The Week That Was: 25/08/2017

Posted on by Tech Law Forum NALSAR

In this second edition of The Week That Was, we find…

  • The 9 Judge Bench of the Supreme Court of India unanimously held that Privacy is a Fundamental Right under Part III of the Constitution of India and gave hope to the LGBT+ community, and may have implications for SEBI’s move to link with Aadhaar, the Beef Ban, among other things In their recent Valut 7 Publication, WikiLeaks published secret documents from the ExpressLane project of the CIA. The Office of Technical Services, a branch within the CIA, has a biometric collection system that is provided to liaison services around the world — with the expectation for sharing of the biometric takes collected on the systems. The core components of the OTS system are based on products from Cross Match, a US company specializing in biometric software for law enforcement and the Intelligence Community. CrossMatch had received certification from STQC India for India’s UID Program (Aadhaar)
    • See more on: BusinessWire, GreatGameIndia News, FactorDaily, WikiLeaks. CrossMatch Aadhaar Kits are one Google Search Away The Director General of Civil Aviation (DGCA) plans to introduce a remote pilot licence for operating drones and is expected to release draft norms for regulating the use of automated aerial vehicles (AAVs). Ahead of Gurmeet Ram Rahim’s rape case verdict where he was subsequently held guilty Mobile Internet Services remained suspended in Haryana, Punjab and Chandigarh for around 72 hours. Following the verdict, it has been reported that (at the time of writing this post) at least 30 people have been killed and more than 250 injured. The Punjab and Haryana High Court reportedly stated that losses incurred due to violence should be recovered from selling the properties of Ram Rahim Singh. Section 144 CrPC has been imposed in 11 districts of Delhi including New Delhi. Meanwhile, Internet Services continue to be blocked in Darjeeling, West Bengal for more than two months. Services had been blocked in the town following deaths of party supporters in violent clashes between the Gorkha Janmukti Morcha and security forces . Cardiotrack, a startup which claims to use Artificial Intelligence (AI) for predicting and diagnosing cardiac diseases, disorders and ailments has tied up with Columbia Asia Hospitals in Bangalore to predict heart condition. The National Payments Corporation of India (NPCI) instructed its member banks to ensure that their applications be equipped to read both UPI QR as well as BharatQR by 15th September 2017. The Electronic Frontier Foundation released a 10+ Year brief history on Activists being silenced on the Internet and Internet Intermediaries’ Long History of Censorship.
      • See more on: EFF.
      Berlin’s Südkreuz station has been investigating how well surveillance cameras and computers can automatically recognize the faces of passersby. It is claimed that this could track terror suspects and help prevent future attacks. Germany seeks to draw up legal guidelines for the operation of driverless cars. The guidelines observe that the software that controls such cars must be programmed to avoid injury or death of people at all cost, that in cases of an unavoidable accident, the software must choose whichever action will hurt people the least, even if that means destroying property or hitting animals in the road. A Russian regulation which requires Russian operators of communication networks (mobile operators and internet providers) to record and store records of communications between all users for at least six months, and provide such data to the authorities at their request, could be in EU’s General Data Protection Regulation 2016/679. Internet overuse could lead to individuals becoming vulnerable to many neuropsychiatric dysfunctions such as irritation, anxiety, obsessive compulsion according to a report by research by Etiologically Elusive Disorders Research Network (EEDRN) which is an umbrella body of medical/research institutes of India including All India Institute of Medical Sciences, New Delhi, National Brain Research Centre, Haryana, and Ambedkar Centre for Biomedical Research, Delhi. FBI arrested a Chinese national who is facing charges related to the malware used in the 2015 data theft from the Office of Personnel Management computer systems — a breach that exposed the personal information of millions of people — according to US officials briefed on the investigation The Department of Justice used a Search Warrant to get data on all information available to DreamHost (a webshost) on all information available to it on an Anti-Trump Site, a website that organized participants of political protests against the current United States administration. The new warrant parameters exclude most visitor logs from the demand, set a temporal limit for records from July 1, 2016 to January 20, 2017, and also withdraw the demand for unpublished content, like draft blog posts and photos.
      • The D.C. Superior Court stated that the government must disclose to the court who will search the material and what process they will use, That information seized by prosecutors not be shared with other federal agencies, and that data not related to the investigation be put under seal with the court and not accessible to the government without additional permission. Free Speech activists however believe some concerns remain
      • See more on: Politico, SCMedia,Popehat, DreamHost, WashingtonPost, PeopleForTheAmericanWay, EFF, Reuters, BuzzFeedNews
      A computer programmer at the Multi-State Lottery Association, secretly installed software that allowed him to pick winning numbers and was collecting money from jackpots in multiple states and now faces up to 25 years in prison.
      • See more on: CNBC.
      The Temer Administration in Brazil signed an order to open a public consultation to alter the “composition, election process and the powers” of Brazil’s Internet Steering Committee. Daily Stormer, a white supremacist website was blacklisted by Google’s domain service, GoDaddy, Cloudfare, SquareSpace, Zoho, Sengrid, NameCheap among other service providers. The Russian Network Information Center (RU-CENTER) registered the domain Dailystormer.ru, however, it was later blocked when Roskomnadzor, the Russian media watchdog asked for it to be taken down because of extremist content. A supposedly new version of the notorious neo-Nazi and white supremacist site Daily Stormer hosted by DreamHost was later DDoS’ed. Alphabet Inc.’s Google lost a bid to overturn a magistrate judge’s order forcing the company to turn over Gmail data stored abroad in response to a federal warrant.
      • See more on: Bloomberg BNA. An activist in Thailand was jailed for sharing an article on Facebook which was found to violate Thailand’s strict lese majeste laws against insulting, defaming, or threatening the monarchy.
        • See more on: EFF.
        A hacker under the pseudonym ‘xerub’ published what they claim to be the decryption key for Apple iOS’ Secure Enclave Processor (SEP) firmware.The secure ​enclave handles the processing of fingerprint ​data from ​the ​​touch​​ID ​​sensor ​​and determines ​​if ​​it ​​is ​​a ​​match​​ or​​ not​​ while ​​it ​​also enables ​​access ​​for ​​purchases ​​for​​ the ​​user. While ‘xerub’ and Apple state that ​ user data would not be at risk from this leak. Apple has reportedly yet to confirm the validity of the key. In the West Bank, the Palestinian authorities have arrested six journalists in August so far, shut down 29 websites and introduced a controversial Electronic Crimes Law imposing tight controls on media freedom and banning online expression and dissent In a case similar to Cross v Facebook reported on the earlier edition of The Week That Was, Facebook defeated another case over not removing user comments. The plaintiff, Paree La’Tiejira, who has been an adult entertainer, was apparently questioned of her birth gender in the past and a Facebook user posted a comment on her Facebook page accusing her of having been born male among other things. Facebook won the anti-SLAPP motion having qualified under Section 230 Communications Decency Act protection. In a lawsuit alleging price fixing against Uber and its former CEO Travis Kalanick. Uber (and Kalanick) moved to compel arbitration on the basis of the arbitration clause in Uber’s terms of service. The district court found that Uber’s sign-up process failed to effectively form an agreement, The Second Circuit reversed the order. In another case, the plaintiff allegeed that Ticketmaster violates the ADA for admission ticket and parking sales for Levi’s Stadium, Ticketmaster sought to send the case to arbitration. The Court ruled in favour of Ticketmaster In a case on White-on-White text Trademark usage, Agdia claimed that the defendant, in 2007, put the Agdia trademark in white-on-white text on over 200 pages. Even though Google had long configured its algorithms to ignore white-on-white text. Agdia claimed that the defendant’s website was still showing up for its branded organic searches as late as 2015. The defendants moved for summary judgment, their motion was denied. hiQ Labs, a talent management algorithm scraped LinkedIn public profiles and offered two products, entirely predicated on LinkedIn-scraped data: (1) a prediction to employers which employees were mostly likely to be recruited away, and (2) a summary of employee skills. LinkedIn sent a cease and desist letter telling hiQ to stop scraping or face litigation. The parties tried to resolve the dispute but were unable to. hiQ then filed a preemptive lawsuit seeking declaratory relief, and sought a preliminary injunction allowing it to access public LinkedIn profiles pending resolution of the dispute. However, Goldman notes that it would be shocking if “this ruling survives any appeal intact…” Bankers Life, a company that sells insurance and financial products, sued one of its ex-employees (and his new employer, ASB) alleging among other things that the ex-employee violated his non-solicitation covenant through his communications on social media. It was argued that LinkedIn requests sent by Gelineau violated his non-solicitation clause. It was held that the connection request didn’t violate the non-solicitation clause. Bankers Life’s request for additional discovery was also denied SunFrog, a Print-on-Demand website prints user-uploaded designs on T-shirts and other merchandise. Users uploaded Harley-Davidson logos to produce what Harley considered counterfeit T-shirts. The Court issued a Trademark Injunction against the website. Craiglist won a $31 Million in a case against Instamotor an online and app-based used car listing service, over claims that Instamotor scraped craigslist content to create listings on its own service and sent unsolicited emails to craigslist users for promotional purposes. Delaware’s Governor John Carney Jr. signed SB 69 into law. This would explicitly authorize the use of distributed ledger technology (“blockchain”) in the administration of Delaware corporate records, including stock ledgers. This opens the door for such companies to issue, execute, settle, redeem and trade stock in such a way as to harness the benefits of the blockchain. Plaintiff Matt Hosseinzadeh published a video skit featuring the “Bold Guy” character, “Bold Guy vs. Parkour Girl” video. Ethan and Hila Klein created a “reaction video” to it. In addition to a copyright claim, Hosseinzadeh sued over the Kleins’ allegedly misleading DMCA counter-notice and their statement about the lawsuit. The Kleins won a summary judgment on grounds of fair use. A two Judge Bench of the Supreme Court of India held that the live feed received by Prasar Bharati from content rights owners or holders is only for the purpose of re-transmission of the said signals on its own terrestrial and DTH networks.
        • See more on: SCC Online Blog.
        • Find the case Union of India v. Board of Control for Cricket in India, 2017 SCC OnLine SC 991, decided on 22.08.2017 here.
        Elon Musk’s OpenAI software has become the first AI to beat one of the world greatest eSports athletes Danil “Dendi” Ishutin in Dota2 A U.S. appeals court on Monday upheld the conviction of a former New Jersey-based high-speed trader who was found guilty in the first U.S. criminal trial involving the manipulative trading practice known as spoofing.
        • See more on: Reuters.
        • Find the case U.S. v. Coscia, 7th U.S. Circuit Court of Appeals, No. 16-3017 here.
        Maryland’s Personal Information Protection Act has been amended to expand the definition of personal information, modify the definition of breach of the security of the system, provide a 45-day timeframe for notification, allow alternative notice for breaches that enable an individual’s email to be accessed, and expand the class of information subject to Maryland’s destruction of records laws. A law has been proposed which is designed to protect private information and regulate who has legal access to it, as well as lay out penalties for those found abusing information in Oman. The Ninth Circuit determined on Tuesday that a plaintiff’s claim that the Fair Credit Reporting Act (FCRA) had been violated was sufficient “injury” for the case to proceed. The Court of Appeal for Ontario held that a utility sharing residents’ energy consumption data with police, which led to a search and criminal charges, violated their reasonable expectation of privacy. Ola and Uber have entered into an alliance with the Airport Authority of India (AAI) to set up designated cab zones at five AAI-run airports including Kolkata, Chennai, Pune, Bhubaneshwar, and Lucknow. Sharp, a Japanese electronics manufacturer, has filed a lawsuit challenging a foreign gag order that company lawyers say prevents Sharp from talking about its own brand. OkCupid made the unusual move of announcing that it had given a single member a “lifetime” ban on Thursday—and naming him—in order to make a point, asking its users to be vigilant about any other active members of hate groups found on the site and to report them. UC Web, the browser owned by Chinese internet giant Alibaba, has come under the scrutiny of the government as part of investigations against Chinese companies over data theft. If found guilty of stealing data of Indian users, the company may be banned in the country. Telecom regulator TRAI has issued recommendations which addressed issues like governance and legal framework for cloud services in India, data protection, moving government data to cloud, among other things. Facebook’s The People You May Know feature connected an individual to someone who turned out to be her great aunt by marriage (she had no Facebook friends in common). Raising privacy concerns as to how Facebook made that connection in the first place. The Delhi High Court sought the response of Facebook, Google and Yahoo on a plea to direct them to take down the links of Blue Whale challenge, an internet-based suicide game that has been allegedly linked to several deaths of children worldwide. Notice was also issued to the Centre and the Delhi Police asking them to inform about the steps they have taken in this regard. The ‘game’ has been banned in Uttar Pradesh. Odisha’s DGP KB Singh told all SPs in the state to keep a watch on various social media outlets and ensure that the suicide game was not available to the users in the state. An AI reportedly used bitcoin trail to find and help sex-trafficking victims.

Read more

The Week That Was: 11/08/2017

Posted on by vanlalvena

In this first edition of The Week That Was, we find…

  • Marcus Hutchins, the white-hat hacker known for stopping the WannaCry worm was charged with creating the Kronos banking trojan, a widespread piece of malware used to steal banking credentials for fraud and is accused of selling it to cybercrime market sites. He has denied any wrongdoing and pleaded not guilty.
    • See more on: ArsTechnica, Wired, IndianExpress, Engadget, Telegraph, TechBeacon
      • Find the full indictment here
      The Californian Court of Appeal in a majority rule in Cross vs. Facebook held the plaintiff could not claim a violation of his right of publicity; the plaintiff could neither demonstrate that the advertisements used his name or likeness, nor could he demonstrate that any of the advertisements were created by, or advertised, Facebook – that the advertisements only appeared in content posted to Facebook by third parties. Facebook was held not liable.
      • See more on: EFF, Eric Goldman’s Technology and Marketing Law Blog.
        • Find the case here.
        The DC Circuit recognised that in a situation where “an unauthorized party has already accessed personally identifying data”, substantial risk of harm could be said to exist, that this risk of future injury, of identity theft, was sufficient to give the plaintiffs standing under Article III.
        • See more on: JDSupra
          • Find the case here [Attias v. CareFirst, Inc., No. 16-7108 (D.C. Cir. 2017)]
            • See also similar decisions by Contrarily see opposing decisions by Senators in the United States seek to pass a bill to regulate the Internet of Things requiring vendors to provide “the internet-connected equipment to the U.S. government to ensure their products are patchable and conform to industry security standards.” The function-creep that is Aadhaar could soon be linked to Voter IDs. A notification recently mandated Aadhaar numbers for obtaining Death Certificates.
              • Re: Voter ID, See more on MediaNama
              • Re: Death Certificate, See more on LiveMint.
              • Further, more than 20,000 Aadhaar numbers were [inadvertently or otherwise] published on a Punjab Govt. website India blocked access to Internet Archive’s Wayback machine. This was due to Court Orders obtained by Bollywood Studios
                • See more on: MediaNama,  EconomicTimes. Further, as per the Minister of State for Electronics and IT, in 2017, till June, as many as 735 social media URLs and 596 websites had been blocked. Biologists at USENIX Security claim that encoding malicious software into physical strands of DNA is possible; such that when it is analysed by a gene sequencer, the resulting data would become a program that would corrupt the gene-sequencing software and take control of the underlying computer. The UK Govt announced a Data Protection Bill which introduces a “right to innocence” which would allow individuals to instruct social networks to delete anything they posted before the age of 18 ‘Self-driving cars’ might be common in the future, but we can already see some of the issues that could arise. Security researchers at University of Washington have found ways which could cause the computer vision systems to misidentify the road signs. The National Cyber Coordination Centre, the Indian government’s cyber security project which scans and records meta data on the Internet is live. It would likely have access to NATGRID and other intelligence/surveillance wings such as  NMW, EMMC. Scientists used a powerful gene editing tool called Crispr-Cas9 to fix mutations in embryos made with the sperm of a man who inherited a heart condition
                  • See more on: Guardian, NewsWeek, MedicalDaily, Scroll.In
                    • Find the study here.
                    • Alternatively, listen to one of the scientists working on the same speak on it here.
                    Around 175,000 connected security cameras manufactured by Chinese company Shenzhen Neo Electronics  are vulnerable to cyber attacks, according to a report by BitDefender.
                    • See more on: SecurityAffairs.
                      • Find the report by BitDefender here.
                      A Google Employee in the United States of America was fired over a controversial memo on gender diversity. Sundar Pichai, Google’s CEO reportedly said that the memo suggesting that some individuals would “have traits that make them less biologically suited to that work” was offensive and a violation of their “basic values” and “Code of Conduct” WhatsApp seeks to enter the FinTech industry in India, with plans to enable payments over UPI [Unified Payments Interface] Russia and China seem to be even more aggressive in clamping down on VPN services Checkers, Chess, Go, and Poker were seemingly not enough, Google’s DeepMind now seeks to take on the videogame StarCraft II BabyQ and Little Bing,two experimental chatbots in China were reportedly taken down due to voicing criticism of the Communist Party.

Read more

Law Enforcement v. End-to-End Encryption

Posted on by Kaustub Neil Singh Bhati

The age of digital communications with all its power to reach people instantly, anywhere on the globe, still has shortcomings. The instant communications happening all around us through laptops or mobiles involve two crucial processes i.e. encryption and decryption. These two processes are fundamental to the transfer of our voice and messages to the designated recipient anywhere around the world. While data resides on our devices or when it is being transferred, it is susceptible to interception by government or any other third party. Government intercepts these signals of communications, of the people suspected of wrongdoing with judicial permissions but this ability of the governments to gather intel by intercepting communications has hit a wall with the mass use of end-to-end encryption. The E2EE makes it highly improbable if not impossible to intercept such transmission and here lies the bone of contention between law enforcement and the public use of end-to-end encryption.

In a post-Snowden world, there has been relatively more awareness and interest in the right to privacy regarding digital communications; and in knowing when the government can snoop-in on personal conversations. A majority of the communications taking place today are digital and involve two crucial processes i.e. encryption and decryption. Encryption (which is conversion of information into a code) happens when a message/call is initiated. At the same time, decryption (conversion of code back into useful information) happens when the message/call is received by the recipient. There are multiple nuances in this process; both in the technological aspect and the legal aspect.

Read more

Kill the Kill Switch

Posted on by Vishal Rakhecha

India is at the third position in a list with some of the most ‘democratic’ countries like Syria, Saudi Arabia, etc. Internet shutdowns can have some serious free speech and free association implications, which is why it is necessary to have clear and precise regulations to ensure that this power is not used arbitrarily and unreasonably.

The internet has grown from being just a communication medium to becoming a marketplace, an entertainment source, a news centre, and much more. At any given moment, there are thousands of gigabytes of information travelling across the planet. But all of this comes to a standstill when the internet shuts down. An internet shutdown is a government-enforced blanket restriction on the use of internet in a region for a particular period of time. The reasons vary from a law and order situation to a dignitary visiting the place. There is a requirement for an analysis into whether such shutdowns can be justified, even on the direst of grounds.

Read more

Consent to Cookie: Analysis of European ePrivacy Regulations

Posted on by Vishal Rakhecha

This article is an analysis of the newly passed ‘Regulation on Privacy and Electronic Communications’ passed by the European Union.

A huge part of our daily life now revolves around the usage of websites and communication mediums like Facebook, WhatsApp, Skype, etc. The suddenness with which these services have become popular left law-making authorities with little opportunity to give directions to these companies and regulate their actions. For the large part these services worked on the basis of self-regulation and on the terms and conditions which consumers accepted. These services gave people access to their machinery for free, in return for personal data about the consumer. This information is later sold to advertisers who later on send ‘personalised’ advertisements to the consumer on the basis of the information received.

Read more

Reconstructing a Crime Scene: Virtual Reality in Courtrooms

Posted on by Kaustub Neil Singh Bhati

Virtual Reality is the latest buzz in the technological sphere, especially with the arrival of VR devices like headsets from giants like Facebook (Oculus Rift), Sony (PlayStation VR) and HTC (Vive). It is a relatively old concept (Aspen Movie Map was the first example, created by MIT in 1978) but with advancement in contemporary technologies, virtual reality has progressed by leaps and bounds in its effectiveness i.e. from being a mere 3-D image to an immersive and interactive system. Apart from its use in gaming and other entertainment purposes, it has been proposed to use this technology in another rather unexpected facet that of judicial proceedings.

Prior to the use of the technology it is important to analyse the concerns regarding the technology in question in a courtroom setting. The concerns are multifold: the manipulation of facts regarding the actual scene of crime/accident, time delay in court proceedings, cost of the expensive procedure and the possibility of manipulation of the trier of facts (judge/jury) i.e. inducing bias. While all of these are relevant questions regarding the use of virtual reality in courtrooms, each of the above concerns can be mitigated.

Read more

PATENTING OF HUMAN GENES: Intellectual Property vs Access to Healthcare & Research

Posted on by bhattacharyasayan

In the case briefs of Myriad Genetics vs Associated Molecular Pathology, amongst the several moving stories of victims of gene patents, contained the story of Abigail, a 10-year-old with a long QT syndrome, a serious heart condition that, if left untreated, could result in sudden death. A company in this case had obtained patent on two genes associated with this condition and developed a test to diagnose the syndrome. But then they went bankrupt and never offered such tests. Another lab tried to offer the test to Abigail, but the previous company which held the patent to such diagnosis threatened to sue the lab for patent infringement. So as a result, for 2 years, no test was available. During that time, Abigail died of undiagnosed long QT.

In 1790, the US Government started issuing patents under Patents Act 1790, with the motive of “Encouraging Arts and Sciences”. These intellectual property rights slowly became the biggest statutory safeguards of research and investment in a democracy. Edible business cards, nicotine infused coffee, a rock-paper-scissors card game for people too lazy to use their hands and finally thong diapers which make up the list of some rather amusing patents the USPTO has issued to protect intellectual property.

Read more