance on individuals but juxtaposes these with stories of resistance and courage.

Palestine and Israel continue to dominate the news cycle. Then one learns that several Members of Parliament and leaders belonging to political parties opposed to the ruling regime in this country, those working in the office of Rahul Gandhi, a few individuals apparently on the other side of the divide, not to mention a few journalists, including Siddharth Varadarajan, one of the founding editors of The Wire, Anand Mangnale and Ravi Nair of the Organised Crime and Corruption Reporting Project (OCCTP), have all been “alerted” by Apple:

“State-sponsored attackers may be targeting your iPhone… These attackers are likely targeting you individually because of who you are or what you do. If your device is compromised by a state-sponsored attacker, they may be able to remotely access your sensitive data, communications, or even the camera and microphone.”

If you thought iPhones were more secure than cellular mobile phones with the more commonly-used Android operating system, you are wrong.

Is there anything common between Israel and the alert issued by Apple? Answer: Yes.

Named after a mythical winged horse from Greek mythology, Pegasus is one of the world’s most powerful cyberweapons. To say that Pegasus is the nuclear bomb of computer software would be an understatement. It is zero click-bait. In other words, the person who uses a mobile phone does not have an iota of an idea if, how, when and where their phone has been infected by this spyware. Earlier, one would have to click on a link to enable malware to enter the phone. Technology has “progressed” at a phenomenally rapid pace.

Laurent Richard and Sandrine Rigaud
Pegasus: The Story of the World’s Most Dangerous Spyware
Macmillan, 2023

The privately-owned Israeli company called the NSO Group that developed the world’s most dangerous surveillance tool claims that it is used for law-enforcement: for nabbing terrorists, drug dealers, paedophiles, tracking drones and even finding people trapped in the rubble of a collapsed building. But this spyware – and its clones and imitations, including one named Predator – that is supposedly made available only to government law-enforcing agencies after due authorisation by the Israeli government, is also misused by regimes across the world, especially authoritarian ones. Only governments, and perhaps indirectly a few big business groups, can shell out the big bucks needed for the targeted deployment of Pegasus. Although Tel Aviv claims that the spyware is sold only to government bodies and NSO denies its unauthorised use – this argument is what Laurent Richard and Sandrine Rigaud’s book Pegasus: The Story of the World’s Most Dangerous Spyware seeks to dispute and demolish.

The crucial question that logically arises in the context of what’s currently going on is, why Israel’s military forces could not anticipate the attack by Hamas on October 7, despite having developed the most advanced spyware. This question remains unanswered.

To go back to Pegasus, the fact is that this spyware has been, and almost certainly continues to be, misused to track not just the political opponents of those in power in several countries, but also those within their respective governments who the rulers want to keep an eye on. Pegasus has been used to listen in to, read and view conversations, text and audio messages as well as videos over electronic mail and text communications on the mobile phones of quite a few heads of governments. For example, the royalty of Morocco used the spyware to snoop on top functionaries of the government of France as well as dissidents. The most widespread use of Pegasus is to track politicians, journalists, lawyers, judges, government officials and human rights activists.

This is what this book is all about. It has been written by two journalists who work with the Paris-based Forbidden Stories, which received a data leak of some 50,000 phone numbers on which Pegasus had apparently been used. Amnesty International was first roped in as a collaborator. Thereafter, the numbers were shared with more than 80 journalists working in 17 media organisations across the world, including The Wire in India. Those willing to have the innards of their phones forensically examined after extracting data from their personal devices, saw the information being scrutinised by technical experts in Europe and in Canada (at the Citizen Lab). The book details the elaborate way the global investigation was conducted over more than three months and finally made public in a coordinated manner in July 2021.

What makes the 318-page book extremely readable is that it is written in a racy style and filled with many anecdotes and accounts of the personal experiences of individuals. These include many heart-rending, real-life stories of people who were killed, their families devastated and how innocent people were harassed, tortured and incarcerated merely for doing their jobs in earnest – that is, exposing corruption in high places, abuses of power and the nexus between criminals and top government officials. The stories in the book are not just about death and destruction but also about amazing courage and fortitude. The way the researchers and technical experts behind the investigation went about doing their work in digging up the dirt about Pegasus are recounted in gripping detail.

Before proceeding further, a personal disclaimer is in order. Besides the founding editors of The Wire Siddharth Varadarajan and M.K. Venu, this reviewer is among those whose phones were forensically examined and who are named in the book at many places. I am also among those who have petitioned the Supreme Court of India in this connection. Whereas several governments in different countries have initiated probes into allegations of misuse of the spyware, the government of India has brazenly stonewalled attempts to disclose whether it has used Pegasus, that too despite the intervention of the country’s highest court. Not only does the government’s stance suggest that it has much to hide, the Supreme Court too hasn’t exactly covered itself with glory because of the tardy way in which it has acted – or rather, not acted.

On October 27, 2021, the Supreme Court had formed a committee headed by retired Justice R.V. Raveendran, with two members assisting him: Alok Joshi, former director of the government’s external intelligence agency the Research and Analysis Wing (RAW) in the Cabinet Secretariat and 1976 batch officer of the Indian Police Service; and Sundeep Oberoi, chairman of the sub-committee of the International Organization of Standardization, International Electro-Technical Commission and Joint Technical Committee. The committee was supported by another panel of three technical experts: Naveen Chaudhary, a professor of cyber security and digital forensics at the National Forensic Sciences University, Gujarat; Prabaharan P., professor, Amrita Vishwa Vidyapeetham, Kerala and expert on cyber security; and Ashwin Anil Gumaste, professor, department of computer sciences and engineering, Indian Institute of Technology, Bombay.

A day before the then Chief Justice of India N.V. Ramana retired on August 26, 2022, he observed in court that the government of the day had not cooperated with the committee he had appointed. He remarked: “We will say one sentence — the government did not cooperate with the technical committee on scrutiny of the devices for Pegasus spyware.”

He was that day presiding over a three-judge bench comprising Justices Surya Kant and Hima Kohli. He opened the voluminous report in three parts in court and the judges went through it quickly. The CJI said the technical committee had examined 29 phones and found malware in five of them but could not state if the malware was Pegasus. He said the Raveendran committee’s report would be uploaded on the website of the Supreme Court but the technical committee’s report would be uploaded after redacting portions as committee members had requested that personal data not be disclosed.

CJI Ramana said the Raveendran committee had recommended changes in the existing law on surveillance and also suggested that the protection of privacy be enhanced “along with the cyber secrecy of the nation”. The CJI said the committee’s recommendations and observations could be made public.

The bench stated: “Such a course of action taken by the Respondent Union of India, especially in proceedings of the present nature which touches upon the fundamental rights of the citizens of the country, cannot be accepted…The mere invocation of national security by the State does not render the Court a mute spectator.”

Earlier, when CJI Ramana had asked the Solicitor General of India Tushar Mehta representing the government to answer a straight question – has any agency of the Indian government purchased and used Pegasus – the latter refused to answer “yes” or “no” ostensibly on the ground that the answer would adversely affect “national security interests”. This was how brazen the government’s response was. But worse was to follow.

After the Raveendran committee and the technical committee submitted their reports in a sealed cover, and despite CJI Ramana’s observations in court, late at night on August 25, 2022, the Supreme Court decided to “re-seal” the report of the Raveendran committee and keep in the “safe custody” of the Secretary General of the court. The legal website The Leaflet commented: “The decision to keep the two reports under wraps, despite the CJI’s oral commitment to upload them on the Supreme Court’s website, disappointed those who expected some degree of transparency from the highest court.”

The case was supposed to be heard after four weeks. But more than 13 months have gone by and nothing has happened. Meanwhile, curiously, the depositions that were video-graphed (of various individuals, including Varadarajan and me) and made available on the publicly-available website set up by the inquiry committee, cannot be accessed at present.

To return to the book by Ricard and Rigaud, the particularly gripping stories are not just about Jamal Khashoggi, the Washington Post columnist and occasional critic of the royal family of Saudi Arabia (in particular, Mohammed bin Salman or MBS) who was allegedly complicit in engaging certain persons who cut Khashoggi’s body into pieces in October 2018 inside the Saudi consulate in Istanbul, Turkey. Pegasus was apparently deployed to track his fiancé and his lawyers even as he entered the consulate.

Equally gripping are the stories of journalists from Mexico, some of whom are no more. The murder of 39-year-old journalist Cecilio Pineda remains unsolved, as is the unnatural death of Regina Martinez of Prosco. Both exposed the working of the drug mafia whose members bribed and colluded with local government officials and police personnel. The phone of another investigative journalist, Jorge Carrasco was apparently compromised by Pegasus even as he continued to probe the circumstances of the deaths of his fellow journalists.

The book diligently documents not just the ghastly consequences of state surveillance on individuals but juxtaposes these with stories of resistance and courage. The examples of brave journalists, Khadija Ismayilova of Azerbaijan, and Bastian and Frederik Obermaier of Hungary, provide silver linings of hope in the dark clouds of dictatorship and authoritarianism.

Out of the 50,000 odd phone numbers that were “leaked” to Forbidden Stories (perhaps by an NSO insider), over 1,000 numbers in some 50 countries were found to have been allegedly infected by Pegasus after verification with multiple sources. Among these numbers were those that belonged to three presidents, ten prime ministers, one king, two Emirati princesses (no prizes for guessing their names), at least 600 politicians and government officials, 192 journalists, and 85 human rights activists and lawyers.

Let me anticipate a reaction to this review from supporters of the BJP and those who are part of the right-wing ecosystem, an instance of “whataboutery”. If Pegasus has indeed been misused across the world, what’s new about what is happening in India? Small consolation then?

Be that as it may, there is much in the book about how the international operation to ensure that 80 journalists working in 17 media organisations across the world, were persuaded to keep the entire investigation under wraps for many months, that is, before detailed questionnaires were e-mailed to NSO in Israel. The book ends soon after July 2021 when the stories were published in a coordinated manner over more than a week. I think it’s time for Ricard and Rigaud to publish a revised, enlarged edition of the book. Check out the many dozens of Indians whose names were disclosed in the series of articles published by The Wire that month.

One last remark. Why have I repeatedly used the word “allegedly” in this review article? The reason is simple: traces of Pegasus are very, very difficult to find. To understand how difficult this process is, read the book.

Paranjoy Guha Thakurta is a Delhi-based journalist. He is the co-author (with Ravi Nair) and publisher of The Rafale Deal; Flying Lies? The Role of Prime Minister Narendra Modi in India’s Biggest Defence Scandal.

How Systems of Discrediting, Judicial Harassment and Tech Are Used to Take Down Journalists

In Brazil, there is a lack of vision towards developing a stronger media ecosystem; we need public policy that is not tainted by private interests but attached to the strengthening of our democracy.

The text below is a slightly edited version of the author’s remarks to the M20 Media Freedom Summit held online in Delhi on September 6, 2023 by the M20 Organising Committee, which comprises 11 editors from India and a former judge of the Supreme Court.

Good morning to you all, and thank you for inviting me. Mostly, thank you for putting together this initiative, which I think is timely and necessary. Very briefly, I could say that freedom of expression and press freedom in Brazil are at risk in many ways.

I would start by mentioning attacks, both violent personal ones and virtual ones. Journalism and journalists have been attacked in many ways in Brazil by public and private actors, including our previous president who is very explicit in how he despised journalism and journalists, particularly female journalists. I think that we have a background there, where journalism as a trusted information source has been discredited little by little, and today we face a difficult situation when it comes to public trust in relation to the media in general.

I would say the second risk that we face is a strategy called judicial harassment. It is becoming very popular in Brazil to judicially pursue journalists and media organisations. This is a tactic that has been used a lot by political and/or religious groups to intimidate journalists.

My third point would be that an element of risk comes with our great dependence on tech platforms. I think that the media industry today in Brazil, as well as globally – I don’t think we differ strongly from many other countries – have an enormous level of dependence on media platforms. They are the great mediators between us and our audiences. We depend greatly on them to distribute our content, but not only that. They have been shaping markets, our market, distributing, giving out a lot of money and with not very transparent criteria – selecting who would get these financial resources and who won’t get these financial resources in a market that is already fragile from a financial perspective, creating a lot of imbalance in an already very unbalanced market.

Also read: Media Faces Counter-Offensive as States, Including Elective Democracies, Repress Independent Journalism

In Brazil over the past two years, we have been trying to approve some regulatory legislation. We had an attempt to vote a bill three or four months ago and we saw the power of the lobby coming from the platforms. They played very strongly, although they keep saying ‘you need to regulate us’. Once regulation time comes, we see that it is absolutely not in their interest to become regulated, and what we saw in Brazil can be perceived as an example to the rest of the world in the sense of how much money, effort and people they have put in to prevent a legislation to be passed.

I think that also what we are considering now in Brazil is the kind of retaliation that we are observing in other parts of the world, such as removing news content from news feeds in the case of Facebook and from search in the case of Google. The Brazilian market is a market that is largely dependent on these tools, so if news is removed from search, this would harm publishers from small to big publishers very much, and it’s something that we need to address also as a risk, from my point of view.

I would say that another risk is our market itself. Brazil has a very traditional and concentrated media market, that is mainly owned by some families. The shape of the market ends up shaping the public debate – how the public debate is shaped in the country.

Our media market is also always very fragile from a financial perspective, which makes it more vulnerable to different interests –political, religious and commercial. I think that the Brazilian media industry has had a hard time innovating. It has a lot of barriers to new entrants – I speak from experience – which also creates a lot of barriers to a more diversified media market, which would be healthier and strengthening for the media industry.

Finally, I would like to emphasise that we also have a lack of vision of a public policy towards media, the media ecosystem. I think the debate in Brazil ends by talking about media regulation which is perceived as censorship, and is not elaborated further than that, and we need to have a broader vision. One would be to have a public policy that is not tainted or contaminated by private interests – that really plans to shape and to stimulate and to develop a stronger media ecosystem that is attached to the strengthening of our democracy.

I would like to end by saying that I think that this kind of initiative that [the Indian M20 Organising Committee] have put together can be a great forum for us to develop – to debate all those issues that I’ve mentioned, but also to induce a national debate that is connected to other public agendas.

The media so far is not perceived as an element that has to do with the development agenda within our country. I think it’s perceived as something that is not side-by-side with our other public policy issues such as education or health or things like this. I think that if we consider the media ecosystem and its strengthening and development as part of our public agenda, it could bring very positive outcomes for our market, our industry and our ecosystem.

To conclude, we would be happy to contribute and help organise an event in Brazil next year, let’s talk about that. Thank you very much.

Paula Miraglia is Co-founder & Director General, Nexo Jornal and Gama Revista, Brazil

India’s Laws Create Dangerous ‘Backdoor’ for Surveillance Companies, Govt Surveillance: FT

India finds itself amongst countries like Uganda and Rwanda, as far as laws allowing for interception of communication goes. Most companies globally ask governments for a ‘court-approved warrant for targeted interception’. Not so, here.

New Delhi: India’s “so-called lawful interception monitoring systems” are helping provide the “backdoor” that allows “prime minister Narendra Modi’s government to snoop on its 1.4bn citizens, part of the country’s growing surveillance regime”, reports The Financial Times.

The prestigious London-based financial daily tracks how India mandates that telecommunication networks install hardware “to search, copy and pump that data to Indian security agencies on demand, with the help of AI and data analytics”. This hardware is meant to be attached to “subsea cable landing stations that have proliferated around India’s coast.” It is these cables that make global communications between India and the rest of the world possible in the digital age. This, it finds, is fuelling and helping private companies that sell powerful surveillance tools.

The companies FT identifies include Indian providers such as Vehere, “as well as less well known Israeli groups like Cognyte or Septier.” The profile and track-record of some of these companies have raised serious concerns.

Septier was among companies termed a “potentially irresponsible proliferator” by the Atlantic Council in 2021, which it meant as those companies “willing to accept or ignore the risk that their products will bolster the capabilities of client governments that might wish to threaten US/Nato national security or harm marginalised populations”. Septier called this “pure speculation” at the time, as per the report.

India’s case is unusual and an exception to most other democracies, as it requires “telecom companies to install surveillance equipment at subsea cable landing stations and data centres that is approved by the government as a condition of operation.”

After the Snowden tapes created a storm, revealing how intelligence agencies in the US and UK were engaged in mass surveillance via backdoor arrangements, telecom companies have pushed back on government pressure “to install official backdoors providing unfettered access to customer data.” They have preferred to demand a court-approved warrant for targeted interception, as and when governments have made requests for surveillance.

India finds itself amongst countries like Uganda and Rwanda, who have similar interception laws. But, remarks FT, the scale of India’s telecoms usage has zoomed in recent years. Projections of wireless data usage are up “from an average of 1.24GB per person a month in 2018 to over 14GB.”

The companies we keep

Septier is an Israel-based company. Founded in 2000, has sold its lawful interception technology to telecoms groups including Mukesh Ambani’s Reliance Jio, the Vodafone Idea Indian joint venture and Singapore’s Singtel.

Israel-based Cognyte, is cited as another leading provider of surveillance products in India.

Vehere, jointly headquartered in India and the US, is also mentioned as a company relevant in this context. It advertises its “state of the art monitoring solution” that helps telecom companies “fulfil their legal obligation to intercept calls and data while maintaining maximum privacy protection”, says FT.

The Financial Times contacted the government of India, Cognyte, Vehere, Reliance Jio and Singtel for comments, but says they did not respond. Vodafone Idea said it “remains strictly compliant to licensing conditions mandated by [the] government of India and the prevailing regulations in force at any given time”.

Broader concerns

Concerns about India’s surveillance regime have multiplied since reports about India deploying the Pegasus spyware of Israeli group NSO, “triggering a political scandal when the hacking tool was found on the phones of journalists and activists in 2019 and 2021.”

In July 2021, 16 international news organisations including The Wire, the French media non-profit Forbidden Stories and Amnesty International came together to expose the use of this spyware – which the NSO Group said it only sold to governments – was used across the world, including in India.

The personal data protection bill passed in this monsoon session of Parliament has been criticised for being one that protects governments from scrutiny and not citizens, providing legal cover for surveillance. Critics and activists say, “the government’s favourite catchphrase ‘as may be prescribed’ is the highlight of this DPDP Act. It has been used 28 times in a 21-page Act with 44 sections. The ambiguity has been kept so that the government can take arbitrary decisions.”

G20: India Is Now the Vishwaguru of Digital Authoritarianism

The new data protection Bill, IT Rules, internet shutdowns and poor cybersecurity record seen together are ominous. The citizen, not government and Big Tech, should be at the centre of a healthy digital ecosystem.

Certainly since this millennium clocked in, India has had a romance with an idea of itself as an ‘IT nation’ – this is from the times when ‘Y2K’ was the world’s biggest digital problem. India’s software Business Process Outsourcing units or BPOs popularised the phrase ‘Bangalored out’ in the world. It was said that India would hog all the jobs from the West. India’s call-centres, the emergence of companies like Infosys and success of TCS, and legends that timetables for the London tube were drawn up in Bangalore were the stuff of TV soaps. Typical characters in The Big Bang Theory and Silicon Valley had distinct ‘Indian’ accents, they were geeks who knew their 0s from their 1s. At Cupertino in the canteen, Telugu is said to be the second-most popular language after English. Indian-origin persons heading several Big Tech ventures added to this ‘India is about digital’ mythology.

So then is it not natural for a ‘Vishwaguru’ nation to try and use this, like Yoga and Ayurveda, for purposes of publicity, market itself as a model for democracies for the best handling of data and the net?

It was at the end of last year that the first attempts to mine the G20 into an internal PR coup and spin a routine rotational presidency into a personalised, crowning glory moment for the Indian prime minister were put into motion. A different push, outward, of owning a term called ‘techade’, trying to get India to grab centrestage and be a model for how data and the digital world was organised, was also set in motion last winter.

Niti Aayog’s Amitabh Kant spoke in a style now perfected by the government, of double-speak mashing buzz words in vogue globally, but standing for the opposite (like the ‘Freedom of Religion Bills’ are designed to do the exact opposite). Kant spoke of the data “gold standard”, which he said “emphasises on nations to invest in self-evaluation of their data governance architecture, calls for modernisation of national data systems to incorporate citizen voice and preferences regularly, advances principles of transparency for data governance and finally brings to the forefront the need for strategic leadership on data for sustainable development”.

Serious limitations on handling data

India’s date with data and the digital ecosystem it is creating have serious limitations and, far from trying to be what the G20 should aspire to do, may well be an index of the opposite.

The latest Personal Data Protection Bill was brought in by the Union government – supposedly to protect citizen data – last year, when a parliamentary committee examined it and suggested several changes. But it was withdrawn abruptly without giving any reasons. A reinvented Bill was introduced this year and rushed through parliament. Bloomberg described it as “a boon for global enterprises such as Google and Meta, as it eases data flows and reduces their compliance burdens”. The Bill offers little protection for citizens, and exempts the biggest data fiduciary in the country, the government (and any other company it may decide to exempt, without having to cite reasons) from accountability. The Union minister misleadingly compared the Bill to EU’s landmark General Data Protection Regulation (GDPR). Claiming that the GDPR gives “16 exemptions”, he said that the DPDP Bill gives only “four exemptions”. But as was pointed out in the Tech Policy podcast by technology journalist Aditi Agrawal, “in India’s version of the Bill they’ve used commas. So, that’s why you have six listed exemptions. But, if you look at each of the sub-clauses, there are actually many more.”

Also read: Digital India Has Run Out of Freedoms

Privacy is the lens through which the task of protecting citizens’ data from misuse is framed in the GDPR. But in India, the shift from the first draft Bill that the Justice B.N. Srikrishna Committee put out in 2018, a year after the Supreme Court ruled on the right to privacy being a fundamental right, is drastic. The draft has seen at least five versions. The thrust is now on allowing government and companies the ease of mining citizens’ data. There is no independent data protection authority provided for. India’s deployment of facial recognition technology without proper consultation and the rampant use of cameras in public places makes it among the most surveilled and data-hungry systems in the world.

India’s cybersecurity record has been a cause of grave concern. Health data, regarded as the most sensitive, was leaked from COWIN, the government’s centralised portal for COVID-19 vaccines. A bot via Telegram is said to have been able to made public personal details like names, Aadhaar numbers and passport details upon entering phone numbers. Such break-ins were said to have happened at least thrice, though the last time in June got an acknowledgement this summer. The most worrying thing is that there is no process to address breaches or reveal who has been held accountable. There is no record of any investigation being carried out by CERT-In. Earlier this year, India’s premier medical institute, the All India Institute of Medical Sciences in Delhi, was down for 19 days as the system was hacked by cybercriminals and as the minister later admitted, one TB of encrypted data from the hospital taken. No process, follow up or confidence inducing measures. Again, no process established for the hacks or accountability.

There are other pieces that make for India’s ‘digital’ universe.

For a start, internet penetration in India is way behind the world penetration of 63%. It was 46% in 2021, which places it at rank 120 in the world, as per a Mint analysis.

The rules for social media and technology platforms, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which were firmed up in April this year, encompass websites of all kinds. They controversially and deliberately confuse government control with regulation. A ‘fact-checking unit’ of the Union government has the powers to decree anything online as not true and it can be taken down. A stand-up comedian, Kunal Kamra, as well as media bodies have challenged the rules and spoken of their power to silence voices. “They are following the diktat ‘Rome has spoken’ which implies that whatever the government speaks is final and no one has the right to express their views,” Kamra’s counsel argued in the Bombay high court.

Big Tech: Intimidated or happy to help?

Big Tech’s relationship with the Indian government must face serious scrutiny. WhatsApp has teamed up with a billionaire, the Ambanis, putting paid to any ideas Silicon Valley may have nursed about being seen as disruptive or with the average Joe. Meta’s inability to produce an honest report about fake news and hate speech in India and its impact have been written about in detail. The Washington Post has also run investigations about Big Tech feeling pressured to not take down posts they deem as harmful, false or spreading hate. “In India, where the Hindu-nationalist Bharatiya Janata Party — part of the coalition behind Modi’s political rise — deploys inflammatory rhetoric against the country’s Muslim minority, misinformation and hate speech can translate into real-life violence, making the stakes of these limited safety protocols particularly high,” it wrote in 2021.

Twitter’s founder, Jack Dorsey said in June that the Narendra Modi government made “many requests” to Twitter during the farmers’ protests for the deletion of content by journalists critical of official policy and also threatened to shut down Twitter in India and raid its employees’ homes. The IT minister dismissed his claims as baseless, but the very public sparring between government and Twitter in 2021 saw the police being deployed in two cities, and this is a matter of public record, as The Wire reported at the time.

Podcast: India Has Been the Leading Country in Internet Shutdowns for 5 Years. That’s Alarming.

The cyber-world being soaked with misinformation is something The Atlantic pointed to in 2019; “Many of India’s misinformation campaigns are developed and run by political parties with nationwide cyberarmies; they target not only political opponents, but also religious minorities and dissenting individuals, with propaganda rooted in domestic divisions and prejudices.” A Study by the Oxford Internet Institute of Oxford University found that “over a third of visual content (predominantly images) shared in BJP WhatsApp groups (34.5%) was “divisive and conspirational”, with the figure at 28.5% for the Congress”.

The internet and democracy

How societies and governments treat the internet is emerging as a shorthand for freedoms and the status of democracies, the world over. Much is written about how the digital world in China (firewalled), Iran (restricted) or Russia (bot farm-filled) is. But there is little scrutiny of India, as it tries to sell its digital payment infrastructure or its public digital infrastructure as elements the world should emulate.

But India is also the world’s internet shutdown capital. Last year, 45% of all internet shutdowns were in India. For the past five consecutive years, India has topped the global list of states that cut off the internet for their citizens. Manipur this time saw 100 days straight minus the internet, curbing information and also the rights of those seeking redress or help. Education and utilities suffer greatly too. In India, the casualness with which this is done must ring alarm bells about how the internet can be controlled.

In January, the Modi government was able to invoke ‘emergency powers’ to knock a BBC documentary on the Gujarat violence in 2002 which the prime minister presumably found unflattering off the internet, without giving any reasons or explanations.

That was only a sign or a symptom of the serious issues citizens of India face online. Far from a “gold standard”, India is writing a manual for digital authoritarians globally. How to dodge the worst of both worlds, an authoritarian government intent on surveillance as well as Big Tech as it draws each ‘data principal’ into its net, is among the biggest challenges Indians face today.

How Much Data Village and Ward Volunteers in Andhra Pradesh Collect From Voters

Compared to traditional censuses and surveys, the Andhra Pradesh government is collecting information continuously from its citizens, and on a wide range of aspects of their lives.

The village and ward volunteer system in Andhra Pradesh, launched by the YSR Congress Party (YSRCP) government in 2019, has come under attack from opposition parties, the Jana Sena Party and Telugu Desam Party (TDP).

TDP chief Chandrababu Naidu has alleged on multiple occasions that the volunteers (whose job is to provide last-mile governance and access to welfare schemes) are being used by the YSRCP to also conduct activities that benefit the party.

Now, Jana Sena chief Pawan Kalyan has alleged that the household level data of citizens collected by the volunteers, particularly that of welfare scheme beneficiaries, is being misused, and raised concerns of data security.

Naidu cautioned people about sharing personal information with volunteers, while Pawan Kalyan declared that his party would move court against the volunteer system to protect personal data and privacy.

“Volunteers are entering homes and collecting people’s personal information on the pretext of providing various benefits. They are even asking women if they suspect their husbands are having extramarital affairs. They are asking men what the women in their families are doing outside the home… Isn’t this wrong? Privacy [is important]… Why do they need our personal information?” Naidu asked on Friday, July 14, while flagging off a procession focused on women’s welfare at the TDP headquarters in Mangalagiri.

It’s unclear what kind of data inputs Naidu was talking about. However, information related to individuals’ sex and marital lives including number of sex partners, instances of polygamy, domestic violence and attitudes towards contraception, etc. are gathered as part of the National Family Health Survey conducted by the Union Ministry of Health and Family Welfare.

While village and ward volunteers are not involved in these surveys, as part of an education survey, volunteers were able to gather details of individuals’ marital status.

Also read: In Andhra Pradesh, Government Volunteers Are Mapping Every Voter Household

The recent controversy erupted after actor-politician Pawan Kalyan made the sensational claim that volunteers in Andhra Pradesh were surveilling residents and targeting women living alone, to hand them over to “anti-social forces” who were kidnapping them.

However, he has failed to furnish evidence to back these alarmist claims so far.

The National Crime Records Bureau (NCRB) figures that Pawan Kalyan cited for untraced missing women too are way above the official numbers for Andhra Pradesh. While he claimed that 17,000 to 18,000 missing women were untraced, as per NCRB figures for 2021, 474 minor girls and 2,711 adult women remained untraced in the state, including those reported missing in previous years.

Claims of human trafficking aside, concerns over misuse of citizens’ data gathered under e-governance initiatives aren’t new to Andhra Pradesh. Such large-scale comprehensive collection of socio-economic data was first carried out in the state in 2016, under the previous TDP government, in the name of the Andhra Pradesh Smart Pulse Survey conducted state-wide.

Surveyors carrying smartphones carried out an e-KYC (electronic Know Your Customer, a process by which a person’s identity and address are verified digitally with Aadhaar authentication) targeting nearly socio-economic data of 1.48 crore households in the state.

The survey entries were also matched with the State Resident Data Hub (SRDH), an Aadhaar-linked repository of citizens’ data, to create ‘360-degree profiles’ of residents.

Clusters of 50 households were first created as part of this survey, and a similar mechanism is now used by village and ward volunteers too. Under the Smart Pulse Survey, officials used an app to collect various data points of residents to build the Andhra Pradesh government’s ‘360-degree profile’ database on residents in the name of ePragati, an authority which enables e-governance for providing citizen services and welfare schemes.

Now, village and ward volunteers are using various state government apps, including the Grama Ward Sachivalayam Volunteer Mobile Application, to gather citizens’ data.

Here’s a look at the kind of data inputs sought by each of these apps, based on the mobile app code.

The following code shows the parameters collected as part of the Smart Pulse Survey. The information sought in the app used for this survey includes the individual’s occupation, address, phone number, Aadhaar number (UID), any agricultural vehicle owned, electricity bill, ration ID, their possessions including land, vehicle, refrigerator etc., whether they hold any government job, whether they pay income tax, etc.

This information became the foundation for deciding who should receive government welfare schemes. The information on income tax status, electricity consumption, land and vehicle ownership, having a government job etc. were used as the criteria for exclusion from government welfare schemes.

But the volunteer system is not just about welfare schemes. The data collected by village and ward volunteers is now used for day-to-day governance as well.

Volunteers have been roped in to carry out varied surveys related to COVID-19, education, health, livestock etc. usually carried out by individual departments for governance activities.

The volunteers use an app for these surveys, and code from the Grama Ward Sachivalayam Volunteer Mobile Application shows the kind of data they have been authorised to gather.

Each of the 50 (or more) households allocated to the volunteer are listed on the app, with the volunteers expected to re-verify the household details once every 6 months using Aadhaar e-KYC. Each household member’s information is collected with their name, household ID, Aadhaar number (UID), date of birth, mobile number, gender and door number.

The code also shows that the volunteers can use the app to find out who is the head of the household and which family members are living in the household.

The volunteers are also authorised to collect photos of the household members, geotagged with GPS location as part of these surveys.

The volunteers are also able to gather details of citizens’ religion, caste and even sub-caste.

As part of the education survey, the volunteers were able to gather details of individuals’ marital status along with other personal data already being collected.

The education survey collected the following details of individuals’ education and employment status – educational qualification, whether they know how to read and write, whether they have dropped out in the middle of their education and their reason for doing so.

During the COVID-19 pandemic, the volunteers were the agents of last-mile governance, identifying people’s health status, distributing masks and even identifying the vaccination status of individuals. These are the health parameters volunteers were expected to collect using their app – including information on various non-communicable diseases, HIV/AIDS status, pregnancy, etc.

This data is a lot more detailed than what was asked in the Union government apps designed for citizens – AarogyaSetu (for contact tracing and self-assessment) and CoWIN (for vaccination).

Earlier in June, a massive data breach came to light when the private information of lakhs of citizens who had used the CoWIN app to get their COVID-19 vaccine was leaked by a Telegram bot. Delhi police have arrested a man and his minor brother from Bihar over the data breach.

Also read: CoWIN Data Leak Is a Sign India Needs to Rethink its Digital Public Infrastructure Strategy

Beyond these surveys, volunteers were also authorised to collect information related to regular welfare services including distribution of ration, pension, insurance, etc.

As part of the state government’s activities to promote livelihoods for people with livestock, the volunteer app lists code to collect information on dairy animals — a livestock census of sorts.

The app also includes a questionnaire on local governance, on access to various civic services such as garbage collection, cleaning of roads and canals, water supply, functioning street lights etc.

There are more functions that are part of the app, which are primarily directed towards the state government’s welfare schemes such as Amma Vodi (financial incentive for mothers of school-going children), Manabadi Nadu Nedu (an infrastructure revamping scheme for schools), YSR Nethanna Nestham (financial incentive to handloom weavers), etc.

Apart from these, the app code suggests that the state government also collected information about the volunteers themselves, including the WhatsApp groups the volunteer is part of and whether the volunteer is reading a newspaper from the funds allocated for the same.

I am not trying to put out the entire code here, but just enough to show the kind of information that is being collected from only one app – the Grama Ward Sachivalayam Volunteer Mobile Application, out of numerous mobile applications used by various government departments and even citizens in Andhra Pradesh.

This is how the Andhra Pradesh government is collecting citizen’s data as part of their e-governance initiatives. Compared to a traditional census and survey, here the information is being collected continuously. There’s a lack of privacy that is guaranteed in anonymises census and statistical surveys, where only summarised data is shared with government departments.

Now, government departments have access to profiles of every individual with constant collection of personal data linked with their Aadhaar.

A major concern with such large-scale data collection is possible voter profiling – the fear that volunteers are possibly working on behalf of the YSRCP, tracking the different needs of people to target them during elections.

Ahead of the 2019 Assembly and Lok Sabha elections, the TDP itself was accused of data theft. A private firm called IT Grids which had developed the TDP’s official app Seva Mitra was booked for voter data theft, for allegedly stealing data related to Aadhaar, electoral rolls and beneficiaries of government schemes from the government database to help improve TDP’s election outcomes.

This article was first published in The News Minute under Creative Commons Attribution – No Derivatives 4.0 International (CC BY-ND 4.0). Read the original article here.

Proposed Amendments to the Registration of Births and Deaths Act Are Crafty and Underhanded

Beyond the surveillance-minded nature of the proposed amendments, the most concerning part is the issue of birth certificates becoming as mandatory as Aadhaar for voter identities.

The Registration of Births and Deaths Act 1969 is a simple law that was brought for registration of births and deaths in the country.

With new amendments, the Ministry of Home Affairs is proposing to make Aadhaar mandatory to track new births and deaths in any family. It is proposing to build a database of births and deaths and use it to update every other database in the government, from the National Population Register, to voter rolls, and the databases of ration card, passport, driving licence and Aadhaar.

The move will essentially track every Indian human across their lifetime from birth to death.

The Bill proposes to also make birth certificates mandatory for joining schools, registration of votes, marriages, issuance of passports, in applications for government jobs and for pretty much anything else the Ministry of Home Affairs wants. This is going to make Indians stand in queues the same way they did because of Aadhaar.

The proposed amendments to this 50-year-old law will turn a simple state exercise into a population controlling mechanism that can be used against every citizen. Every individual has the right to documentation, a birth certificate or other forms of identification which they need to lead a dignified life. History shows us this simple yet transformative exercise can be weaponised and used to identify populations that are different and non-conformative.

The National Intelligence Grid (NATGRID) was proposed with the idea of interlinking databases across the government’s branches for surveillance of the population. While the proposal existed, without the Aadhaar project, inter-linking of databases and accessing real-time information on Indians was a challenge. Aadhaar solved this for the Union home ministry and it pushed the surveillance capacity of the state at population scale. This has been a major point of contention with Aadhaar and its associated projects including National Population Register and National Register of Citizens.

The linking of databases and creation of 360° profiles using Aadhaar has always been an issue that was challenged in courts, with the Supreme Court agreeing and recognising Indians’ fundamental right to privacy. While the Supreme Court duly noted reasonable restrictions on various grounds like national security do apply. A lack of a privacy law or surveillance law has ignored any form of accountability on the executive. The upcoming Digital Personal Data Protection Bill 2023 also gives complete exemptions to the executive on data collection.

The very idea of these linking databases automatically allows the Ministry of Home Affairs to use information submitted for a specific purpose to be used for a secondary purpose. The purpose of birth certificates is at best is to prove nationality and at worst to prove lineage to a parent. The weaponization of this information without clearly bringing in any surveillance reform is an illegitimate act by the Ministry of Home Affairs.

Also read: The Union Govt Is Yet to Release Data on Births and Deaths for 2021. Here’s What We Are Missing

It is odd that the government thinks mass surveillance of the entire population will somehow help secure our country.

The Aadhaar project has only shown that large databases are full of noise with fraudulent data entries. The promise of biometrics and birth certificates helping bring security is a myth. Especially when the state has no clue how to control our borders and is unable to deal with the Manipur crisis while ordering the collection of biometrics of any potential foreigner.

This linking of databases and their effects can easily be seen in southern states of Telangana and Andhra Pradesh, where the push for real-time governance has allowed the government to track residents from birth to death. There is active opposition for this set-up in Andhra Pradesh with political parties questioning the scale of data collection as part of real-time governance. The real-time policing in Telangana shows how all the information collected for welfare is being shared to police for real-time surveillance.

Also read: What Khadeer Khan’s Death Says About Telangana Police’s ‘Tech Revolution’

Beyond the surveillance-minded nature of this entire setup, the most concerning part is the issue of birth certificates becoming as mandatory as Aadhaar for voter ID. This has serious consequences for electoral democracy. The creation of 360° profiles with Aadhaar and linking it with the voter ID has already affected elections with how political parties can micro-target voters and delete voters from electoral rolls. Not only does it make us vulnerable to electoral fraud, it also centralises the management of electoral rolls using Aadhaar and birth certificates. It will also lead to exclusion of voters causing challenges with representation mostly among marginalised.

Several of these issues were not clarified by the Supreme Court during the Aadhaar judgement and are likely to come back to the court in future.

While this Bill puts in place a mechanism to continuously collect information from individuals, it needs to be noted that the government still has to carry out large scale data collection drives to update this entire set-up. The Census 2021 whenever it happens will be the place where the Ministry of Home Affairs will push for the implementation of this setup. It is to be noted that the Census Act does not allow any data sharing, while the present draft promotes data sharing across government departments.

This proliferation of personal data across several departments is bound to leak and also cause unforeseen challenges that were similarly anticipated with Aadhaar. This bill, whether it is passed or not, does not stop the continuous expansion of personal data collection. This entire 360° profile setup to track us from birth to death has always been the foundation that Aadhaar was being built on and for.

This Bill, although it looks simple with mere changes to registration of births and deaths, has the potential to completely modify the relationship between an individual and the state. The Bill is expected to be pushed through the parliament this session, no matter the opposition. A vast majority of Indians might simply comply with this the same way they were forced to comply with Aadhaar. The present political conditions do not allow for any form of serious discussion on this Bill even outside the parliament.

As much as one should be afraid of the surveillance state, the lack of capacity inside the state makes me wonder how long they will continue to push this without no opposition from the population.

Srinivas Kodali is a researcher on digitisation and hacktivist.