Another Nail In the Coffin Of Corporate Sovereignty, As Massive Asian Trade Deal RCEP Nears Completion Without It

from the ISDS,-what-is-it-good-for? dept

Remember RCEP? The Regional Comprehensive Economic Partnership is a massive trade deal being negotiated by most of South-East Asia -- including China and India. Although still little-known, it has been grinding away in the background, and is drawing closer to a final agreement. Almost exactly a year ago Techdirt noted that there were some interesting rumors that corporate sovereignty -- officially known as investor-state dispute settlement (ISDS) -- might be dropped from the deal. A story in The Malaysian Reserve confirms that is the case:

After missing several deadlines, member countries of the proposed Regional Comprehensive Economic Partnership (RCEP) have agreed to exclude the investor-state dispute settlement (ISDS) mechanism, a move that might expedite conclusion of the talks by the end of the year.

[Malaysia's] Ministry of International Trade and Industry (MITI) Minister Datuk Darell Leiking … said all RCEP member states -- 10 Asean countries plus six free trade agreement (FTA) partners namely Australia, China, India, Japan, New Zealand and South Korea -- have decided to drop the ISDS, but the item could be brought up again within two years of the agreement's ratification.

So corporate sovereignty is definitely out of the initial agreement, but could, theoretically, be brought back after two years if every participating nation agrees. Despite that slight loophole, this is a significant blow against the entire concept of ISDS. It's part of a larger trend to drop corporate sovereignty that has been evident for some time now. That still leaves plenty of toxic ISDS clauses in older investment treaties and trade deals, but the tide is definitely turning.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: china, corporate sovereignty, dispute settlement, india, isds, rcep, trade agreements

Indian Counseling Company Files Criminal Complaint Against Blogger Who Informed It About A Sensitive Data Leak

from the thanks-for-the-help!-they-sued dept

For doing the company the favor of informing it about a leaky AWS bucket exposing sensitive counseling records of 300,000 Indian employees, the company -- 1to1Help -- has filed a criminal complaint against the person who brought the situation to its attention.

In the middle of May, a researcher came across the exposed data and informed Dissent Doe of DataBreaches.net about their findings. After verifying the leak, Dissent Doe began trying to contact 1to1Help to inform it of the leak. No response was received until over a month later, possibly prompted by Dissent Doe contacting a large American company that was a customer of 1to1Help.

The slow response was blamed on internal email routing. Here's some of what was seen in the exposed bucket:

In looking at the plaintext counseling logs, I saw counseling logs for employees of Cognizant, IBM, HP, Capgemini, Dell, Oracle, and Microsoft.

[...]

There was more than 280,000 records in the users’ table, and more than 300,000 records, total, in the exposed bucket. As of the time of this posting, we have not been told for how long the bucket was exposed. Nor do we yet know how many unique IP addresses may have accessed and/or downloaded the data. What we do know is that contact information for employees of business and financial sector firms was freely available — as was sensitive information for some of them that might be used by miscreants for spearphishing or even extortion.

Data on employees included their first and last names, their username, their email address, their password (in plaintext in some tables), their telephone number, IP address, gender, and their relationship status.

Keep in mind that 1to1Help is a counseling firm that provides mental and physical health services to customers. That gives you some idea just how sensitive this information is, especially when bundled with the usual PII and personal email addresses.

The contact person at 1to1Help sent an email detailing the steps the company had taken, as well as preventative measures deployed to prevent further leaks in the future. Unfortunately, 1to1Help's Anil Bisht also tried to talk Dissent Doe out of writing about this leak.

As a small India based business (where there is no 911 support for threats and suicides, and where until recently suicide was criminalized) it has been an uphill battle to popularize and gain acceptance for counselling. By publishing specifics, this would bring about a general mistrust and discourage employees from reaching out to counselling firms such as ourselves. This in turn would be detrimental to the users and may even lead to loss of life. We cannot emphasize the impact of this enough.

[...]

We once again thank you for your time in interacting with us and respect that your interest is in safeguarding the users. May we once again request you to desist from publishing & securely delete any user data that you may have.

Doe refused, stating that she would not be covering up the leak. Nor would she delete the data until full disclosure was made by 1to1Help.

Because of this refusal to cover up 1to1Help's screw-up, the company has decided to take legal action against Doe and her site by filing a criminal complaint in India. It has already managed to secure an injunction against the site forbidding it from publishing… an article that has already been published.

The injunction was issued by a civil court in Bangaluru on August 6th — five days after I published my report on the leak. The plaintiffs are seeking a permanent injunction that would bar me and my site:

- from disclosing, publishing or broadcasting the schedule data or any part thereof; and

- from publishing or broadcasting any report or article on the breach of the schedule data as threatened (sic) in their emails dated 11/06/2019, 14/07/2019 and 30/07/2019 addressed to the plaintiff;

The suit also seeks to direct Domain People to block the website of DataBreaches.net.

As Doe notes, it appears 1to1Help's lawyers made a number of self-serving omissions when filing this complaint. First, they failed to point out the article had already been published, which would have allowed the court to review the content and see if it actually violated the law.

Second, the lawyers claimed Doe's site was "rogue," due to it containing no contact information for Doe. They were either wrong or lying, as Doe's site does contain a contact number and she is reachable via social media and other venues, having spent more than a decade covering security breaches.

Finally, 1to1Help claimed in its filing that Doe tried to blackmail it by giving Anil Bisht deadlines to respond for comment before publication. That's called journalism, not blackmail, and either its lawyers can't comprehend that or willfully misportrayed this extremely common process to the court.

The problem isn't the person reporting the leak. The problem is the leak and the company that took its time responding to the problem and then decided to take legal action when the person reporting the leak refused to cover it up.

This leak was not the fault of databreaches.net or the researcher who found it and provided data to this site. This leak was the responsibility of the entity responsible for securing the data properly but who did not encrypt it, who failed to detect their own error, and who then ignored multiple attempts to notify them that they had a leak.

What if I hadn’t persisted in trying to notify them? Their filing notes that they were contacted by a client on June 27. Whom do you think notified that client? It was this blogger and this site — still trying to get 1to1Help.net to address the leak. Not to toot our own horn, but if it wasn’t for this site’s persistence, they’d still be exposing sensitive data that the whole world could be downloading. And yet the company wants me charged criminally and got an injunction to try to censor me from reporting on their security incident?

This is far too common a response and it's certainly not limited to India, where the legal system is often used to target speech complainants don't like. Doe resides in the United States, so the First Amendment protects everything she's written, even from a company halfway around the world that doesn't like its lax security discussed in public.

Filed Under: breaches, criminal complaint, dissent doe, india, leaks, reporting
Companies: 1to1help

Why Carl Malamud's Latest Brilliant Project, To Mine The World's Research Papers, Is Based In India

from the sci-hub-to-the-rescue-again dept

Carl Malamud is one of Techdirt's heroes. We've been writing about his campaign to liberate US government documents and information for over ten years now. The journal Nature has a report on a new project of his, which is in quite a different field: academic knowledge. The idea will be familiar to readers of this site: to carry out text and data mining (TDM) on millions of academic articles, in order to discover new knowledge. It's a proven technique with huge potential to produce important discoveries. That raises the obvious question: if large-scale TDM of academic papers is so powerful, why hasn't it been done before? The answer, as is so often the case, is that copyright gets in the way. Academic publishers use it to control and impede how researchers can help humanity:

[Malamud's] unprecedented project is generating much excitement because it could, for the first time, open up vast swathes of the paywalled literature for easy computerized analysis. Dozens of research groups already mine papers to build databases of genes and chemicals, map associations between proteins and diseases, and generate useful scientific hypotheses. But publishers control -- and often limit -- the speed and scope of such projects, which typically confine themselves to abstracts, not full text.

Malamud's project gets around the limitations imposed by copyright and publishers thanks to two unique features. First, Malamud "had come into possession (he won't say how) of eight hard drives containing millions of journal articles from Sci-Hub". Drawing on Sci-Hub's huge holdings means his project doesn't need to go begging to publishers in order to obtain full texts to be mined. Secondly, Malamud is basing his project in India:

Over the past year, Malamud has -- without asking publishers -- teamed up with Indian researchers to build a gigantic store of text and images extracted from 73 million journal articles dating from 1847 up to the present day. The cache, which is still being created, will be kept on a 576-terabyte storage facility at Jawaharlal Nehru University (JNU) in New Delhi.

India was chosen because of an important court battle that concluded two years ago. As Techdirt reported then, it is legal in India to make photocopies of copyright material in an educational context. Malamud's contention is that this allows him to mine academic material in India without the permission of publishers. But he also believes that his TDM project would be legal in the US:

The data mining, he says, is non-consumptive: a technical term meaning that researchers don't read or display large portions of the works they are analysing. "You cannot punch in a DOI [article identifier] and pull out the article," he says. Malamud argues that it is legally permissible to do such mining on copyrighted content in countries such as the United States. In 2015, for instance, a US court cleared Google Books of copyright infringement charges after it did something similar to the JNU depot: scanning thousands of copyrighted books without buying the rights to do so, and displaying snippets from these books as part of its search service, but not allowing them to be downloaded or read in their entirety by a human.

The fact that TDM is "non-consumptive" means that the unhelpful attitude of academic publishers is even more unjustified than usual. They lose nothing from the analytical process, which is merely extracting knowledge. But from a sense of entitlement publishers still demand to be paid for unrestricted computer access to texts that have already been licensed by academic institutions anyway. That selfish and obstructive attitude to TDM may be about to backfire spectacularly. The Nature article notes:

No one will be allowed to read or download work from the repository, because that would breach publishers' copyright. Instead, Malamud envisages, researchers could crawl over its text and data with computer software, scanning through the world's scientific literature to pull out insights without actually reading the text.

The thing is, if anyone were by any chance interested in reading the full text, there's an obvious place to turn to. After all, the mining is carried out using papers held by Sci-Hub, so…

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: academic papers, carl malamud, copyright, india, journals, research, science, tdm, text and data mining
Companies: sci-hub

Indian Gov't Uses National Security Law, Bad Information To Block Twitter Accounts All Over The World

from the censorship-starts-at-home-but-has-plenty-of-travel-options dept

US social media companies are continuing to act as proxy censors for governments around the world. This is adding some bizarre twists to stories of social media content takedowns as governments target posts by non-citizens located thousands of miles away.

India may have abandoned a fake news law, but it still acting as though unverified news is a threat to national security. In a case covered by Kevin Poulsen for The Daily Beast, an American college student's tweets were targeted by the Indian government, which claimed the student was engaging in spreading propaganda.

Twitter is warning a Texas college student that it might “be obliged to take action” after some of his tweets were ruled a national security threat by the government of India eight thousand miles away.

The notice issued to 21-year-old Ryan Barenklau on Saturday is part of a crackdown on a group of open-source investigators who spend their days sifting through data and imagery to glean insights on regional conflicts around the world. Barenklau’s focus is primarily on Crimea and North Korea, but in May a journal in India wrongly claimed his account was part of a Pakistani disinformation ring.

Barenklau was hit with notices from Twitter over five tweets, none of which mention India. The tweets discussed North Korean missile tests, possible US government action in Iran, the recent Hong Kong protests, and, weirdly, CBS News footage of the Notre Dame cathedral fire.

Others received similar notices recently originating from the Indian government, including a British student who tweets covered Syria, Sudan and the Gulf of Oman, and "NatSecJeff," the Twitter account of Pakistani investigator/British counterterrorism think tank member Faran Jeffery.

The scattershot approach of these takedown demands suggests the Indian government is using an automated tool to search for targets and issue notices. Securing the nation from online threats is a job that is too important not to do, but not important enough to do well.

But there's more to this than bulk removal requests. Research published by the Great Game India journal claimed these accounts were all part of a coordinated misinformation campaign by Pakistani operatives.

Great Game India pegged Jeffery as a fake news operative working for Pakistan, citing some of his other tweets, and the fact that he previously worked for a Pakistani institute with military ties. In May, an Indian newspaper aired the journal’s findings under the headline “Retired Pak officers behind 'fake news,’” publishing a list of seven additional Twitter accounts that frequently share Jeffery’s tweets.

The paper, citing Great Game India’s research, claimed all the accounts “have Pakistani roots."

Now that the damage has been done and content blocked, the journal's researchers are saying mistakes may have been made. But they're unwilling to go into specifics about which of the targeted accounts -- which include two US college students -- they're wrong about. Given the circumstances, it appears the Indian government is targeting Twitter accounts in the US and Britain for spreading misinformation… based on bad information.

Pushback from US tech companies has been minimal. Users no longer need to fear just their own governments, but every government in the world. As more governments enact laws directly targeting speech, the effects will continue to be felt around the globe.

Filed Under: automated censorship, censorship, india, social networks
Companies: twitter

Stupid Battle Over YouTube Subcribers Now Includes A Takedown Order From A Court In India

from the courting-subscribers dept

One of the stupidest fights over internet points has reached its latest nadir. It's nadirs all the way down, tbh. If you're interested, there's an entire Wikipedia page with a blow-by-blow of YouTuber PewDiePie's fight against Indian content conglomerate, T-Series. It starts with subscriber counts and ends with a court order. In between, there's racism, hacked printers, billboard purchases, invective of all varieties, and this salvo from the controversial PewDiePie: a "diss track" called "Bitch Lasagna."

If you're inclined to click through and assail yourself with "Bitch Lasagna," you'll be greeted with some of the worst white boy rapping since white boys started rapping. Robert Van Winkle is rolling over in his grave. [Note: My apologies to all of us: I've been informed Mr. Van Winkle is, unfortunately, still alive.] Contained in this video are some slurs against the country of India and its inhabitants -- not all that unexpected for a diss track.

What's a little more unexpected is how far T-Series will go to up its subscriber count and fan the flames of this meaningless -- but lucrative -- battle over numbers in a little red box. There's now a court involved.

Delhi HC has ordered the removal of PewDiePie’s diss tracks against T-Series namely ‘Congratulations’ and ‘Bitch lasagna’, Bar and Bench reports. YouTube has also been ordered to see that these videos are not uploaded on the platform again. If you search for either of the videos on YouTube, you will see that they are not available in India.

[...]

The High Court was of the opinion that the songs have “repeated comments made which are abusive, vulgar and also racist in nature,” according to the report. The matter is currently pending in the Delhi High Court and the next hearing will take place on July 15.

The court isn't wrong. The video contains all of those elements. But this isn't really about someone offending a country with over 1 billion residents. It's about who has the higher subscriber count. By geofencing PewDiePie out of India, T-Series can hope to grab the lead for good. This is a race to the bottom and T-Series has taken the lead by using the power of the government to nuke a competitor's video.

But I'm sure -- given enough time -- PewDiePie or his supporters will find a way to "top" this. Taking control of unsecured devices and vandalizing war memorials is just part of the stupid, stupid game being played here.

Filed Under: courts, diss tracks, india, pewdiepie, subscribers, vulgar language
Companies: t-series, youtube

Report: In Bollywood, Movie Piracy Is Largely Carried Out By Rival Publishing Houses

from the inside-job dept

To hear it from the film industry writ large, a certain picture is painted in one's head when film piracy is discussed. That image is of a person, typically young, perhaps living in Mom and Dad's basement and covered in Cheetos dust, illicitly downloading film after film for their personal enjoyment, cackling evilly all the while. And, hey, personal downloading that amounts to infringement is certainly a thing.

But it's not the only thing. In India, where Bollywood has often put out the same old story about the evils of piracy, and where the government recently ramped up criminal penalties for recording or transmitting films and audio, one newspaper has comments from within the industry that suggest much of the film piracy in question is specifically enabled by rival publishing houses.

According to a Tamil cinema DVD seller, who spoke on the condition of anonymity, piracy is mostly an inside job. The source explains that movie companies are leaking each other’s films, as a competitive move.

“People from rival production companies or those from the creative department secretly release the movie online or circulate it as DVDs to hit the collection at the box office,” the source said.

This sounds like a Wild West story, but the allegations don’t stop there. Another source said that the local censor board and distribution houses are also on the piracy bandwagon.

“Another industry source said insiders in the censor board and distribution houses sell these copies for up to `5 lakh. The copies are uploaded on private portals that have dedicated passkeys,” the Times of India reports.

None of this specifically excuses downloading a film illicitly, of course. However, it most certainly does call into question the industry claims that piracy is by and large harming the wider film industry. If that were true, then these industry insiders uploading cam-footage and other films of recent releases would be committing self-inflicted wounds. Doing so would make little sense, were the larger claims of the industry true.

Amazingly, this goes even further down the chain, supposedly. These insiders work with theater owners to get these recordings, rather than movie-going citizens.

When it comes to recording video and audio at movie theaters, it is believed that some movie industry insiders work in tandem with theater owners to leak high profile films. As a result, some films appear online just hours after their official premiere.

So we have multiple layers of India's film industry facilitating the infringement of that industry's films to harm the competition, all while the studio heads and government say that it really hurts the entire film industry. If all of this is true -- and it's definitely an "if" --, it would appear that Bollywood is very busy harming itself for reasons that can't be explained.

Other than to say that the industry's hand-wringing is overblown, of course.

Filed Under: bollywood, competition, india, movies, piracy, studios

Indian Government Wants Tech Companies To Give Law Enforcement 24-Hour Access To User Data And Broken Encryption

from the it's-going-to-get-a-whole-lot-worse-before-it-gets-even-worse dept

India's government is joining the rest of the world in seeking more direct control of the internet. We in the US used to be able to point at Section 230 immunity and the First Amendment as evidence of our hands-off approach, but with the passage of FOSTA and multiple legislators demanding tech companies engage in more moderation and less moderation simultaneously, we've ceded a lot of the high ground.

The Indian government, however, is seeking to expand its control of the internet far past what should be considered reasonable in a nation whose government pays occasional lip service to protecting free speech. In addition to its already-abused laws covering certain forms of speech -- which, in practice, tends to mean criticism of government officials -- the Indian government is demanding speedy takedowns of content and direct access for law enforcement to user info, posts, and comments around the clock.

The proposals would… require any platform with more than 5 million users in India to appoint a “person of contact” for “24x7 coordination with law enforcement agencies and officers”, keep a record of all “unlawful activity” for 180 days (or indefinitely if mandated by a court), and send monthly notifications to every user informing them that the platform can “remove non-compliant information” immediately and kick the user off.

This is the result of discussions with representatives from companies including Google, Facebook, Whatsapp, and Twitter. There's no word yet on how compliant these companies will be. The only news that's surfaced so far is the Indian government's long list of demands. And those demands include something becoming distressingly popular in world governments: broken encryption.

“[On] the face of it, [the government seems] to be contemplating pro-active censorship and breaking encryption with traceability,” Apar Gupta, an Indian Supreme Court lawyer and cofounder of the Internet Freedom Foundation, told the Indian Express. “They will make the internet a corporal environment, damaging the fundamental rights of users.”

This will more closely align India's control of the internet with the Chinese model (or the Australian model!) -- something no nation should be in any hurry to adopt. That tech companies may be willing to comply with these demands rather than lose millions of users is worse news for everyone who uses their platforms. One just needs to look at Turkey's stranglehold on Twitter to see where this will be headed: tech companies will be complying with laws not valid in their home countries, allowing authoritarian rulers to silence critics and stifle dissent by proxy.

From what's been observed so far, Whatsapp seems to be the only company publicly resisting the Indian government's advances. Buzzfeed reached out to the other companies involved in these talks but has not received any comments or statements in response. Whatsapp's refusal to cooperate with India's demands for broken encryption dates back several months, but it's unlikely to have changed its views on undermining the protections it offers its users.

It's more bad news for internet users around the world, some of whom are going to be caught up in the Indian government's new net rules, even though they don't reside in that nation. Agreeing to help the government directly police users and/or break encryption will create ripple effects felt far outside the borders of India.

Filed Under: encryption, going dark, india, law enforcement