Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/161 Thanks!
Please enjoy.
Maria Xenos, talk about in your
surveillance
state.
Hello. Thank you very much for being
on a Sunday morning, I'm so terrible, I'm
so sorry for being late.
I have no sense of time whatsoever, which
is probably something I should work on.
So my name is Maria.
I work at the Center for Internet Society
in Bangalore, India in particular.
I'm working on the Privacy Project and
I'm specializing on surveillance in the
country, and we are funded by Privacy
International.
So about a year ago, I moved to India
to explore surveillance.
But the first thing that we probably
think of when we think of India is
something like this, right?
So one of the main problems in India
is poverty, corruption and so on.
So when you first think of India, we
think of images like this
or this are slums.
So many argue, hey, so
is not even an issue in India.
Surveillance is a western elitist issue.
How dare you claim?
And that's an issue to an India.
What's surveillance? Most people don't
even have access to the internet.
What the hell are you talking about?
Well, that's actually a good point.
Until I went walking around in slums and
noticed this, hey,
there are satellites in slums.
Sure, they may not have access to clean
water, but they do have a satellite
and they do have cable TV.
And that's to say the least because they
also have cell phones,
as you can see.
So although Joshua, poverty
and corruption and diseases and so on
are major issues in India, at
the same time, most people in India do
have cell phones and
in particular, according to We Are
Social.
They have this pretty cool graph here.
Well, this data, which shows that roughly
78 percent of population
in India use mobile phones.
So that's pretty much the majority
population who have mobile phones.
And this is an important bit of
information because most surveillance in
India is carried out through mobile
networks.
So when trying to understand surveillance
in the country, we need to first look at
the laws. We need to understand which
laws allow for surveillance, then which
which schemes and projects are being
carried out based on these laws in
order to implement surveillance.
And then, of course, we have to look at
the surveillance industry, basically who
is providing the technology to aid law
enforcement agencies so they can spy in
India to begin with.
So in India, there are five
laws which mandates targeted
surveillance, namely the Indian
Telegraph Act, the Indian Wireless
Telegraphy Act, the Indian Post Office
Act, section 91 of the
Code of Criminal Procedure and the very
controversial Information Technology Act.
Now, I'm not going to focus on the
previous four, but later on maybe,
but are mainly going to focus on
Information Technology Act.
And the reason for this is because
it's a bizarre law.
It makes no sense as absolutely crazy or,
well, India's even start to describe it.
So first of all, I'm going to draw your
attention to section 44 of this law.
Basically, what it says is that anyone
who fails to provide access information
to authorities will be punished.
Oh my God, what the hell is this about?
It's like we're in 1994 for something,
right?
Then there's Section 66 A.
Now this has drawn a lot of media
attention because they actually have been
lots of cases where people have been
arrested and prosecuted as a result
of this law.
In particular, the section states that
anybody who sends an offensive message,
whatever the hell that means through any
type of communication service, whether
that's a cell phone or the internet,
will be punished.
And the reason why I've used this image
is to enjoy attention to one particular
case, which occurred last November in
2012, where
a politician, Bell Thackeray, died.
And as a result of that, they shut down
Mumbai.
And so one woman in Mumbai posted on
Facebook something like, Oh my god,
I can't believe this attack, Mumbai, just
because this politician died.
And then the other girl next to her like
the post because they dared to
do so. They were arrested.
They were literally arrested because
they posted, I can't believe I'm buying
them because it's politicians death and
because the girl liked it.
So this just shows that a very
small extent, what kind of abuse
and power the government is capable
of as result of this law?
Then there's the famous Section 69
of this law, and of course, it's famous
for completely the wrong reasons.
This section allows for the interception
of any information transmitted through
a computer resource, meaning that
literally anything you do online or
through your computer anyhow, especially
if your computer is targeted remotely,
can be essentially intercepted and once
it's intercepted.
Law enforcement agencies can gain access
to that data and judge you based on that.
And this section goes beyond that.
It requires users to disclose their
private encryption keys or
fail jail sentence of up to seven
years.
This is bizarre, to say the least,
because the only hope we really have to
keep our private data private is
to use encryption, right?
And so when the government through this
law requires you to disclose your private
encryption key, then that is extremely
problematic, to say the least.
And not only does it say that, but
generally the slots generally states that
if the government, for whatever reason,
is intercepting your communications and
using encryption, they can
call you up and say, Hey, why are you
using crypto?
Decode this for me now?
And if you don't, you're sent to prison.
That's up to you to judge and decide
how fair that is.
Then there's Section 80, which basically
allows the police to seize suspects in
public places without a warrant.
Now we're talking about India, the
world's largest democracy population,
speaking when we can see that in 2013,
the world's largest democracy has
sections as these ones, which allow
people to be to be
arrested in public with no
real grounds without a warrant.
And that is fundamental problematic for
all democracies of the world, I think.
Then under this law, the Information
Technology Act, there are the notorious
cyber cafe rules.
Now the reason why the government went
the extra mile and actually implementing
these rules is because, hey, most people
in India don't have computers.
Most people in India use the internet
through cyber cafes.
So what the fuck are you going to do?
You have to obviously monitor
cyber cafes.
And to do that, they've implemented these
rules, which basically require cyber
cafes to maintain backup logs
for each login by each user
and to retain such records for a year.
And not only to do that, but also to
ensure that such logs are not tampered
with. And then upon request,
they can give it to governments.
So literally, if you use
the internet or you know and it's Typekit
in India, be very, very careful
what you do because be sure that the
government will access that sooner or
later.
So these laws mainly, you
know, mandates targeted surveillance,
so mass surveillance in India kind of
falls in the gray area because it's not
technically legally mandated, but is not
prohibited either.
However, they are the license agreements
which do so.
The thing is that ISP's and tribes in
India and in most of the world, in order
for them to operate, they have to comply
with some license agreements, right?
And if they don't, well, they just can't
operate.
So in India, the ISP license agreement
basically requires all ISP providers
to conduct blanket mass surveillance on
their communications.
And if they don't, well, they just can't
operate.
So, so essentially what they have to
do that they have to purchase the
hardware and the software required to
monitor the communications at their own
cost in order to do this.
Now anyone can argue like what
kind of incentive do they even have to
purchase? This hard was offered to begin
with. It's not like they have a revenue
per se from doing it.
Well, like I said, they just can operate
if they don't. So they have to.
And the craziest part about this license
agreement, I think, is that bulk
encryption is prohibited.
And in general, if you use encryption
that exceeds a 40 but key
length and special algorithms, then
again, you have a problem.
The only cases we can actually do this,
we can actually use crypto more
than 40 bits.
It's if you get specific permission by
the ISP written permission, right?
And so I'm guessing that
in order to get this permission, they're
going to be like, Oh, why do you need it
for who you communicate with?
What? How exactly going to use this for?
So again, that kind of beats the purpose
of using encryption to begin with, right?
So technically, India does
everything it can to prohibit encryption
and to make sure that your data is out
there and vulnerable.
And now this ISP license agreements
kind of falls under the umbrella of the
U.S. license agreements, the Unified
Access Services License Agreements.
This applies to both ISP's NTSB
is in India. And so now they're pretty
much all required to conduct BlackAnd
surveillance under it.
In particular, there's a section under
this license agreement which mandates
the implementation of the central
monitoring system, which I'll refer to
later on.
And this is scary, to say the
least. So like I said, so events in India
over mass surveillance, although is not
legally mandated, it is required
for these fucking license agreements.
So they still have to do it anyway.
And then, of course, there are the mutual
legal assistance treaties.
Now the Amplats are basically agreements
between countries so that they can share
intelligence data.
India has such and blessed with another
thirty five countries, including the US,
as you can see.
Oh, how happy Singh is with Obama, right?
Now that's what we got to the legal
aspects. So now let's look at the schemes
being implemented based on these laws so
they can actually carry out surveillance
and practice.
So first, we have some data sharing
projects, and it's kind of unfortunate
that to say that data sharing budgets are
so bad as surveillance schemes because
because they're actually better as well.
But imagine how bad the situation is that
I have to call these not so bad.
So first of all, there's the national
intelligence grid, which is basically
an intelligent grid which links the
databases of all departments and
ministries of the government in order to
create comprehensive patterns of
intelligence.
So what that means, basically, is that
every single ministry in the government
has a whole bunch of data that collects
these are all linked together.
So when the government wants to access
like specific data about a specific
person instead of going to,
I don't know, 10 different ministries and
creating one by one, they had this
central database where it's all stored
and collected the views, the data mining
software to analyze it and to profile
that individual. And that way they have a
clear idea of who that person is and how
exactly they want to talk to that person
or not.
Then this this is a tennis, which
is quite similar.
Essentially, what this does is that it
links the databases of 14000
police departments across the country
again to create a comprehensive personal
intelligence. And what does that mean?
That means that, hey, they want to tell a
story about you.
It doesn't matter if that story is right
or wrong. It doesn't matter if it's true
or not. They can tell a story about you
and that. And based on that story,
they're going to probably arrest you or
not. And maybe even worse, who knows?
The worst part is that all of us lacks
legal backing.
Now, on top of that,
we have other schemes like the law for
errors of the monitoring program.
Now we're proceeding to the surveillance
schemes. This one basically operates
on two levels for telecommunications and
internet communications with regards to
telecommunications.
Essentially, all mobile operators in
India are required to sell their own
lawful intercept a monitoring system at
their premises, and to intercept all
communications with regards to internet
communications.
Well, the government has installed this
type of system at the international
gateways of all ISP's, and that
way all traffic or internet traffic
is essentially intercepted by the
government.
And because of course, that's not enough.
They also have the NSA monitoring
systems, so we know as a fact
that internet monitoring systems are
using two states and Delhi and Assam,
by the way, Assam is this is a state
up in the Northeast.
It's a very politically sensitive area.
It's really creepy that they're using it,
that using this there in particular.
There are many allegations that the
system is also used in other states,
like in Maharashtra and Karnataka.
However, we don't have proof of that.
And the reason why I to have proof of
that is because we only have tenders for
these two states for some.
And the reason why we don't have tenders
for the rest of the state is because,
well, most of it in India is carried
out in secret.
So in most cases, they don't even care
about legalism what they do.
So we don't even know what's going on.
But what we do know for this is very
limited. And I said, basically some of
are used to be able to, you know, detect
cures and some communications
and then even worse than all the previous
because obviously the rest wasn't enough.
But there's also the central, the
centralized monitoring system.
Now the centralized monitoring system
has been carried out since 2009.
That's four years didn't when we
really started to know about it
when those actually any media coverage
about it.
This April this year.
So four years later, this dam
scheme has been carried out for four
years in secret, and now we know about
it. So essentially what it does is that
it intercepts all telecommunications
in the country, everything.
This is basically a project carried out
by the Center for Communications Security
Research and Monitoring and implemented
by the Department of Telematics, which is
a Department of the Ministry of
Telecommunications.
Go figure.
And since its implementation, we know
that seventy two million dollars
have been allocated to this project, and
that is that is as of June 2013,
as of six months ago.
And this is based on what the government
says. So this may not actually be
the right figure. It was probably more
than this, as we can imagine.
Now this itself is extremely problematic
because we're talking about India.
We're talking about a country which has
huge problems of poverty
and the ills of investing this money
in education and health and so
on. They're investing it and intercepting
telecommunications.
The question is why is it about control?
Who knows the very secretive about it?
So how does the CMAs even work?
Well, I mentioned the lawful interception
monitoring system before.
So based on that, all taxpayers in India
had to install
lawful interception systems in their
premises.
Now what they're doing with the special
monitoring system is that they are
installing integrating lawful
interception systems with ISF
servers. ISF servers are intercept,
store and forward servers.
So now that they've integrated these
two systems, the law for it is up systems
and ISF servers.
These then basically
transfer data to the regional monitoring
centers. So every state in India
has a regional monitoring center and then
all of these regional monitoring sensors
are linked to the central monitoring
system. So the main place for data
stored and that's in Delhi.
And this data, basically
from the TSB, it goes directly
to the regional monitoring system,
regional monitoring center.
And then from there it goes directly to
the central monitoring system.
And this is all carried out through
dark fiber optic cables.
The way is transmitted.
So what has already been done with regard
central monitoring system?
So we have a few governmental documents
which verified these facts, one of which
is that as of six months ago, 80
percent of the physical data center had
already been built.
So it might even be ready right now.
So it's safe to assume that
this project is way ahead
in general has been carried out in three
phases. Each one lost around 13
to 14 months.
So it's probably safe to assume that
right now, most of it has been carried
out. And we know that for a fact,
especially because most of these services
have been fully integrated and tested for
two of the largest CSP providers in
India, and that is MTNL and
telecommunications.
So most people in India use MTNL
and telecommunications, in some cases,
even me, unfortunately.
And we know the fact that if you're using
these two tier IP providers, all data
essentially intercepted and stored in a
central monitoring system.
Well, we also know is that about eight
million dollars have been given to a
snel, which is another large test
you provide in India for interconnecting
eight one central monitoring system
locations.
Well, we also know in addition to that is
that the government has signed a
memorandum of understanding with BSNL
so that they can use multilevel
model protocols of switch.
What's it called? Nebulous connectivity
addition to this?
So when I was looking through
governmental documents, what is very
interesting is that the government
actually made an attempt to say no
commerce is not a problem.
Health care is good for your privacy.
And so what they were arguing their
documents was like, Oh damn.
Over the last months, we've received so
much criticism from the media and from
organizations that we're infringing on
people's privacy and human rights.
Well, we've got to do something about
that. So that actually came down with a
list of why this seems as privacy
friendly.
And I think the reasons are hilarious,
but that's up to you to decide, I guess.
So the first reason is that, hey,
the A will just automate
the existing process of interception and
monitoring. No worries.
I mean, we were interested you
communications anyway.
We're just automating it now.
So what's the big deal?
We're protecting your privacy.
Yay.
The second one is that the deception
and monitoring will be a quote in
accordance with Section five, paragraph
two of the Indian Telegraph Act.
Do you know what the section says?
Basically, it says that the disruption of
communications can be carried out
in the occurrence of a public emergency
over public safety when it is necessary
or expedient to do so.
OK, then.
So basically, we have this very
this very broad terms of public
emergency public safety.
If it's necessary to expand to do so,
intercept communications and therefore,
of course, this is privacy friendly.
Then there are other arguments that,
hey, we will bypass ISPs.
We no longer need to, you know,
ask to speak, to give us the data.
Because what will happen now,
essentially, is that, as I mentioned
before on how it works, is
that all data from TSB will go directly
into the CMS database,
which means that they don't have to ask
for it. So they're like, OK, so TSB
providers, they won't access your data
only we are accessing your data,
therefore your data safe with us.
Sure.
The next point
is that the commerce authority and, by
the way, by serious authority, what we
really mean as the intelligence bureau,
they will provision that section requests
from law enforcement agencies.
So what that means is that law
enforcement agencies will be like, Hey,
CMS, I want access to this person's
data and they will give it to them.
And they're arguing that the system's
authority won't have access to the
content data.
I'm not sure how that's actually even
possible. Like, how can they give the
data if they don't even access it?
I don't know. That's a mystery, which
they should. I don't know.
Enlighten us about the SEC.
And the last point is that the
CMS will include a non erasable
command log for all provisioned
activities. And the reason why this
privacy friendly is because that way you
can check to see
what type of data has been provision to
law enforcement agencies in every given
time. And that way, it can be transparent
and so on.
However, the don't don't mention
like who is going to maintain this
fucking command log, who is going to have
access to it, who can control it, and who
can check it to ensure that
the right type of data or whatever or
under the right legal procedure, the date
has actually been handed over to law
enforcement agencies.
There is no checks and balances
whatsoever. So of course, if you're,
you know, the CMS is good for our
privacy, supposedly.
I don't know.
I'm just presenting the other side, their
side. It's up to you.
Decide how privacy finally, this is
or isn't.
So does anyone have an idea
why have some cell phones in front of the
Taj Mahal?
OK, so this is BlackBerry.
So the reason why I had this, because a
few months ago, the Indian government
signed this agreement with
with BlackBerry, essentially
for the interception of solutions.
So the agreement was the thought
that all BlackBerry, BlackBerry Messenger
and BlackBerry Internet services
can be intercepted.
However, it remains unclear.
You know, if this falls under the central
monitoring system or the lawful
interception monitoring system, how
there's so many systems, it's not even
clear what this has been carried out
under. And they obviously, you know and
open about it, so it remains a mystery.
But we do know that BlackBerry has
definitely been intercepted.
Hello in the country.
No, you idiot.
The reason why I'm including this random
biometric thing.
Yeah, those woman scamming her fingers.
It's because this is probably integral to
everything else that I mentioned.
So the u8e scheme is the largest
biometric data collection scheme in the
world right now.
And essentially, what it does is that it
requires Indians to give up their iris
and their fingerprints, so to give up
their biometric and also some other
demographic data.
Now, in theory, this is voluntary.
You can choose to use it.
However, that voluntary because
there's this other program called the
NPR. And under that,
well, you have to register with NPR and
then the NPR requires you to have a UID,
so you have to register with the UID.
But it's voluntary.
And then on top of that, in order to
have access to almost all, if not
all, governmental services in the
country, you have to have a UIDAI.
So for example, if you're an Indian
and you want to get access and you, like,
belong in the below poverty line
and you want to get access to
food programs or cash transfer programs,
you have to have your I.D.
number, you have to be registered with
us.
So also, if you want
your kids to school, your kids can't go
to school in many cases unless they
register with the idea and this goes on
and on and on. So there are like loads of
government services, which you just can't
access unless you have a 12
digit number called Aadhaar.
And unless you are registered with this
scheme. So although it's voluntary, it's
actually a pretty mandatory, I think.
And the reason why this is really, really
concerning is because the UID pretty
much serves as a unique identifier,
so all other surveillance pretty makes
sense in light of this,
in which sense the government has
to intercept the communications of 1.2
billion people.
Now, when it's doing that, it's likely
that there will be error in matching
patterns and creating profiles and so on.
So how do you make how do you make sure
that there's data that you have access
to? Actually, it belongs to the person
you think it does?
Well, that's where the UIDAI comes
in. The UIDAI verifies
that well, supposedly verifies
that its data belongs to an X
person.
So, for example, if they have your data,
which they've got to find a section of
your telecommunications or your internal
communications, they link that to this
number. And that way, then that way they
know that, hey, it's you, it's your
data, and I'm prosecuting you for sure.
But then that itself is very problematic
because, you know, the larger the sample
of data you have, the larger the
probability for error.
There have been loads of cases of
corruption which have been reported.
Many of the contractors of the UIDAI
have links with intelligence agencies
and in particular with US intelligence
agencies.
There have been many cases where data has
just been lost as just disappeared
mysteriously.
That kind of shit happens in India all
the time, I guess.
So this itself is a very vulnerable
system, so it's very questionable, you
know, with regards to how effective
it is in everything.
And end of the day, fingerprints, really.
I mean, it's so easy to fake your
fingerprints, right?
If you just go to Google and you say,
help make my fingerprints, that six tips
of how to do it.
So using the system to
verify people and to judge them and to
arrest them and so on based on that
is fundamentally flawed, in my opinion.
Now.
This is the actual
scanner that is used for the
system.
This is what they. This is a fingerprint
scanner. They use this to
collect Indians fingerprints.
And anyway, so
this the small scanner.
The small box
basically is really important because
all other surveillance that I mentioned
in India only really makes sense if
this damn thing exists.
So feel free to come later on and check
it out and maybe play with it if you feel
like if you like doing so.
So there's there's a honeypot,
the reason why I have it is because all
these schemes, especially the UID,
the CMS, they basically are like a
type of honeypot because when you
centralized data, essentially what you're
doing is that you're creating a
centralized point for cyber attacks.
So although they argue that, hey,
all these systems are to increase your
security or they're actually doing is
providing fake security because
based on this whole honeypot premise that
the more centralized the data is, the
more vulnerable it is.
It doesn't make any sense.
So sorry.
So that's with regards to the schemes and
to the laws. Now notice that all of this
we need to see which companies are
actually providing the technology to be
able to make these schemes even possible.
So I started investigating the
surveillance industry in India a few
months ago. Initially, I had a random
sample of 76 companies.
Then I narrowed it down to 50 companies.
So I repeat, this is a random sample
of surveys, larger companies.
And what I did essentially was
that I looked at their technologies and
what they do and everything
where they comply with lawful regulations
and so on. And so I rank the companies.
So shall you have the list of the 50
companies?
And the other ones from most harmful
to least harmful.
So the least harmful company is
legend. systems and by the way, this is
Bob Biljon systems.
So if you think that a device
which can make all solvents possible is
sold by the least harmful company, then
you don't want to know what the most
harmful ones do.
Now, the criteria that I use to rank
these companies were basically to, first
of all, the types of solutions that they
produce and they sell.
And who they sell them to.
So solutions and clients.
The reason why I looked at so the
solutions, I ranked them based on another
two subcategories outreach and harm.
So basically, if
the solutions do mass surveillance or
targeted surveillance and how harmful
they are in the sense, like how much data
do they actually capture?
For example, it might be more harmful,
like an intimate phone monitoring
solution. It's potentially more harmful
than biometrics because a
phone monitoring solution can potentially
conduct mass surveillance.
It catches much more data than a
biometric device, and it goes more
harmful. And then, of course, the
clients. I had four kinds of clients,
or ISP's TSP, said
law enforcement agencies and so on
corporations, organizations and the
public. And I ranked, I
suppose, into ISPs as the most harmful
category, and the public has the least
harmful ISP's in tests because the most
harmful because of direct access to all
the data.
So from the
from this essentially to some interesting
points or not so interesting, that's up
to you to decide.
So out of this random sample of 50
surveillance technology companies, 18
of them cell phone monitoring solutions
and repeats, it's a random sample.
So even a random sample, a huge,
huge a big amount of these companies
sell for munching solutions that solves
very problematic.
And the reason why I'm focusing on phone
munching solutions because like I
mentioned, roughly 80 percent of our
population, India have cell phones, so
this directly affects them.
Then, out of the 50 companies, 30
of them sell two solutions to law
enforcement agencies.
And I repeat, this is a random sample.
So that itself is very problematic.
And what's very interesting is that out
of the 50 companies, only six
of them comply with lawful interception
standards and regulations when they refer
to lawful signs of regulations.
I'm referring to Ed Sinclair and these
very interesting regulations.
So these companies, actually
three of them are not even Indian rights.
Three of them. So as a comparison,
you to makeover, they're not Indian.
The other three are so out of my
sample of 50 companies, 40 of them are
Indian. 10 of them were from other
countries in the world.
And it's very interesting to see that out
of my 40 Indian companies, only three
of them bother to comply with
lawful interception standards.
This itself is very problematic because,
you know, if you're doing surveillance,
you might as well put a front if you're
smart enough, right?
You might as well put a front and say,
Hey, at least I comply with lawful
regulations. You can't judge my
technologies or anything, but only three
of them have bothered. Which is quite
sad, actually.
Then again, are these companies only
19 of them are certified, and only
seven of them are ISO twenty seven
thousand and one certified.
Now the reason why I'm focusing on the
ISO twenty seven thousand one
certification is because this
certification is with regard to data
protection. And so all these companies
are handling sensitive personal data.
And so they have to comply with some type
of standard or certification with regard
to data protection.
Now, only seven of them are ISO
twenty seven thousand one certified,
which means that it's likely that most of
them aren't.
And while they are using your personal
data or Indians personal data
that anyone care about putting a fence to
show that they even care about it, or
that they're making an effort to protect
the data for a server,
then only 19 of these companies have
privacy policies, which isn't
isn't a surprise. It just goes to show
that, you know, countries are going
ahead with saying these crazy solutions,
and they even bothered to pretend
that they care about your data.
What's interesting, though, is that when
I was going through these companies, what
I notice is that
the more controversial or the more scary
the products of a company is, the more
likely it is to comply with lawful
regulations and to be certified,
which is very ironic itself, you know.
But it also kind of makes sense because I
guess if you're selling, you know,
very scary products, you want to put a
front that, Hey, I am certified,
I care about the law, I care about
your data.
It's probably not true, but that's
usually the case.
With regards to the least harmful
technology companies like I mentioned
before, precision biometric systems
is supposedly the least harmful,
and that's where I got this biometric
device from.
It's very funny that mobile spy is
ranked as the second least harmful
company, and that's really tragic because
essentially what it does is it sells
mobile spyware.
And like I said, most people in India use
mobile phones and cell
phone surveillance really affects them.
Ravi Raj Technologies, although it only
sells biometrics itself, is
but worrisome because actually what they
do is that they sell biometrics to
governments like Tunisia and Zimbabwe
and Saudi Arabia.
So when you have a company selling
biometrics to non-democratic regimes
or to transitioning to democracy
countries, you are saying that stuff can
be very problematic because they can use
such biometrics to target political
dissidents or anyone who doesn't agree
with them.
So with regards to the most harmful
surveys of larger companies, my data.
First of all, there's comm labs you might
have heard of combat I was before because
WikiLeaks actually have released a whole
bunch of documents brochures with
regards to their products.
So they have a whole wide range
of internet monitoring and phone
monitoring solutions.
I've only picked out two, which I thought
was quite interesting and can look them
up further. The first one is verband
this, which is for it, which is basically
an internet interception solution.
And then there's a sensor which
essentially in a unified way
intercepts telecommunications.
And the interesting thing of the way it
does that is even able to detect
cognitive and emotional stress and voice
calls and flag them.
So the message from here is beware
of how you speak on the phone.
Make sure you have no stress in your
voice. Don't be stressful.
You will think you're a target and will
come arrest you or something.
Crazy.
Second, one day points out and another
like, very like harmful company as
Behera. So these are all Indian
companies, right?
So Barra as a whole wide range of
products, including the crimes
as the Sidr analysis system essentially
was able to do, is gather intelligence
and, you know, unveil hidden
relationships and patterns and so
on. And it's able to do this by using
an advanced to school tool and
even able to detect sleeper cells.
And on top of that, it can even analyze
more than 40 billion records
and less than three seconds, or at
least according to their brochures.
And I repeat, this is an Indian company.
And the reason why I'm pointing this out
is because there's been so much talk
about Finfish and Gama Group.
And yes, I completely agree.
That's some scary shit out there.
But what I'm trying to emphasize here is
that a lot of equally harmful
companies exist in India as well.
Some case they're even more scary.
Bellator networks or political
networks, they sell solutions
for the disruption of the internet, for
the intersection of telecommunications.
They sell and it's a cell interception
and decryption system and cyber
cafe monitoring systems.
Because like I mentioned before, you have
to monitor cyber cafes.
Most people in India use cyber cafes.
How else would you do that?
What's very interesting about this
company is that and their websites,
the openly states of the supplies of
solutions to the Ministry of it.
And that's very interesting because most
companies don't. They're very secretive
about who they sell them to.
So I kind of feel that the more open
a company is about what they do, the more
dodgy they are in a way because
that because they have the balls to say,
you know, yes, we supply this industry
out of it and we're telling you about
that and we're untouchable, like,
that's some scary stuff, I think.
And then Clear Trail Petrol is another
company you may have heard of again, some
of their brochures are in WikiLeaks as
well, so they have a whole wide range of
products, including
control and X-Trail, which are for
monitoring IP and voice networks, the
ones for mass monitoring.
The others were targeted.
Now quick trial, I think, is particularly
interesting because this essentially what
it does is a tactical wi fi monitoring.
So what it does is that in real
time, it's able to monitor Ethernet
LANs in India as even
able to deploy spyware into
a target's computer.
So if you think in India
that you know you're safe because you're
using Wi-Fi or because you're using
the internet, you know, through a cyber
cafe or through a hotel or another public
place, think again, you're
it's very likely that you may be
your communications may be intercepted.
If you're a target, then there's
trail, which is a bit worrisome
because what it does is off the
interception of GSM phone calls.
And the reason why this is problematic is
because well of the interception
in India is technically illegal,
for starters.
So in 2011, there were these allegations
that the National Technical Research
Organization was snooping on.
Politicians threw off the interception,
and following this, the Ministry
of Home Affairs issued a directive
to ban all of the interception
in India.
So since then, the Department of
Telecommunications has really been
busting. Everyone is trying to produce
this and sell this.
But yet they're going ahead with this.
And actually, they're not only selling
the stuff to India, they've assigned us
lots in the Middle East.
So actually, Clear Technologies and
Palladian are two companies
which are probably the main suppliers of
surveillance technologies in the Middle
East and in other Asian countries,
which is very concerning because we're
talking about authoritarian regimes, we
are talking about democracies.
But hey, even if we talk about
democracies.
Well, it was hard to find democracy.
But still, you can see that in India,
even though it's the world's largest
democracy, the surveillance is crazy.
And the main reason why it's crazy is
because there is no privacy law.
There is no privacy legislation
whatsoever.
No data protection.
Nothing, nothing whatsoever.
So she has a story.
So essentially in India, you have all
these strict surveillance laws which
require you to hand over your encryption
key, which mandate that all your
communications are intercepted.
You have these massive schemes
implementing this.
You have these, these technologies
and these companies selling spyware.
And yet there is no privacy law.
On top of that, prior to the
implementation of all the schemes I
mentioned before, there was no
parliamentary or public debates prior to
the implementation.
So essentially, what this shows is that
the government does whatever whatever
it wants.
It doesn't care if you feel that
its schemes are, you know, violating
human rights or whatever because it knows
what's good for you.
It's going to protect you and you just
have to blindly trust the government.
This itself is very concerning because
when the government doesn't even try,
you know, it's you put a friend or
doesn't even try to gain some type
of public consent that is fundamentally
problematic for the nature of the regime.
Even in the most authoritarian regimes,
you will see governments trying to gain
some type of public consent from the
public before going ahead with
like schemes and
projects which are invasive to people's
human rights.
But in India, that's even the case.
They don't even care about gaining public
consent. So that itself is
extremely problematic, to say the least.
So in light of all of this in
India, no privacy law.
All the surveillance schemes.
The question comes down to is privacy
dead or didn't even exist to begin with?
Well, many could argue that, hey, privacy
doesn't even exist to begin with because
this is India, and they don't necessarily
have the concept of privacy in their
culture because privacy itself
is a very individualistic type of human
rights. So it's something that's more
western in the way.
But in the end of the day, I think that
privacy is very important that everybody
all over the world should have this
right, regardless of their culture,
whatever, because privacy essentially
protects you from abuse from those in
power. And that is privacy
and chose your individual freedom and
your autonomy as a human being.
Which and that has nothing to do with
culture. So regardless of your culture,
because of everything else, everybody
should have this rights.
And in India, they're doing everything
they can to violate this.
Which is why with the center, for
instance, a society that I work with, we
have drafted a law because, you know,
a bill, sorry, a privacy bill.
Because hey, if the government does a one
to create one, we'll create for them and
hopefully they'll implement it someday.
So if you like, you can get in touch
with me and I can share the bill with
you. And if you have any feedback, if
there are any lawyers out there who would
like to look at us and give us any
feedback on how to improve it, they'll be
wonderful.
And general, if anyone would like to
cooperate and dealing and tackling
surveillance in India and restricting it,
please contact me. That would be amazing
because, you know, if we don't
right now, this is still the beginning
and we have to do something about it now.
And we don't do something about it now.
We'll regret in the future because it's
only getting worse.
And actually, we'll regret it if we're
lucky, if we're not lucky,
we won't regret it.
And the reason why we won't regret it is
because we won't even see it.
We won't even acknowledge it as a
problem.
And that is the worst thing that can
happen if surveillance is socially
integrated on a global level.
That's the worst thing that could happen
because we won't even acknowledge as a
problem and how we won't
resist to it and won't try to tackle it.
And so essentially what we're talking
about is the ultimate control of our
lives.
So if you don't want to ultimately
control, if you don't want to be totally
controlled, we have to do something about
it now. And I think it's very important
to start with India.
India, a country of 1.2 billion people
with an expanding middle class and the
reason why I'm emphasizing expanding
middle class is because a lot of people
are going to have more access to the
internet over the next two years.
It means that more people are going to be
under surveillance and hey, they won't
even tackle the system because they'll
want to maintain the new economic status.
So it's unlikely that they'll tackle the
government because of surveillance,
right? So we're talking about a
much scarier system
in the future, one which is likely to
affect every single one of us in the
future. So it's not just about India.
This is a global problem, and I really
recommend that we work together and we
try to find a solution for it now before
it's too late.
Thank you.
All right. Thank you very much.
Now we have some time left for Q&A.
Are there any questions?
Please go to the microphones over there
and over there and yeah,
you
know, that's a great start.
You didn't talk about how
getting a cell phone is so complicated in
India, you need to register and fill out
millions of phones.
Is this information that's collected in
the process of getting a SIM card
actually used by the CMS?
Or is this a completely different branch
of government?
I think the information gathered, you
know, when you register for some card is
not as clear.
It was used by the CMS because
essentially what the CMS does is that it
intercepts like old telecommunications
through tubes.
So that doesn't include data, you know,
for the SIM card per say.
However, you are right that actually
getting a SIM card is quite a complicated
process, and the reason why is
complicated. It was because they tried to
gather as much data as possible.
So in India, in order to get Go SIM card,
you have to give them a copy of your ID
or your passport.
You have to give them proof of address.
You have to give them a contract, which
proves that you actually love what you do
and so on. So there's a lot of
bureaucracy involved in actually getting
a SIM card.
However, nonetheless, most people you
know, go with with the bureaucracy and
they register anyway, and most people use
cell phones.
But that type of data, which is gathered
through that is basically
this is stored in ministries and like
mission before the data from different
ministries are shared, you know, through
that grid. So in many cases, the
government does have access to this data
and it can be used for whatever reason.
But it doesn't fall under the central
monitoring system per se, because that
that's basically involves the data
through TSP is.
OK. Over there, though, some questions.
Yeah, thank you for your great talk, and
this is really scary. I can't even
believe we're talking about the NSA
all the time and this.
Not at all, although it obviously
affects a lot more people.
But, yeah, Western media and all that.
My question is, what can you talk
about the political motivation in
the mass surveillance in India a little
more? Because, yeah,
in America, we know it's all
about terrorism and stuff.
And in India, I don't know if terrorism
is a problem or if it's about, I don't
know, child porn like we had in Germany
or I don't know what what the
official motivation is.
And maybe you can also talk about
what you think the real motivation might
be.
Thank you. Good question.
So just like in the West, the motivation
is crime and terrorism.
Right?
Actually, terrorism is actually more of a
problem in India than it is in the US or
in most countries of states because there
actually are terrorist attacks from
Pakistan in India.
I mean, terrorist activism actually is
a problem in India, unlike most Western
countries. So so
what we can see is that since 2008,
since the 2008 Mumbai attacks,
surveillance has just rapidly increased.
So since the that the Mumbai
terrorist attacks, we've had the
implementation of the central monitoring
system. We've had them permission of the
UIDAI.
We've had the limitation of the lawful
intercept and monitoring system.
So all these projects and these schemes
are referred to have been implemented
after following the 2008 Mumbai
terrorist attacks.
So I think it's safe to say that
the 2008 Mumbai terror attacks are
equally a landmark as the nine 11
terror attacks in the US.
So yeah, they definitely could.
Crime and terrorism as a reason for this.
In other cases, like in the case of the
UAE, which is the biometric data
collection scheme, what they
obviously can't close, you know, crime
and tourism there.
So what they do say in that case is that
the reason why they're collecting
biometric data is that they can provide
unregistered people in India and identity
because most people in India live in
rural communities, right?
And they're not even registered like
they're kind of like invisible citizens.
We don't even know they exist in many
cases. And this makes it very hard for
them to have access to governmental
services. So the government is arguing
that, hey, in order for us to provide
them access to governmental services and
for us to know who actually exist in the
fucking country, we're enrolling
their biometric data.
So that's what they say with regards to
that. Then with regards to child
pornography, that that as well is
something to keep. Citing pornography
in general is like illegal in India.
So they obviously want to censor it as
much as possible.
And in general, they've over the last
year, they're really trying to increase
cybersecurity in general.
They've even come down with this national
cybersecurity policy, which they
implemented a few months ago.
And essentially, the cyber security
policy allows for a lot of surveillance
as well. And that, you know, ISP's and
TSB implement, you know, install their
own hardware software to monitor
communications and so on, and that they
share intelligence and everything else
that comes with that.
So in public, they do argue
that the main reason for this is security
is to tackle crime and terrorism
is to tackle child pornography and
some case pornography in general to
provide an identity systems like in the
case of the UIDAI.
But in my personal opinion,
I really don't think a government would
invest so much money
in such a risky project in such risky
projects because in the day, the rescue,
because what you're doing is that you're
collecting humungous volumes
of data from literally a billion
people, and you're hoping this will make
sense. You're hoping that when you mine
the data, you'll be able to find the
right person.
So I think they're not really smart about
it. I think they're just like
from one sense. I think they just like
copying the West.
They're like, Oh, the West, you know,
carries out surveillance to, you know,
tackle crime and terrorism.
Let's do the same.
Let's just intercept everything,
monitor everyone and hope that,
you know, somehow this data will be
useful. We don't know why we're gathering
that to begin with.
But, you know, and hopefully later on,
we'll figure out why.
So I think that partly
they're just blindly copying the West.
And on the other hand, I think it comes
down to control because every government
knows that if you're able to
know everything about everyone,
you're a super powerful nerd.
There's nothing more empowering than
knowing everything a person has done,
everything they're doing and everything
they're likely to do.
Because even though something able to
predict, because once you have all this
data and your minus and use behavior
statistics on it, you're able to predict
with some type of probability how this
individual is likely to behave in the
future. And if you apply this on a mass
level, you're probably likely to predict
how the masses are likely to be in the
future. So this really comes down to
public control.
And I think that anyone who's in power,
like all they care about, is guaranteeing
and ensuring that they're still in power.
So it really comes down to public
control, in my opinion.
Thank you.
OK. I think we have time for
one question, and we have some questions
from the internet, so have a go.
Yes, we have a question from the
internets about the
referring to the privacy bill that the
CIA has drafted.
So someone's asking, does
the bill communicate information that
could be understood by the general
public, not
necessarily educated?
If it were debated in parliament?
So I can you repeat the last point, so if
the bill was debated in parliament, would
that would that what
I do is I decide the question?
OK?
So does the privacy bill
that C.O.s has drafted to communicate
information that could be on a suit by
the common man if it were a debate
in parliament? So Kamerman not
necessarily having been educated.
Hopefully, yes, hopefully.
So essentially what this bill, I mean, I
haven't personally drafted this bill has
been drafted by my lawyer colleague.
This is what this bill does, is that it
regulates data protection so that
data protection covers all data collected
and stored through the interception of
communications or whatever
this. This involves basically that
data might be collected, you know,
through companies data which may be
collected through schemes and nearly all
types of data. So it regulates it.
And then on top of that, what does is
regulate surveillance.
So by regulating surveillance and by
regulating data protection, essentially
that way, it kind of tries to,
you know, protects data which, you know,
which is harvested by the government,
even data collected by
citizens who you know,
are the least affected by it or not.
So for example, like I mentioned before,
the u8e scheme mainly affects the poor in
India because they're the ones who are
the most likely to register because
they're the ones who have to get access
to BPL catch up programs, right?
So by doing so, their data is vulnerable.
But through this bill, where we aim to do
is protect. This type of data is
collected to ensure that in every case,
in every case, it's very clear legally
who has access to the data under what
conditions the data is
disclosed and if so, why and how and
so on who it is shared with,
how long it's retained for and all other
questions revolving around it.
So this bill is not very specific to
specific types of data, but it covers
data protection in general and it
regulates surveillance and the disruption
of communications in general.
And it also establishes a privacy
commission which is responsible for
ensuring that data actually is protected.
But yeah, sure, there obviously this
law, this bill, obviously as imperfect.
I'm sure you can find lots of space for
a lot of criticism, and I'm sure there
might be loopholes.
It's very hard to create a perfect
bill, especially because
the person we have is that we're we've
been discussing this bill in roundtable
meetings with multiple stakeholders.
So we've actually had a lot of people
from the industry attending these talks,
and they've really tried to influence our
bill in the sense that what they have
been arguing is that, hey, if
individuals choose to give up their data
to our services, that obviously
means, you know, that they trust us with
their data. So that way, you know,
we're obviously getting their consent so
we don't have to ask for their consent in
other way, which I say, no, that
should not be the case. You should always
gain individual consent prior to handling
their data in any in any way.
But it's difficult because the thing is,
in order to actually implement the bill,
we have to discuss it with
a lot of stakeholders from the industry,
from the government and so on, because we
need them to support the bill so that it
can be, you know, implemented at all,
ever, you know.
But at the same time, there are trying to
influence in a way which is not very
privacy friendly.
We're getting there. We're still
discussing the bill. And if you like,
I can email it to you and you can have a
look. I'm not sure if that covered your
question, though.
OK, yeah. I think we're out of time
right now. So if you still have any
questions, I see you standing there and
over there, I think you will be able
to answer them on stage.
Yeah, of course. If you have any other
questions, come find me.
I'm happy to answer and to discuss and
analyze anything you like.
Great. Thank you very much.