Internet Access Is A Fundamental Human Right In Cyberspace

A few years back talking about human rights in cyberspace generated skeptic reactions. Things have not changed much even today but at least now we know that human rights can be extended to cyberspace.

At Perry4Law Techno Legal Base (PTLB) we have been supporting the efforts that can ensure recognition of human rights in cyberspace at both national and international level. At the national level, India is still not ready and willing to recognise human rights in cyberspace. At the international level, part of human rights in cyberspace has started gaining importance.

For instance, the United Nations (UN) has declared that right to access to Internet is a human right. Similarly, Organisation for Security and Cooperation in Europe (OSCE) has also supported this stand of UN through a recently released report.

The report has analysed the first ever of state regulations on Internet access within the 56-member OSCE. Finland and Estonia have already declared access to Internet as a human right and this is a good step in right direction. PTLB welcomes these reformative actions of Finland and Estonia.

Countries around the world are restricting human rights in cyberspace by citing national security, sovereignty, law and order and many such grounds. While none can doubt that national security is an important function of a sovereign state yet there must be a harmony between national security and human rights.

Giving a blind and absolute primacy to national security even if clearly means violating basic human rights is not a wise approach for a welfare state like India. We hope Indian government would consider empowering Indian netizens by recognising and strengthening their human rights in cyberspace.

22 Nations Supports A Resolution To Pre-Empt Cyber Attacks

22 nations, including Russia and US are co-sponsoring a resolution to pre-empt cyber attacks that Organisation for Security and Cooperation in Europe (OSCE) is expected to adopt this week. The proposal calls for member nations to exchange information about the way they intend to deploy cyber technology during military conflicts. A decree to this effect has been introduced by a Belgium parliamentary member.

OSCE parliamentarians are gathering this week in Serbia to select provisions for inclusion in the Belgrade Declaration, an annual statement that guides OSCE decisions. The organisation, which represents North America, Europe and Central Asia, provides a venue for negotiations on conflict prevention and post-war rehabilitation.

This is a significant regional cyber security initiative that can help in the formulation of a dedicated international regulatory regime for cyber security. However, the ideal forum for worldwide discussion of cyber security threats is the United Nations (UN).

Regional cyber security cooperations can help in consolidation of international cyber security initiative. Last month, defense ministers at NATO, which does not include Russia, approved a new policy on cyber defense to help allies protect their communications systems and deter cyber attacks. This way cyber security is in the process of being consolidation in stages.

If the OSCE succeeds in conducting dialogues between states on norms in cyber security it would be a major step toward a more global approach, which may be promoted by the United Nations. The UN and OSCE do not share a budget but coordinate closely on field operations.

A proposal to establish a cyber security unit within the OSCE secretariat is also in process. Separately, the White House in May distributed a voluntary international strategy for cyber security that, like the OSCE proposal, urges cooperation in developing standards for acceptable conduct on the Internet.

M-Governance Policy Of India

Mobile governance (m-governance) is an innovative method of using mobile technologies for effective governance and public services delivery. M-governance facilitates many public services in almost real time and without hassles. However, along with the benefits of m-governance it has many drawbacks as well.

Firstly, we have no implementable m-governance policy in India. In the absence of proper planning and a sound m-governance policy it is not a wise option to utilise m-governance services in India.

Secondly, we have no dedicated legal framework for m-governance in India. This may create problems in cases of mobile banking, m-governance, m-commerce, etc. Of course, we have information technology act 2000 (IT Act 2000) as the cyber law of India yet it is far from perfect for even e-governance purposes and it is not at all applicable to m-governance environment.

Another issue pertains to the exercises of e-surveillance and phone tapping by Indian government and its agencies. Till now we have no lawful interception law in India. Phone tapping is done under the colonial and outdated Indian telegraph act 1885 and e-surveillance is done under the IT Act 2000. Both these acts are violating the letter and spirit of Indian constitution and have incorporated many unconstitutional provisions that are well beyond the parliamentary and judicial scrutiny.

Recently, the ministry of communication and information technology (MCIT) has launched the central monitoring system project of India. It has the capabilities to monitor all sorts of telecommunication and electronic communications. However, it is a pure executive exercise with no legal framework, civil liberty safeguards and parliamentary and judicial scrutiny.

At the international level some development for safeguarding the human rights in cyberspace has been taking place. United Nations has declared that access to Internet is a human right. This shows that human rights protection in cyberspace cannot be ignored by nations in future.

Finally, m-governance cannot succeed till we ensure cyber security for m-governance in India. Till now even the basic level cyber security is missing in India and we have no cyber security policy in India. Further, the IT Act 2000 need to be suitably amended or a dedicated legislation for m-governance must be enacted in India.

All these issues are integral part of the m-governance policy of India. Before jumping upon the fancy idea of m-governance we must ensure that it can operate and flourish in India.

Human Rights Protection In Indian Cyberspace

A few years back talking of human rights in cyberspace was seen with skepticism. Now people around the world are more concerned and aware of their human rights in cyberspace.

Surprisingly, United Nations has still not considered human rights issues of cyberspace though it has recently announced that access to Internet is a human right. United Nations must seriously consider protection of human rights in cyberspace as soon as possible as nations across the world are becoming more and more oppressive and endemic e-surveillance oriented.

While United Nations has declared that access to Internet is Human Rights yet Indian government is well committed to deny not only this human rights but also all other possible human rights in cyberspace.

For instance, projects like national intelligence grid (Natgrid), central monitoring system project of India (CMS), centre for communication security research and monitoring (CCSRM), Aadhar project of India, crime and criminal tracking network and systems (CCTNS), national counter terrorism centre (NCTC), etc have no “procedural safeguards” and they are violating human rights and fundamental rights in their “present form”.

These projects have been launched without any legal framework and parliamentary oversight. Further, even the most “basic laws” like data protection Laws, data security laws, privacy laws, etc are missing in India.

United Nations must urgently step in to formulate an international treaty on protection of human rights in cyberspace. If UN maintains its indifferent attitude, draconian laws like the cyber law of India keep on surfacing.

Central Monitoring System Project Of India

Central Monitoring System Project of India (CMS Project of India) is a very crucial project to safeguard Information and Communication Technology (ICT) related security and e-surveillance issues in India. It is mooted by the Central Ministry of Communication and Information Technology (MCIT).

The aim of CMS Project of India is to have a “Centralised Mechanism” where Telecommunications and Internet Communications can be analysed by the MCIT, Indian Government and its Agencies. Some have called this mechanism as the Internet Kill Switch of India where Internet Communications all over India can be suspended through this mechanism.

Recently, the United Nations declared “Right to Access” to Internet as Human Right. This would have a positive impact upon many Human Rights in Cyberspace. For instance, Right to Speech and Expression, Right to Privacy, Right to Know, etc cannot be violated by the CMS Project of India. United Nations must expand Human Rights Protection to many more issues.

This is the real problem for the CMS Project of India. We have no dedicated Privacy Laws in India, Data Security Laws in India and Data Protection Laws in India. Further, the CMS Project of India is also beyond the “Parliamentary Scrutiny”. The Cyber Law of India, incorporated in the Information Technology Act 2000 (IT Act 2000), was drastically amended through the Information Technology Amendment Act 2008 (IT Act 2008).

The IT Act 2008 incorporated various “Unconstitutional Provisions” in the Cyber Law of India that clearly violates the Human Rights in Cyberspace. For instance, provisions regarding Internet Censorship, Website Blocking, Encryption and Decryption, etc have no inbuilt “Procedural Safeguards” as mandated by the Constitution of India. This is the reason why the Cyber Law of India needs to be repealed.

Further, we have no E-Surveillance Policy in India. Even Phone Tapping in India is done in an “Unconstitutional Manner” and even by private individuals with or without Governmental approval.

If CMS Project of India has to be “Legal and Constitutional” it must be subject to “Parliamentary Oversight”. Further, the IT Act 2000 must be repealed as soon as possible as it is clearly not in conformity with the Constitution of India and Civil Liberties Protection in Cyberspace.

Of course, if India Government persists in this “Unconstitutional Approach”, taking recourse of “Self Defence Measures” is not a bad option. Rather that remains the “Sole Option” when our Parliament, Executive and Judiciary fail to protect Fundamental Rights enshrined in the Constitution of India and the Human Rights Charter of United Nations.

Encryption Policy Of India Is Needed

Use of Encryption in India has never been smooth. Intelligence Agencies in general and Central Home Ministry of India in particular are very much concerned about use of Encryption beyond 40 bits. However, what Home Ministry is not realising is that anything below 128 bits of encryption is definitely “Unsafe” and anything below 256 is “Potentially Unsafe”.

The Stakeholders that need “Higher Encryption Level Protection” includes Banks, Stock Exchanges, E-Mail Service Providers, Corporate Communications, Sensitive Government Communications, etc. It is “Not Feasible” to ask for Encryption Level below 256 bits.

Obviously, Indian Government has to take care of National Security and Law Enforcement needs as well. This does not mean we should have a “Weak Cyber Security Infrastructure” in India. On the contrary, we must ensure a Strong, Robust and Resilient Cyber Security Infrastructure for India.

At Perry4Law Techno Legal Base (PTLB) we believe that India should invest in establishing good Techno Legal Cyber Security Capabilities on the one hand and Cyber Skills and Intelligence Gathering Skills Development in India on the other hand. We believe that E-Surveillance can never be an “Alternative” for good and effective Cyber Security and Intelligence Gathering Capabilities. E-Surveillance must “Supplement” Intelligence Gathering Skills and “Not Supplant” the same.

This entire problem is happening because we have no Encryption Policy in India that clearly demarcates what level of Encryption can be used and what level cannot be. Further, we have no Legal Framework regarding Encryption usage in India.

We also have no Encryption Laws in India or Encryption Framework and Norms in India that have been “Prescribed” by the Parliament of India. All we have are “Encryption Guidelines” that are incorporated in various “Civil Contracts” with Telecom Companies and other such Companies. At most they are “Departmental Guidelines” but they do not have the “Force of Law”.

They are indirectly made applicable as “Forced Conditions” by the Telecom Companies and other Stakeholders. The “Legality” of this is very much doubtful as “End Users” have no “Autonomy” and “Free Choice” in such cases.

The Cyber Law of India, as applicable through Information Technology Act 2000 (IT Act 2000) has a single provisions in this regard. Section 84A of IT Act 2000 says that the Central Government may prescribe the modes or methods of Encryption. Till now the Central Government has not prescribed any “modes or methods” of Encryption usage in India. In fact, the IT Act 2000 is so “Badly Drafted” that many of its provisions are “Unconstitutional” and there is an urgent need to “Repeal” the Cyber Law of India.

It is high time for us to formulate a Techno Legal Encryption Policy for India as soon as possible. The Encryption Policy of India must keep in mind the Commercial, Cyber Security, Cyber Law, National Security, Intelligence Agencies and Law Enforcement requirements.

Further, the Indian Encryption Policy must also keep in mind the Civil Liberties in Cyberspace. Recently, the United Nations has declared that “Access to Internet” is a Human Right. Indian Government must “Balance” the National Security Requirements with Human Rights in Cyberspace as giving “Primacy” to one over another is not feasible.

Perry4Law and PTLB hope that Indian Government would take immediate steps to accommodate these “Suggestions” of ours.

Cyber Security Must Be An International Issue

I personally believe that Cyber Security is an “International Issue” and not a “National One”. Those who believe it to be a National Issue are going to suffer a lot. Similarly, “Self Regulation” is not going to help us in the long run especially when countries all over the world are establishing Cyber Commands and Cyber Warfare Capabilities.

I also believe that despite all odds, we must try to formulate International Cyber Law Treaty and International Cyber Security Treaty. Without clearly demarcating the “Roles and Responsibilities” of Nations in the Cyberspace, International Mutual Cooperation in this regard is next to impossible.

United Nations has a bigger role to play in this regard. On the one hand it must formulate International Cyber Law and Cyber Security Treaty whereas on the other hand it must make these Treaties in conformity with the Human Rights in Cyberspace.

Developed Countries like US are not interested in Treaties on Cyber Law and Cyber Security except to the extent permitted by present International Legal Framework .This Framework was formulated at a different time and in a different context. It is high time to abandon the same in the larger interest of “International Community”.

The growing Cyber Attacks on Gmail, Citicorp, etc are happening because of this “Void” at the International level. This “Void” is also forcing the Countries to adopt their own Cyber Security safeguards. Australia has planned a Cyber Defence Strategy whereas European Union has set up a team of Cyber Crime Fighters. Countries are adopting this “National Approach” because there is no “International Framework” to deal with these issues.

The sooner we have International Frameworks for Cyber Law and Cyber Security related issue the better it would be for the interest of International Cyberspace Community at large.

International Cyber Security Treaty Is Required

The threats of Cyber Crimes and Cyber Security attacks are alarming these days. As more and more Critical Infrastructure is connected to Information and Communication Technology (ICT), a need has been felt to protect Critical ICT Infrastructures all over the World.

In a typical Cyber Attack by an Enemy State, the Critical Infrastructure is the first choice. Estonia witnessed this truth in the past. Further, in cases of Cyber Warfare and Cyber Terrorism also Critical Infrastructure is the chief target of Cyber Attack.

It is surprising that despite the seriousness of the issue we have no International Cyber Law Treaty and International Cyber Security Treaty. International Organisations and Institutions have still not taken Cyber Crimes and Cyber Security very seriously. Even Human Rights Protection in Cyberspace has not been taken by seriously by all concerned.

Organisations like United Nations, North Atlantic Treaty Organisation (NATO), etc have also not shown much interest in this regard in the past. Now these Organisations have taken notice of the nuisances of Cyberspace and they are gradually shifting their attentions to Cyber Crimes and Cyber Attacks.

International Organisations dealing with Human Rights, Cyber Law and Cyber Security must start thinking in this direction as issues like Cyber Warfare, Cyber Terrorism, Cyber Espionage, Cyber Crimes, E-Surveillance, Unlawful Interceptions, etc are “Transnational” in nature.

If different Countries would have different laws for these issues, it would be very difficult to truly enforce protective provisions against these menaces at National and International levels. It is high time for UN to seriously consider issues like International Cyber Law Treaty, International Cyber Security Treaty and Protection of Human Rights in Cyberspace.

Technology Dispute Resolution Policy Of India

India has no policy framework for technology dispute resolution. At Perry4Law and Perry4Law Techno Legal Base (PTLB) we have been providing techno legal technology dispute resolution policies and strategies. We have been maintaining that online dispute resolution in India is the need of the hour.

However, ODR in Asian countries at large is not much popular and this includes India as well. Since there is no policy framework for ODR in India, Perry4Law and PTLB are providing the same here.

We have arranged and assembled all the possible information that we have shared with world at large in this piece of article so that individuals and international organisations like United Nations, United Nations Commission on International Trade Law (UNCITRAL), World Intellectual Property Organisation (WIPO), World Trade Organisation (WTO), etc can be benefited from the same.

Cross border technology transactions and dispute resolution is the latest trend in ODR. However, there are no international legal standards for ODR and international harmonisation of ODR is required as soon as possible. Similar is the situation regarding use of ODR for cross border e-commerce transactions.

There seems to be no effective coordination between UNCITRAL, ODR and India. Further, ODR in India is facing severe legal roadblocks that are preventing its growth in India. The Arbitration and Conciliation Act 1996 of India needs to be urgently amended to accommodate ODR, technology dispute resolutions, domain name dispute resolution, cyber squatting cases, cross border e-commerce transactions, etc. Even technological issues of intellectual property rights (IPRs) in India would require ODR mechanism.

The legal and judicial system of India needs innovative methods like ODR. At the same time, ODR is techno legal in nature and it requires ODR skill development and training for its proper utilisation in India.

All the abovementioned issues need to be formulated into ODR and technology dispute resolution policy of India. Law Ministry of India has proposed changes in the Arbitration and Conciliation Act 1996 and these suggestions can be incorporated in this same.

International Organisations And Cyber Crimes

Cyberspace has become an important aspect for Policy Formulation and International Commercial Transactions. Internet and E-Governance has become ubiquitous and indispensable these days. With this growth comes the darker side of technology as well.

Cyber Crimes and Cyber Attacks have increased significantly. International Organisations like United Nations, North Atlantic Treaty Organisation (NATO), World Intellectual Property Organisation (WIPO), International Telecommunication Union (ITU), etc are involved with Information and Communication Technology (ICT) in one form or other.

However, till now we do not have an Internationally Acceptable Cyber Crime Treaty. For instance, India is not a part of the European Union Convention on Cybercrime. Similarly, there are many countries that are not part of EU Cyber Crime Treaty.

United States has recently suggested that NATO must have an enhanced role in International Cyber Security. US is advocating an expansion of NATO’s “Threat to one is a threat to all” Treaty to Cyberspace as well. US has also formulated its International Strategy for Cyberspace.

Although the suggestion of US is worth considering yet NATO should not be the first platform where International Cyber Crimes and Cyber Security issues should be discussed. It is the United Nations that must be the platform where International issues of Cyber Law, Cyber Crimes and Cyber Security should be discussed.

We at Perry4Law and Perry4Law Techno Legal Base (PTLB) have been suggesting ICT Policies and Strategies in general and need for International Cyber Crime Treaty And International Cyber Security Treaty in particular. These are the issues whose time has come. Let us start the ball rolling.