Disney Should Buy Spotify

You may think that winning the streaming race depends on having the best content, but things have already begun to change. As of now, the company with the better bundle will win, and that’s why it makes sense for Disney to buy Spotify this year.To read the full article, visit OZY.Rohan is a technology policy analyst at The Takshashila Institution.  

Your Fitbit is Going to Replace Clinics near You

First, it was payments and now it’s healthcare. Big Tech in the US and China is revolutionising the health sector, with hundreds of billions of dollars of market share at stake. There are multiple factors that are driving this movement. For starters, there’s the simple need to find new avenues for growth for both American and Chinese tech giants, and there are only so many trillion-dollar industries to disrupt to add shareholder value. China has more reasons and more at stake here. Both countries boast of high levels of internet penetration and smartphone use. Both the US and China are rapidly aging societies. This implies a growing geriatric healthcare burden and creates incentives for new alternatives to overcrowded hospitals. Both are home to a wealthy middle class, which is seeking better health solutions. According to Royal Philips’ Future Health Index 2019, both the US and China are global frontrunners in terms of adoption of digital health technology, with a large number of medical professionals and consumers relying on tools for self-monitoring and online consultations. This is a key contributor to their rise in demand for wearables. This is supported by and fuels their dynamic and thriving innovation ecosystems. This explains why American and Chinese companies are making moves in healthcare based on their core competencies. Recently, Amazon backed on its software to move into telemedicine and also invited healthcare companies to build tools on Alexa’s platform. Amazon’s core competence, however, is its efficiency in distribution networks. So the e-commerce giant acquired Pillpack, an online pharmacy. The Alibaba Group, on the other hand, entered the healthcare game early with its TMall Pharmacy in 2015. However, in 2018, Alibaba consolidated its healthcare assets, including medical devices, e-appointments, drug purchases, and delivery services under the banner of Alibaba Health, which leverages the group’s advantages in data processing and e-commerce. Another big Chinese player in the field is Tencent, which owns WeDoctor, one of the world’s biggest health tech start-ups. Google is great at data analytics and OS development. Keep that in mind and Project Nightingale begins to make sense. As does Google’s $2.1 billion acquisition of Fitbit. Google’s Chinese search counterpart Baidu has bounced back after a 2016 controversy over healthcare ads to explore the possibility of leveraging artificial intelligence and blockchain technology for its medical data sharing and distribution solution. Meanwhile, Apple excels in devices that track wellness. Think Apple Watch and the electrocardiogram that comes installed on it. Or the dedicated carekit and researchkit open-source frameworks that Apple has been pushing recently for developers. IDC data for 2018 show that while Apple is the market leader in the wearables segment, Chinese firms Xiaomi and Huawei take the second and third spots, respectively. Their global ranking is buttressed by their dominance in the Chinese and Indian markets. So what does the future of the health tech sector look like? We predict three scenarios that we believe will play out over the next five years: First, wearables will become the new OPDs: With Big Tech investing in healthcare across Silicon Valley, Zhongguancun, and Shenzhen wearables and telemedicine have a bright present and future in their diagnostic capabilities. Recording pulse or temperature, scanning bones or tissues, diagnosing based on those, and getting medicines have become or are becoming tasks that can be worked upon remotely or be delivered to you. Over the coming decade, wearables will reliably send accurate data in real-time to process for millions of people. This would give them a decisive advantage over the number of people physical OPDs can carter to, making the latter obsolete.  Second, tech giants will dominate health & life insurance: Wearables and smartphones are becoming increasingly sophisticated in diagnostic capabilities and tracking. As that continues to happen with every new iteration of FitBits and the Apple Watches, the OS becomes a platform for companies to sell services and gain revenue. WatchOS and WearOS (and/or what future FitBit OS is going to be called), are likely to go on to sell insurance through their devices. Whether Google/Apple curate a new insurance policy or end up acquiring an insurance company to do it for them is irrelevant. Considering that insurance is a lucrative market, and that data from the apps in the OS gives Google/Apple a comparative advantage means that it is the matter of when, not if, for both tech giants to start peddling their own insurance through the OS on smartphones or wearables. Third, Sino-US rivalry will stymie health tech’s future growth: The deepening strategic rivalry between the US and China has already shifted from competition over trade policies to a battle for technological supremacy. This is playing out in the form of expanding the definition of sensitive technologies that must be protected, tighter security reviews of Chinese tech investments, undoing of completed acquisitions, blacklisting of certain firms, export restrictions and a contest for foreign markets and data streams. Much of this is captured in the geopolitically charged discourse over Huawei and 5G. The health tech industry can expect a similarly rocky future. Collaboration between research communities and business entities across the Pacific will be difficult. Acquisitions in foreign markets are likely to become a politically polarising decision. Capital flows into each other’s health tech ecosystems will become increasingly constrained. Data will become the biggest sticking point, with most states preferring some form of localization.

Can Modi govt know who you text? Should FB be liable for your posts? We’ll know in Jan 2020

Apart from deciding on end-to-end encryption for chats, the amended IT Rules will also decide on what content belongs on the internet.

Should Facebook be liable for the content you post? Should Apple build a backdoor to allow access to iPhones? Should the government know who you are texting and should it have access to your messages? On 15 January 2020, the amendments to India’s IT Rules will answer these questions by finalising the intermediary guidelines.That is also one of the reasons why over the course of 2019, we have talked about whether the government of India should be allowed to break end-to-end encryption. Of course, the topic gained traction after the November Pegasus WhatsApp hack reports. And the Narendra Modi government said the law allows it to intercept and monitor digital content in the public interest.The problem with this whole encryption debate is that it takes up a disproportionate amount of mind space. Don’t get me wrong; encryption is a vitally important issue. However, it is not the only issue that will be covered by the IT amendments.The January amendments will also decide on these crucial issues.Also, we will use the words intermediary and platform interchangeably. But for context, a platform is an online service like Facebook or Twitter, while intermediary includes platforms, the servers they are hosted on, and even the cybercafé you might access the platform through.How many users before a company needs an office in India?According to the proposed amendments, any intermediary with over 50 lakh users will need to:

1. Have a permanent registered office in India
2. Appoint a nodal point of contact for the government
3. Be included in the Companies Act

This may read fine at first glance. But take another look. Users as a term is vague. Monthly active users? Daily active users? Registered users? You might have an account on Pocket, but never end up using it. Does that mean Pocket now needs to have an office in India and appoint a person in charge of talking to the government on the off chance that 50 lakh people one day decide to use the app?The other thing here is how does the government keep track of the number of intermediaries who have included a nodal point of contact? Apps do not notify the government before they are made available to the people. Instead, they show up on the App Store/Play Store, ready to be used. And how would the government even know when an intermediary has crossed 50 lakh users? Should all intermediaries make their user stats public or release a notification when they meet the threshold?Clearly, these guidelines were drafted just keeping in mind Facebook and WhatsApp. However, they will have anticipated but unintended consequences as far as smaller firms are concerned.

---

Also read: The rise of Pegasus and why India should know the problem with hiring ‘internet mercenaries’

---

What content belongs on the internet?

The intermediary guidelines also talk at length about content takedowns and what should and should not be allowed to remain on the internet. You could say that the Modi government has written itself a blank cheque in being able to dictate this. Here are just some of the grounds on which companies may be asked to remove content:

• In violation of decency and morality
• Public order
• Impacts the sovereignty and integrity of India
• Security of state
• Friendly relations with the foreign states
• In relation to contempt of court
• Defamation or incitement to offence
• Defamatory
• Obscene
• Pornographic
• Paedophilic
• Hateful
• Harassing
• Blasphemous

A lot of these make sense. We as a society have a consensus that child porn, hate crimes, and videos against animal cruelty do not belong on the internet. The government also has every right to argue that content that impacts its security and relations with other states should be taken down. But look at some of the other grounds. Who decides what content is defamatory or blasphemous? For instance, comedy at the expense of someone or something can end up disparaging the subject. Does that mean comedy does not belong on the internet? You could argue a similar case for memes, documentaries, and blogs. Based on these grounds, anything that the government of the day doesn’t like can be taken down.Should we have a best-efforts approach to aiding law enforcement?Remember the anticipated but unintended consequences? Well, not all intermediaries have the same access to user data. A cloud service provider does not have the same power as a multi-million user platform. So, when law enforcement goes asking for information, they also take into account the asymmetries that exist within the ecosystem.A best-efforts approach will make sure that requests do not make cloud service providers or even cybercafés liable for sharing data they don’t have access to. Because, if at the end of the day, a request is not technically feasible, all it does is ensure that the matter will be taken to court to place undue stress on the intermediary.As for whether or not the government should break encryption, I’d strongly recommend against it. Internet shutdowns are bad enough. Imagine if we lived in a world where the government could learn about who you text and what you may be talking about. Recently, American WeChat users were banned for celebrating the Hong Kong election results. Similar instances could end up happening in India and at scale, that could end up being a threat to democracy unlike any we have seen before. To that end, watch out for the guidelines on 15 January, they could set the tone for the rest of the year.Rohan Seth is a Policy Analyst with the Technology and Policy Programme of The Takshashila Institution. Views are personal.This article was first published in The Print.

PLA SSF: Why China will be ahead of everyone in future cyber, space or information warfare

People’s Liberation Army Strategic Support Force contingent made its debut appearance at China’s military day parade, earlier this year. Formed on this day in 2015, it is mandated to create synergies between China’s space, cyber and electronic warfare. The PLA considers these three domains critical for “commanding strategic heights.” The SSF was formed to optimise China’s dominance in these three domains and also contribute to enhancing the PLA’s broader goals of strategic deterrence and integration for information warfare. Read more...

India’s National Cybersecurity Policy Must Acknowledge Modern Realities

Earlier this year, it was discovered that India was the target of two cyberattacks in the same month. The malware attacks at the Kundankulam Nuclear Power Plant and the Indian Space Research Organization (ISRO) are believed to be the outcomes of phishing attempts on employees. In 2018, it was reported that an officer of the Indian Air Force was sharing sensitive information on Facebook with two women who had honey-trapped him. None of these incidents are known to have resulted in severe harm, but the possibility that they could have is reason enough for India to cultivate and shape international discussions on cyberspace.As is the case with both international terrorism and protection of the environment, cooperation is a prerequisite to deal with cyberthreats given their borderless nature. India’s National Cyber Security Policy (2013) did not assign much weight to this aspect and defined no measurable outcomes against which progress could be judged. With its upcoming National CyberSecurity Policy (2020-2025), India has the opportunity to align its domestic policy with its global aspirations.Warfare in Cyberspace Is UniqueCyberspace is an amalgamation of the virtual with the physical. Actions in the virtual realm can affect the physical domain. With low barriers to entry, cyberspace provides attractive options for the launch of attacks and allows actors to achieve strategic outcomes both within and outside of the information domain. From crumbling critical infrastructure to designing a smart misinformation campaign that can influence democratic processes, the spectrum of outcomes that cyberattacks can achieve is broad. The Stuxnet malware, a U.S.-Israel joint operation to target Iran’s nuclear enrichment plant in Natanz, displayed the capabilities of a highly sophisticated and targeted cyber-offensive operation. Operations against Ukraine’s power grid in 2015, misinformation campaigns targeting U.S. presidential elections in 2016, and the WannaCry and NotPetya ransomware outbreaks in 2017 all showed the potential for real-world impact and collateral damage.There are two features that distinguish these attacks from conventional ones. First, cyberattacks are hardly predictable. Accurately determining an incoming attack is at present not possible. Second, as long as there is plausible deniability, attribution is tough. As such, warfare in cyberspace poses a unique challenge to national security and the lack of rules to govern it intensifies this challenge.Security in CyberspaceThe United Nations Charter, the Laws of Armed Conflict (LOAC), and other regional arrangements provide a general overarching framework for governments to manage problems of security across all domains. Cyberspace differs from conventional domains of warfare because it functions as both a battlefield and a weapon. It is therefore risky to assume that existing rules of conflict can be extended to cyberspace as well.American political scientist Joseph Nye has discussed the absence of coherence among existing norms that govern cyberspace. Existing practices are based on agreements between private players (largely multinational corporations) with only a mild degree of enforceability. Since providing security is a critical function of government and it is most susceptible to attacks, only governments are properly incentivized to set the rules. Numerous track two groups and various private conferences and commissions continue to work on the development of norms. Successive UN-GGEs (Governmental Groups of Experts) have developed a consensus that the UN Charter and international law apply to cyberspace. But cyberspace is changing faster than countries can legislate internally and negotiate externally.There is no denying that all security efforts need to be collaborative. But as with international terrorism and environmental protection, effective norms and rules can only be set if all stakeholders consensually arrive at what the rules should be. Currently there are two camps on the global stage: a Sino-Russian camp and a rival one comprising the United States, Western Europe, Japan, Australia, and New Zealand. The former espouses the supremacy of national sovereignty in the governance of domestic cyberspace, risk of destabilization by the application of existing international humanitarian law to cyberspace, and the need for new, binding international agreements. The latter advocates for a free and open internet as well as the full applicability of international law (including the right to self-defense, use of countermeasures) to cyberspace. Resolutions sponsoring the formation of the Russia-backed Open Ended Working Group (OEWG) and the UN-GGE 2019-21 were both passed in the United Nations General Assembly in 2018. The UN now has two parallel tracks working toward the establishment of norms in cyberspace. The OEWG is open to all member states and will hold consultations with stakeholders across members, NGOs, and private industry while the UN-GGE is comprised of 25 member states with consultation typically limited to regional organizations. The prevailing atmosphere of mistrust portends further deterioration rather than improvement. This variance between great powers has weighed heavily on international discussion on norms while cyberattacks continue to happen, quietly.There is some scope for optimism yet. At a panel in the recently concluded Internet Governance Forum in Berlin, the Global Commission on the Stability of Cyberspace (GCSC) proposed eight norms including protection of the public core of internet and infrastructure essential to elections, referenda, and plebiscites. This was followed by informal consultations at both the OEWG and UN-GGE in early December. Through the Paris Tech Accords, Digital Geneva Convention, and Charter or Trust, private companies have also sought to play a more active role in the shaping of norms, which is significant as they operate a significant portion of the public internet.What Has India Done So Far?In 2011, India’s proposal for a Committee on Internet Related Policies (CIRP) comprising 50 member states was met with the criticism that it would create an exclusive club. Since then, an analysis of India’s contribution to debates on internet governance by the Center for Internet and Society (India) has revealed a tendency to shift between support for multilateralism and mutli-stakeholderism. Researchers have termed this “nuanced multilateralism,” where a broad range of stakeholders are consulted, but not involved in implementation and enforcement. On the question of cyberspace sovereignty, India seems to share common ground with the Sino-Russian camp, but has refrained from commenting definitively on the issues dividing the two camps. India was one of the member states that backed both UNGA resolutions that resulted in the formation of the OEWG and the UN-GGE (2019-2021). It is also a member of the UN-GGE and has not yet contributed formally to OEWG proceedings. On the multilateral front, it has stayed out of the Osaka Track for Data Governance and the Budapest Convention on Cybercrime.There is no single approach that captures India’s engagement with multilateral institutions. Its rule-taker instinct is evident from India’s support for the United Nations’ peacekeeping operations. Contrary to this is the rule-breaker approach, which is evident from India’s endeavor to be recognized as a nuclear weapon state while also challenging the norms established by the Nonproliferation Treaty. The expectation that India will be a rule-maker all by itself is unrealistic. In the multipolar world that exists today, no single country, let alone India, can become make the only rule-maker. A more achievable goal for India would be to play the role of a rule-shaper, an active voice among rising powers. This goal finds its strength in India’s economic prowess and diplomatic experience in working with alliances.India’s success in shaping the international narrative on climate change has already proven its ability as a rule-shaper. With its upcoming National Cybersecurity Policy (2020-2025), India must look to articulate and justify its position on the applicability of international law to cyberspace. It should bring its domestic policy in line with its global aspirations. Given the importance of private companies in this exercise, it must also consider creating an office of a tech ambassador that will present its position consistently. This level of transparency can serve as an important confidence-building measure as it engages across multiple stakeholders and fora to shape future norms.Shibani Mehta and Prateek Waghre are Research Analysts at The Takshashila Institution, an independent center for research and education in public policy.

This article originally appeared in The Diplomat

Look at the numbers: Why Digital India can’t afford internet shutdowns with slowing economy

Take a look at these numbers – 3, 5, 6, 14, 31, 79, 134, 91. These are the numbers of documented instances of internet shutdowns in India between 2012 and 2019. The 2019 number will certainly rise during the final weeks of the year as anger against the Citizenship (Amendment) Act and the Bharatiya Janata Party rises.

And yet, as internet shutdowns are reported in Meerut, Aligarh, Malda, Howrah, Assam, Nagaland, one wonders if Narendra Modi government really thinks it can help assuage anger and old resentments.

World over, protesters have always found a way out of any clampdown. In Hong Kong, protesters are using Bridgefy, a service that relies on Bluetooth, to organise.And yet, all governments, irrespective of whether it is the Congress or the BJP or any other party, keep using internet shutdowns as a kill switch. But tech stops for no one. It’s time India thinks beyond shutdowns.

A new era

In almost all cases, mobile internet services were shutdown. For four of the last five years, more than half of these shutdowns have been ‘proactive’ in nature. They have been imposed based either on Section 144 of the CrPC or The Temporary Suspension of Telecom Rules issued by the Ministry of Communications under the NDA government in 2017. While an appeal against the use of the former was struck down by the Supreme Court in 2016, the latter suffers from a lack of transparency and was passed without any consultation with citizens, who are directly affected. Through RTI requests it has also been revealed that many instances of internet shutdowns go undocumented and due process is not always followed.

The willingness and urgency on display to snap communication lines is worrying, especially in ‘Digital India’. Considering that 97 per cent of the estimated 570 million internet users use at least a mobile device access to access the internet, and the growing reliance on connectivity for communication and commerce, this is a severely disproportionate measure. Various studies have pegged the cost of these disruptions from 0.4-2 per cent of a country’s daily GDP to $3 billion for India over a 5-year period ending in 2017.

Since 2017, India has witnessed nearly twice as many shutdowns. Even so, until mid-2019, internet shutdowns predominantly affected parts of Rajasthan and Jammu and Kashmir, both accounting for nearly 250 instances. More importantly, they were rarely imposed in urban centres. In August 2019, a new era began unfolding. First the ongoing internet shutdown in the region of Jammu and Kashmir is the widest sustained disruption ever documented. Second, on the day of the Supreme Court Ayodhya verdict, proactive internet shutdowns were in operation in Aligarh, Agra and Jaipur, signalling a shift in the willingness to deploy them in urban centres. And finally, with ongoing protests against the Citizenship (Amendment) Act, reports have been coming in about internet disruptions in Assam, Tripura, multiple districts in West Bengal, Aligarh and Meerut in Uttar Pradesh, cementing the use of internet shutdowns as the tool of choice.

Diminishing returns

The framework of Radically Networked Societies (RNS) can be used to understand the interplay between protesters and the state. An RNS is defined as a web of connected individuals possessing an identity (real or imagined) and having a common immediate cause. The internet as a medium provided them the ability to scale faster and wider than ever before.With measures like internet shutdowns and curfews, the state aims to increase the time it takes for them to mobilise by restricting information flows. However, such methods are bound to have diminishing returns over time.Snapping communication lines will do little to quell genuine resentment and may conversely encourage people to take to the streets and violate curfews, thereby increasing chances of escalation. Mesh networking apps that operate without internet connectivity will eventually make their way into the toolkit of Indian protesters, like they did in the Hong Kong protests, rendering the argument of shutdowns as an ‘online curfew’ moot.

Better than shutdowns

The Indian State must evolve beyond the use of internet shutdowns. Instead, it should look to address the causes and reduce the time it takes to counter mobilise. There have been some instances of state authorities trying different approaches.In September 2016, when there were protests in Bengaluru over the Cauvery water sharing judgment, instead of shutting down the internet the Bengaluru Police took to Twitter to dispel misinformation and rumours proactively. In the days leading up to the Ayodhya verdict, several police departments were proactively monitoring social media for objectionable messages. While this did not function smoothly on the day of the verdict since the police went on an excessive case registering spree, the Bengaluru example shows that it can work. Future capacity building and training cyber personnel to specifically counter flows of misinformation online must be a consideration going forward.The reaction to viral hoax messages circulating before the Ayodhya verdict warning of surveillance also produced some interesting insight. While more surveillance is never the answer, alternate ways of promoting responsible behaviour should be explored. This could range from encouraging fact-checking of information to political leaders leading by example and not encouraging abusive trolls, misinformation flows themselves. Conflict and polarisation as engagement must be actively discouraged.

Another important step is to counter dangerous speech in society. Research has shown that misinformation/disinformation does not only circulate during specific events. Conditions that exacerbate such flows already exist in society. While the state alone cannot do this, it must nudge the people towards countering it. Such measures must be articulated in the upcoming National Cybersecurity Policy.

Ultimately, that the world’s largest democracy is by far the world leader of such disproportionate tactics should be reason enough for the Indian state to rethink the use of internet shutdowns. But if that doesn’t suffice, the realisation that they come with an expiry date should spur it into fixing the underlying problems unless it wants to live with the diminishing returns that incentivise escalation.The author is a Research Analyst at The Takshashila Institution’s Technology and Policy Programme. Views are personal.This article originally appeared in ThePrint.in

Are Internet shutdowns healthy for India?

Democratic governments must be accountable to the public and provide a rationale for disrupting Internet services in a timely manner. In the interest of transparency, all governments should document the reasons, time, alternatives considered, decision-making authorities and the rules under which the shutdowns were imposed and release the documents for public scrutiny. This is the way civil society can hold governments to the high standards of transparency and accountability that befits a democracy.Indiscriminate Internet blockades are not likely to safeguard public order in today’s time and age. Indiscriminate shutdowns have high social and economic costs and are often ineffective. A proportionality and necessity test and cost-benefit analysis to determine the right course of action are essential at this juncture. Indian civil society needs to push for a transparent and accountable system which ensures better Internet governance.Read the whole post here.

Data Protection Bill, an unfinished piece of work

Bill demands age verification and consent from guardians of children for data processing

Shashi Tharoor has a strong case when he says that the personal data protection Bill should have come to the information technology standing committee. It does set a precedent when issues as important as the bill do not go through proper channels of debate. Because of the nature of the Bill, there is a tremendous amount of scope for discourse and disagreement.

Let us begin with the most debated aspect of this legislation, the Data Protection Authority (DPA). Because the mandate of the Bill is so large, it can only go on to set guidelines and give direction on where the data protection space should go. The heavy lifting of enforcement, monitoring, and evaluation has to fall on the shoulders of a different (and ideally independent) body. In this case, it is the DPA that has the duty to protect the interests of data principals, prevent any misuse of personal data, ensure compliance with the act, and promote awareness about data protection. The body needs to enforce the Bill down to auditing and compliance, maintaining a database on the website that has a list of significant data fiduciaries along with a ranking that reflects the level of compliance these fiduciaries are achieving, and act as a form of check and balance to the government.

However, the DPA may end up not being the force of objective balance that it has often been made out in the Bill. Here is why. The body will have a total of 7 members (a chairperson with 6 others). All of them will be appointed by the government, based on the recommendations of the cabinet secretary, secretary to the Government of India in the ministry (or department) dealing with legal affairs, and the secretary to the ministry (or department) of electronics and information technology. All of this falls under the mandate of the executive and has no involvement required from the judiciary or for that matter the legislative. Also, the current version of the Bill does not specify who (or which department) these recommendations will go to in the central government. Is it MeitY? NITI Aayog? PMO? There is no clarity.

One cannot help but notice a pattern here. The Bill itself is going to go to a committee dominated by members of the ruling party and the enforcer is going to be wholly constituted by the executive.

Where is the feedback loop? Or the chance for scrutiny? You could at this point begin questioning how independent the DPA is going to be in its values and actions.

That is not to say that the Bill is all bad. Specifically, it does a good job of laying out the rights of the personal and sensitive personal data of children. And that is not often talked about a lot. The Bill here has a unique approach where it classifies companies that deal with children’s data as guardian data fiduciaries. That is crucial because children may be less aware of the risks, consequences and safeguards concerns and their rights in relation to the processing of personal data. Here the Bill clearly requires these guardian data fiduciaries to demand age verification and consent from guardians for data processing. Also, fiduciaries are not allowed to profile, track, monitor or target ads at individuals under 18.

This is a loss for Facebook. The minimum age to be on the social media platform is 13. And Facebook’s business model is to profile, track, monitor, and micro-target its users. One of two things will happen here. Facebook will either have to change the bar for entry onto the platform to 18 as per the Bill. Or, it will need to ensure that its algorithms and products do not apply to users who are below 13. Either way, expect pushback from Facebook on this, which may or may not result in the section being modified.

The other thing the Bill should add on children’s rights is the requirement to simplify privacy and permissions for children to be consistent with global standards. For instance, the GDPR mandates asking for consent form children in clear and plain language. There is value in making consent consumable for children and for adults. So provisions in this regard should apply not just for children but also for adults, mandating a design template on how and when consent should be asked for.

In sum, the Bill is an unfinished product in so many ways. It has good parts, such as the section on the personal and personal sensitive data of children. However, it needs debate and scrutiny from multiple stakeholders to guide the DPA to be the best version of itself and it is in the government’s hands to make that happen.

Genomics data banking could revolutionise healthcare, but comes with unmitigated risks

You read a brochure that promises to tell you what diseases you are likely to get in the next decade. Obviously you want to lead a longer, healthier life. So you send a cheek swab to the clinic and await test results. Thankfully, your reports are largely all-clear except a minor mutation which would likely pre-dispose you to diabetes in your 40s. Your doctor dutifully prescribes diet control, exercise and a pill.

A few months later, you hear that your cousin has got convicted in a hit-and-run case. Unwittingly, you played a role in the conviction because it was your DNA that led the police to identify him. Your chances of getting diabetes may be lower, but your cousin’s chances of proving himself innocent are nil. Sounds unbelievable? (Read more)

Citizenship Law and NRC Issue can Strain India’s Ties With its Most Important Neighbour — Bangladesh

The Print’s daily roundtable TalkPoint posed a question connected to the foreign policy implications of the Citizenship Amendment Bill and the National Register of Indian Citizens: CAB, NRC, Kashmir: Is Modi govt damaging India’s diplomatic standing for domestic politics? ‘Neighbourhood first’ was supposed to be the guiding principle of Modi government’s foreign policy. But all three measures — the new citizenship law, NRC and Kashmir issue — are examples of policy actions that are likely to have adverse outcomes for India’s interests in the region.The amended citizenship law and the NRC issue will put strains on India’s relations with its most important neighbour in the Indian subcontinent — Bangladesh. In 2018, Bangladesh emerged as India’s largest export market for Indian-made two-wheelers. Bangladesh has also surpassed Pakistan in terms of GDP per capita. The 2011 census data shows that illegal migration from there is reducing — it a stock problem from the past and not a flow problem of the present. Most importantly, the Sheikh Hasina government is one of the few steadfast pro-India formations in the neighbourhood. Unfortunately, the signal being sent to other leaders in the region is that taking pro-India positions might turn out to be a loss-making proposition.In the case of Kashmir, Pakistan will try to use the Article 370 issue to drive a wedge between the US and India. From Pakistan’s standpoint, returning to the India-Pakistan hyphenation era in the eyes of the US is desirable. From India’s viewpoint, the more Pakistan features in India’s foreign policy outlook, the less energy it has for confronting the more significant global challenges.Read the entire discussion on ThePrint.in website here. 

The Battle in Pakistan’s Military-Jihadi Complex

Contrary to popular belief, Pakistan's military-jihadi complex (MJC) has not been brought to its knees by Balakot, Uri, or even FATF. India's actions in Kashmir, for example, have provided the MJC with the perfect excuse to interfere as it does best. The reason for its current quiet is internal political turmoil connected to COAS Bajwa. India can ill-afford to take it for granted.For more, read The Telegraph Online.

2020 cybersecurity policy has to enable global collaboration

The rapid expansion of digital penetration in India brings with it the need to strengthen cybersecurity. The critical nature of the myriad cyber threats that India faces was underscored by the recent breach at the Kudankulam nuclear power plant and the Indian Space Research Organisation. These were just two of the 1,852 cyber-attacks that are estimated to have hit entities in India every minute in 2019. Symantec’s 2019 Internet Security Threat Report ranks India second on the list of countries affected by targeted attack groups between 2016 and 2018.It’s clear that India faces expanded and more potent cyber threats. Given this fact, the new national cybersecurity policy, set to be announced early next year, should improve on the shortcomings of the previous policy of 2013. The most significant of these were the absence of clear, measurable targets, failure to set standards for the private sector and limited focus on international collaboration.

 In many ways, the broad thrust of the 2013 policy was on point. It argued for the need to build a “secure and resilient cyberspace,” given the significance of the IT sector to foster growth while leading to social transformation and inclusion. This called for creating a “secure computing environment and adequate trust and confidence in electronic transactions, software, services, devices and networks”. Since then, certain steps have been taken to operationalise the policy. These include the establishment of the National Cyber Security Coordination Centre and Cyber Swachhta Kendra along with announcements to set up sectoral and state CERTs and expand the number of standardisation, testing and quality certification testing facilities. However, much more needs to be done and that too at a faster pace.While it is no one’s argument that state capacity can be augmented overnight, setting clear targets can help drive action towards an identified goal. Moreover, the lack of these in the 2013 policy means that it is extremely difficult today to assess whether the policy had the desired impact. Five-year plans are well-written documents, whether or not you agree with the goals they outline for the nation or even if the five-year approach is right at all.The most quantifiable item on the agenda for the 2013 cybersecurity policy was the objective to create a workforce of 500,000 professionals skilled in cybersecurity in the next five years through capacity building, skill development, and training. The objective set a number that one can look at five years from then and see if they exceeded or fell short of expectations. And the data in this regard is sobering. For instance, in 2018, IBM estimated that India was home to nearly 100,000 trained cybersecurity professionals. What’s further alarming is that it estimated the total number needed at nearly three million. The 2020 policy must, therefore, not just identify clear targets but also identify the ways and means through which that target should be met.Almost everything else in the 2013 document was fairly ambiguous. It contained repeated references to adopt and adhere to global standards for cybersecurity. However, there was no clarity on what specific standards should be followed and how long industry should take to adopt them.This brings us to the second shortcoming. The policy at the time was hoping to balance a trade-off between encouraging innovation while ensuring that basic standards for security and hygiene were met. When it comes to the private sector, it repeatedly used words such as “encourage”, “enable” and “promote”, being careful to not make anything mandatory. Even when it did mandate something, say global best practices for cybersecurity to critical infrastructure, it is hard to say how it planned to declare the mandate a success or a failure. This is again a pitfall that the 2020 policy must avoid. The policy must establish or identify standards that the industry should adopt within a fixed timeframe. Also, there is a need for the government to engage with the private sector, particularly when it comes to sharing skills and expertise.Finally, when it comes to international collaboration, the 2013 policy argued for developing bilateral and multilateral relationships in the area of cybersecurity with other countries and to enhance national and global cooperation among security agencies, CERTs, defence agencies and forces, law enforcement agencies and the judicial systems. Since then, India has entered into a bunch of cybersecurity-related MoUs. However, there is an urgent need to set into place domestic frameworks, say for instance with regard to data protection, which will enable broader global collaboration and participation in rule setting. Unfortunately, this has not been happening. For instance, India was not a signatory to the Budapest convention which would have allowed for easier access to data for law enforcement. It also did not enter into an executive agreement under the US-initiated CLOUD Act. On a related note, the government also did not sign the Osaka Track, a plurilateral data sharing agreement proposed at the 2019 G20 Summit. These are important dialogues that India must be part of if it needs to build a resilient and thriving cyber ecosystem.

How to start your own country: All you need is ‘friends’

Nityananda's Kailaasa, located off the coast of Ecuador, has its own flag, recognised a set of official languages and even set up a department for homeland security and defence. To all appearances, it seems like a legitimate country and may inspire more to establish their own. But creating a new country is not as easy as you would think.Continue reading here

Personal Data Protection Bill has its flaws

Data Protection Authority can potentially deal with brokers and the negative externality

Indian tech policy is shifting from formative to decisive. Arguably the biggest increment in this shift comes this week as the Personal Data Protection Bill will (hopefully) be debated and passed by the parliament. The bill itself has gone through public (and private) consultation. But it is still anyone's guess what the final version will look like.

Based on the publically available draft, there is a lot right with the bill. The definitions of different kinds of data are clear, and there is a lot of focus on consent. However, there is not enough focus on regulating data brokers. And that can be a problem. Data brokers are intermediaries who aggregate information from a range of sources. They clean, process, and/or sell data they have. They generally source this data if it is publicly available on the internet or from companies who first hand.

Because the bill does not explicitly discuss brokers, problems lie ahead. Broadly, you could argue that brokers come under either the fiduciary or in India sell lists of people who have been convicted of rape and the list ends up becoming public information.

Similarly, think about cases where databases of shops selling beef, alcoholics or erectile dysfunction are released into the wild. The latter two are instances the US is somewhat familiar with. A data broker can ask its clients to not re-sell the data, or expect certain standards of security to be maintained. But there is no way to logistically ensure that the client is going to adhere to this in a responsible manner. The draft bill talks about how to deal with breaches and who should be notified. But breaches are, by definition, unauthorised. A data broker’s whole business model is selling or processing data. All of which is legal. So, how should the

Indian government be looking at keep data brokers accountable? Some would argue that the answer may lie in data localisation. But localisation will only ensure that data is stored/processed domestically. Even if the broker is located domestically, it doesnt matter unless there is provision in law for mandating accountability.

The issue around brokers is also unlikely to be handled in the final version of the bill. Even though it is important and urgent, it does not take precedence over more fundamental issues. What is going to happen here is that data brokers and their activities are going to be subject to the mandate of the Data Protection Authority (DPA) due to be formed after the bill is passed.

Once the DPA is formed, there are a few ways in which it can potentially deal with brokers and the negative externality their role brings.

One option could be to hold data brokers accountable once a breach has occurred and a broker has been identified as culpable. The problem here is that data moves fast. By the time there is a punitive measure in response to a breach, the damage may have already been done. In addition, such a measure would also encourage brokers to hide traces of the breaches that lead to them.

Another alternative could be to ask every data broker to register themselves.

But that would mean more data brokers being incentivised to move out of the country while maintaining operations in India.

Rohan is a technology policy analyst at The Takshashila Institution.

This article was first published in Deccan Chronicle.

How India can build its own SpaceX

While the Indian Space Research Organisation is doing a commendable job, the participation of private space companies from India, at the global stage is still very limited. India must adopt an enabling policy framework and incorporate independent & fair institutional design mechanisms to promote NewSpace startups in the country. Establishment of independent space regulatory authority, disputes settlement appellate tribunal and a commercial entity to carry out operations built on legacy ISRO technology are essential.For more, please read here.

A small step for data protection, big leap awaited

It is an exciting time to be in the Indian tech policy space right now. The government has listed the Personal Data Protection Bill in Parliament for the winter session. The Union Cabinet has aprroved the Bill and it is likely to be introduced for discussion before the on-going winter session of Parliament ends on December 13.

Going forward, this Bill will update the currently non-existent standards for privacy and consent. The law will (as stated in the draft Bill prepared by a high-level committee headed by former Supreme Court judge, B N Srikrishna ), also set up a data protection authority. As these developments occur, and India begins to set its own standards in the space, it is important to keep in mind that this milestone is the beginning for stronger data protection, and not the end.

One of the most important aspects of the Bill is the setting up of the data protection authority (DPA). While the draft Bill sets up broad principles for privacy, a huge chunk of the work has been left for the DPA to carry forward. There are big-ticket items that need to be resolved while keeping in mind the larger vision for data protection in India. For instance, the authority will need to establish and enforce conditions on which personal data can be collected, accessed, and processed without consent. The DPA will need to be the policy formulator as well as the enforcer. Given the pace of progress in technology, the DPA will also need to be proactive in its approach rather than reactive. All of this means that the authority is always going to be strapped for capacity and will need to have appointments whose values align with that of the law’s larger vision. It is a thankless task to manage trade-offs between privacy and innovation in a country like India. That is what the bill is formally setting in motion through establishing the DPA.

Momentous as the Bill’s passage will be, it is crucial to note that this will not automatically mean that personal data is safeguarded going forward. There is potentially a 12-month period between the date it is signed-off by the President and when it is finally notified by the Central Government. This can be followed by a 3 month period to establish the Data Protection Authority and another nine to fifteeen months for all provisions to come into effect. Cumulatively, this could mean that it may be more than two years after it receives Presidential assent before there is a fully functional data protection regime in place. The process could conclude earlier, but given the complexity of the tasks at hand it is not unreasonable to expect that most of the allowed timelines will have to be utilised.

As with any policy, the outcomes will depend on how effectively it can be implemented. Much has already been written about the drawbacks of a consent-based model resulting in consent-fatigue. The Bill calls for privacy by design, but ensuring accountability will be difficult since most design decisions are opaque. A recent study on the EU’s General Data Protection Regulation (GDPR) and ePrivacy Directive violations revealed that 54 per cent of websites tested were non-compliant. Also, considering the number of data fiduciaries (not limited to the online world) one can interact with on a daily basis, a person may never find out if their personal data has been misused, or which entity is responsible. The bill proposes mechanisms for addressing grievances. It also requires entities that handle large volumes of user data to undergo audits and assessments. How responsive and transparent these processes turn out to be will indicators of how efficient the policy is.There have only been limited studies on privacy in the Indian context but the most existing literature points to the collectivist nature of society to explain the low levels of privacy consciousness. While awareness is growing, if people display a high level of apathy towards ensuring protection of their personal data it may push data fiduciaries down the path of non-compliance.

The government should table the Bill at the earliest to allow sufficient time for discussing the finer aspects of the Bill on the floor of the house. The number of questions posed to MEITY on the topic of privacy and data protection indicates a high degree of interest in Parliament on the subject. The government should also endeavour to remain as transparent as possible when framing the remaining provisions. Simultaneously, society should not slide into complacency after the passage of the Bill. Instead, it must continue to stay engaged to ensure that we have a strong data protection regime that succeeds in safeguarding Indians’ fundamental right to privacy.

(Rohan Seth and Prateek Waghre are technology policy analysts at The Takshashila Institution)

This article was originally published in Deccan Herald.

Bengaluru needs more high-tech companies, not fewer

The Karnataka government is set to release a new industrial policy next month with the goal of encouraging investment in tier-II cities. As it has been in the past, this goal is likely to be framed in zero-sum terms i.e. achieved by pushing IT companies to move away from Bengaluru and in other cities instead.We will limit this article’s focus on what such a policy direction would mean in high-tech sectors such as biotech, aerospace, and IT. , this push towards creating an alternative of centre gravity for the high-tech industry seems to be an intuitive answer for achieving balanced regional growth. And yet, this view is wrong because it doesn’t square with the empirical experience of high-tech clusters elsewhere in the world.Read more at: https://www.deccanherald.com/opinion/bengaluru-needs-more-high-tech-companies-not-fewer-780314.html

4 Lessons for India From China’s October 2019 Military Parade

With the People’s Republic of China (PRC) marking its 70th founding anniversary on October 1, the grand military parade at Tiananmen Square was the highlight of the celebrations. It showcased China’s newer arms, ammunition, and technology. Over 15,000 personnel, 160 aircraft, and 580 pieces of military equipment participated in the military parade, including sophisticated weaponry such as hypersonic missiles, intercontinental-range land and submarine-launched ballistic missiles, stealth combat and high-speed reconnaissance drones, and fifth-generation fighter jets.China intended to address both domestic and international audiences through this parade. At home, the leadership hoped that the parade would stir up feelings of nationalism. Internationally, the display of force was intended as a warning to the United States and China’s neighbors. Further, the parade reflected the People’s Liberation Army’s (PLA) progress toward becoming a “world-class military” by 2050.Although policymakers and military leaders across the world were keeping a close eye on China’s military display, perhaps those in India should have been paying the most attention. The parade was not directed at India, but New Delhi can learn a lot from China’s use of military modernization and its ongoing defense reforms. Here are four key lessons New Delhi can take from China’s 2019 military parade. Read more...

Should India be bolder with China?

India’s response to China’s diplomatic offensive of recent years has been inconsistent and sporadic. Using diplomatic tools in an institutionalised way to highlight China’s vulnerabilities is something India refrains from. This, despite China’s increased diplomatic activism against India. For instance, China raised the dilution of Article 370 in the United Nations Security Council on behalf of Pakistan. It has repeatedly blocked India’s entry into the 48-member Nuclear Supplier Group. It also took over 10 years to sponsor the blacklisting of Masood Azhar as a UN-designated global terrorist.India should not refrain from developing diplomatic leverages and using them against China, whenever required. It should issue statements on China’s “re-education camps” in Xinjiang, its activities in the South China Sea which impact India, and Hong Kong protests. It could also occasionally use Tibet as an irritant like China uses Kashmir. All of these with the presumption that India has improved its border infrastructure to at least maintain status quo in case of escalation of tensions. Read more...

Subcontinent is not ‘India’s own backyard’. Neighbours will continue to pursue foreign policies independently

The Print’s daily roundtable TalkPoint posed a question connected to the new Sri Lankan President Gotabaya Rajapaksa's India visit: With strong leaders like Rajapaksa, Hasina, Oli, is India losing dominance in South Asia?My response:Strong leaders or not, these sovereign South Asian states will continue to pursue their independent foreign policies based on their strategic priorities. The subcontinent is not ‘India’s own backyard’. There’s no need to judge every political change in these countries based on how it will affect India’s ‘dominance’ in South Asia.Structurally, it is natural for these states to play India off against the other powerful economy, China. In fact, smaller states across the world tend to balance their relationships with bigger powers.As long as these states are mindful of India’s security concerns and economic well-being, India shouldn’t be overly concerned with China’s presence. Given China’s overbearing foreign policy approach, it is likely to establish itself as a primary object of hate among India’s South Asian neighbours soon. India must instead do enough to be the second-best option for every smaller nation.From the perspective of these states, both India and China have their comparative advantages. China has more economic wherewithal whereas geographical proximity makes India irreplaceable for them.Therefore, the emergence of strong leaders in Sri Lanka, Bangladesh and Nepal should not be seen as a zero-sum game in India.Read the entire discussion on ThePrint.in website here.