Data leak: What makes Indian internet users vulnerable & how govt can help protect our digital data

On June 12, there were reports of a Telegram bot churning out personal data of Indian citizens like Aadhar and passport numbersThis was allegedly because of a data leak from the CoWIN portal Union health ministry, Indian Computer Emergency Response Team and the ministry of electronics and IT collectively denied any data breach from CoWINThe Digital Personal Data Protection Bill 2022 is set to be tabled in the monsoon session of the Parliament – but is it enough?In this two-part podcast series, Internet Freedom Foundation’s policy director Prateek Waghre tells us what makes Indian internet users vulnerable and how the government can help protect our digital data Ep 1: Data leak: What makes Indian internet users vulnerable & how govt can help protect our digital dataOn 12 June 2023, there were reports of a bot on the messaging platform Telegram churning out personal data of Indian citizens like Aadhar and passport numbers. This was allegedly because of a breach of the CoWIN portal, short for the Covid Vaccine Intelligence Network, that was created to streamline the vaccine distribution process.In response to these claims, the Union health ministry, the Indian Computer Emergency Response Team and the ministry of electronics and IT, collectively denied any data breach from CoWIN. Union minister for electronics and IT Rajeev Chandrashekhar tweeted: “The data being accessed by bot from a threat actor database, which seems to have been populated with previously stolen data stolen in the past. It does not appear that CoWIN app or database has been directly breached.” This is part 1 of a podcast series about not just what the alleged CoWIN breach means for regular Indian citizens, but also about our data privacy in general. Is our data safe on the internet, and how can the Indian government make it even safer for us? To answer these questions, we have with us the policy director at the Internet Freedom Foundation, Prateek Waghre, who will talk to us about data breaches, data safety and what makes India a work-in-progress in this regard. Excerpts…Moyurie: What kinds of information comprises a person’s “digital data”?Prateek: The answer to that probably evolves based on the time period in which that question is typically posed, right? If you think back, maybe 15-20 years ago the type of data that you would normally put out on the internet would be very limited, right? It might be limited to just some sort of demographic information. We are potentially using the internet to apply for jobs and things like that, probably not transacting as much, but if you fast forward to today, it’s significant. So many aspects of life are now intermediated by the internet, of course depending on your socio-economic situation. But significant parts of your life are on the internet, from right from the thoughts you might be putting out on social media, to transaction sites which will require financial information. All of that has different levels of information. This can vary from things like your name, your phone number, your address. It can include in some cases information about your family member, that can include information about where you are going, whom you are meeting etc. All of this is something that we’re either supplying actively or in some cases passively, which is being inferred based on our activities. So there’s a whole range of data about us as individuals, as citizens that we find or that you’re likely to find on various parts of the internet today.Moyurie: Who bears the responsibility of protecting this data?Prateek: It’s a shared responsibility. To some extent the onus is on the companies themselves that are gathering this information. Right now, you have to assume that you’re gathering a limited amount of information. Only as much as you need and not than what you want because the tendency right now -- especially with data being considered a monetizable asset -- is that you tend to gather as much information, as much data about individuals, about their behaviour, about their practices as you can and then you probably figure out later how that can be monetized. The incentive there is to gather as much data as possible rather than trying to limit the amount of data you’re collecting. And, the more data you accumulate the more you know it’s potentially vulnerable to various sorts of risks. From the government’s position, it becomes two-fold and it becomes more complicated.The government is also providing services, so it collects data from that perspective. So, the same logic that applies to companies also applies to the government. But then there’s also the broader context of the regulatory environment which the government should provide right in terms of setting the foundation and the framework for when data should be collected, how long it should be retained, for what sort of practices. If data is compromised, if they should be notified when it happens and if there is a possibility for compensation, things like that.That framework is something that the government has to set and then enforce. As individuals, we can do certain things to protect the amount of information we share. But that’s not always a choice that’s available to a lot of effect. You know some of us may have the option to say “hey, we will not use XYZ server site because it collects too much data” or you don’t like the company. But I think it’s important for us to ignore that. Not everybody can exercise that choice and the full onus should not fall on Individuals.There are potentially some basics that individuals can practise themselves. But broadly, they don’t have the incentive today. And the way data practices work today, they don’t really have a significant amount of choice on that. It then goes back to the other two main actors in this site which are the companies and anyone collecting data to minimise the amount of data they collect and make sure whatever they do have is safe and not shared with too many other entities. And to fully inform the people they’re collecting data from, why they're collecting it, what they’re going to use it for and then actually not use it for any purpose. And then the government of course, in terms of setting up a legal framework for this.Moyurie: What would you say are the consequences of India not having data protection regulations? How are we as internet users left vulnerable?Prateek: There are two parts with the regulation bit and then there’s a functioning regime that can actually enforce it. There are global practices that people can always adopt. But from the Indian legal landscape, there isn’t something that’s enforcing the types of data practices. You know what their duties are in case they suffer a data breach or some data is leaked -- do they have to inform individuals, etc. None of that is codified. It then goes down to maybe what a company may choose to do themselves and I think in most cases, companies would prefer this information not going out there. In terms of also there not being a codification of what they can use data for. There is nothing if you collect data for a specific purpose (in data protection parlance you call this “purpose limitation”) which is when you’re collecting information or collecting data from an individual you inform them what the purpose is, what they’re collecting this information for and then limit it only to that. If not, if you’ve collected five pieces of information about a person, you can then use that for anything else tomorrow. So for those sorts of protection, practices need to be codified. The second step of that is enforcement because once you have the regulation you also need to enforce it. The other thing to understand is that some of these data flows are extremely complex to understand and extremely complex to even detect, if someone is abusing them or is not following the legislation or what’s being prescribed as per the law. You also need an independent body to be able to enforce that, to be able to hold companies as well as government departments accountable. You need both the regulation and the enforcement to go hand in hand. 108393569Ep 2: What India’s proposed data protection legislation gets right, and doesn’tThis is part 2 of the podcast series on data safety, with the policy director of Internet Freedom Foundation, Prateek Waghre. In part 1 of this podcast, Prateek took us through the basics of what constitutes our personal digital data and how internet users are left vulnerable to data leaks, like the alleged data breach from online vaccine-registration portal CoWIN. In this episode, he will talk about India’s existing data protection systems – what it has, what it lacks and what the upcoming Digital Personal Data Protection Bill 2022 has in store. Excerpts…Moyurie: In your article for The Times of India, you mentioned a three-pronged solution there for data protection. One of them I remember was a data protection Bill, which has been drafted and will be tabled in the monsoon session of the Parliament. What are your thoughts on it?Prateek: What we pointed out in the article was that there was a vacuum potentially at three different levels. One was at the level of a privacy regulation or a data protection Bill. That’s a functional data protection regime. Second, in terms of an overarching cyber security or an updated overarching cyber security policy. The current one is from 2013. There was a consultation that the national security council secretary carried out in late 2019 for a cyber security strategy, not necessarily a policy. They sought input and one of the outcomes of that process along with this strategy would also be an updated policy that then sets the direction for the cyber security ecosystem. That’s something that we don’t have yet. The third component that we spoke about was essentially the idea of sharing information across ministries which was in the form of the national data governance framework, which is currently not in effect. As per statements by the ministry, I believe, it’s finalised. But it’s unclear whether finalised means in effect or not and whether that information is being shared.One thing they pointed out is that it doesn’t seem to have a legal basis. But now, going back to the point about the data protection Bill itself and the criticisms. Let’s look at the content of the Bill. One aspect is that the Bill leaves a lot of the specifics to be determined by subordinate legislation at a larger scale. So the phrase “as may be prescribed” appeared an inordinate number of times across the Bill. Now you could reasonably argue that in some cases that’s required. It’s not possible for the Act to specify everything and I’ll take that. But I think in our analysis we did find that there are a lot of specifics that were left under an “as may be prescribed” language. It made it hard to analyse the implications of the Bill in a thorough way because you would have to wait for this subordinate legislation or rule-making to take place. The thing with rule-making is that it doesn't have to go through the same level of parliamentary scrutiny. It’s something that the government can ratify. So there is that aspect of one not having enough specificity and the ability for it to be updated without adequate safeguards in the process. Moyurie: Based on what you have said so far it feels like a recurring need for any data protection regulation is the government putting limits on itself and holding itself accountable, for any data breach or data collection…Prateek: Absolutely. Because, as more and more services are being digitised, they’re seeing this across different levels of society. Of course, it brings about many other challenges in terms of opacity of decision making etc. But just limiting ourselves to data and data protection for now also means that you know as an actor that is vulnerable to attack, you have the government at various levels with different levels of capabilities.It is important to highlight that the resources that were diverted or resources invested in protecting CoWIN were likely higher than a lot of other databases across the country. So there is always going to be that difference in the level of protection of this data which may be the same data. It matters less to me where my information is breached from.Let’s say you know health information about me is breached from a government hospital locally or a private hospital locally or a centralised database that maintains vaccination records. So as an individual, it does not matter to me much where that data has gone from as long as that information out there has the potential to be misused in some way. There are different levels of harm that can occur from that. The source of the data doesn’t matter as much from an individual’s perspective.For the full interview, please listen to the podcast.Audio production: Shantanu Nanoti