Banning TikTok is another nail on coffin of internet exceptionalism

This article was first published in Deccan Chronicle. Views are personal.This has been a busy week for the internet. Earlier this week, India banned TikTok (along with 58 other apps from China). This was followed by Airtel and Jio blocking access to DuckDuckGo (a privacy-first search engine). If we zoom out, there is a strong argument to be made that both of these developments are part of a larger pattern. That is, both these developments are detrimental to the special status we have afforded the internet for so long.

Modi govt’s silence on China gave ‘satellite warriors’ a free run. India will rue the damages

The Ladakh stand-off has boosted transparency, for it has given greater visibility to a species of information soldiers who could be described as ‘Satellite Warriors’. These individuals, who are mostly housed in either think tanks or media, are increasingly the main sources of satellite imagery, informing the Indian and international public about China’s military moves. Their interpretations based on commercially available satellite imagery often vary from the official descriptions of the situation on the ground. Without any official interpretations contradicting their claim, the satellite warriors are having a free run while Prime Minister Narendra Modi’s statements, even if they refer only to Galwan, are increasingly looking like lies attempting to hide in plain sight. You can find the article here

After the Indian Ban on 59 Chinese Apps, What Comes Next?

As the clock ticked towards 9 PM on the night of June 29, the talk of Internet in India was the Ministry of Electronics and IT’s press release indicating that 59 apps would be banned. The stated reason for this ban was that they were engaged in activities prejudicial to the sovereignty and integrity of India.The common thread among these apps is that they are of ‘Chinese origin’ even though that isn’t explicitly mentioned in the government’s banning order.How it could be implementedFor now, let’s set aside the question of whether the ban is a fitting response to the killing of 20 Indian soldiers in Galwan, Ladakh on June 15, and whether it is justified or not. What is likely to happen from here is that the Google Play Store and iOS App Store will be asked to de-list the apps from their Indian storefronts. There is precedent for this when a ban on TikTok was ordered by the Madras High Court.Read more

Apple v Basecamp: We need to separate gatekeeper from toll collector

This article was first published in Deccan Chronicle.In his book Super Pumped (a biography of Uber), Mike Isaac argues that App Store and Play Store give Apple and Google, respectively, the power to destroy multi-billion dollar companies. So when Travis Kalanick (then CEO of Uber) was charged with breaking some of the rules of App Store, and he managed to survive a meeting with Tim Cook without getting Uber kicked out of App Store, he felt like he could survive anything. When it comes to App Store, and the millions of developers and apps working on it, Apple is god.

Encouraging small sellers to get online must be a policy priority

The article was first published in Deccan Chronicle. Views are personal. At least 20% of Indian retailers were likely to wind up their business in the coming months. Because of restrictions in movement, it is hard for small sellers to maintain demand, and the only possible solution to that is to move online. Doing so at a national scale will expand the consumer base and better equip retailers to handle logistics.While moving online is a widely accepted solution for sellers, it comes at a monetary and compliance cost. If small retailers are to survive the pandemic, costs of moving online will need to be mitigated. Currently, instead of an incentive to move online, the pre-COVID tax regime has inadvertently installed exist entry barriers that act as a deterrent.

Now is the time for misinformation reform

This article was first published in Deccan Chronicle. Views are personal.One of the most evident changes brought about by the pandemic has been accelerated shifting our interactions online. This involves turning to the web not just our engagements with friends or colleagues, but also for questions and comments about the virus and the developments around it. For instance, running Google searches on whether the virus can spread through water, or engaging on Twitter about the latest numbers and how they can be controlled.Like many such transitions, there are multiple anticipated second-order effects of increased user interaction on platforms. Firstly, an increased number of searches around COVID-19 provides advertisers with an incentive to leverage that to their advantage. This includes advertising false cures for the virus, or masks, or immunity boosters. In addition, it also includes using controversial targeting options (such as anti-vaccine groups) to sell products.

Removing Chinese apps from your phone is the opposite of self-reliance

This article was first published in Deccan Chronicle.The most important takeaway from Nobel Laureate Daniel Kahneman’s insights from ‘Thinking Fast and Slow’ is that the human brain has two systems, System one and System two. The former is good at ‘fast thinking’, which relies on our instincts and emotions to come to conclusions quickly. Kahneman refers to the latter as slow thinking, which is more deliberate and logical in its approach.If I ask you to compute two plus two for me, System one will immediately throw up the answer. But if I ask you to manually multiply five thousand nine hundred four by twenty-eight thousand four hundred and ninety, you will automatically engage System two.  There are some tasks to which System one is better suited, while there are others for which you need to rely on System two. When you end up using the wrong system for the wrong task, you will likely end up with the wrong answer.Read more.

How Covid-19 Changes the Geopolitics of Semiconductor Supply Chains

On May 15, Taiwan Semiconductor Manufacturing Company (TSMC) — a semiconductor manufacturing behemoth that makes Apple’s A-series chips — announced its plans to build a $12 billion plant in the state of Arizona. On the same day, it was reported that TSMC has stopped taking new orders from Huawei to fully comply with the latest export control regulation imposed by the US. These are significant shifts in the semiconductor industry. We have an analysis of why these changes are happening and more importantly, why are they happening now.We argue that the economics of semiconductors — turbocharged by efficient and lean global supply chains — has made it a viable geopolitical tool. The US-China confrontation over Huawei is just one manifestation of this confrontation over semiconductors. COVID-19 only exacerbates this contestation. We evaluate four specific risks and write that COVID-19 will change the resilience-efficiency trade-off in the semiconductor industry. National governments and the geopolitical environment will be the key drivers of this transformation.The full article can be read on South China Morning Post here.

Will India experience the fallout of Trump vs Twitter?

This is an extract from the full article which appeared in Deccan Herald.....But before resorting to isomorphic mimicry, it is important to understand what the executive order proposes. The reading suggests that it seeks to narrow the definition of 'good faith' under which a platform can carry out 'Good Samaritan' blocking. Kate Klonick was quoted in Recode as saying that the order was not enforceable and even referred to it is as 'political theatre'. And Daphne Keller published an annotated version of the order in which she classified various sections as 'atmospherics', 'legally dubious', and points on which 'reasonable minds can differ.The current trajectory in India appears to be headed in the opposite direction. A recent PIL in the Supreme Court, filed by a BJP member sought to make it mandatory to link social media accounts with identification. While the petition itself was disposed of, the petitioner was directed to be impleaded in the ongoing Whatsapp Traceability case. The draft Personal Data Protections proposes 'voluntary' verification for social media intermediaries.

#BanTikTok Solves Nothing

This article was first published in Deccan Chronicle.Earlier this month, there was a huge push on Twitter to #BanTikTok. While Twitter is always enraged about most things, there are few apps in India that divide opinion more than TikTok. Earlier last year, Madras High Court placed a ban on the app, only to lift it later.Let us go a level deeper than the Twitter outrage and look at the reasons behind the call to ban the app. When the Madras High Court gave the order to ban TikTok, there was a clear implicit rationale that can broadly be divided into three main points. Firstly, TikTok has problems with content. Media coverage in India and abroad have noted the presence of pornography on the platform. Besides, the platform is a very graphic medium to spread hate speech. WIRED has done some excellent reporting on this and finds that the app has been used as a channel to incite violence between castes, at times leading to murder. 

What 300 Days of Internet Winter in Kashmir Tell Us About Erecting a Digital Wall

This is an extract from the full article published on The Wire.....What is the cost of this protracted disruption?There is no shortage of real-life stories about the economic impact this prolonged Internet disruption has had in the union territory. Media reports are replete with such examples.Given that we are still in the midst of these events, an academic exercise to estimate the economic costs has not been published.Still, using available numbers regarding internet subscribers (38% from TRAI for the service area of Jammu and Kashmir) and a rough estimate of time connected drawn out from reports on patterns of internet usage by people in India (different sources peg the ‘active consumption’ time between 90 minutes and 150 minutes. Let’s use the higher end of that range. Note that there is no measure of passive consumption impacted), it is possible to arrive at a back-of-the-envelope ‘estimate’ of how many hours of Internet access have potentially been disrupted since August 4, 2019.

Between August 4 and January 14, when there was a complete shutdown, this number amounted to ~1.9 billion hours. In the period from January 14 to March 4, when there was whitelisted access another ~600 million hours were added. And the 87 days between then and May 30, will have accounted for another ~1 billion hours. That adds up to around 3.5 billion hours of disrupted internet access for approximately 12.25 million people. Let that sink in.

Advertising a tax on the poor, pandemic going to exacerbate it

Supply of endless addictive content is a feature and a bug of the attention economy. However, much like its traditional counterpart, the attention economy is harsher on the poor than on the rich. And the pandemic is likely going to make it worse. Your attention has a monetary value for streaming platforms. Given by the current monthly prices, Netflix values your time at ₹26.2/day, Prime Video at ₹4.2/day, Hotstar at ₹9.8 a day, and YouTube (Premium) at ₹4.2/day. Roughly the per capita income of an Indian is ₹1,35,048. A yearly subscription to Netflix would cost 7.1% of that figure; Prime Video would be 1.1%, Hotstar at 2.65%, and YouTube at 1.14%.Read more.

Why India needs to be the centre for content moderation reform

You could put a price tag on what it costs to keep platforms clean of harmful content. $52 million is a good starting point (and an underestimation). But the learnings that come out of this experience have the potential to be priceless. Not just in terms of how much money they can potentially save in counselling costs, but in terms of preventing the mental harm that content moderation causes people who undertake it.The article was first published in Deccan Chronicle. Read more. 

Will Facebook’s ‘Supreme Court’ make the internet a safer place?

An intended and anticipated consequence of this board is that it will instil more transparency into the process of what stays up and why. By reporting on what the board discussed and did not discuss, it will help bring more clarity around the most prevalent problems on the platform. It may help tell us whether bullying is a bigger problem than hate speech or how (or where) harassment and racism manifest themselves. Read more. This article was first published in Deccan Chronicle. Views are personal.

Why govt must address the question of access inequity before making mobile apps mandatory during COVID-19

....

The Issues

Several concerns have been raised about the implications on multiple fronts. Privacy, and the risk of its evolution into a vehicle for mass surveillance. Security, and the potential information security risks to individual users as well as a large centralised database of citizen data. Legal - whether the National Disaster Management Act confers the necessary powers to do so, as well as the absence of Data Protection legislation. Technological - efficacy of contact tracing apps/algorithmic risk detection and the associated issues with false positives and false negatives. Transparency - opaque processes and the fact that the code has not been open-source yet. Some reports suggest that this may happen when the app is considered to be 'stable'. It is unclear, though, how stability is defined.The Ada Lovelace Institute has published a rapid review titled "Exit through the App Store" which warns of the risks of 'rushed deployment of technological solutions without credible supporting evidence and independent oversight'.

On Equity

An aspect which is under explored is Equity, or the lack of it. In designing public policy, Equity is a crucial part of policy design. It deals with the social allocation of benefits and deals with the questions of 'who pays' and 'who benefits'. In the book 'Policy Paradox', Deborah Stone lists 3 dimensions and 8 issues and associated dilemmas with each distribution method. Ultimately, this is a complex undertaking and no matter what criteria is for distribution, some group or the other will feel that they have been left-behind by the policy.Read more

Jio-Facebook’s e-commerce monopoly is not a foregone conclusion

This article was first published in Deccan Chronicle, views are personal.Earlier last month when Facebook made a $5.7 billion, (₹43,574 crore) investment to buy 9.99% share in Jio Platforms ltd, it led to plenty of analysis on how this deal was going to impact the Indian digital ecosystem.There is, of course, plenty to read into. For starters, you could say that for Facebook, this is all a long ploy to monetize WhatsApp. WhatsApp is the dominant means of communication in India. In 2017, Indians made 50 million minutes of WhatsApp video calls a day.Considering the bigger picture, Indian traffic on WhatsApp is bound to be significantly higher. WhatsApp has likely acquired a sizeable number of Indian customers since 2017 and the statistic above does not even take into account time spent by Indians on voice calls and texts.India is a huge market opportunity for WhatsApp, and considering the platform is end to end encrypted and does not run ads, the market dominance does not directly translate into revenue. It is no wonder that WhatsApp has been trying to launch a payments service in India for over two years now. ‘WhatsApp Pay’ has recently been granted regulatory approval to roll out the service in a phased manner.  Chatter after the deal focused on the combination of WhatsApp and ‘JioMart’ bringing kirana stores online, making a decisive entry into a new, relatively unexplored landscape.When asked to do a ‘TalkPoint’ by The Print on the subject, I found to my surprise, the widespread speculation around whether this news was the beginning of an inevitable monopoly. The short answer to this question is that the Jio-Facebook alliance translating into a monopoly is far from a foregone conclusion.The long answer begins with my information economics class for The Takshashila Institution. During the segment on standards wars, one of the key topics is around what are the key assets for a technology to establish itself as a standard. According to Hal Varian (Chief Economist at Google), there are seven key assets to a standards war; control over an installed base of users, intellectual property rights, ability to innovate, first-mover advantages, manufacturing abilities, strength in complements, brand name and reputation.Just looking at the deal and the nature of JioMart and WhatsApp, it is evident that the alliance has the first mover advantage. Kirana stores are an unexplored market and there is a significant opportunity to be tapped here. But a first mover advantage does not directly translate into victory.History of modern tech (a fascinating topic for a different column) has repeatedly taught us that doing something right can be more important than doing something first. The iPad was not the first tablet and Microsoft Zune was launched before the iTouch. But Zune, and the early competitors to the iPad have been relegated to being case studies in product failure.Put this into context, and the rest of recent news starts to seem like a natural flow of events. The week the news broke, Amazon’s homepage was updated with an article by Gopal Pillai (VP, Seller Services) titled ‘Local Shops on Amazon, a new beginning for offline retailers, highlighting Amazon’s shift of focus towards the issue. The timing is not a coincidence, competition moves fast. In the coming months, expect similar developments from Flipkart and Snapdeal as well.It is also important to note that core competences are going to play an important role here. Jio and Facebook can boast unparalleled national integration and scale.  However, neither of those companies have the experience in seller interactions, operating complex supply chains, and consumer preference data that Amazon boasts.So the first mover advantage is not definitive. Comparative strengths in other assets will be established over time. It is too early to say who the players will be. There is a whole bunch of plausible combinations involving payment apps, telcos, and e-commerce giants that could be possible. The Jio-Facebook alliance is likely the first alliance in a battle that is going to be long and drawn out. In addition, we do not know yet how the ability to innovate and strength in complements will demonstrate itself over the coming times.Borrowing from Donald Rumsfeld, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. The outcome of this deal on the e-commerce landscape in India is filled with known unknowns.Sure, given Facebook’s financial might and Jio’s demonstrated understanding of the Indian market, it is so easy to classify the move as the beginning of a monopoly. It may well turn out to be one. But to conclude that a monopoly is inevitable or that in some sense we are already there, is jumping to conclusions.

Stay safe and go back to the newspaper this pandemic

This article was first published in Deccan Chronicle. Views are personal.It is arguably easier to deal with the coronavirus than it is to deal with misinformation about it. The key difference is that when dealing with the former, you have your work cut out for you. Maintain social distancing, close borders, flatten the curve, and build capacity in the national healthcare system. When it comes to dealing with misinformation there is no one set of steps you can take to definitively win the battle.We did not need a global pandemic to realise how big a challenge misinformation is, but it helps. In India and abroad, we have seen some spectacular consequences of spreading misinformation. In the UK and Netherlands, conspiracy theorists spread misinformation claiming that 5G cell towers were spreading coronavirus. As a result of which, some 50 towers were burnt in the UK and 16 in the Netherlands.

 Closer to home, when PM Modi asked citizens to light candles and make noise for 10 minutes, WhatsApp was rife with networks of misinformation. People claimed that the rise in temperatures or the chance in decibel levels would kill the virus. Even if you have not been subject to any of these messages, you have likely heard that Indore locals or Muslim mobs attacked health staff and attacked doctors who went to treat them.  To put it mildly, it does not make any sense to attack doctors during a pandemic. Until you read Indian Express’ report that fake WhatsApp videos were circulated in localities claiming that healthy Muslims are being taken away and injected with the virus were doing the rounds of Tatpatti Bakhal and adjoining localities.Misinformation is so potent because social media is an excellent tool to spread narratives and reinforce beliefs, as opposed to television. Imagine a scenario when you are viewing protests live through news on a television screen. In all likelihood, all you can see is a hoard of people fighting with the police or marching down an aisle with slogans printed on charts.  The information you take in is largely what is visible on the charts or what the anchor at the time is saying.Compare that to how you observe a protest on social media. On Twitter, when you follow a trending hashtag, it will show you the video of the protestors or the slogans they carry. In addition, you will also be able to look at what most people are saying or thinking about during the protests. This helps absorb a narrative a lot more quickly than a news anchor would.In times of panic, like protests or a pandemic, the narratives thrive and get a larger audience. This leads to more engagement and more content. It is a vicious cycle that reinforces itself. That’s how it becomes easy to believe that 5G towers are spreading the virus or that doctors have come to inject you with the virus and not to treat you.It’s hard to say whether most misinformation is a result of malice or stupidity. But when it comes to tackling the infodemic, there are not a lot of generally accepted truths in the area.  The broad goal is clear. We need to re-evaluate the importance we afford to social media in our news diet. To anyone who hasn’t been living under a rock, it is evident that WhatsApp is not a credible source of information.In that spirit, it is easy to go to news sources that are free and convenient to access, such as Twitter and Facebook. It is even better when the news comes to you through push notifications on WhatsApp. However, when we rely on these sources for the news, there is no assurance that we actually get the news.Quality journalism and information that comes as a result of it is a commodity. Like most commodities, it might make sense to pay for it with money (not with privacy). Paying for the news is inherently not a foreign concept. We have paid for newspapers before, and a significant number of us still do so. It may not make sense to physically hold a newspaper everyday right now, but paid digital access is a more convenient and ironically, a more natural alternative.The trade-off is worth it. There is no end in sight to the lockdown and the pandemic. In times such as these, the value we attribute to information will increase on average. You may have a gripe with the editor about the stories s/he curates for you, but in a good news agency, there is genuine effort involved in fact checking and ensuring that consumers get both sides of a story. Any person who sends you a forward on WhatsApp will not go through any of these pains.So this lockdown, consider paying for the news or be critical of what you consume for free.As 5G towers in the UK and injured doctors in Indore will tell you, it is worth it. 

Should You Download Aarogya Setu?

This week of the pandemic has focused significantly on around Aarogya Setu and contact tracing. So much so that during his speech extending the lockdown, PM Modi urged people to download the app.The idea is for the Government to use the app to know where you are and who you have been in contact with, enabling contact tracing.The app’s privacy policy has been under fire since its release and has been updated recently with improved protections. Because the app is to be used for contact tracing as well as quarantine enforcement, it will collect huge amounts of personal and sensitive data. For instance, signing up to the app requires you to put in your name, age, gender, phone number, and profession.Once you have registered, the app will begin to use Bluetooth to check who you have been in contact with. In case you test positive, the information might come in handy to notify people who may have also been infected. However, the Bluetooth itself does not give away your location.The way it works is if the Bluetooth on your phone detects another phone in range, the pair will exchange keys and keep a record of the interaction.The app will use the GPS inbuilt on your phone to monitor your location, enabling it to determine whether you are adhering to the quarantine with significant accuracy. The phone will take note of your location every 15 minutes and only share the information with the Government server if you test positive.Normally, you would have found the data collected by the app to be extremely invasive. But then again, these are not normal times. You could make the argument that the measures are necessary and proportional.There are some technical shortcomings and slightly concerning macro trends with the concept. Firstly, the usage of Bluetooth. Bluetooth is fairly trustworthy over 6 ft (the norm for physical distancing). However, the same things that stop coronavirus from spreading do not apply to Bluetooth. As put by Casey Newton, Bluetooth can recognise two devices kept 10 ft and an apartment wall apart while the coronavirus may not transmit through walls.Situations like these are likely to lead to a lot of false positives.  Secondly, the context here matters. India faces different challenges as compared to the developed world. Earlier this month, when Apple and Google came up with the idea to enable contact tracing, it led to plenty of debate around wealth distribution being strongly correlated with OS distribution.The idea is that if you wanted to check where in the world wealth was concentrated, you could look at a map of iOS users around the world. Android, on the other hand, runs on a lot more smartphones than iOS, and not all of them have Bluetooth-LE, which is needed to enable contact tracing. Here, it is the poor who lose out.In India’s case, the poor currently lose out because they own feature phones and not smartphones. While Medianama reports that the Government is working on a feature phone version of the app, the poor will continue to remain at a disadvantage until it is released.Should you download the app? Yes. The updated privacy policy is a marked improvement upon the previous one. Most data collected by the app is stored on the device locally or 30 days, after which it is deleted. Data that is shared with the Government will be deleted after 45 days.However, in case you are unfortunate enough to test positive, the information shared with the Government will be deleted two months after the individual is cured.Broadly speaking, this policy is a step towards better data management practices. While protections could have been made better through open sourcing the app and disclosing the encryption, the current version of the app is reasonable in its approach and mandate.  More importantly, perhaps, in last week’s column, I made the point that the liberties we give up today may end up becoming the norm tomorrow.This very much applies to Aarogya Setu. Even with an updated privacy policy, in regular times, the app would have been considered invasive to personal privacy.The hallmark of a good policy/programme is that it ceases to exist once it has achieved its goal. What the app does need is an end date so that it does not inadvertently set a new normal. This also applies to measures such as facial recognition techniques being used to enforce quarantines as well as any other means that collect, store or process data.The pandemic will hopefully come to an end sometime. Keeping that in mind, so should the technology measures that are used to contain it. In that regard, Aarogya Setu should lead the way. A new, worse normal in privacy is the last thing the world needs. This article was first published in Deccan Chronicle. Views are personal.

Overcorrection at the cost of privacy during coronavirus is problematic

This article was first published in Deccan Chronicle. Views are personal. There are three pillars of crisis management, according to NYU professor Scott Galloway. First, the top guy/girl takes responsibility. Second, acknowledging the issue. Third, overcorrect. When you read it out loud, it seems reasonably straightforward but is a process that should not be taken for granted.It has taken governments and leaders around the world multiple attempts to take responsibility and acknowledge the issue. Finally, time has come to overcorrect. Six months from now when things are back to relatively normal, measures taken now may look drastic, but that is the point.However, it is not going to be easy to overcorrect. Even governments have to follow social distancing and may already have limited capacity to deal with a pandemic of this size. Given the pervasive nature of modern technology, it is no wonder that government administrations around the world are going to try and use digital methods to aid their efforts.China has been ahead of the curve on this. The government has begun using the Alipay app to assign citizens with QR codes based on their risk of exposure to regulate citizen movement. A green QR code means that you are free to move around. A yellow code means a one week quarantine while a red QR code refers to a two week quarantine. In Tamil Nadu, the Police is now using facial recognition to track people in quarantine. At a larger scale, the Union Government of India is using the Aarogya Setu app to help connect Indian citizens to health services.To most people, it might not make sense to talk about privacy in such times. And on one level, they would be right. It is hard to overstate the seriousness of the situation and dealing with the pandemic comes first. In such emergencies, concerns about privacy come second. Moreover, as a fundamental right in India, privacy exists with reasonable restrictions. Erosions of privacy must be necessary, legal, and proportional. Instead of being suspended, this standard should be upheld. Because as the Union Government (and the larger international community) use facial recognition, or apps such as the one deployed in China, it is crucial to keep in mind that such techniques have the potential to set a new normal by resetting our expectations on personal privacy.Rahul Matthan has an excellent analysis backed by observations regarding this. Before 26/11, hotels in India would let you drive to the entrance and hand over your keys to the valet. Post the Mumbai attacks, vehicles are mandatorily screened, as are people and the contents of their baggage. As a practice, it seemed important and urgent at the time, and has now become routine.More than a decade from now, doing so has become the expectation, and it is probably for the best. However, that was 2008, and the difference between now and then is that the liberties yielded today will be a lot more invasive than just vehicle checking at hotels.For instance, in case of CoBuddy (the app bring used in Tamil Nadu to track people), the app has constant access to the phone’s GPS and continuously checks the location of the phone. The app automatically sends an alert to the Police as soon as the person moves out of the geofence. The Police also sends users prompts 2-3 times a day to verify their faces.Not all data is created equal. While both facial data and location data are personal and sensitive, the former tends to be more invasive. This is because facial information is permanent and cannot be easily changed. While constant access to people’s location can help determine where they live and their movement patterns, it is easier to change where you go compared to how you look.The Aarogya Setu app, while admittedly better than (now discontinued) Corona Cavach when it comes to privacy, still collects your name, phone number, age, sex, profession, countries visited in the last 30 days and whether or not you are a smoker (apart from constant access to your location). Compare this with the Singapore government’s app, Trace Together, that only stores your mobile number and a randomly generated ID. Not only are we being subject to invasive apps, lists of infected people with their names and addresses have been made publicly available without their consent.Given the nature of the crisis and the tech response we have seen, it is evident that two things are happening here. Firstly, there is little regard to data minimization. Governments in India and across the world are collecting more data and accessing increased data points to get a better sense of people’s movements during the crisis. Once your name, age, facial data is shared with the government, it is unlikely to change. Instead, once this crisis is over, the data can be used for purposes it wasn’t collected for.Secondly, violations of personal privacy are becoming the norm and not the exception. It is now somehow okay to post lists of infected people on WhatsApp groups and to provide facial data to the police 2-3 times a day. Much like the vehicle checks at hotels post the 26/11 attacks, our expectations of privacy are being reset. Only this time, it is being done at scale.It is fair to say that we live in unprecedented times. But just because we do, does not mean that the necessity and proportionality standards for eroding personal privacy should be suspended. If anything, they should instead be upheld. Because the liberties we give up today, may end up becoming the norm tomorrow.

Zoom fiasco highlights need for data protection law

This article was first published in Deccan Chronicle.None of the protections afforded by a privacy law are in place yet, which leaves our data open to exploitation by tech companies.There has been a lot going on at Zoom. The video conference app has been a major beneficiary from the lockdowns imposed due to the coronavirus, as humanity participates in its largest-ever work from home experiment. As a result, Zoom’s shares have doubled in value in less than six months. All is not well though, the company has been fraught with privacy issues recently. For instance, the Electronic Frontier Foundation (EFF) pointed out that hosts of Zoom meetings can see if the participants are paying attention based on whether or not the Zoom window is active on their screens.Zoom would likely make the argument that the ability to be able to check whether people are active on a team call is a feature, not an instrument meant to cause harm. Which is one way to look at things. But at the same time, that is not the only slip up in terms of privacy the company has been embroiled in this past month. VICE reported that Zoom’s iOS app sends user data to Facebook even if you do not have a Facebook account. Zoom notifies Facebook when the user opens the app, shares details about the user’s device, such as the model, time zone, city, phone carrier, and the unique advertiser identifier (a unique number created by user devices which are then used to target ads).Zoom’s privacy policy is not explicit about this data collection and there is a blame game to be played here. Facebook can make the argument that it requires developers (like Zoom) using Facebook’s SDKs and Pixels to be transparent about the data they are collecting, using and sharing. Zoom can and has argued that Facebook was collecting unnecessary device data. We need to talk about all of this because apps like Zoom and Houseparty are not going anywhere.Instead, this incident is an excellent teacher for how policy and protections work in the data protection space. Firstly, it highlights the need and urgency for India (and other countries) to have a data protection law. These are exactly the kind of offenses a data protection law is supposed to penalise. In an ideal world, had there been a data protection law in place here, Zoom likely would have had to adhere to a standard of explicit consent. This way, the user would have been aware of what data was being shared. Had Zoom not adhered to the guidelines of consent, it would have had to pay a penalty. The data being shared with Facebook would have come under ambits of personal data, personal sensitive data and non-personal data, requiring different levels of protection and liability.The fact that none of the protections afforded by a privacy law are in place yet means the only protections users have are those given to them by companies whose objective is to maximise shareholder value. More often than not maximising shareholder value comes at a cost of trampling on user rights. Most companies will be more than happy to make this trade-off and would ideally want to do it when there isn’t a data protection law in place.At this point, it is hard to state whether or not a data protection regulation is going to be a definitive solution to incidents like these. Broadly because there isn’t a lot of precedence to learn from yet. Arguably the most significant existing legislation in this space is the General Data Protection Regulation (GDPR) in the EU. The law was enforced in May 2018 and an assessment of how its implementation has fared is due by the Commission sometime this year.There is every chance that the Personal Data Protection regulation that India ends up adopting is not going to fix everything when it comes to abuses of power that come with a vacuum in the data protection space. It is going to be hard to implement clauses and penalties on every website on the internet and to track data flow at scale.  However, as any policy analyst worth their salt will tell you, change happens at the margins.In the larger picture, Zoom sharing data with Facebook without explicit notice is a sign that is reflective of a deeper problem of accountability within the data protection space. There are no laws, and when laws do exist, they are near impossible to impose and monitor. This should serve as a high-profile warning sign of practices that currently exist and are going to continue until regulation exists.The writer is a technology policy analyst at The Takshashila Institution. Views are personal.