Want Anybody's Personal Details From Aadhaar, India's Billion-Person Identity Database? Yours For $8

from the Aadhaar-admin-accounts-also-available-on-request dept

We've been writing about the world's largest biometric database, India's Aadhaar, since July 2015. Over 1.1 billion people have now been enrolled, and assigned an Aadhaar number and card, which represents 99.9% of India's adult population. There are currently around 40 million authentications every day, a number that will rise as Aadhaar becomes inescapable for every aspect of daily life in India, assuming it survives legal challenges. That scale necessarily entails a huge infrastructure to handle enrollment and authentication. So it will comes as no surprise to Techdirt readers that it turns out you can obtain unauthorized access to the Aadhaar system very easily, and for very little cost. As the Indian newspaper The Tribune revealed:

It took just Rs 500 [about $8], paid through Paytm [an Indian online payment system], and 10 minutes in which an "agent" of the group running the racket created a "gateway" for this correspondent and gave a login ID and password. Lo and behold, you could enter any Aadhaar number in the portal, and instantly get all particulars that an individual may have submitted to the UIDAI (Unique Identification Authority of India), including name, address, postal code (PIN), photo, phone number and email.

What is more, The Tribune team paid another Rs 300 [$4.75], for which the agent provided "software" that could facilitate the printing of the Aadhaar card after entering the Aadhaar number of any individual.

Given the repeated assurances by the UIDAI that the Aadhaar database was completely secure, this is big news, and led to some breathless damage limitation by the Indian authorities on Twitter. The UIDAI explained that: "Some persons have misused demographic search facility, given to designated officials to help residents who have lost Aadhaar/Enrollment slip to retrieve their details"; and: "There has not been any data breach of biometric database which remains fully safe & secure with highest encryption at UIDAI and mere display of demographic info cannot be misused without biometric". Although it may be true that this is not a biometric data breach, it nonetheless reveals a serious vulnerability in the system's design, and on a vast scale. According to the original article in The Tribune, more than 100,000 "village-level enterprise operators", hired to help with Aadhaar enrollment, have been offering this kind of unauthorized access to the database. In fact, the problem seems to be even more serious than simply providing login credentials to thousands of people. Here's what another Indian site discovered:

Following up on an investigation by The Tribune, The Quint found that completely random people like you and me, with no official credentials, can access and become admins of the official Aadhaar database (with names, mobile numbers, addresses of every Indian linked to the UIDAI scheme). But that's not even the worst part. Once you are an admin, you can make ANYONE YOU CHOOSE an admin of the portal. You could be an Indian, you could be a foreign national, none of it matters -- the Aadhaar database won't ask.

Even if biometric data is not involved, it's hard to see how UIDAI could claim that these aren't breaches of the database, or deny that the entire Aadhaar system is seriously compromised. It's almost inevitable that the security of an important database system will be defeated eventually in some way, since the rewards are by definition so high. The fundamental problem with Aadhaar is its underlying intent -- to create a single, giant database with key personal information about a billion people that can be accessed very frequently and very widely. That's never going to be safe, as the inevitable future breaches will confirm.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, database, hacked, id, identity, india, privacy

India's Supreme Court Rules Privacy Is A Fundamental Right; Big Ramifications For The Aadhaar Biometric System And Beyond

from the constitutional-core-of-human-dignity dept

In a move that will have major implications for the online world in India and beyond, nine Supreme Court judges have ruled unanimously that privacy is a fundamental right under the Indian Constitution. As part of a decision spanning 547 pages (pdf) they declared:

Privacy is the constitutional core of human dignity.

The case was brought as a result of a legal challenge to India's huge biometric database, Aadhaar, whose rise Techdirt has been charting for some years. A post on the EFF Web site explains the legal background, and why the Supreme Court decision was necessary:

The right to privacy in India has developed through a series of decisions over the past 60 years. Over the years, inconsistency from two early judgments created a divergence of opinion on whether the right to privacy is a fundamental right. Last week's judgment reconciles those different interpretations to unequivocally declare that it is. Moreover, constitutional provisions must be read and interpreted in a manner which would enhance their conformity with international human rights instruments ratified by India. The judgment also concludes that privacy is a necessary condition for the meaningful exercise of other guaranteed freedoms.

Now that a solid constitutional foundation for privacy in India has been affirmed, other judges will proceed with examining the legality of Aadhaar in the light of the many relevant points made in the ruling:

The Aadhaar hearings, which were cut short, are expected to resume under a smaller three- or five-judge bench later this month. Outside of the pending Aadhaar challenge, the ruling can also form the basis of new legal challenges to the architecture and implementation of Aadhaar. For example, with growing evidence that state governments are already using Aadhaar to build databases to profile citizens, the security of data and limitations on data convergence and profiling may be areas for future privacy-related challenges to Aadhaar.

A case challenging WhatsApp's new privacy policy that allows content sharing with Facebook is also certain to be affected by the ruling, but the ramifications go far beyond Aadhaar and the digital world. As an analysis in the Economic Times notes, the judgment could lead to the decriminalization of homosexuality in India, as well as affecting laws that restrict a person's right to convert to a different religion, and state-level rules that impose restrictions on animal slaughter. The breadth of those possible impacts underlines just how epoch-making last week's decision is likely to prove.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometrics, india, privacy

Two Bollywood Film Producers Get Court To Block Tons Of Sites In India, Including Archive.org

from the street-sweeper-for-justice dept

How many innocents would you accept being caught up in an action designed to nab criminals? How many good people is it acceptable to throw into jail alongside the truly bad actors? Most people would agree that any action that penalizes the innocent in order to punish the guilty is a bad course, with only truly minimal amounts of collateral damage being acceptable. Now let's port that over to internet sites and ask how many innocent websites is it acceptable to block in order to block sites that are actually engaged in undesirable behavior?

Well, for the legal system in India, that question has often been answered in a cavalier manner, with regular court orders to block innocent websites being doled out to battle both terrorism and at the request of copyright holders to stop infringement. It's in the latter cases where things get really silly, with previous orders issued to block sites like GitHub and the Internet Archive. Well, it seems the Internet Archive endured this sort of thing again recently, as a court order at the request of two Bollywood film studios caught archive.org into its ISP blocking web.

Earlier this week (and again for no apparent reason), the world renowned Internet Archive was rendered inaccessible to millions of users in India. The platform, which is considered by many to be one of the Internet’s most valued resources, hosts more than 15 petabytes of data, a figure which grows on a daily basis. Yet despite numerous requests for information, none was forthcoming from authorities. Quoted by local news outlet Medianama, Chris Butler, Office Manager at the Internet Archive, said that their attempts to contact the Indian Department of Telecom (DoT) and the Ministry of Electronics and Information Technology (Meity) had proven fruitless.

Now, however, the mystery has been solved. The BBC says a local government agency provided a copy of a court order obtained by two Bollywood production companies who are attempting to slow down piracy of their films in India. Issued by a local judge, the sweeping order compels local ISPs to block access to 2,650 mainly file-sharing websites, including The Pirate Bay, RARBG, the revived KickassTorrents, and hundreds of other ‘usual suspects’. However, it also includes the URL for the Internet Archive, hence the problems with accessibility this week.

Let's be clear about what this sort of thing represents: the punishment of the innocent in favor of an easy and lazy attempt to block copyright infringement. That's not an overstatement. The continued use of court orders to block entire websites and the routine collateral damage are not exceptions, they are the rule. That they are allowed to continue to do this sort of damage even while the Indian government hand-waves away frantic requests for information from innocent site operators is as good a definition of whatever the opposite of justice is as I can think of.

Importantly, neither the court that issued the order or the two film companies requesting it, and ostensibly providing the list of sites to be blocked, are due any recompense for these actions. Perhaps most frustrating, the Internet Archive has clearly stated that not only does it have a method for copyright holders to request content takedowns, but it complied with those requests from these very same film studios.

“Is the Court aware of and did it consider the fact that the Internet Archive has a well-established and standard procedure for rights holders to submit take down requests and processes them expeditiously?” the platform said. “We find several instances of take down requests submitted for one of the plaintiffs, Red Chillies Entertainments, throughout the past year, each of which were processed and responded to promptly. After a preliminary review, we find no instance of our having been contacted by anyone at all about these films. Is there a specific claim that someone posted these films to archive.org? If so, we’d be eager to address it directly with the claimant.”

Now, archive.org was not the only innocent site blocked by this order. Weebly.com, along with at least one news site and the site for a French ISP also had their sites blocked. Still, this damage appears to be mostly met with indifferent shrugs by the Indian government and the film studios that issued this request.

So, for India, we have an answer to the question of how many innocent sites it's willing to harm to combat copyright infringement. That answer, by our litmus test, is "too many."

Filed Under: copyright, india, internet archive
Companies: bbc

Indian ISPs Continue Futile Effort To Prevent Subscribers From Using Decent Encryption

from the good-luck-with-that dept

The global war against privacy tools, VPNs and encryption continues utterly-unhinged from common sense, and the assault on consumer privacy remains a notably global affair. Reddit users recently noticed that India's fifth largest ISP, YOU Broadband, is among several of the country's ISPs that have been trying to prevent customers from using meaningful encryption. According to the company's updated terms of service, as a customer of the ISP you're supposed to avoid using encryption to allow for easier monitoring of your online behavior:

"The Customer shall not take any steps including adopting any encryption system that prevents or in any way hinders the Company from maintaining a log of the Customer or maintaining or having access to copies of all packages/data originating from the Customer."

Of course enforcement of such a requirement is largely impossible. But You Broadband isn't just being randomly obtuse, and while the ISP's TOS is making headlines, this effort isn't really new. Most Indian ISPs are simply adhering to a misguided (and still not adequately updated) set of 2007 guidelines imposed by India's Department of Telecommunications (word doc) demanding that ISPs try and prevent their subscribers from using any encryption with greater than a 40 bit key length if they want to do business in India:

"The Licensee shall ensure that Bulk Encryption is not deployed by ISPs connecting to Landing Station. Further, Individuals/Groups/Organizations are permitted to use encryption upto 40 bit key length in the symmetric key algorithms or its equivalent in other algorithms without having to obtain permission from the Licensor. However, if encryption equipments higher than this limit are to be deployed, individuals/groups/organizations shall do so with the prior written permission of the Licensor and deposit the decryption key, split into two parts, with the Licensor."

Which is and of itself is rather hysterical, given that since 1996 or so, most folks have considered a 40 bit key length to be the security equivalent of wet tissue paper. In fact, Ian Goldberg won $1,000 from RSA for breaking 40 bit encryption in just a few hours way back in 1997, saying this at the time:

"This is the final proof of what we’ve known for years: 40-bit encryption technology is obsolete."

And yeah, that was twenty years ago. But this sort of policy is pretty standard fair in India, which is no stranger to censorship, internet filtering, and blind, often-mindless expansion of surveillance. India's government has also been at the forefront of attempting to impose backdoors in encryption, and there's a recent effort in some corners to attempt to ban Whatsapp as well.

I've yet to see any ISP successfully enforce this ridiculous governmental restriction (if you're in India and you have, let us know in the comment section precisely how). But it's still part of an over-arching mindset that sees standard, intelligent privacy and security practices as an enemy that must be thwarted. Usually either to expand government surveillance, prop up idiot ham-fisted internet filters (as we're seeing in Russia, China and India), or to erode consumer rights in the face of what are endless attempts to monetize your online behavior.

Filed Under: encryption, india, privacy, vpns

India Learns The Hard Way That Equating Patents And Innovation Comes At A Price

from the bankrupt-ideas dept

Last December, we wrote about China reaching a rather questionable milestone: filing one million patents in a single year. As Techdirt has pointed out repeatedly, more patents do not equate to more innovation, so simply filing huge numbers of patents means very little in itself. The government of India has just found this out the hard way. As The Hindu reports, CSIR-Tech, the commercialization arm of India's Council of Scientific and Industrial Research (CSIR), has had to shut down its operations. The reason? It's run out of money as a result of filing too many patents:

CSIR has filed more than 13,000 patents -- 4,500 in India and 8,800 abroad -- at a cost of ₹50 crore [about $7.7 million] over the last three years. Across years, that's a lot of taxpayers' money, which in turn means that the closing of CSIR-Tech is a tacit admission that its work has been an expensive mistake -- a mistake that we tax-paying citizens have paid for.

The Hindu explains that obtaining thousands of patents was not to protect innovative work, or even to boost licensing revenues. Instead, many scientists wanted to have a patent or two to their name in order to make their curriculum vitae look more impressive:

Recently, CSIR's Director-General Girish Sahni claimed that most of CSIR’s patents were "bio-data patents", filed solely to enhance the value of a scientist's resume and that the extensive expenditure of public funds spent in filing and maintaining patents was unviable. CSIR claims to have licensed a percentage of its patents, but has so far failed to show any revenue earned from the licences. This compulsive hoarding of patents has come at a huge cost. If CSIR-Tech was privately run, it would have been shut down long ago. Acquiring Intellectual Property Rights (IPR) comes out of our blind adherence to the idea of patenting as an index of innovation.

India's unfortunate experience is interesting because it shows how the erroneous view that patents are proof of innovation has led scientists to file applications for them purely out of vanity, with serious knock-on effects. Not only is there no evidence that the resulting patents were worth obtaining, but India's CSIR-Tech office has been forced to shut down as a direct result of applying for them.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cost, india, innovation, patents
Companies: csir

Photocopying Textbooks Is Fair Use In India: Western Publishers Withdraw Copyright Suit Against Delhi University

from the let's-celebrate-a-rare-win-for-the-public dept

Back in September last year, Mike wrote about the remarkable court ruling in India that copyright is not inevitable, divine or a natural right. As we have been reporting since 2013, the case in question was brought by three big Western publishers against Delhi University and a photocopy shop over "course packs" -- bound collections of photocopied extracts from books and journals that are sold more cheaply than the sources. Although the High Court of Delhi ruled that photocopying textbooks in this way is fair use, that was not necessarily the end of the story: the publishers might have appealed to India's Supreme Court. But as the Spicy IP site reports, they didn't:

In a stunning development, OUP, CUP and Taylor & Francis just withdrew their copyright law suit filed against Delhi University (and its photocopier, Rameshwari) 5 years ago! They indicated this to the Delhi high court in a short and succinct filing made this morning.

This withdrawal brings to an end one of the most hotly contested IP battles ever, pitting as it did multinational publishers against academics and students.

The Spicy IP post has a useful short timeline of the case, as well as a link to the site's extremely detailed coverage of all the twists and turns of the saga, which is now finally -- and definitively -- over. Importantly, the case was:

one that ultimately tested the bounds of copyright law in India. And clarified that while educational photocopying is permissible, there are limits to this as well. And that any copying must comport closely with the intended purpose ("in the course of instruction"). In that sense, publishers have made some gains in at least ensuring that a complete free for all regime is not what is intended by the law. But a circumspect one, where the copying has to fall within the bounds of the educational exception.

Overall, this is a huge victory for educational access and public interest in India. And very welcome in a world that was witnessing a rather one sided ratcheting up of IP norms, at the cost of all else!

That's an important point. So often it seems that copyright only ever gets longer and stronger, with the public always on the losing side. The latest news from India shows that very occasionally, it's the public that wins.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, fair use, india, photocopying, textbooks
Companies: cambridge university press, cup, delhi university, oup, oxford university press, rameshwari, taylor & francis

India Opening Up World's Largest Biometric Database For Commercial Applications, Despite Inadequate Privacy Protection

from the India-Stack-attack dept

Techdirt has been following India's construction of the world's largest biometric database, called Aadhaar, since July 2015. Concerns include the fact that what was billed as a voluntary system has been morphing into a compulsory one, and evidence that Aadhaar simply can't cope with real-life biometrics. Undeterred, the Indian government wants to expand the system even further by opening it up for use by companies, as the Wall Street Journal reports:

The Indian government has gathered digital-identification records, including fingerprint impressions and eye scans, of nearly all of its 1.2 billion citizens. Now a government-backed initiative known as "India Stack" aims to standardize ways to exchange the data digitally to facilitate the transfer of signatures and official documents that citizens need to get jobs, make financial transactions or access government services.

By allowing developers to incorporate use of government identification records in their commercial websites and apps, the initiative envisions Indians -- with mobile phones in hand -- using iris and fingerprint scans to sign up for insurance, invest in mutual funds, receive health-care subsidies and verify their identity for school examinations.

In itself, there's nothing wrong with this approach. Indeed, it has many benefits, notably making it easier for people to deal with India's bureaucracy, and helping to fight corruption. But those advantages could be compromised if privacy is neglected. And here the Indian government is sending all the wrong signals:

Prime Minister Narendra Modi's government has delayed a new bill that would bring India's privacy laws more in line with those of major European nations. Meanwhile, the government has questioned a constitutional right to privacy in pleadings before the Indian Supreme Court.

Without adequate privacy protection, the system seems ripe for abuse, both by unscrupulous companies targeting hapless consumers, and by state organizations, which might use it as a powerful surveillance tool. If the Indian government wants to become a world leader in using biometric-based digital identity for its citizens, as the Wall Street Journal article suggests, it should make crafting effective privacy protection laws a priority.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometrics, india, privacy

Indian High Court Blocks Rent-Seeking Collection Societies From Seeking Any More Rent

from the laws-are-for-other-people dept

Ben Challis of the 1709 Blog reports that one of India's top courts has just cut a few performance royalty "collection societies" off at the knees.

In a blow to three Indian music copyright collection societies, the Delhi High Court has restrained them from granting any such licence till April 24th 2017. Justice Sanjeev Sachdeva, in an interim order, restrained the Indian Performing Right Society (IPRS), the Phonographic Performance Ltd (PPL) and Novex Communications Pvt Ltd from contravening section 33 of Copyright Act, which provides that only registered societies can grant licences in respect of copyrighted work(s).

None of the three collection societies are registered, which means they can no longer shake down everyone from doctors (for music played in waiting rooms) to concert venues for licensing fees and performance royalties. In the latter case, the societies were often instrumental in limiting the amount of live music available to Indians, even though they had no royalty claim on the live music itself.

PPL collects a fee if any recorded music is played at a concert. "Live concerts do not need our clearance. But who can ensure that no recorded music will be played in the time gap between different artists or before the concert begins? At times people responsible for giving out permissions take unfair advantage in charging money. We are taking note of that and strict measures will be taken," says Sowmya Chowdhury, country head and director of PPL.

Venue owners were so intimidated by the societies' per-seat royalty demands they'd often refuse to host a concert if the artist couldn't come up with all sorts of paperwork.

PPL happens to be Phonographic Performance Ltd and IPRS is Indian Performing Right Society, two pan-India autonomous bodies that report to the central HRD ministry and control the fate of live performances. Their roles are not even completely understood by musicians, which often leads to trouble before concerts. Pt Tejendranarayan Majumder was at a loss when he was asked for innumerable no-objection certificates before a recent concert at an auditorium.

[...]

Most auditoriums demand no-objection certificates from PPL and IPRS. Even police permission is given only after these are submitted.

Once again, we have an entity supposedly looking out for artists doing what it can to prevent artists from earning a living. This is what they won't be able to do now, thanks to a change in the nation's copyright law.

Blocking these societies from collecting performance royalties won't do much for the artists signed to them. But then again, the collection societies weren't doing much for artists in the first place. IPRS has been particularly shady. Many royalty collection societies are known for their extremely limited distribution of funds. Those that do pay out more regularly still tend to hand the bulk of it to charting artists, no matter who actually earned it.

IPRS, however, apparently didn't even bother with limited royalty dispersals.

The IPRS will be investigated under Prevention of Money Laundering Act (PMLA), 2002, after it was alleged that the company (which was once a society) has collected royalties on behalf of authors, composers and music publishers, and failed to distribute it among the rights holders.

Fourteen months later, the results of the investigation have yet to be made public, but chances that royalties will soon be flowing to artists remain slim. IPRS and PPL are no longer public societies. They are both private companies.

PPL's decision to go private followed IPRS's. Both moves appear to have been motivated by government scrutiny. The government is still looking into IPRS's royalty distributions, but the society's decision to go private appears to have been a failed attempt to prevent this investigation from taking place.

IPRS in its petition had submitted that it had ceased to be a ‘copyright society’ and therefore the Central Government had no power to investigate IPRS. The Bombay High Court in dismissing IPRS’ petition had observed that the allegations for which the inquiry had been instituted were committed when IPRS was still a ‘copyright society’.

This move has completely backfired on IPRS. It didn't manage to avoid the investigation of its current collections, and it's now being prevented from collecting anything else for the next few months. And it very much looks like any fees it obtained between its opting out of India's "copyright society" and now were collected illegally.

These societies claim to be in the copyright business, but apparently can't bothered to adhere to the nation's copyright laws. And if those in the copyright business don't respect the law, they can't really get too bent out of shape if no one else does either.

Filed Under: collection societies, copyright, high court, india, performance rights, rent seeking