8878 - Forget about Aadhaar, look at what Facebook’s doing

Forget about Aadhaar, look at what Facebook’s doing

While the European Court of Justice has just delivered a verdict on privacy that should cheer the hearts of the anti-Aadhaar brigade – it has scrapped the ‘Safe Harbor Agreement’ between the US and EU – the origins of the case should chill them.

By: Sarthak Ray | New Delhi | October 8, 2015 7:08 PM

All those worried about the possible invasion of their privacy under Aadhaar would do well to keep in mind social media sites like Facebook – India has 11 crore users of Facebook – or Google for that matter, have a lot more information about them, where they hang out, their likes, dislikes, and the lot.

While the European Court of Justice (ECJ) has just delivered a verdict on privacy that should cheer the hearts of the anti-Aadhaar brigade – it has scrapped the ‘Safe Harbor Agreement’ between the US and EU – the origins of the case should chill them. The case stems from an Austrian law student, Maximilian (Max) Schrems experience with Facebook in 2011 – when Max asked Facebook for the data it had on him, to his horror he was given 1,200 pages of data including certain bits he had deleted!

So all those worried about the possible invasion of their privacy under Aadhaar would do well to keep in mind social media sites like Facebook – India has 11 crore users of Facebook – or Google for that matter, have a lot more information about them, where they hang out, their likes, dislikes, and the lot. While this is not to say India should not have a privacy law, keep in mind Aadhaar officials aver their database is not an invasion of privacy since it cannot be queried on any transaction details of users, it merely authenticates biometrics on request. Hopefully, this will be proved to the Supreme Court which will be hearing the matter soon.

Max heard an official of the Facebook legal team speak about Facebook’s compliance with EU privacy laws as tenable under the UE-EU ‘Safe Harbor Agreement’. Convinced that ‘Safe Harbor’ allowed the social media giant to circumvent EU’s much stricter data protection laws, Schrems asked the company to submit all the data it held about him (he remains a Facebook user to date, as also having a Twitter presence) in 2011.

Schrems then approached Ireland’s data regulator, the Irish Data Commissioner — Facebook’s European headquarters are in Dublin — to get Facebook to stop sending data to the US, saying that the country did not provide sufficient safeguards for user data; he based this inference on the Edward Snowden leaks on the NSA’s Prism programme that allowed the surveillance agency to directly access information from Facebook, Microsoft, Google and other digital companies. But the case was thrown out by the data regulator as “frivolous and vexatious”, in the backdrop of the Safe Harbor agreement. Upon appeal in the European Court of Justice, however, Schrems’ argument was upheld. Europe’s highest court also found the Safe Harbor framework itself to be in violation of the Union’s and some member countries’ strict privacy laws. As per the agreement, US firms listed under the Safe Harbor framework could transfer EU citizens’ data to the US — while remaining consistent with the EU Data Protection Directive — by providing a self-certification to the US department of commerce that they are compliant with the EU privacy protection standards. The enforcement of the certification was left with the US Federal Trade Commission.

Essentially, the agreement set a US watchdog to check if American tech companies were sticking to European laws on privacy with respect to EU users. Safe Harbor-listed firms (including those tagged “not current” or no longer assured the benefits of Safe Harbor) include the usual suspects like Facebook, Google, Twitter and other firms handling sensitive information like 67 accounting firms (including the likes of Grant Thornton), 242 financial services firms and 60 insurance firms (including MetLife, Inc and all its US subsidiaries listed as a single party). There are 5,479 US firms, spanning industries from advertising services to defence equipment, lawn and garden equipment to veterinary equipment and supplies in this list.

First Published on October 08, 2015 7:08 pm

7692 - TECH COMPANIES CALL ON US TO END BULK COLLECTION OF METADATA

TECH COMPANIES CALL ON US TO END BULK COLLECTION OF METADATA

Tech Companies Call on US to End Bulk Collection of Metadata

By Fred O'Connor, 27-Mar-2015

A slew of tech companies have joined privacy groups in calling for the U.S. government to reform its surveillance practices.

An open letter from the tech industry and privacy organizations urges the government to not renew the provision in the Patriot Act that allows for the bulk collection of metadata. That provision, called Section 215, expires in June.

"There must be a clear, strong, and effective end to bulk collection practices," reads the letter, which was signed by the industry group Reform Government Surveillance, whose members include including Apple, Facebook, Google, Evernote, Twitter and Microsoft. Any data collection efforts need to protect user rights and privacy, the letter said.

The issue stems from the bulk collection of metadata, like the length and time of phone calls, by U.S. intelligence groups including the National Security Agency. In 2013 former NSA contractor Edward Snowden released documents that showed the NSA was gathering this information from millions of phone calls.

"Nearly two years after government surveillance revelations came to light, the U.S. Government still has unfinished business to reduce the technology trust deficit it has created," said Fred Humphries, Microsoft's vice president of U.S. government affairs, in a blog post.

Attempts by Congress to reform the country's surveillance programs have so far failed. In November, the Senate voted against a bill that would have reined in the NSA's ability to collect telephone records in bulk.

On Monday, a spokesman for President Barack Obama's National Security Council told Reuters that the administration will stop the bulk data collection if Congress fails to reauthorize it. The administration, however, wants Congress to enact legislation allowing the collection to continue, saying that Section 215 is "a critical national security tool" that has uses besides bulk data collection.

Fred O'Connor writes about IT careers and health IT for The IDG News Service. Follow Fred on Twitter at @fredjoconnor. Fred's e-mail address is fred_o'connor@idg.com

7691 - Australia passes data retention bill amid privacy abuse concerns - Economic Times

Australia passes data retention bill amid privacy abuse concerns

AFP Mar 26, 2015, 03.36PM IST

SYDNEY: Australia's upper house Thursday passed a controversial law requiring telecommunication firms to retain customers' digital data for two years as part of a range of counter-terrorism measures, despite fears by privacy advocates of abuse.

The law was passed with the support of the Labor opposition, and received 43 votes in favour with 16 votes against. It was passed by the lower House of Representatives last week.

The Liberal-National coalition government said the legislation was a central tool for law enforcement and intelligence agencies in their fight against terrorism.

"By passing this Bill, the parliament has ensured that our security and law enforcement agencies will continue to have access to the information they need to do their jobs," Attorney-General George Brandis and Communications Minister Malcolm Turnbull said in a joint statement.

"No responsible government can sit by while those who protect us lose access to vital information, particularly in the current high threat environment."

Australian Prime Minister Tony Abbott earlier Thursday did not say how much it would cost to implement the law but added his conservative government would make "an appropriate upfront contribution to the cost" to the telecommunications industry.

The data retention legislation has been slammed by privacy advocates, who say Australians would be vulnerable to the misuse of their personal or private information by the nation's security agencies.

The opposition Greens party, which voted against the bill in the Senate, described the law as "a form of mass surveillance".

"Surveillance should be targeted, proportionate and levelled at serious criminals, organised crime and national security threats. This bill entrenches the opposite," Greens Senator Scott Ludlam said in a statement after the bill was passed.

"The government won't disclose the costs of the scheme, is silent on the risk of unauthorised disclosure, and at no stage has been able to point to evidence that collecting the private records of 23 million non-suspects will keep people safer or reduce the crime rate," he said.

The law has also been criticised as impinging on press freedom, a charge refuted by Brandis and Turnbull who said the government had incorporated several protections for journalists.

"The bill contains new and strengthened safeguards... no comparable nations will have greater pre-authorisation approval and post-authorisation oversight requirements for journalists," they said.

Abbott last month warned of a long era of heightened threats from "home-grown" extremists and announced new security measures including revoking citizenship for dual-nationals linked to terrorism.

Canberra raised its threat level to high in September and has since carried out a series of raids amid alarm over the departure of some 90 of its nationals to Iraq and Syria to fight with jihadist groups.

In December, Man Haron Monis -- a gunman with a history of extremist views -- took 17 people hostage at Sydney cafe. Two hostages were killed in the hours-long seige, one by Monis and the other by a ricocheting bullet when police stormed the building.

7690 - The NYPD's newest technology may end up recording conversations - Business Insider

The NYPD's newest technology may end up recording conversations

CALE GUTHRIE WEISSMAN0MAR 26, 2015, 07.23 PM

Andrew Burton/Getty Images

ShotSpotter detects the sound of a gunfire and sends the location to local authorities.

The NYPD's latest anti-crime program may be more invasive than it seems. Called ShotSpotter, this technology claims to help police reduce gun violence by monitoring public streets for loud noises. The problem is: ShotSpotter may also be able to record conversations, Fusion reports.

The company has adamantly maintained that it is not a voice surveillance device, but others aren't so sure.

"There is clear evidence that ShotSpotter can record conversations,"Electronic Frontier Foundation activist Nadia Kayyali told Business Insider.

While ShotSpotter admits that these cases happen, it emphasizes that they are exceptional. It only collects noises that happen at exactly the time of the blast, according to CEO Ralph A. Clark.

"The system basically truncates the noise; two seconds before, maybe three seconds after," Clark explained to Business Insider. He went on to emphasize that ShotSpotter's technology does not live-stream.

"The technology is not capable of doing any online real-time streaming," he said.

Privacy concerns over ShotSpotter, however, may still start to bubble up in New York, which is piloting a $1.5 million project to test the on-the-street equipment.

"This gunshot detection system is going to do a world of good in terms of going after the bad guys," New York City Mayor Bill de Blasio said when announcing the initiative. Beginning this week, the NYPD will install 300 ShotSpotter microphones in both Brooklyn and the Bronx.

ShotSpotter, which has been used by public authorities for over a decade, is used in over 90 US cities, including Oakland, Newark, Miami, and Worcester. It works by installing sensors that are activated when loud noises are registered. If ShotSpotter hears what it thinks is a gunshot (a loud noise that is registered by three nearby sensors and then confirmed by an internal team), it notifies both the police and its database of the location. The problem, as Fusion reports, is ShotSpotter's program may stand in the way of the some citizens' Fourth Amendment rights.

The cases when ShotSpotter data was used in court present a unique privacy conundrum. 37-year-old Oakland resident Tyrone Lyles's last words were, "Why you done me like that R? R, why you do me like that dude?" Those last moments were recorded and sent to the authorities via ShotSpotter. The recordings were used as evidence to convict Arliton Johnson, Lyles' shooter, of first-degree murder.

Similarly, in New Bedford, Connecticut, a man named Michael Pina yelled "No, Jason! No, Jason!" in 2012 after being shot. Nearby sensors heard his cries, recorded them, and hurled authorities into action. Police then arrested and convicted two men in connection with Pina's murder.

While the merits of determining a gunfire's location seem obvious, ShotSpotter has led to some unintended consequences. In both of the aforementioned cases, ShotSpotter picked up the dying words of these men, and these recordings were subsequently used as evidence in a court of law. This indicates that the company's technology, while intended to merely record loud blasts, has the potential to be a privacy nightmare. Oakland, which has had a contract with the company since 2006, has been debating its use for years now. The Northern California city alone has used the sensors' recordings of human voices as evidence twice.

ShotSpotter claims that its sensors are "specifically designed to be triggered by loud explosive or 'impulsive' sounds only" and that recordings of voices are purely incidental. "The entire system is internally designed not to allow 'live listening' of any sort," the company writes in itsprivacy policy. And when the devices do transmit live audio the recordings only last a few seconds. This does not constitute surveillance, in its eyes.

In his conversation with Business Insider, ShotSpotter 

CEO Clark went on about the specific cases when his company's audio has been used. "Conversations were not recorded," he said. "[There were] people shouting just before or just after a felony." And these cases, he emphasized, have happened fewer than five times out of the millions of impulses that ShotSpotter's sensors have picked up in the last 20 years.

At the same time, the duration of the sensors' recordings were deemed long enough to help identify suspects. This could create a Fourth Amendment problem. Is it enough that ShotSpotter's intention isn't to record voices when it has been used to do just that?

"Of course there are audio sensors that are constantly recording," Oakland Police Captain Ersie M Joyner III said to the Oakland Public Safety Committee last year. "It takes a loud bang to activate the sensors to start recording."

Shotspotter.com

ShotSpotter picks up audio as well as gunshot noises, which could violate 4th amendment rights.

ShotSpotter's critics see a breakdown in what it says it does and what has been done. It's important that communities installing the program know precisely what it does because of the evidence that it can record conversations, according to Kayyali.

"The representations [to communities] need to be accurate," she added.

Another criticism of ShotSpotter is that it may not even be effective. New York City's Public Advocate Letitia James cites the National Institute of Justice, which claims ShotSpotter "accurately detected 80% of test shots." This statistic, however, dates back to 1999. Newer data from Newark show it's less accurate. The New Jersey city has been installing sensors since 2007 and false positives have reportedly been rampant. Between 2010 and 2013, "75% of the gunshot alerts have been false alarms," WNYC reports.

In regards to false positive statistics, Clark said that his company has spent the last five years improving its technology to send out better, more correct reports to authorities.

"We're amazingly good at what we do," he said to Business Insider. "We're not perfect but we strive for perfection."

New York, for its part, is trying to be transparent with how it uses ShotSpotter. Public Advocate James introduced legislation last week that would require the NYPD to provide detailed reports about data collected throughout the year.

"The information that can be gathered from ShotSpotter is critical in helping police respond faster to incidents involving gunshots," said James in her office's press release. "We must also ensure that this technology is used transparently."

Business Insider reached out to James's office about the program's privacy concerns. "ShotSpotter has proven to detect gunfire at impressive rates and I support any measure that helps reduce violence in our communities," she emailed to us in statement. "My office has been in contact with ShotSpotter, and they have assured us they are working to address the issues raised regarding privacy concerns."

Still, regulatory oversight remains woefully behind the times as shiny new devices roll out. Kayyali put it plainly saying, "the law has not caught up."

Clark, though, said he's happy that the conversation about privacy is happening. He maintains that ShotSpotter is anything but a surveillance device, but that new technologies come with certain trade-offs.

"People should be asking [these questions]," he said.

3441 - Has India set up its own surveillance system to tap calls, emails? - First Post

Has India set up its own surveillance system to tap calls, emails?

53 mins ago

 By Anurag Kotoky/Reuters

India has launched a wide-ranging surveillance program that will give its security agencies and even income tax officials the ability to tap directly into e-mails and phone calls without oversight by courts or parliament, several sources said.

The expanded surveillance in the world’s most populous democracy, which the government says will help safeguard national security, has alarmed privacy advocates at a time when allegations of massive US digital snooping beyond American shores has set off a global furor.

“If India doesn’t want to look like an authoritarian regime, it needs to be transparent about who will be authorised to collect data, what data will be collected, how it will be used, and how the right to privacy will be protected,” said Cynthia Wong, an Internet researcher at New York-based Human Rights Watch.

The Central Monitoring System (CMS) was announced in 2011 but there has been no public debate and the government has said little about how it will work or how it will ensure that the system is not abused.

The government started to quietly roll the system out state by state in April this year, according to government officials. Eventually it will be able to target any of India’s 900 million landline and mobile phone subscribers and 120 million Internet users.

Interior ministry spokesman KS Dhatwalia said he did not have details of CMS and therefore could not comment on the privacy concerns. A spokeswoman for the telecommunications ministry, which will oversee CMS, did not respond to queries.

Indian officials said making details of the project public would limit its effectiveness as a clandestine intelligence-gathering tool.

Representational Image. Reuters

“Security of the country is very important. All countries have these surveillance programs,” said a senior telecommunications ministry official, defending the need for a large-scale eavesdropping system like CMS.

“You can see terrorists getting caught, you see crimes being stopped. You need surveillance. This is to protect you and your country,” said the official, who is directly involved in setting up the project. He did not want to be identified because of the sensitivity of the subject.

NO INDEPENDENT OVERSIGHT

The new system will allow the government to listen to and tape phone conversations, read e-mails and text messages, monitor posts on Facebook, Twitter or LinkedIn and track searches on Google of selected targets, according to interviews with two other officials involved in setting up the new surveillance program, human rights activists and cyber experts.

In 2012, India sent in 4,750 requests to Google Inc for user data, the highest in the world after the United States.

Security agencies will no longer need to seek a court order for surveillance or depend, as they do now, on Internet or telephone service providers to give them the data, the government officials said.

Government intercept data servers are being built on the premises of private telecommunications firms. These will allow the government to tap into communications at will without telling the service providers, according to the officials and public documents.

The top bureaucrat in the federal interior ministry and his state-level deputies will have the power to approve requests for surveillance of specific phone numbers, e-mails or social media accounts, the government officials said.

While it is not unusual for governments to have equipment at telecommunication companies and service providers, they are usually required to submit warrants or be subject to other forms of independent oversight.

“Bypassing courts is really very dangerous and can be easily misused,” said Pawan Sinha, who teaches human rights at Delhi University. In most countries in Europe and in the United States, security agencies were obliged to seek court approval or had to function with legal oversight, he said.

The senior telecommunications ministry official dismissed suggestions that India’s system could be open to abuse.

“The home secretary has to have some substantial intelligence input to approve any kind of call tapping or call monitoring. He is not going to randomly decide to tape anybody’s phone calls,” he said.

“If at all the government reads your e-mails, or taps your phone, that will be done for a good reason. It is not invading your privacy, it is protecting you and your country,” he said.

The government has arrested people in the past for critical social media posts although there have been no prosecutions.

In 2010, India’s Outlook news magazine accused intelligence officials of tapping telephone calls of several politicians, including a government minister. The accusations were never proven, but led to a political uproar.

NO PRIVACY LAW

“The many abuses of phone tapping make clear that that is not a good way to organize the system of checks and balances,” said Anja Kovacs, a fellow at the New Delhi-based Centre for Internet and Society.

“When similar rules are used for even more extensive monitoring and surveillance, as seems to be the case with CMS, the dangers of abuse and their implications for individuals are even bigger.”

Nine government agencies will be authorised to make intercept requests, including the Central Bureau of Investigation (CBI), India’s elite policy agency, the Intelligence Bureau (IB), the domestic spy agency, and the income tax department.

India does not have a formal privacy law and the new surveillance system will operate under the Indian Telegraph Act – a law formulated by the British in 1885 – which gives the government freedom to monitor private conversations.

“We are obligated by law to give access to our networks to every legal enforcement agency,” said Rajan Mathews, director general of the Cellular Operators Association of India.

Telecommunications companies Bharti Airtel, Vodafone’s India unit, Idea Cellular, Tata Communications and state-run MTNL did not respond to requests for comment.

India has a long history of violence by separatist groups and other militants within its borders. More than one third of India’s 670 districts are affected by such violence, according to the South Asia Terrorism Portal.

The government has escalated efforts to monitor the activities of militant groups since a Pakistan-based militant squad rampaged through Mumbai in 2008, killing 166 people. Monitoring of telephones and the Internet are part of the surveillance.

India’s junior minister for information technology, Milind Deora, said the new data collection system would actually improve citizens’ privacy because telecommunications companies would no longer be directly involved in the surveillance – only government officials would.

“The mobile company will have no knowledge about whose phone conversation is being intercepted”, Deora told a Google Hangout, an online forum, earlier this month.

Reuters

3318 - Privacy for the Other 5 Billion

Privacy for the Other 5 Billion

Western-backed biometrics programs for the developing world could put data in the wrong hands.

By Kevin P. Donovan and Carly Nyst

Posted Friday, May 17, 2013, at 11:51 AM

An Indian villager looks at an iris scanner for a pilot project of the Unique Identification Authority of India, or UIDAI, in the village of Chellur, northwest of Bangalore, on April 22, 2010.

Photo by Dibyangshu Sarkar/AFP/Getty Images

Move over, mobile phones. There’s a new technological fix for poverty: biometric identification. Speaking at the World Bank on April 24, Nandan Nilekani, director of India’s universal identification scheme, promised that the project will be “transformational.” It “uses the most sophisticated technology … to solve the most basic of development challenges.” The massive ambition, known as Aadhaar, aims to capture fingerprints, photographs, and iris scans of 1.2 billion residents, with the assumption that a national identification program will be a key ingredient to “empower poor and underprivileged residents.” The World Bank’s president, Jim Yong Kim, effusively summed up the promise as “just stunning.”

Although few can match Nilekani’s grand scale, Aadhaar is but one example of the development sector’s growing fascination with technologies for registering, identifying, and monitoring citizens. Systems that would be controversial—if not outright rejected—in the West because of the threat they pose to civil liberties are being implemented in many developing countries, often with the support of Western donors. The twin goals of development and security are being used to justify a bewildering array of initiatives, including British-funded biometric voting technology in Sierra Leone, U.N. surveillance drones in the Democratic Republic of the Congo, and biometric border controls in Ghana supported by the World Bank.

This vigorous adoption of technologies for collecting, processing, tracking, profiling, and managing personal data—in short, surveillance technologies—risks centralizing an increasing amount of power in the hands of government authorities, often in places where democratic safeguards and civil society watchdogs are limited. While these initiatives may be justified in certain cases, rarely are they subject to a rigorous assessment of their effects on civil liberties or political dissent. On the contrary, they often seek to exploit the lack of scrutiny: Nilekani recommended in another recent speech that biometric proponents work “quickly and quietly” before opposition can form. The sensitivity of the information gathered in aid programs is not lost on intelligence agencies: Pulitzer Prize-winning journalist Mark Mazzetti recently revealed that the Pentagon funded a food aid program in Somalia for the express purpose of gathering details on the local population. Even legitimate aid programs now maintain massive databases of personal information, from household names and locations to biometric information. 

Humanitarian organizations, development funders, and governments have a responsibility to critically assess these new forms of surveillance, consult widely, and implement safeguards such as data protection, judicial oversight, and the highest levels of security. In much of the world, these sorts of precautions are sorely lacking: For example, despite the success of information technology in Africa, only 10 countries on the continent have some form of data protection law on the books (and even those rarely have the capacity or will to enforce them).

Kenya is a good example of how these programs can go wrong. In the country’s recent election, a costly biometric voting scheme flopped, adding widespread uncertainty to an already fragile situation. The problems were manifold, from biometric scanners that couldn’t recognize thumbprints to batteries that failed and servers that crashed. As journalist Michela Wrong put it, “almost none of it worked.” With limited resources, why support expensive and often ineffective technologies like biometric voting when traditional systems often suffice? 

While biometrics could help clean up electoral rolls, they may very well serve to obfuscate the electoral process, as information is passed through proprietary applications and technologies, closed to public scrutiny and audit.

But the worries in Kenya extend beyond technological failure. Like many low-income countries, Kenya has historically lacked a robust program of birth registration, making public health work notoriously difficult. It also stymies the provision of education services and cash transfers to vulnerable populations. To rectify this, the Kenyan state has sought to enroll all adults in a biometric national identification scheme that aims to interoperate with various other databases, including the tax authority, financial institutions, and social security programs. According to the director of this Integrated Population Registration System, George Anyango, the government now has “the 360 degree view of any citizen above the age of 18 years.” The Orwellian language is particularly worrisome given Kenya’s lack of data protection requirements and history of political factionalism, including the ethnic violence in the aftermath of the 2007 election that resulted in the death of more than 1,000 Kenyans.

The Aadhaar project in India—a country with a history of ethnic unrest and social segregation, widespread political and bureaucratic corruption, and with no effective legislative protection of privacy—should raise similar, magnified fears. Furthermore, it’s doubtful the program could help bring about the social equality it promises. Proponents of these state registration schemes argue that a lack of ID is a key reason why the poor remain marginalized, but they risk misdiagnosing the symptom for the cause. The poor are marginalized not simply because they lack an ID, but rather because of a complex history of discriminatory political, economic, and social structures. In some cases a biometric identity scheme may alter those, but only if coupled with broader, more difficult reforms.

One of Aadhaar’s biggest promises is the opportunity to open bank accounts (which require identification). Yet, poor, marginalized Indians, even with an ID, find formal banks to be unfriendly and difficult to join. For example, the anthropologist Ursula Rao found that the homeless in India—even after registering for Aadhaar—were blocked from banking, most frequently for lack of proper addresses, but more fundamentally because, as she notes, biometric identification “cannot establish trust, teach the logic of banking, or provide incentives for investing in the formal economy.” Bank managers remain suspicious and exclusionary, even if an identity project is inclusive. Without broader reforms—including rules for who may or may not access identity details—novel identification infrastructures will become tools of age-old discrimination.

Another, more practical drawback is that biometric technology is particularly ill-suited for individuals who have spent years in manual labor, working in tough conditions where their fingerprints wear down or they may even lose full fingers or limbs. Even with small authentication error rates—say, the 1.7 percent that recent estimates from Aadhaar suggest—the number of failures in a population the size of India’s can be enormous. Aadhaar has already enrolled 240 million people, with plans to reach all residents. You do the math.

The growth of these systems is due in part to the lack of public education and consultation, as well as the paucity of technical expertise to advise on the risks and pitfalls of surveillance technologies. But certainly the international donors and humanitarian organizations that support these initiatives have a responsibility to critically assess and build in safeguards for these technologies. Given the enormity of the challenge facing these organizations, it is perhaps easy not to prioritize issues like privacy and security of personal data, but the same arguments were once made against gender considerations and environmental protections in development. Aid programs that involve databases of personal information—especially of those most vulnerable and marginalized—must adopt stringent policies and practices relating to the collection, use, and sharing of that data. Best practices should include privacy impact assessments and consider the scope for “privacy by design” methodologies.

As the rhetoric around Aadhaar makes clear, the promise of a quick technical solution to intractable social problems is alive and well. However, it is time to recognize that human development involves the protection of civil liberties and individual freedoms, and not blindly rush into the creation of surveillance states in the name of development and poverty alleviation. Donors and aid organizations need to remember that the other 5 billion deserve privacy, too.

3230 - The Aadhar Card - How Safe Is My Data?

The Aadhar Card - How Safe Is My Data?

Thursday, Apr 11, 2013, 0:56 IST

Berges Malu  

Applying for an Aadhar Card is a privacy nightmare.

The need for me to have an Aadhar card continues to have me flummoxed. But after a lot of cajoling from my parents and friends, I decided to go ahead and apply for a card at an enrollment camp that was set up at the University I study at. What I experienced has left me a wee bit stunned on how and what exactly our government that is well known more for its goof ups than its successes has rolled up their sleeve for Aadhar cardholders and how they plan to keep this entire mammoth machinery running.

Thankfully unlike the royal run around I was made to go through for my passport, the process to get my Aadhar card was an absolute breeze.  My companion and I deposited our forms in the morning, got a token number and in the evening we headed over to the enrollment center, stood in a rather short queue and were out with a smile about 15 minutes later. But while the process was a breeze and I had no complaints about the promptness of the entire process, how my data was handle left me questioning the entire identification process.

To start with, the agent there, never once took a look at the copies of documents I was submitting as proof of identity. He only checked it, to confirm my father’s name. He never bothered to check if the documents were indeed true copies or just well made out photo-shopped documents, and he never asked to see the originals. He didn’t bother to ask me if I wanted to link my Aadhar card to an existing bank account and thankfully on his own never ticked the part about my information being shared to other authorities.

He then went on to dump these loosely stapled bunch of documents into a carton that I have no clue was headed where. Here was a pile of very valuable personal data, that included everything from my date of birth, address, educational qualifications and I had no clue what was to happen of it. One needn’t worry about what the government would do with the data fed into the system, its what could happen to the hard information that was in this carton, almost every bit of our lives was ready for an identity thief to come by and pick up.

A recent article in MiDDAY (http://goo.gl/ZL5WG) reported that copies of the compulsory documents that were submitted by residents in a Mumbai colony as proof of identity etc as well as hard copies of the forms, were left behind by the agency that filed the data and no one had picked it up. This after the residents had already received their Aadhar cards.

What I also noticed was, of the two agents stationed at the enrollment center, the woman (who managed the enrollment of women) didn’t speak a word of either English or Hindi, she only spoke Telugu, while the enrollment of data is done in English. Now while there is nothing wrong in speaking only the language of your state (and God knows how big a proponent I am of every citizen living in Maharashtra learning Marathi), entering in data of individuals in a language other than your is surely not your best forte, and as was bound to happen, almost every woman who went over was locked in a battle with her trying to get her to correct the umpteen goof ups she made.  Makes me wonder why I shouldn’t be surprised that many Aadhar cards are turning up with images of Trees, dogs and other pets as was reported recently? (http://goo.gl/tCUgG)

Which left me wondering, if my data at primary source is being dealt with in such a lackadaisical manner, what would happen once it reaches the government and how careful will they be with all of this? 

2983 - Google Says Electronic Snooping by Governments Should Be More Difficult

Google Says Electronic Snooping by Governments Should Be More Difficult

By CLAIRE CAIN MILLER

If a government wants to peek into your Web-based e-mail account, it is surprisingly easy, most of the time not even requiring a judge's approval.

That is a problem, according to Google, which said it had received 21,389 requests for information about 33,634 of its users in the second half of last year, an increase of 70 percent in three years. Google handed over some personal data in two-thirds of those cases.

The vast majority of the requests came from the United States government. In the last six months, United States officials made 8,438 requests for data, and Google complied with at least part of the request 88 percent of the time. (One of those, most likely, was for access to the Gmail account of Paula Broadwell, which ultimately revealed her affair with David H. Petraeus, formerly C.I.A. director.)

To mark Data Privacy Day on Monday (a holiday that, no doubt, you have highlighted on your calendar in eager anticipation), Google is trying to rally support against broad government access to personal online data.

"We want to be sure we're taking our responsibilities really seriously, protecting our users' information and being transparent about it," David Drummond, Google's chief legal officer, said in a rare interview.

"We want people to know that we are not going to just roll over but we are going to make sure that governments around the world follow standards and do this in a reasonable way that strikes the balance," he added.

The heart of the issue is that the law grants more protection to a piece of paper on your desk than it does to an e-mail stored online. The Electronic Communications Privacy Act was enacted in 1986, years before widespread use of e-mail or cloud storage, or the invention of social networking.

"People probably assume that all their communications, whether it's physical letters or phone calls or e-mails, are protected by the Fourth Amendment and the police have to go to a judge to get a warrant," said Trevor Timm, a privacy advocate studying surveillance at the Electronic Frontier Foundation. "In fact, that's not the case."

For instance, the law says the police do not need a search warrant, which requires a judge to agree there is probable cause, to read e-mail messages that are more than 180 days old.

Congress is expected to consider amendments to the 1986 law this year. Meanwhile, the Obama administration has been pushing for Web companies to allow easier electronic wiretapping.

In the United States, 68 percent of requests for Google users' information come in the form of subpoenas, which do not require a judge's approval. The rest are search warrants or other types of court orders.

Google said it had been fighting the broad use of subpoenas by requiring search warrants for detailed personal data -- beyond things like a user's name, location, phone number and time that an e-mail was sent -- even if the law seems to say a subpoena is enough.

In a primer published on Monday, Google says it requires a search warrant to share Gmail messages, private YouTube videos, stored voicemails or text messages on Google Voice and private blog posts on Blogger.

Though Google has sometimes struggled over the years to earn users' trust in how it handles personal data, the company stands out in its efforts to protect users against government requests for data.

"Google's been kind of a pioneer," Mr. Timm said.

Since 2010, it has published its transparency report, outlining the number of government requests it receives for users' data or to remove content from the Web. Companies including Twitter, which employs several former Google lawyers, have followed suit. Mr. Drummond says he wants other Web companies to do so, too.

Google says it scrutinizes each government request, narrows the scope if possible, and notifies users of the request if it is not prohibited by law.

2799 - India is second only to US in accessing private details of netizens

15 NOV, 2012, 08.36AM IST, ISHAN SRIVASTAVA,TNN 

India is second only to US in accessing private details of netizens

CHENNAI: India ranks second globally in accessing private details of its citizens, next only to the US, if the latest data from Google is to be believed. The transparency report by the internet search giant lists out requests it received from governments across the world to access information on the users of its various services.

In the first six months of 2012, India made 2,319 requests involving 3,467 users. In comparison, the US made 7,969 requests in the same period and Brazil, which comes third, sent 1,566 requests. Globally, there were 20,938 requests for user data during the January-June period. The data can include your complete Gmailaccount, chat logs, Orkut profile and search terms among others. These reports are prepared by Google every six months, and were started in July-December 2009.

The requests for user data from India doubled from 1,061 in July-December 2009 to 2,207 in July-December 2011.

"Though India is a large country with a significant number of internet users, this data is nonetheless an indicator of growing surveillance," said Pranesh Prakash, policy director at Centre for Internet and Society ( CIS), a Bangalore-based organization looking at issues of public accountability, internet freedom and openness.

"India lacks a general privacy law that helps set guidelines for such user requests, despite privacy being a constitutional right as part of the right to life," said Prakash.

India also actively sends requests to take down content which it deems defamatory and against national security. While the number of court orders for taking down web content has remained almost stagnant over the years, there has been a rise in the number of requests by the executive and police.

Between January and June this year, there were 20 court orders and 64 requests from executive/police that resulted in 596 items being taken down from the web. In comparison, there were only eight court orders and 22 executive/police requests in January-June 2010, resulting in 125 items being taken down.

"The government does not always specify the reason for which they want access. They just want access, what they do with the information is not known to us," said a legal adviser to an MNC. "These requests come with a threat to our continued operation in India."

Falsified court orders are also being employed to seek removal of content. Three such court orders were sent to Google "that demanded the removal of blog posts and entire blogs for alleged defamation." One order was said have been issued by a local court in Andheri, Mumbai while the other two by the Delhi high court. But all the three were found to be fake.

Google says a single court order was responsible for removal of 360 items this year as they "contained adult videos that allegedly violated an individual's personal privacy." While such orders have a positive impact like curbing pornography and violent content, governments at every level have also tried to use these requests to take down unfavourable content or criticism.

In January-June 2011 period, Google received "requests from state and local law enforcement agencies to remove YouTube videos that displayed protests against social leaders or used offensive language in reference to religious leaders". Google rejected a majority of these requests. It also received a request from a law enforcement agency to remove 236 communities and profiles from Orkut that were critical of a local politician. Google did not remove them either.

"Prior to 2009, government had limited powers of interception. However, after 26/11 they gave themselves huge powers to block and monitor content," said Supreme Court lawyer Pavan Duggal. "Data privacy is non-existent in India."

He said that the A P Shah Committee, which was formed to recommend principles for a privacy law, has submitted its report to the Planning Commission and now it is up to the government to take it to the next stage.

Both Prakash and Duggal said that technology companies in India, including telecom players, should come out with similar transparency reports as Google. A report by international watchdog Privacy International says that Bharti Airtel, in its 2010-2011 annual report, said it had received 422 appreciation letters from law enforcement agencies for assistance in lawful interceptions. "The Indian IT Act requires electronic audit by firms but the law is silent on how this audit is filed," said Duggal.

Globally, Dropbox, LinkedIn, Sonic.net and Twitter release transparency reports apart from Google.

==========================================================

http://www.indianexpress.com/news/google-india-s-requests-for-user-details-rise/1031210/

Google: India’s requests for user details rise

Press Trust of India Posted online: Thu Nov 15 2012, 02:09 hrs

New York : India sought confidential web user details in as many as 2,319 cases from Google in the first six months of the year, in what is seen as a growing trend of government surveillance of internet activities by people and organisations.

Besides, the number of items sought to be removed from Google’s various internet platforms such as YouTube videos, search results, images and web pages, more than doubled to 596 in the six-month period to June 2012, Google said.

The number of requests for web user details rose by five per cent from those made in the preceding six-month period (July-December 2011), and placed India at the second place after the USin terms of the government requests for user data from Google.

Google said in its half-yearly Transparency Report that it complied with 64 per cent of the total 2,319 requests made by the Indian authorities between January-June 2012.

Google was also asked by Indian authorities to remove as many as 596 items (including photos, web pages, videos etc) from its various platforms and websites like Youtube, Orkut and Google Images.

About India, the report said, “In response to a court order, we removed 360 search results. The search results linked to 360 web pages that contained adult videos that allegedly violated an individuals personal privacy.”

The other major countries for such requests included Brazil, France, Germany and the UK.

2598 - Report - Biometric Data Collection and Database sharing Poses Serious Privacy Concerns

2598 - Report - Biometric Data Collection and Database sharing Poses Serious Privacy Concerns
http://thinkprogress.org/security/2012/05/31/492739/biometric-data-privacy/

By Eli Clifton on May 31, 2012 at 9:30 am

The U.S. Department of Homeland Security (DHS) takes approximately 300,000 fingerprints per day from non-U.S. citizens crossing the border into the U.S. and collects biometrics from noncitizens applying for immigration. A report from the Electronic Frontiers Foundation (EFF) and the Immigration Policy Center (IPC), both policy research foundations, warns that DHS biometric databases — which are increasingly interconnected with biometric data collected by state and local law enforcement officers who regularly collect fingerprints — DNA and even face prints and iris scans of people booked into local jails, could raise serious privacy concerns.

“Some people believe biometrics and databases are the silver-bullets that will solve the immigrant enforcement dilemma. But biometrics are not infallible, and databases contain errors. These problems can result in huge negative consequences for U.S. citizens and legal immigrants mistakenly identified,” said Michele Waslin, Senior Policy Analyst at the IPC.

“Biometric data collection can lead to racial profiling and can disproportionately affect immigrants,” said EFF Staff Attorney Jennifer Lynch. “It also gives the government a new way to find and track people throughout the United States.”

The EFF and IPC are urging the U.S. government to curb potential racial profiling and discrimination against immigrants by limiting unnecessary biometric collection and addressing the privacy issues that arise from growing and increasingly interconnected biometric databases.

Police use of biometrics has already emerged as a contentious political issue in New York. Earlier this month, the Obama administration expanded the Secure Communities Program, a federal fingerprinting program to identify illegal immigrants in Massachusetts and New York. 

New York Governor Andrew Cuomo objected to the program. “There are concerns about the implementation of the program as well as its impact on families, immigrant communities and law enforcement in New York,” wrote New York Governor Andrew Cuomo in a letter to DHS. “As a result, New York is suspending its participation in the program.”

While most Americans haven’t yet encountered law enforcement’s increasing use of biometrics data collection and biometrics databases, the Los Angeles Police Department are already using handheld devices to scan the fingerprints of day laborers standing on street corners who are not suspected of any criminal activity.

“While most of us would be really suspect if a police officer randomly asked us to submit to a fingerprint scan on the street,” Lynch told New America Media. 

“When you feel like you have little voice in society and you lack power to challenge authority, I think harassment like this is a big issue.”

• Tags: Immigration and Customs Enforcementprivacy