Mozilla's Open Letter To Expert Committee Drafting India's First Data Protection Law Slams Aadhaar Biometric Identity System

from the the-lizard-wrangler-speaks dept

Techdirt has been covering India's monster biometric database, Aadhaar, since 2015. Media in India, naturally, have been on the story longer, and continue to provide detailed coverage of its roll-out and application. But wider knowledge of the trailblazing identity project remains limited. One international organization that has been working to raise awareness is Mozilla, home of the Firefox browser and Thunderbird email client.

Last May, an opinion piece entitled "Aadhaar isn't progress -- it's dystopian and dangerous", by Mozilla Executive Chairwoman and Lizard Wrangler Mitchell Baker and Mozilla community member Ankit Gadgil, appeared in India's Business Standard newspaper. In July 2017, Mozilla released a statement on the Indian Supreme Court hearings on Aadhaar. A blog post in November pointed out that the Aadhaar system is increasingly being used by private companies for their services, something Techdirt covered earlier. Similarly, after it was revealed that anybody's Aadhaar details could be bought for around $8 each, Mozilla issued a statement saying "this latest, egregious breach should be a giant red flag to all companies as well as to the UIDAI [Unique Identification Authority of India] and the [Indian] Government."

Following the creation of a committee to draft India’s first comprehensive data protection law, Mozilla has now paid for an open letter to appear in The Hindustan Times. It was written by Baker, and co-signed by 1,447 Mozilla India community members. Although the letter welcomes the work being carried out by the committee of experts, it criticizes Aadhaar for its many failings, and points out some serious omissions in the committee's report on data protection:

The current proposal exempts biometric info from the definition of sensitive personal information that must be especially protected. This is backwards, biometric info is some of the most personal info, and can’t be "reset" like a password.

The design of Aadhaar fails to provide meaningful consent to users. This is seen, for example, by the ever increasing number of public and private services that are linked to Aadhaar without users being given a meaningful choice in the matter. This can and should be remedied by stronger consent, data minimization, collection limitation, and purpose limitation obligations.

Instead of crafting narrow exemptions for the legitimate needs of law enforcement, you propose to exempt entire agencies from accountability and legal restrictions on how user data may be accessed and processed.

Your report also casts doubt on whether individuals should be allowed a right to object over how their data is processed; this is a core pillar of data protection, without a right to object, consent is not meaningful and individual liberty is curtailed.

On a Web page called "Key challenges and the way forward", Mozilla calls on the Indian government to "pause further roll out of Aadhaar until the major problems with Aadhaar have been addressed." It also has a further suggestion:

The Indian government must release Aadhaar as true open source software rather than use language of open source, and encourage the use, development, and adoption of open source as a pillar of the Aadhaar system

Of course, you might expect an open source foundation like Mozilla to say that, but nonetheless it's good to see what is at heart a software organization engaging with global problems that affect huge numbers of people in this way. Others should do the same.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometrics, database, india, privcy
Companies: mozilla

Canadian Courts Edging Towards A Warrant Requirement For Device Searches At Borders

from the putting-it-a-step-ahead-of-the-Land-of-the-Free dept

The problem with border searches making a mockery of rights respected (for the most part) elsewhere in the nation isn't limited to the United States. Up in Canada, courts (and lawyers) are asking the same questions: how well are old, pre-smartphone laws holding up to today's reality? Everyone already knows what the answer is: not well. The question is: when will the Canadian government do anything about it?

Canadians -- like Americans -- have the right to be free of unreasonable searches. Unfortunately, just like in America, this right seems to evaporate when one approaches the border. According to the Canadian customs law, border guards can search a lot of stuff travelers carry without a warrant.

[S]ection 99(1)(a) of the Customs Act… gives border officers the power to, "at any time up to the time of release, examine any goods that have been imported and open or cause to be opened any package or container of imported goods and take samples of imported goods in reasonable amounts."

According to the government, this means smartphones, tablets, and laptops should be treated as "containers," with the "entire lives" stored within being nothing more than items in a box. The Canadian government has chosen to equate smartphones with briefcases, arguing the incredible amount of personal information stored on phones is just a stack of papers. It's not much different than the arguments made on this side of the border, where the government has equated smartphones to pants pockets or address books, even though smartphones contain boxes full of documents (metaphorically) -- often far more information than anyone actually keeps physically in their homes.

Border security is a bit different than regular law enforcement. Law enforcement is able to empty the pockets of detainees and make limited searches of backpacks, luggage, etc. for officer safety reasons -- mainly to prevent overlooking a weapon that could be used against them. This analogy fails when it's a smartphone, which can't be used as a weapon. Outdated analogies are part of the reason the US Supreme Court erected a warrant requirement for cellphone searches. Canadian courts appear to be headed in the same direction, but the border location of these searches complicates matters.

Unlike a briefcase or a filing cabinet, judges have found, a smartphone can contain "immense amounts of information" that touch a person's "biographical core."

They've acknowledged that laptops create detailed logs and trails of data that can be used to retrace a person's steps in ways that physical documents can't.

And lawyers have successfully argued that smartphones and laptops, far from being static stores of information, are in fact portals to the near-limitless volumes of data stored in the cloud — from social media profiles to email accounts and file-sharing apps.

It was in this context that a Manitoba provincial court judge last year made a significant ruling: just as Section 8 of the Charter of Rights and Freedoms protects Canadians from unreasonable search and seizure, that right should also apply at the border when an officer asks to search your smartphone or laptop.

If this decision is upheld, there would be a warrant requirement for cellphone searches, even at the border. This would place Canada ahead of the US in terms of privacy protections. While there is a warrant requirement in place for cellphone searches of arrestees, courts in the US have held national security priorities trump the Fourth Amendment at the border. In response, there's been a surge in the number of devices searched without a warrant, jumping from 5,000 to nearly 20,000 from 2015 to 2016 -- and nearly 5,000 PER MONTH have been searched so far this year.

And while all the discussion about warrantless device searches at the border tends to revolve around national security, three of the four cases seeking to challenge the Canadian government's stance on device searches deal with child porn. The fourth involves drug trafficking. Not exactly as advertised when pitched to the public. Cases where privacy protections would have demanded a warrant have been exempted thanks solely to the physical location of the search.

Filed Under: borders, canada, device searches, privcy, warrants

Where's The Outrage Over The Gov't Brushing Mass Privacy Violations Under The Rug?

from the what-a-joke dept

I have to admit that I've been a bit in shock over Congress's decision to simply renew the Patriot Act, recently, without a single safeguard to protect against abuse. That's because just before all this happened, we wrote about how a report from the government found (not for the first time) that the FBI regularly abused its authority to get phone records it had no right to. This went well beyond earlier reports of abusing National Security Letters. In this case, the FBI didn't even bother with NSLs. Instead, sometimes it would just use a post-it note. On top of that, reports came out noting that just weeks before this report was released, the Obama administration issued a ruling with a blanket absolution for the FBI's activities -- basically saying that if the President said it was okay, it was fine.

This is not how our government is supposed to work.

Julian Sanchez has a fantastic article that should be a must read, detailing how Obama went from being a candidate who insisted there would be "no more National Security Letters to spy on citizens who are not suspected of a crime" because "that is not who we are, and it is not what is necessary to defeat the terrorists," to one who appears to have no problem regularly spying on citizens and covering it up. President Bush was really bad with warrantless wiretapping and retroactive immunity for telcos -- and most people figured Obama would at least be marginally better on that issue. But it's really scary how the entirety of the federal government doesn't seem to care much about these blatant privacy abuses -- and the public and the press has shrugged them off as well.

Given all the reports of abuses, and Obama's campaign statements, you would think that at least the government would put in place some kind of oversight and safeguards when the Patriot Act came up for renewal. No such luck. In fact, the administration appears to have worked with Republican Senators to make this possible. I don't think this is what people meant when they expected to see more "reaching across the aisle" from the President:

Indeed, by the time the House Judiciary Committee took up the question of reauthorization in early November, legislators of both parties were venting their frustration about the scant guidance they'd gotten from the administration.

Behind closed doors, however, the administration was anything but silent. Instead of openly opposing civil-liberties reforms that had been under consideration in the Senate, The New York Times reported in October, the Obama administration opted for a kind of political ventriloquist's routine. The Justice Department wrote a series of amendments diluting or stripping away the new protections, then laundered them through Republicans on the Judiciary Committee, who offered them up verbatim.

It's worth taking a closer look at one such reform proposal -- again, predating the latest and most damning OIG report -- to get a sense of the disconnect between the administration's public and private stances. Some legislators had wanted to require the FBI to develop "minimization procedures" for NSLs, as they do when full-blown wiretaps are employed, to ensure that information about innocents is not circulated indiscriminately and that irrelevant records are ultimately discarded. This would only bring NSLs in line with other Patriot provisions compelling production of business records, where minimization is already required, and in principle, the Justice Department is already on board with this plan: As Inspector General Glenn Fine noted in his testimony before the Senate in September, the department's NSL working group was already laboring to develop such procedures in response to the abuses documented in previous OIG reports -- but the working group had been dragging their heels for more than two years.

The task of blocking any legal requirement that the Justice Department pick up the pace fell to Rep. Dan Lungren, a Republican from California. At a House markup session in November, Lungren offered up an amendment that would strip away the minimization mandate and even argued, bizarrely, that the very concept of "minimization" was inapplicable in the NSL context. He was visibly confused when Judiciary Committee Chair John Conyers, after making a point of praising Lungren's "scrupulous study" of the issue, pointed out that the Justice Department itself had publicly accepted the need for such procedures.

"This is the first I had heard that the Justice Department was either considering it or had not raised any objections to this," a visibly perplexed Lungren stammered, "because it was my understanding they felt this was an inappropriate transfer of a process that is used in the electronic surveillance arena." The talking points with which Lundgren had been supplied, it seems, had not been checked against the official assurances the department had been providing.

Sanchez's writeup goes into a lot more detail, but it's a depressing look at today's politics, media and the public as well. Politicians from both parties first belatedly tried to "legalize" blatantly illegal spying on Americans, and then, when they had an immediate opportunity to put in place the most basic safeguards because "that is not who we are," instead conspired with each other to renew the law and completely ignore the vast and blatant abuses of it. When you wonder why so few people trust politicians, this is why.

Equally troubling is the fact that the story of the widespread spying basically disappeared after a week. Sure, lots of people are focused on the buzz du jour (healthcare, healthcare, healthcare), but how is it that everyone is just willing to forget that our own government has been spying on thousands of people in ways that flagrantly violate what the law clearly states?

Filed Under: patriot act, privcy

UK Officials Accused Of Colluding With Phorm

from the that-would-not-be-good dept

While the US quickly condemned clickstream tracking as a likely violation of privacy, many were quite surprised when UK officials went in the other direction, suggesting that Phorm's tracking was legal. The European Commission was so annoyed by this that it's taking legal action against the UK for privacy violations. But, still, many people are wondering why the UK government said something like Phorm was legal... and now accusations are coming out that it's because UK government officials let Phorm take part in writing the policy. There are a bunch of incriminating emails between the Home Office and Phorm, including one where officials ask Phorm execs if they would be "comforted" by the position the gov't was about to take. In another, the officials ask Phorm to review the document and give feedback, prior to the gov't releasing the actual policy. Talk about regulatory capture... The government, for its part, claims that people are misreading the emails, but it's difficult to see how the emails can be misread when they blatantly ask Phorm to review the document, and inquire whether the company and its partners will be comforted by the ruling.

Update: On top of this, it appears that Phorm is now lashing out at critics, claiming that they're "smear merchants" and "privacy pirates." That sounds convincing...

Filed Under: behavioral advertising, collusion, privcy
Companies: phorm