Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/213 Thanks!
Can you hear me OK?
Cool.
Such a lovely, sunny day outside, it's a
shame you have to listen.
Listen to me sitting in here, but
thank you for coming.
My name is Constable Srikkanth.
Also sometimes referred to as Hound Me.
I work for an organization called
Tactical Tech and,
among other things,
Tactical Tech works
in helping rights activists
and journalists understand their security
and privacy risks.
We have a table outside of the noisy
square. I encourage you to come talk to
us and look at some of our resources,
especially if you want to help your
non-technical friends understand how
they can protect their
communications and data.
Today, however, I'm not here to talk
about my work at Tactical Tech,
but talk to you about
something I've been thinking about
observing, analyzing
and researching for the last little
while.
So the government of India over
the last few years, the government of the
country, I grew up in
the government of the country I've spent
most of my life in has made a series
of decisions,
a series of decisions which
have taken a form of several databases
and schemes they've implemented
to collect, analyze,
monitor
and intercept
our personal information.
And I've been thinking about how
this affects a democracy
as large as India and what
kind of implications this has on our
personal liberties.
So I'm going to share some of
my observations with you today and
some of the questions I have.
And with a little bit of help,
hopefully from you.
Try and find answers to these questions.
Before I continue, I have to.
I should thank Maria from Center
for Internet and Society, who did a
brilliant talk yesterday
about the state of surveillance in
India at the moment.
She's going to be a tough act to
follow and but I hope to add
some more value to the conversation
she started yesterday.
So there's this.
There's a there's a lot of dialog around
privacy that we all talk
about all over the place today,
and there's a specific dialog
in India around the
whole concept of privacy and what
that means in the Indian context.
There is also this
notion that there is a lack
of enthusiasm around privacy
in India.
And why is that?
Is it because the the
social values around privacy are
different in a country like India
when you compare it to the West?
Or is it that Indians don't
care about privacy at all?
Also, the fact that there's
a very large, very diverse population
of about 1.2 billion people
living in that country
means the country has a
very diverse set of problems.
People say if we don't really need to
care about privacy because we have larger
problems such as poverty and corruption.
That we need to solve,
and therefore.
A lot of schemes that
have been implemented
to either solve problems of corruption
and poverty or combat terrorism
are justified.
That's what the Indian government has
been saying for a little while.
What I think about this is
surveilling a large states such as
this or surveilling any state and its
citizens.
Is it is
an extremely.
Totalitarian concept,
it has led to totalitarian regimes
in the past, and historically
we know that.
Well, building massive databases of
citizens personal data
has usually led to
limiting our personal freedoms.
So why is it?
After we've debated this and
spoken about this for so long now
that one of the world's
largest democracy when it comes to the
number of people who live there, is
adopting this totalitarian idea.
And what is their justification to
do this?
This is an old argument, we all know
the argument that a lot of
states use around national security,
like if you don't give up your personal
information, the state is not going to be
able to give you welfare
or protect you.
There's also this
argument is flawed, because there just is
we know historically there isn't enough
evidence to actually prove
that this works.
This is not something I'm going to get
into a lot.
This is a conversation.
We've had a lot over the last four
days and there are there are people
who can probably have this discussion
better than I can.
I'm going to talk about the Indian
context a little more.
About the notion that Indians don't care
about privacy.
Simon Davies said
this a little while ago, says the Indian
train syndrome in which total
strangers will disclose their lives on a
train to complete strangers.
And this is true.
It's very commonplace for me
to be in a situation in
and in many places and many
environments in India, where I
am asked very personal questions such
as.
How many children I have or how
much money do I make, or if
I am, if I don't have children by,
when am I going to have them?
And and I'm used to this question
and sometimes I.
Avoid answering them, sometimes I
answer them and I get into a debate about
them, but it is also very commonplace for
people to actually give out this
information very
readily.
But does that mean that people don't care
about privacy in India now going back
to this, the Indian
train syndrome, when there is
a lot of personal information exchanged
very readily in a train, if
you're traveling with a few strangers at
the end of that exchange, if you're
sending email addresses, people usually
don't hand out their passwords also.
So, yeah, there are things people think
about when it comes to privacy, it's
just.
I think it's just sort of slightly
differently considering
how diverse the context is that.
There is a study that department
called recog at the in the Western
seat of information technology in Delhi
did. This is, of course, based on
sample data. This is so
yeah, keep that in mind.
But what the research
shows that about 46 percent of
the people who participate in this survey
read the privacy policies and
the terms of conditions while signing up
with services online.
It also showed that about 63 percent
of the participants when they
get onto Facebook or another social
network, change the default
privacy settings.
And 70, almost 72 percent people
mentioned deleting their personal
data from their cell phones before they
sell it.
So people are clearly thinking about
privacy, especially when it comes to the
digital, when it comes to how we interact
with digital technology and how
we share and access information
online.
So yes, I think we do care,
especially when it comes to our digital
privacy.
Let's just quickly think what is this
thing called privacy anyway?
It's it's it's a it's a it's talked about
differently in different ways.
I'm just going to look at what kind of
what kind of personal freedoms.
Does the law give us
or.
And what
that means to our personal
civil liberties in the digital context.
But to start with.
The Black Clothes Dictionary says
privacy is basically the right to be left
alone, the right of a person to be free
from unwanted publicity.
The right to live without unwarranted
interference by the public in matters
with face. The public is not necessarily
concerned.
And do we have any rights that actually
give us these liberties?
This is what the Universal Declaration of
Human Rights says no one shall be
subjected to arbitrary interference with
his privacy, family, home or
correspondence, nor to attacks upon
his honor and reputation.
Everyone has the right to protection of
the law against such interference or
attacks.
Now, back home in the Indian context,
the Constitution of India, this is one of
the most basic fundamental rights defined
in the Constitution of India, where
the Article 21 of the Constitution says
no person, no person shall be deprived
of his life or personal liberty, except
according to procedure established by
law.
And what are the laws?
Also, let's before we talk about
the laws that govern telecommunications
and digital freedoms in the country.
Let's also look at one more thing which
says no person accused of any offense
shall be compelled to be a witness
against himself, which
means I have the right
to not give away any information
that is personal to me.
Unless I have.
I am being investigated for an offense
that is the right to silence, which is
again defined in the
Constitution of India.
The law that mandates a lot of
telecommunications, how telecommunication
and telecommunications are governed in
the country is a very old article.
The Indian Telegraph Act.
It dates back to the date, back to 1885.
What it says is that you can't
actually intercepted communications
unless it's a matter of public safety
or public or if it's a public
emergency.
Let me take you back to the year
2008 for a second.
2008 was an extremely
important year for a lot of us in India.
There were two landmark events
that really
define how we think about or understand
digital freedoms in the country and
how the government has been making
these decisions that impact
these freedoms today.
There was one event
which was horrifying.
It deeply shocked and saddened
all of us.
This was the terror attacks of the 26th
of November, 25th of November 2008
in the city of Mumbai.
This attack is commonly also
called India's 911.
The second event
that also saddens me personally
and a lot of us is the fact that
there was an amendment to the Information
Technology Act called the Idi
Amin Amendment Act of 2008.
Which essentially now
gives the government complete
control over intercepting
your communications without the need
of a court order or a
warrant.
There's a couple of things that Typekit
removed from what the Telegraph
Act had.
Now, the Indian government does not
just intercept
your communication if it's a matter of
public safety or public emergency.
They can come after you
under the pretense of investigating any
offense.
I'm going to talk about some recent
developments, some of the schemes
and.
Systems that I just started talking
about, that the Indian government has
been establishing.
A few years ago,
the government decided to build
a massive database of
citizens personal data.
And store it centrally
and set out on a low
set out on collecting
data about.
A citizen, including their biometric
information, they said of something
called the National Population Register,
which was
supposed to be launched with the census.
And what this was going to do is collect
13 categories of demographic information
of every Indian resident,
every resident in India, and also
three categories of biometric data
collected collected from all residents
aged over five in about.
And the DNPR signing over the NPR
was mandatory, so you had to give up
this personal data.
What they did not have anything in
writing about was.
But the collection of your biometric
data, your fingerprints, your iris scans,
they do not define this, but they went
out and said they wanted to go ahead and
start doing this anyway.
The primary objective of the National
Population Register was to assist in
improving security by checking for
illegal immigration, illegal migration.
They also had a few secondary objectives.
Now these are find extremely vague.
They don't they don't really have any
clear definitions.
They say, Oh, we're going to provide
services under several government
schemes and programs using the NPI.
This will also help us pay for identity
fraud, and it'll help us improve
planning.
We don't know how they intend to do all
of these things using that data, that
isn't really not much information that
has been disclosed about how this
data is going to be used.
Another interesting project, which
has been the subject
of much debate and controversy
and a lot of conversations and dialog
around is what
the Indian government set up as a part of
the Planning Commission
and as a part
of planning. The Planning Commission's
initiative, called the UIDAI, which
is the Unique Identification Authority
of India, is something called a unique
identification project.
Also very commonly known as the ADHA
project,
what the UIDAI intends to do
is provide every citizen in
the country with a unique 12 digit
number.
They also say this is not mandatory.
You only sign up for the UID if
you wish to.
This is the bit that I find extremely
problematic about the unique ID
project.
The UIDAI
has decided that it will collect all this
data, build this massive database.
And stored it all in a centralized
location.
This includes all our personally
identifiable information, which is
my name, my father's name,
my religion,
what I wear, where I live, what
I do, and my fingerprints and
iris scans, all of this stored in one
massive centralized database.
A volunteer of the USDA
said this what is at heart, it's an
unadulterated identity program that
answers one question is the individual
who he or she claims to be?
Now, also remember I said
you were enrollment in the uaed program
is voluntary.
Now,
is that really true?
Because I actually a few days
ago, just before I came to Berlin,
I was in Bangalore and I got an SMS,
which said So we have something called
the Direct Benefits
Scheme in India, which
gives us a lot of subsidies.
And one of the subsidies I get as
being an Indian citizen is subsidies on
the cooking gas we use at home
to cook food every day.
So we we actually get to buy this at
a subsidized rate from the government as
long as we are buying it straight from a
government authorized agency.
So this is a must said.
You have to register before
the end of the year with your ID
number, with the gas agency, otherwise
we're not going to give you these subsidies.
So there are other agencies that are
being that are being
bullied into, except only
providing these services if
a citizen has the U.S.
has a USD number, even
if the UIDAI actually says
this is voluntary.
A lot of other organizations, other
institutions and government authorities
are now making it mandatory for.
A citizen interacting with that
specific agency to provide
a U80 number to avail these services.
The Maharashtra government even said, Oh,
you know, what are we not going to register
any marriages in the country anymore
unless you have a UAD number
so you can actually get married unless
you just have this voluntary number?
And.
And then go to the marriage bureau.
Fortunately, the Supreme Court of India
in September.
Made a ruling which said
that is actually not mandatory.
Now we'll see how that plays out.
So why did it either come into being
anyway?
Why is it that we need to
meet the u8e?
Why does everybody need this uad no.
Why? Why is there the need for
this database of people
in the country?
The government says India is
there's a there's a very large migrant
culture in India and there is no central
identity that has been provided
traditionally to an Indian citizen.
There is something called the ration
card, which I can get access to in the
state I'm living in, which gives me
certain benefits that I can access from
the state. But if I decide to move to
another state, the race card is not valid
anymore, which means I don't have another
ID document,
which I can use to avail
any services or benefits
as a citizen of India.
So they said it'll solve that problem.
Everyone's going to have one central,
centrally issued ID.
They also want to use
this program to give direct
benefits to.
The rural and the urban
poor people who are under
what we call the below poverty
line, they
have a program called Cash for Food,
which intends to directly
transfer money
to citizens into
their bank account as long as
they have a bank account, which is linked
to their UID number.
They can get money straight into their
bank accounts so they can actually buy
food.
So those
are those were the primary
two justifications that the government
said is why we need
the Aadhaar card.
Now, there's a few other things that have
been worrying me about
the other card, which I want to talk
about for the next few minutes.
The USDA.
Decided that the only way we can build
a large, technical,
secure system such as this
is by actually working with private
vendors who have the expertize that
the government of India does not possess.
They went out and bought
and negotiated several partnerships
with large enterprises
and private contractors to
make this whole system happen.
So a lot of a big part of this is
actually privatized.
Now, there's a few companies
that are involved, more than a dozen
private companies that are involved in
the USDA project.
And as I was looking at the list
and some of them and talking to some
other people, there's some information
that has been
coming to surface, which actually worries
us about how and why did
the government make the decisions
to conduct business
with certain companies.
One of the companies is an American
company called L-1.
Now L1 is a company
that claims on their website
that they provide highly specialized
government consulting services that
address the most important challenges
facing U.S. defense and global security.
They also claim that they have more than
a thousand specialist, most holding
top security clearance.
There's another company.
And yeah, this is the interesting bit
about.
So George Tenet,
he's he's he's
a former CIA chief, actually
sits on the board
of 11 of 11.
Tim Shorrock was an investigative
journalist, actually looked into this and
actually uncovered these links between
George Tenet and the CIA and
L1 and also established
that actually one of the biggest clients
eleven have are the CIA.
Accenture is a large global
enterprise that I'm sure a lot of us
have heard of them.
They also have links of
working with US intelligence
agencies for several years now, in 2012.
They were actually awarded a large
contract to do
bio surveillance by the Department of
Homeland Security in the United States.
This is another company that is doing a
large part of the work for the USDA
and making the Unity Project happen.
And more recently.
Max Shearson, who is
the CEO of MongoDB,
MongoDB is
sure a lot of technologists here and
maybe others are familiar with MongoDB.
It's an open source database system,
which is actually quite an amazing
system, but it is a it
is developed by a private company
and the USDA started talking to MongoDB
to.
Try and use their technology
and their services to captain and analyze
data of over a billion citizens
who are going to be registered with the
UIDAI.
Now, the MongoDB, interestingly,
receives a chunk of its funding from
a venture capital
that is owned by the CIA called In-Q-Tel.
It's actually quite commonplace for a lot
of open source projects or other
technology companies to receive
funding from intelligence agencies.
It's not the first time we've heard of
it. And sometimes it's had great results.
We've had some great software being
written by money that has been spent by
intelligence agencies.
But that's not the problem here.
It's like why the problem is why is
it that the Indian
government consistently has demonstrated
that they are engaging with
companies who clearly have links with
intelligence agencies in other
countries?
What does that mean for my personal data
as an Indian citizen?
How can I actually trust
my government to keep
me secure when it's
clearly showing me
information about the fact that they are
negotiating contracts with companies
who actually very closely
worked with the CIA and other
US intelligence?
We also have some other smaller problems
in India with the whole roll out its
program that has had to
be launched to 1.2 billion people
and we expect some problems, but
what kind of problems have you had?
This is not this is true.
These are some of your I.D.
cards phone where
the picture was actually not the person,
but sometimes a dog or a tree or a chair.
The USDA accepted this and said, Oh
yeah, we have some problems.
It's the system that we're still
perfecting.
It'll all work eventually.
They said there are enough safeguards to
make sure that this is
this cannot be misused.
But.
With all the independent contractors that
they're working with, other worries such
as somebody actually found
about 2000, I've heard applications with
personal information already
in there on a road on
the roadside, in a small town in
the state of Caroline, South India.
More recently.
There was a fake I.D.
card scam busted in the state
of Gujarat in Senegal, Sudan.
And they actually found equipment that
is that is that have been
authorized to be used only by the USDA,
the eye, which was led by people
who work for the USDA.
Two people who were making
these fake are that guides.
Let's go back to that issue I have
with centralized storage and access
of this data.
Now, this is somebody
who is a researcher with
MIT Geospatial Data Center said, which I
really like.
So I thought that quoted here says, What
is personal information? Personal
information is personal property.
It belongs to the person unless
it is put in the public domain.
The ownership of that personal
information remains with that person.
Which means what? I am not I should
not have to give away my
data to anybody who wants to
put it in a large, centralized
database.
Sunil Abraham, who's the director of
the Center for Internet and Society in
Bangalore, recently said this.
He said what India needs is an evil
Snowden.
The problem with Snowden is
that he has conscience.
Everything that he's leaked so far,
he's done it extremely responsibly
and made sure that he's actually
protecting innocent innocent citizens
from any harm.
Think about what implications.
It would have if someone
say a whistleblower who worked for UIDAI
or someone with the wrong intentions
decides.
And has access to this day later decides
to just take all of this data, put it out
as a torrent.
Online now, that's all I
personally identifiable information
available public to publicly to
everybody.
It is extremely dangerous, as you can
imagine, and I would not advise anybody
to do that, but this
is a possibility that we have to
consider. And that is why
centralized storage of such data is
harmful to society and
is and has these vulnerabilities.
Nandan Nilekani, who is the chief
and chairman of the USDA, said
when asked, what is it that the USDA
can be used for by building
this, he said
We are providing an open architecture
which allows people to build applications
on top of it.
He was asked a few of the questions which
he came out with very similar vague
answers to.
So basically, kind of what this kind
of implies is that the USDA
and the government of India and the
Planning Commission just got together and
said, Let's just launch this system,
let's get all this data and we'll figure
out what to do with it later.
What's important is that we need to
get all this data in there.
Now, clearly what is not about looks like
to me, it means
OK. That is clearly about establishing
control. That is about.
That is about
what I was talking about earlier,
the fact that the state wants to know
what you are and where you are and
who you are at all times.
And
it's
not the first time that the
centralized databases like
like that have been built, and in the
past, we know they have been misused
and let
our biometrics for a second.
No, the u8e project
is collecting my fingerprints.
And they intend to use
this as authentication.
There's a problem with that.
The fact that my fingerprints are users
authentication have several problems,
and the primary one is that biometrics
are not infallible.
If they compromised, my fingerprint is
compromised, I cannot go get a new one.
And.
They cannot be secured, unlike
other digital forms of authentication,
which I can actually revoke and
create a new one if
necessary, if they are compromised.
And digital signatures also,
like we all know, all these other digital
encryption methods don't require
centralized storage, and
they're definitely more resilient in
terms of security that way because, for
example, my Ethereum pin, I can
revoke it if I need.
If I lose my,
if I lose my card, I can or.
Well, basically, if someone actually
forgets my pin and I can revoke it, I
cannot do that with my fingerprint.
And then in in in in such
a large context when you actually trying
to use bio biometrics.
But biometrics are not infallible
when, especially when you're using it in
a population of 1.2 billion people
that are in inaccuracies that can arise
from variations in
individual attributes and inaccuracies
in the technology.
They can also change.
In response to a number of things, a
number of factors which like the
environmental stress, activity, illness
and AIDS, this is something that
there is a lot of
proof about and.
There is a whole possibility of error
when you're doing this with 1.2
billion people.
And then
let's talk about technology for a bit
like it really depends on the accuracy
of the technology like this.
There's many aspects in biometric
technology that can affect this.
There's calibration sensors, algorithms
and.
You don't go about piloting a system like
this on the whole country without
thinking about these issues are testing
them.
And it is possible to fake fingerprints.
We know that the Chaos Computer Club
in the past has shown us how
to do that. There's a lot of other people
who've shown us how to do that.
A quick Google search for fake
fingerprints will give you a lot of
information about how you can actually do
that.
Also, in the Indian context, there is
a lot of there is
a lot of commercial motivation for
people to create
fake or spoof identities,
which has happened a lot.
So for example, we've
known of bank managers
to achieve their targets, creating
what we call benami accounts
for. These mean people
who, well, these are basically the ghost
identities.
People who don't actually exist have
bank accounts because they want because
there are certain targets that banks have
to achieve.
There's also been reports of.
How biometric systems have been misused,
where you can actually use the.
Well, image manipulation software to
create, create fake biometrics,
create unique fake
fingerprints and.
If there's nothing stopping you from
actually buying a bunch of finger prints
from another country, which
has which is what has been done before,
a not at this scale and it can
actually be done and it's going in.
All this gives let you create these
unique identities and create these ghost
identities, which to you, which makes
the u8e system will accept as long as it
is unique.
So this is
a 23 page biometrics report that the
UIDAI put out a little while ago, which
said biometric data by
them is collected by software provided by
the UIDAI, which immediately encrypts
and applies a digital signature.
So if not, encryption and applying a
digital signature works for the USDA,
clearly it should work for citizens.
Why do we need biometrics to protect
us when?
Those are the issues that and those are
the questions I ask about the
whole other project a lot
and this is.
Something that has been talked about a
lot to that, that project itself is
completely unconstitutional.
Actually, there is no legal framework
in the Constitution that
that actually
makes that actually
brings this make makes this
constitutional.
And it's it's just an
executive committee decision which has
actually not been passed by the
parliament. It has no parliamentary
oversight.
So as far as
I'm concerned, as a citizen of India
going by the Constitution of India, I see
there is no accountability or transport
transparency in this project.
Like I said earlier, the Supreme Court
ruled that numbers were not mandatory,
which is, yeah, we'll see what
happens with that.
Let's talk about.
Some other things that worry
me and some, some others at the moment,
the steps that the government has been
taking in surveilling us,
intercepting our communications
and.
How that played out over the last few
years.
I'll give you a little bit of context, a
little bit of history.
In 2011, there were
the government of India put out something
called IP Rules 2011, which basically
prohibits websites and service providers
from hosting information that could be
regarded as harmful, blasphemous,
insulting to India.
They also mandated that
all internet cafes were now required
to install surveillance cameras in their
premises.
And for a while, the
numb and the it was also now
say this required anybody
who uses a cyber cafe in India
to hand out that ID card to the person
who runs it who has to keep a record off.
Sorry. Clearly, that at Miami computer is
not happy with this.
So I have to go on my personal ID every
time I want to use internet in a public
space in India.
And at the same time, there's a camera
watching me and looking behind my
shoulder to see what I'm doing.
India also has a history of being a
country that has been
asking service providers to give
out a lot of user data.
They actually send the second highest
number of requests after the US in 2012
to Google asking for user data.
There's also an act in the Eity
Amendment Act of a section in
the ID Amendment Act of 2008, which
is called Section 66 A.
What this is is you can actually be
imprisoned for up to three years
for sending an email or another or
any other electronic message that causes
annoyance or inconvenience.
Now what in the face of it, what this
section is supposed to do is protect
innocent citizens from online
harassment.
But there's been several instances
in the recent past, but it's been
misused.
In fact, there's misuse by
political leaders who've.
Got people arrested for.
Causing annoyance or inconvenience to
them.
In October this year, a resident
of Chennai, the city
in the city in south India
posted a tweet.
He had 16 followers on Twitter one six.
He posted a tweet
does his 16 followers
claiming that he knew that
a certain politician in South India
who happens to also have also happens
to be a member of
the ruling, the current central ruling
party the politician.
This case, the name is
Kadry Chidambaram, who also
happens to be the son of the present
finance minister of the of the
Government of India, he
tweeted, saying to them buldum had
amassed more wealth than
this other person who is the son in
law off the top of the Congress party,
who are the ruling party in the
country.
His tweet basically had a few words says
to them Chidambaram seems to have
amassed more wealth than
Robert Vadra.
That's basically all he said.
He was arrested.
And.
Well, because Chidambaram filed
a police complaint a few days after
he thought after he saw this tweet,
a university professor in West Bengal
last year was
arrested after
being assaulted by
the party in power.
Some members of the party in power there
was arrested and jailed because
he emailed a spoof,
got a cartoon of
Mamata Banerjee, who is the chief
minister of that state,
and.
Well, more recently,
India actually lost
one of its more most powerful
political leaders
earlier this year.
Bob Parker, who led
despite right wing political party,
called the Shiv Sena and was a very
powerful politician, especially in the
state of Maharashtra, where Mumbai is.
And when he died,
the government decided out of respect to
shut down the city of Mumbai.
Now about her career, interestingly,
although he wasn't extremely powerful
political leader, never held any
kind of position of power in the
government, he was never the chief
minister or any other minister in any
government.
So when the government decided to shut
down the city of Bombay, a lot
of people were Mumbai.
A lot of people thought, Oh, well,
but he's not really.
No, he's not really
a political leader who's ever held and
held an office away to go
actually were arrested because they
posted questioning the shutdown
in the city on Facebook.
So, yeah, those are examples of how the
66 year has been misused by
the by political leaders.
And this is a section which actually is
supposed to prevent me from harassment.
But yeah.
And they also launch something called the
telephone call interception system in
2011.
And what the DCI is let the government
do.
Is monitor in
real time, 900 million landlines
and mobiles in the country,
and all this snooping is invisible.
You don't know if you're being monitored.
It's completely transparent and seamless.
It not just monitors you, but also.
Does voice recognition and pattern
matching based on other sample data
that exist in the system to determine if
you are a terrorist or
not?
More recently,
while actually in
earlier in the year when we were all
shocked and where
and the global dialog started around
Snowden leaks, India quietly started
launching this system called the Central
Monitoring System, which was
conceptualized after the attacks
in Mumbai in 2008.
And.
The CMC will also integrate with what
I mentioned earlier, which is the
telephone call interception system.
And this claims to be the they claim
that it'll be rolled out to a dozen
states by 2014.
So what does the MAX does is basically
bypasses what bypasses your ISP
and plugs straight into.
Eat into
its the the
the Indian government can then
will monitor and
intercept all communications
that are digital in real time.
It can be used to monitor your social
media activity.
It can be monitored, too.
It can be used to monitor your e-mail
activity, your telephone calls and your
mobile calls.
And it also
claims to do.
Real time monitoring of your location
using GPS.
No, who is it that
authorizes or decides on the selection
of targets that
can be targeted through this
surveillance?
Now the agencies that actually have
access to this data are not
required to seek a court order
to do any surveillance anymore.
They don't need to as a service provider
anymore for data.
They can just get it because they have
access to the central system.
These are this is these are the agencies
and authorities that have access
to data, that's a that's a lot of
agencies.
And I was looking at this list and I
suddenly went, Hey, why
is the Central Board of Direct Taxes
direct access surveilling me?
Why is it that
the tax office
needs to have Real-Time?
Capabilities to intercept my
communications.
When did suspicion of tax
evasion legally justify
a wiretap?
And why is it that
someone who forgot to pay their tax
avoiding that tax is now suddenly a
terrorist, which is what
these systems are supposed to fight,
right? That isn't.
The cabinet secretary of India actually
in 2011 said economic offenses
are not public emergencies.
I don't think we even needed someone to
make a statement like that.
The teams will monitor
160 million internet users,
and since it ties in to the diseases
which I spoke about earlier, will monitor
900 million mobiles and landlines and
will do location based monitoring using
GPUs.
The late Bruce Niles said they're doing
all this monitoring to look for
people who might be terrorists.
He says searching for the terrorist
through data mining is like looking for a
needle in a haystack.
To use, imagine
a slightly more real
life example, it's almost
like going
the only way we can actually protect,
say, the city of Hamburg is
if we collect everybody's
keys for their private properties
and deposit them with the police.
And that's the only way we can actually
protect them. So we need all the data,
all everybody's
data. So we can actually.
Then figured out who
among all these people by looking at
their keys is a terrorist.
And they also set up a system called
the National Intelligence Grid, which is
a it is this integrated intelligence
network where
a lot of databases that are owned
by several departments in the government
are now being linked together.
This was again proposed after the 2008
attacks and recently
a few days ago. I read a report
saying that actually now starting to
launch this and it's
supposedly going to be active
by the end of this year or
early next year.
Natalie, it again links
several different different departments
of the Indian government.
And once again, does
it include the tax department,
which I think I missed in the slide, but
no, it is the Central Board of Direct
Access.
So what does all this mean for?
One thing the one thing, one thing to
note with all this happening in the
country is that India actually doesn't
have a dedicated privacy law.
Also, the kind of protections
we have around data
are not really governed by
by a dedicated data protection law.
So where does that leave us and what are
the steps we are taking or we can
take?
To actually exercise
the rights that we have as citizens.
The Center for Internet and Society,
where Maria, who I mentioned earlier
works, is actually drafting
new privacy protection bill.
It's and they've done it in
an extremely collaborative manner where
they've invited
members of the general
public, policymakers, lawmakers,
activists and
private enterprise
folks to come together and work
on this series of about
seven roundtables, if I remember
correctly. So that's happening that
now the reason that the
organization that is not the government
is doing this is because the Indian
government has not done this.
So there is someone else, a bunch of
people actually sitting together and
going, Oh, OK, let's let's let's build a
privacy bill and see if we can
protect our privacy.
They're not things one can do as a
technologist, and this is what I think a
lot of us can do is.
But let's use strong crypto,
which actually helps us protect our data
ourselves, like communications ourselves
and not rely on other agencies
or governments to give us this
protection
as technologists.
A lot of people
I know have been running,
running a lot of trainings, including
Tactical Tech, where I work with and the
crypto body movement when teaching other
people how to use crypto and make this
make this make all this technology
accessible to
people who
don't don't have the technical knowledge
to protect themselves from
being snooped online.
And of course, I think all of us should
be thinking a little more about changing
our online behavior, our digital
habits.
It's really the only very little thing
like this very small little things one
can do to actually protecting us,
including using good crypto and reading
privacy policies or changing up over
privacy settings to make sure we're not
giving up more data than
we should.
And of course, there's a lot of
information that the government of India
has not made available to us, and one
thing that many activists and
others are doing is filing
right to information petitions or
signing online petitions and
actually asking for this information from
the government by writing to them through
various means. And that, I think should
continue in every context, and that is
something we intend to continue doing.
And
I am of the strong belief, and I was
actually talking to a colleague yesterday
and we kind of agreed on this, that
this doesn't happen unless
a bunch of people actually go
out onto the streets and ask for it.
There's a good example of that right now
in India.
Yesterday, the
state of New Delhi, which is also the
capital of India.
The new chief minister, who was sworn in
yesterday and he comes from a party
called the Aam Aadmi Party,
which translates to loosely
translates to Common People's Party.
Now why this party came
into being is because
a lot of people in India, a lot of
activists who were not politicians
launched a large campaign against
corruption, which
in which they motivated millions of
people to come out onto the streets in
protest against this.
And we actually are seeing
change from that.
We'll see how that plays out.
We don't know. But but the fact that
less than a year ago,
this party did not exist and today it's
actually in power in
a national capital means that
people going out in the streets and
protesting can actually change things.
So it's really important for us
to encourage people to
go out onto the streets.
I was in Berlin a few months ago and
I felt really liberated when I marched
in the Freedom Not Fear protest,
where 12000 people in the city
of Berlin were out in the streets.
Trying to reclaim that digital freedoms
and telling the state, no, you
cannot spy on us, you cannot scan
us. And I think
it's important for us right now to try
and
motivate people in India to try
and do something similar.
So, yeah, I'll just leave you
with that, and
I think.
Just to go back to that notion of privacy
that I started with, there's
a lot of people thinking about this in
India and the fact that the question
that keeps being asked is its privacy
that does privacy even exist in
the Indian context?
I just think it's probably
differently configured in the Indian
society.
But it's yeah, it's definitely
not dead. And
fortunately for us, there's a lot of
amazing people, organizations,
individuals and
other institutions and activists who
think the same and are
actually making calls in different ways
to protect this important
human right.
Well, I leave you with that.
I'm happy to talk more about what's
going on in India and
and actually brainstorm some ideas
about what else we should think
about and what we can do.
But yeah, thank you very much.
Yeah.
All right.
We still have some time left for Q&A.
Are there any questions?
Please go to the mikes over there and
over there.
Do we have questions from the internet,
no questions from the internet
over there.
Thanks, Mike. Yeah, thanks for the
very insightful speech.
Interesting.
It's a bit scary, actually.
And so I got a couple of questions,
took a couple of notes.
The first one is how long did it take
overall? I mean, the situation is kind of
scary.
And so how long in the world did it take
to the country to
like, get into this kind of massive?
Private data collection, civilians
of everything, how how many years
did it take?
So a lot of the actual schemes I spoke
about today
were conceptualized after
the attacks in 2011
in Mumbai, which was
very critical, very large
landmark event in India.
And a lot
of this actually is still being piloted
and has not been implemented.
So this is actually a good time when we
are trying to get more information from
the government to understand how these
systems work, to protest against
this and see if we can actually
get them to change their mind slightly
and think about these things differently.
But over the last five years,
when is when most of these systems have
been conceptualized?
OK, so a couple of more questions.
So do you think I mean, we've seen the
links between
some private companies that are obviously
linked to the CIA
for the database
making?
Um, do you think or
do you have any piece of evidence that
would let you think
that there was some U.S.
pressure to build such systems?
No, there isn't any evidence, but it does
raise questions, right?
It's like, why is it that
they have?
Consistently going and negotiated
these contracts and put them in place
with.
And with companies that have
clear links that have been exposed
to intelligence agencies, it
just doesn't make me feel safe as
an as a citizen of a country
where the government is negotiating deals
with someone
who might be linked
and might be compromising
my personal information to
appeal to an intelligence agent, a
foreign intelligence agency.
Okay. And last one, what can non-Indian
people do to help?
What? What can non-Indian people
do if they want to help somehow?
So it's
OK, so there is a it's obviously a global
dialog and discourse that's that's
very important right now.
And one of the things that
that is true, which I didn't mention
earlier, is that it doesn't really just
affect Indian citizens.
It affects a lot of other people.
Considering the fact that there are no
privacy bills and no data protection
laws and the amount of data that
is being invested into India
from other
countries, including
all the business that is being outsourced
into India, should be a cause of worry to
a lot of other people who are not in
India. So we obviously need
global pressure
and people to actually understand what's
happening in India, which is, I think,
what we've been doing reporting
on current events of what's happening and
what and what
that means in the larger global context.
So
there's a lot of things one can think
about doing, including just starting to.
Ask these questions about, OK, if my data
is living in India, is it safe?
And what does that mean to me if I'm not
there?
And as these questions not
just to the Indian government, but
to your two
people who are actually dealing with your
data,
you know where you are.
Thank you.
All right. We have a question at one.
OK. At first I were thank
you two for your good,
if you will, to give us a view
of on this
faraway subcontinent.
India and
we work
in Germany as a watchdog
group to monitor
big enterprises.
And you mentioned two of them, Accenture
and A1 A1.
I never heard of them.
We work almost on
German enterprise batsmen,
but it's men who are
holding a big
personal database on
the Germans and European people.
I think
our view is
shaped, exclude the media in
this. And as a scandal, the
big enterprise prizes are
showed us as the poor guys
who are blackmailed from the secret
services, CIA, NSA and so on.
But from our view as a watchdog
group, the enterprises
have very strong own
interests. And
you mentioned at the end of
your presentation
that fight against corruption
may be a good idea
to
go into this connection between
government secret services and
the enterprises.
And maybe Accenture.
Accenture is
changed the name of this
enterprise several years ago
because they are linked with one of the
biggest corruption scandals
of the Western world.
It was the Enron
scandal, and so we can see
where the fight
against corruption and the fight for more
privacy linked together.
And my question
is, can you tell
me more about a one,
perhaps?
So.
Well, there's actually very little
information that we have in this
specific context, about 11,
but they've basically been building
a well,
they've been basically doing a lot of
consulting and offering
a lot of consulting services
to defense and global security,
like I said earlier. And
they they would also
actually
they're actually a major supplier of
biometric identification software
and which is used by the U.S.
to monitor terrorists and insurgents
in Iraq and Afghanistan.
And they're very closely
linked to the CIA and.
And one of the things, if I now
remember correctly is
that they've been.
They were recently employed by
the Department of Homeland Security, and
I'm just trying to see if I can find some
notes I have here, which has which I can
give you more specific information about
without having to break my memory
for this part.
Maybe you could handle that off
later.
Maybe. Yeah, maybe I have.
I have more details about L1, which
I am happy to share.
If we talk in the halls, maybe
OK, how big is this,
everyone?
If you.
Well, they some statistics, the
public information on their website says
they have over 2000 specialists
who have and a lot of them have top
security clearances.
This is quite big.
OK, thank you.
All right, then I'd say thank you very
much for this great talk
and another round of warm
applause, please.