Friday, May 18, 2012

Cyber (zero) Security for internet

If you read this message 'Access to this site has been blocked as per Court Orders' then you probably know about the arbitrary clampdown on peer sharing sites recently. It is becoming a repeated noticeable trend by certain vested interests with a view to protect their interests (or for some cheap publicity) at the cost of others freedom. While I'm all in support for the right to protect one's 'digital privacy' and ensuring that their data is protected against piracy, I find the blanket gag order a tad overreaching.

The first time it happened, it was annoying, now I'm irritated and a bit worried. Not that I intend to do anything about it, except to write about it, and hope that someone else out there does something to protect the interests of other users who really have no interest in accessing the crap movies that most of these guys spew out at the first place.

I think that these guys who've done the blocking have crossed the line between enforcing their rights and trampling on rights of others, and I'm including the roles of intermediaries and service providers in not taking a harder / definitive stance to clarify the tenability of enforcing blanket bans based on valid specific order (I assume) . I refer to the provisions of the existing IT Act, 2000 & IT (Amendment) Act, 2008 for my reasons:

1. Court orders are obtained to prevent piracy of movies, films, songs, etc. These are perfectly valid. However, blocking entire websites are a clear violation of court order through mischievous interpretation. The orders of the court (I assume) would be specific and restricted only to the contents of the particular film/song etc. Therefore, preventive measures can be taken place to ensure that it can be tracked and removed, or such files can be blocked, etc. However the entire contents of the website cannot be blocked.
2. The actions taken based on such orders where the parties enforce blanket bans are with a clear motive, with a view to intimidate people who use it (referring to those insisting on blocking the whole site and not just the related contents). Under Section 66F(1)(A) of the Information Technology (amendment) Act, 2008, "whoever , with an intent to threaten the unity, integrity, security, or sovereignty of India or to strike terror in the people or any section of people by - (i) denying or cause the denial of access to any person authorized to access computer resource; or (ii) attempting to penetrate or access a computer resource without authorization or exceeding authorized access;".... etc. "...commits the offence of cyber terrorism". While its tricky to prove that the intent (mens rea) was as stated above, as the standard defence would be that they had only gotten a court order to the effect and enforced such order of the court 'in good faith', it is with the same argument that the enforcers of such order should have taken precautions to ensure that access to other legitimate and legally unrestricted aspects of such websites is not disturbed. In other words, when the court order specifically prohibits sharing/distribution of a particular movie/song, etc., it is assumed that all remaining contents of such website are not prohibited from sharing (presumed legal until proven illegal). There is no criminal intent of the host of the site to carry restricted/illegal content, and it cannot be arbitrarily construed as such. By imposing a blanket ban, they have denied access to unrestricted contents of the site unfairly and exceeded their authorized access in enforcing the order, willfully and intentionally. Therefore, even if they are not held liable for 'cyber terrorism', they would be guilty of gross negligence, and misconduct.

 3. Role of service provider (intermediary): The power to block internet sites is defined in Sec 69(A)(1), where the reasons after recording in writing, pass order to the effect of directing the intermediate to block such contents. "Where the Central Govt. or any of its officers specially authorized by it in this behalf is satisfied that it is necessary or expedient so to do, in the interest of sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign countries or public order or for preventing incitement to the commissioning of any cognizable offence relating to above, it may subject to provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of Government or intermediary to block for access by the public, or cause to be blocked for access by the public any information generated, transmitted, received, stored, or hosted in any computer resource". From first reading of the provision it appears that the actions in enforcing a blanket ban can be undertaken and would be tenable. However, for this provision to stand the test of implementation, it has to be interpreted carefully: My understanding is that the order defines the action: i.e: the first part of the section, namely the reason identified by Government or any officer of law should be recorded in writing, by an order. And intermediary takes such actions so as to block access of generation, transmission, receipt or storage of such information - and only such information as required. The action undertaken by the intermediary (the second part of the act) should be consistent with the contents specified in the order. Other information which are blocked without just cause shown by the intermediary cannot be held valid, and he should be held liable for such unauthorized actions (actions not covered by the order).
4. Finally, penalties could be recovered from the litigant: For idiots who claim that their information is being misused, being 'pirated' etc. the court should first ask them what security safeguards they have implemented to keep the information secure, & prevent misuse. It is most often their own distributors and / or some disgruntled employee associated with the film who leaks the print to online 'pirates'. Section 43A of the IT (Amendment) Act, 2008, clearly lays down responsibilities. "Where a body corporate, possessing, dealing, or handling any sensitive personal data or information in a computer resource it owns, controls or operates, is negligent in implementing  and maintaining reasonable security practices and procedures and thereby causes wrongful loss or gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected." Explanation notes defining Body Corporate,and reasonable security practices are detailed.
Once such responsibility is laid down, and in cases where they do succeed in tracking down the source of the person who leaked it unauthorized, then the same person can be forced to remove such content from the site, or be held liable financially for the losses so caused under Section 46.
In the given case, the sites which have been unfairly pulled down can initiate action against the litigants who claim that they are/maybe affected by such sites (1) to explain what safeguards / security practices / procedures that they have undertaken to protect their content in the first place. (2) How they have maintained or whether they have maintained such practices constantly. As these litigants are owners of the data at the time of creation, it would automatically be their 'personal data', and the section clearly extends the scope of responsibility to every such user of the data. Therefore, this provision can certainly turn the tables on wrong enforcing of valid orders which end up curbing the internet freedom.

Most importantly, I hope this wipe the smirk of faces of those idiots who think that they are god's gift to mankind and every work that they do should be protected at the cost of causing discomfort and agony to even those who are uninterested in their affairs. It's a well known maxim that any publicity may be good publicity, but nothing ever comes for free. If you want to freeload on these types of cheap stunts, be prepared to pay for it. And who is going to stand up for and protect the freedom of internet?


Disclaimer: The opinions expressed above is not that of a legal expert, but that of a seriously irritated concerned citizen of India. As you can see from above, I've spent more time than necessary to research relevant acts and voice my half-baked opinions, based on my own (mischievous?) interpretation of facts. I neither claim to have read all the facts relating to matters stated above, nor wish to do so. Readers/Users are advised to conduct their own research to satisfy the validity or otherwise of the facts/opinions. Cheers!

No comments: