Tag: Intermediary liabilities

Uncategorized

Looking for 5 star restaurants or amenities or service providers? Here is the reality by Dr.Debarati Halder

Image courtesy: author

Recently there was a news report of a woman losing a little fortune for a pencil marketing scam in India. In the contemporary world, digital marketing has become a lucrative job for all. This promises a good income from the home comfort zone and just needs two tools: internet connection and a digital technology enabled device (it can be either a smart phone or a laptop or desktop computer). But this is a myth bursting report for everyone who may read this article. I have been contacted by a recruiter agency recently and I got to see a practical example as how such agencies dupe people, especially women.

  1. How do these agencies get the phone numbers of the target victims?

Apparently they have a super research team who may go for data mining from every possible source: this can be data base of the shops where we may have recently visited and shared the phone numbers, our phone data recharging agencies where our phone numbers are supposedly saved for processing the data, third party service providers who may be working with our phone numbers, Aadhar data etc., for our professional workspaces etc. The one who contacted me (un)smartly shared that they collect ‘verified numbers’ by partnering with telecom companies for the purpose of market survey for their clients. Now the question is: who are these telecom companies? Apparently they are the digital communication service providers like Airtel, Jio, Vodafone etc. But not really: there are many telecom agencies who are middlemen. They are the agents of the main data fiduciary. They are data collectors, recharge service providers and they are all bound in the same legal chain, namely Digital Personal Data Protection Act, 2023 and Information Technology Act, 2000(amended in 2008).

  • Modus operandi: These ‘agency’ people filter the profile of data profiles on the basis of certain criteria. This may include age, gender and geo-location. They may contact the target through SMS or through WhatsApp. In the case of later, they may start the conversation by stating about the daily estimated income and after that they may share the trial task. It is but obvious that they do not stick to a static number. Hence if one completes the trial task and shares the bank details, the scammer may ‘vanish’ with account details and some essential confidential information that may enable them to access the account without much hard work.
  • Now comes the question as what type of task would be given and what is the ‘job’. This surprised me because I am a foodie and I really trust the ‘stars’. But its time to come out of the myth. No restaurant may have a neat 5 star from customers and diners. It’s the manipulative work of digital marketing companies that may outsource the job to people like me and you and in between some scammers may join to mint money from both the parties. I was asked to rate restaurants from Google map and the ‘task’ restaurant was somewhere 260 kilometers away from where I stay. I have never visited the restaurant and the place where it is situated. I have never seen their menu card nor I have tasted their food (nope, not even by Zomato  or Swiggy because they wont deliver any food item so far).

Now probably you may know how some restaurants, shops, hotels or even health care service providers may get 5 stars and stay at the top of search list!

But that’s not all. These agencies may necessarily provide links to upload positive comments and stars. A click on them may invite many more digital trouble.

  • Would they be worried if you tell them you have lifted the ‘innocent veil’ and found out who they are? Answer is ‘no’. That’s because they would take seconds to change their phone numbers and delete all texts shared with the victims to disable the latter to take any evidence to the police.

Why are they targeting women? A possible answer is women, especially undergraduate students and home makers may need to make money from the comfort of home. It’s a moonlighting while the home makers are involved in full time household chores.  And yes, most the targets may not be able to suspect the scammers because they may use women’s photographs in their WhatsApp profiles. As such, we may never know who accesses our WhatsApp or Instagram profile pictures and how they may be misused.

The laws that may help: First of all, understand why they are called scammers and what sort of crime they are doing. Digital personal data protection Act , 2023 has mandated that all data collectors must mandatorily explain the reason behind colleting the personal data (including the phone numbers) of data principals. All data fiduciaries are also mandated to explain why and how the collected data will be processed. Have you ever heard from your shopping mall or any other service provider stating you clearly why they are collecting your number? It’s not n for future connection. But its for sharing our phone numbers (whether consciously or unconsciously) with scammers who may continue to feed other business establishments   by providing unauthorized information. S.43A of the Information Technology Act, 2000(amended in 2008) makes the body corporate liable to pay damages to data owners for negligence to protect the integrity of the data. But this is the live example as how all stakeholders in this regard dupe the actual data principle.

Often victims who may understand that they are trapped, may try to counter these scammers by calling them, sharing photos and numbers of the scammers on the social media portals, or even try to reach out to them searching for the physical office addresses. Each of these may invite different kinds of trouble. The best way to address this is to be aware of the patterns of  fraudulent activities done by such scammers, block and report the phone  numbers to the intermediary and report the matter to the portal of https://cybervolunteer.mha.gov.in/webform/Volunteer_AuthoLogin.aspx  . Remember, we women are the chosen target for cyber crooks because they feel women are less empowered. It is our right to be safe and duty to prove them wrong!

Stay safe.

Please don’t infringe the copyright of this write-up. Please cite this as Halder.D(2023). Looking for 5 star restaurants or amenities or service providers? Here is the reality. Published on 11-11-2023 @https://wordpress.com/post/internetlegalstudies.com/1472

Cyber Law

Intermediary liability: Are Universities countable? By Dr.Debarati Halder
Image Courtesy: Internet

Behind every data storage mechanism , there is a human intelligence that works to decide how the data store house will be managed, protected and which data may be exposed and how. For Long I have been arguing that behind every breach of data security, there is a human brain. He/she can be a data collector, data fiduciary, data manager, data protection engineers or a designated data protection officer of any website and tech company. My argument becomes stronger with every day update on data breaching methods: this time it is a two member group of  university officials in western India who have been accused for leaking cloud storage password to another university located in central India. while the accused persons have the right to defense for such allegation, such information may suggest that no organization including the banks, hospitals, universities and government departments dealing with civilian’s data are safe.   

Let us first understand what is an intermediary:

Often, we tend to confuse the term intermediary with website, internet service provider and internet. All  three of them denote different meanings but the concept is over lapping with each other. Indian information technology Act 2000 (amended in 2008) defines  intermediary  especially in respect to electronic records and data in S.2(w) as

any person who on behalf of another person (i) receives, stores or transmits that record or

(ii)provides any service with respect to that record and

(iii) includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes.

Interestingly the word “any person” has got different meanings in this section: when it says “any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record”, it may mean a natural person, i.e. human beings (especially adult human beings, who may be capable to take rational decisions, enter into contracts  etc.) again, when it says “telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes” etc, it may mean a juristic person who has legal personality and who may be represented by its human representatives like the CEOs or the  nodal officers etc.

In its preamble (para 4)in  Recommendation CM/Rec(2018)2 of the Committee of Ministers to member States on the roles and responsibilities of internet intermediaries, the Committee of Ministers, Council of Europe has shared some functions of such intermediaries which are as follows: …………………. “internet intermediaries”, facilitate interactions on the internet between natural and legal persons by offering and performing a variety of functions and services.

Some connect users to the internet, enable the processing of information and data, or host web-based services, including for user-generated content.

 Others aggregate information and enable searches; they give access to, host and index content and services designed and/or operated by third parties.

Some facilitate the sale of goods and services, including audio-visual services, and enable other commercial transactions, including payments.

Individual responsibility of the natural person intermediary for failure to protect the confidentiality of the data

As the above discussion may lead us to understand the meaning of intermediary as both natural person as well as juristic person (who may be represented by a natural person), let me now explain how intermediary (natural person) including the data manager and /or the data protection officer as appointed by the data fiduciary may be responsible for leaking of the data saved in data storehouse under the body corporate . He/she may

  1. Intentionally violate the obligation of confidentiality and share the security password for the data to third party without consent of the body corporate or the data fiduciary who may have collected the personal data for specific purpose.
  2. Negligently passes over the security information to third party to allow the confidentiality of the data to be breached.

In both these cases the primary responsibility of data breach may fall upon the Body corporate who may need to pay compensation under S.43A of the information Technology Act, 2000(amended in 2008) to the data principals whose data has been breached while the same was under his custody. But then such individual (natural persons) may also be held responsible under numbers of legal provisions. These may necessarily include S.72A of the Information Technology Act which prescribes punishment for disclosure of information in breach of lawful contract. This bag of penal provisions against such intermediary (including the data manager or the data protection officer) may also include S.43 read with S.66 of the Information Technology Act which prescribes punishment computer related offences.

What we understand from the above especially about universities as intermediaries as well as body corporates?

Universities are also intermediaries and body corporates who collect personal data including sensitive personal data of the teaching and non-teaching staff and of the students.

The personal data of the above-mentioned stakeholders are connected with their family members. Hence it may be easy for the possible perpetrators to fish out sensitive personal data of university employees and students as well as their family members.

Universities as body corporates also hold information about their own examinations, public examinations and data related to foreign university collaborations (which may also include domestic -foreign trade collaborations).

As a matter of fact, then if data is leaked from the university data base or the university is attacked by ransomware attacks, all stakeholders connected with the universities may be affected and women will be particularly vulnerable targets. It is necessary therefore that all universities must set up proper cyber security infrastructure and employ trained data protection officers and data managers who may be providing safe services for all as university intermediaries.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2023)Intermediary liability: Are universities countable? Published on 31-10-2023 @https://wordpress.com/post/internetlegalstudies.com/1463

cyber crimes against women, Cyber crimes against women, Cyber Law

The TikTok ban : Why the ban may fail to prevent online victimization of women

by Dr.Debarati Halder

Image credit: Google

On 24th April Madras High court would decide on the plea of Bytedance, which owns TikTok regarding the much talked about ban of the app. Tik Tok, , a nongaming app launched in 2019 has given a tough competition in regard to its popularity to all the social media giants because of the unique features  which allows users to create and share short videos with special effects. Teenagers and adults  in India loved the app because unlike other social media platforms including YouTube, TikTok has simple features to upload and publish videos. Unlike PubG however, this did not necessarily have gaming features.

In early April, 2019, the Madurai bench of Madras High court had in an interim order directed the government stakeholders in the State and Centre to ban the video app TikTok as the Public Interest Litigation in this regard emphasized that it encourages pornography and underage users are vulnerable to be exposed to sexually explicit contents, pornography etc, which may not be good for their mental and physical health.[1] Incidentally the Madurai Bench of the Madras High court was the first court in India to take suo motu cognizance in BlueWhale game case and asked the Central government and the social media website, web companies like Google etc to monitor what is being generated and catered to the users through their platform.[2] But in this case, the situation stands on a different platform: consequent to the interim order, Google and Apple removed TikTok app  from their Play Stores.  Resultant, Bytedance had incurred huge loss. But the later has now challenged this interim order on the ground that the interim order was passed on the basis of ex parte hearing. The company had stated that the app allows users to create videos and circulate them for fun and amusement and it does not pose any threat to security of individuals. Bytedance also stated that such bans are against right to speech and expression.[3]

We can see here two important points:

First : before the governments took prohibitory actions (like what happened for PubG ban in Gujarat, where police started arresting those who downloaded and played PubG even after the ban order was conveyed to the public)[4], Web company like Google  and phone and software manufacturing company Apple had followed the mandates of S.79 (exemption of liability of intermediary in certain cases) and Rule 3 of  Information technology (Intermediaries guidelines) Rule, 2011 : specially mentionable are Rules 3(3) and 3(4) which states as follows:

Rule 3(3) states that The intermediary shall not knowingly host or publish any information or shall not initiate the transmission, select the receiver of transmission, and select or modify the information contained in the transmission as specified in sub-rule (2): provided that the following actions by an intermediary shall not amount to hosing, publishing, editing or storing of any such information as specified in sub-rule: (2) — (a) temporary or transient or intermediate storage of information automatically within the computer resource as an intrinsic feature of such computer resource, involving no exercise of any human editorial control, for onward transmission or communication to another computer resource; (b) removal of access to any information, data or communication link by an intermediary after such information, data or communication link comes to the actual knowledge of a person authorised by the intermediary pursuant to any order or direction as per the provisions of the Act;

And Rule 3(4) of the above rule states The intermediary, on whose computer system the information is stored or hosted or published, upon obtaining knowledge by itself or been brought to actual knowledge by an affected person in writing or through email signed with electronic signature about any such information as mentioned in sub-rule (2) above, shall act within thirty six hours and where applicable, work with user or owner of such information to disable such information that is in contravention of sub-rule (2). Further the intermediary shall preserve such information and associated records for at least ninety days for investigation purposes.

These companies apparently did not want to invite any more troubles like the past when they were repeatedly called by the court to explain why they had not taken any action to block and ban contents and materials victimizing children which are regularly shared through their platforms.

Second: Bytedance, the parent company of TikTok has alleged that they were not heard by the court before pronouncing the ban order. Apparently, they may become the first web company to stress upon the point as why they should be banned when they have their flagging system and they do take care of the contents that are flagged. This case would make a history in India where the court has taken a decision influenced by the happenings of the past, and the concerned web company promises to break the glass ceiling because they know this is not the end. While many information as how to use (activate/download) TikTok without Google/Apple Play stores have started surfacing on internet,[5] my concern is not how the app may or may not be downloaded legally or illegally.

Exposing children to pornography, using women as items of sexual gratification, grooming, creating “dangerous contents” which may cause damage to public health, online victimization of women and children etc would not stop if one video creating and sharing app is banned. In that case, the courts must also consider picking up social media giants Facebook, Twitter, YouTube, Instagram etc, and search engines like Google for banning them because of their constant failure to monitor misogynist, sexist, child abusive contents. All social media companies including YouTube have data mined several images, contents and marked them as adult specific. Several videos are not available unless the users verify their age. But how will you search the needle in the hey stack? The courts could not yet make strict regulations for virtual age verification by the web companies. The web companies (hosted in US and other countries) are confused about the law relating to pornography because India does not have any focused law defining pornography still now. Further, the web companies also do not accept all contents (which are alleged to be porn as per Indian understanding) as offensive because the ever expanding free speech and expression jurisprudence of the US does not allow the web companies to take down the contents unless it is gravely threatening to the physical and virtual privacy  and security of the person concerned or damages the reputation of the woman (in case the victim is a woman). Children can still be exposed to online dangers through Facebook, Instagram or YouTube. Women are continued to be victimized through all pockets of internet.

As such, there may be practically no solution for this and ban would encourage more law breaking. Google and Apple had already shown that they are willing to follow the local laws (or rather, not to fall in any legal tangles regarding web service providers liability). It is expected that India creates focused laws to address different emerging and existing types of online victimization and the same are implemented in proper way. Otherwise, the orders of banning may lead to ground ZERO.

[1] For more, see J.Sam Daniel (2019). Ban TikTok, Its encouraging pornography : Madras High court to Centre. Published in NDTV on April 4, 2019. URL https://www.ndtv.com/india-news/madras-high-court-directs-centre-to-prohibit-downloading-of-tik-tok-app-2017482 Accessed on 12.04.2019

[2] Halder, D.(2018) The #Bluewhale challenge to the Indian judiciary: A

critical analysis of the response of the Indian higher judiciary to risky

online contents with special reference to Bluewhale Suicide game. In

Sourdin Tania & Zariski Archie (eds.), The responsive judges. USA:Springer  ISBN no. 978-981-13-1022-5  pp 259-276.

[3] See  Live law news network (2019). TikTok Ban : SC Says Ban Will Stand Lifted If Madras HC Fails To Decide On Interim Order By April 24. Available @https://www.livelaw.in/top-stories/tiktok-ban-sc-says-ban-will-stand-lifted-if-madras-hc-fails-to-decide-on-interim-order-by-april-24-144438 . Publshed in on 22nd April, 2019.  Accessed on 23rd April, 2019

[4] See Ahaskar Abhijit (2019). Why playing PUBG Mobile can get you arrested in Gujarat. Published in https://www.livemint.com/news/india/why-playing-pubg-mobile-can-get-you-arrested-in-gujarat-1552849965539.html on 18th March, 2019. Accessed on 12.04.2019

[5] For example, see SC hearing on TikTok: Why it is difficult to ban the app in India. Published in https://www.businesstoday.in/technology/internet/tiktok-ban-after-madras-hc-decision-reality-banned-apps-tiktok-pubg/story/339286.html   on April 22, 2019. Accessed on 22.04.2019