Дата публикации

On some aspects of information security in India

Over the past decades, the issue of fake information in India has become a serious problem. And although the country has a stable and well-deserved reputation as one of the world's IT leaders, until recently, the authorities paid relatively little attention to both the introduction of cybertechnologies into the management system and their use to counter cyberthreats. The scandal surrounding the UK-based consulting company Cambridge Analytica, which was misusing users' personal data for political purposes without their consent, has added fuel to the controversy.

In an adequate response to the growing challenges in 2017, Indian government launched a new social media policy (guidelines) to counter "anti-India activities" designed to help intelligence and security forces effectively combat any propaganda.

Earlier, in 2013-2014, the state-owned Indraprastha Institute of Information Technology (New Delhi) funded by the Ministry of Electronics and Information Technology, under the project "Integrating Open Source Intelligence from Traditional Sources and Online Social Networks for Intelligence Gathering" (budget of approx. USD 235,000), developed a unique software product to monitor content on social networks – Advanced Application for Social Media Analytics or AASMA.

In February 2016, there were reports in the media about the plans of the secretariat of the National Security Council to create a National Media Analytics Center, which would use AASMA. It was reported that this software was capable of collecting and analysing "live data" about users from several social networks, including Twitter, Facebook, YouTube, Flickr and Google+ 24/7, combining posts, networks of connections and comments, identifying "top users", conducting posts "mood analysis", classifying them into "positive", "negative" or "neutral" categories, inventing instant counters to suppress the outrage caused by the news, "so that personal opinions do not threaten the rule of law and do not turn into public protests".

AASMA aims to help "remember" the author's past behaviour patterns on the web, check how many times he/she has assumed negative/positive attitude, website preferences, etc. In addition, the tool was also planned to be used to create so-called "Social Networking Laboratories" in regional police departments for ongoing real-time monitoring to analyse public sentiment, identify behavioural patterns, opinion leaders, compile predictive analysis of expected events, conduct campaigns on "neutralization" of negative sentiments in social networks, etc. The program can track users' devices and their location and send "alerts" to the authorities depending on the established criteria.

In August 2017, Indian authorities withdrew a tender offer to establish a social media control centre after the Supreme Court called the plan an attempt to create a "surveillance state". But even before the government's plans were released to the public, some of the government departments started using this "strategic" tool: by April 2017, more than 40 state and central government departments had adopted it and another 75 ordered the delivery of AASMA.

In October 2019, the Indian government, based on "cases of misuse of social networks by criminals and anti-national elements", again returned to the issue of regulating their content. The new legislative framework is expected to be developed by mid-January 2020. Its goal is to increase the responsibility of social network platforms for the content posted and to ensure transparency.

The updated draft regulations appeared in the end of 2018 and this time it was justified by the need to stop the flow of fake news, which provoked unrest and violence with human casualties in some regions of the country. It should be noted that the object of legal regulation in the document is formulated very broadly, which implies coverage of virtually any online company – from social networks and e-commerce platforms to Internet providers. The regulations do not clearly define the term "illegal content" in terms of Indian law.

The set of regulatory measures proposed by the Indian authorities can be divided into three blocks:

first, the requirement for Facebook, Google, Twitter, and TikTok to monitor the origin of content that does not comply with local laws (in particular, violates privacy, promotes hatred or misleads) for 72 hours at the request of a law enforcement agency and to "ban" this user;

second, the installation of automatic technical devices by providers to monitor traffic, which will isolate Indians from "illegal information" by sweeping the platforms from "illegal" content;

third, the high-profile demand to lower standards for encryption of messages in messengers so that the authorities can track the sender.

The bill drafters note that the Internet "has become a powerful tool". On the one hand, technology has led to economic growth and social development, on the other hand, there is an exponential increase in hate speech, fake news, disturbances of public order, anti-people activities, defamatory publications and other illegal actions using the Internet/social network platforms. Strengthening supervision is therefore designed to help eliminate "ever-growing threats to human and national rights" and to protect territorial integrity, sovereignty and national security.

In addition, this step was driven by a lawsuit brought against Facebook in connection with the refusal of the company's management to share the data of WhatsApp messenger users the government, citing the absence of such regulations in the legislation. Meeting such requirements would lead to a break in the end-to-end encryption, which would compromise customers' security and privacy.

Industry experts estimate that there are over 600 million online users in India today. According to a report by Hootsuite social media management platform, YouTube is the most popular social media platform, followed by Facebook, WhatsApp and Instagram. Facebook and WhatsApp have approximately 400 million users in India, making it the company's largest market. According to media forecasts, by the end of 2019, the number of social media users in the country will reach 627 million.

Most observers agree that clearly illegal content needs to be regulated. However, it is emphasized that the need to regulate anything that is not manifestly illegal must be carefully and comprehensively examined.

Opponents of the government initiative emphasize that the experience of a number of industries has shown that state regulation inhibits innovation and creates monopolies, as it prevents newcomers from entering the market. For a country in dire need of start-ups, innovation and investment, the new rules will create obstacles to this.

In addition, the authorities lack necessary technological capabilities to detect and remove unwanted content on social networks on the required scale or with high speed.

Human rights activists emphasize that excessive control will turn online companies into censors and can seriously restrict freedom of speech, which, in turn, will lead to "unimaginable damage to democracy".

Civic activists suggest that the function of regulating social network content should be left to the technology companies themselves, which monetise the public resource – personal data of citizens. The government should encourage them to define and periodically update content standards and guidelines for their enforcement. Ideally, this should be done through an independent body with the participation of stakeholders, including civil society and law enforcement agencies. Moreover, the government must encourage social network platforms to take responsibility for manifestly illegal content if it is not removed within a certain period. There is also a need for a transparent and fast redress mechanism in case of disagreements, and the burden of proof must lie with the government. Finally, the government should focus on solving systemic problems in society, since online discussions simply reflect the processes already taking place there. It is believed that strict adherence to the rule of law will ensure greater freedom of expression on the Internet and reduce the need to regulate it.

The Indian case logically fits into the global trend of strengthening the information security. With the adoption of new regulatory framework, India, the world's greatest democracy, will join a growing list of countries regulating social media, including Australia, China and Singapore, as well as the EU.