Header image alt text

Naavi.org

Building a Responsible Cyber Society…Since 1998

The recent fight between ICANN with the German judiciary on what is the “legitimate interest” in ICANN collecting and making available to public the domain name registration details is an indication of the war that is going on between EU and US for economic supremacy on the global platform. EU wants to snatch away the advantage that US enjoys as a global IT player.  In this war, EU is trying to use GDPR as an instrument to make US business bow before the EU authorities. In this fight, the EU Administrators and Courts will stand with the interpretation of GDPR which favours EU. This bias is visible in the case of ICANN issue.

We must understand that ICANN already has a contract under which the registrars have obtained the license and running the commercial activity. Now GDPR is being interpreted as a superimposing law that invalidates the earlier contract. If GDPR has to be brought into domain name contracts, then the existing contracts will have to be revised or ICANN should cancel the registrar licenses of all those who fail to adhere to the contractual terms.

Already Domain Name registrations are often done under unverified e-mail addresses and are used for committing many crimes including phishing and fake news distribution. There is an urgent need to build a trust worthy internet and prevent the misuse of the liberties that enable easy registration of domain named under fake e-mail addresses or e-mails registered with service providers who are dark web constituents untouchable by the international law. Now GDPR is giving legitimacy to such dark web activities and reducing the law enforcement powers of global authorities.

If a EU Citizen books a domain name and hosts a website which is delivering content to people outside EU, then it is an activity outside the EU law making jurisdiction. There is no reason that the world should accept an anonymous registration of a website from a EU registrar. 

The objective of GDPR is protecting the Privacy Right of an EU Citizen. It cannot be an instrument of launching a Cyber War on non EU Citizens through the websites registered by EU registrars. If EU wants to have a system of domain name registrations allowing secrecy of the registrant, they are welcome to create a closed Internet system in which no information goes out of EU borders.  It can be a dark web within the current dark web which non EU countries should be able to block off.

The provision of registrant details and its preservation by registrars is an essential aspect of Cyber Security and EU authorities have displayed a blind faith in Privacy and ignored the adverse effect of the legislation if it is interpreted as it is sought to be interpreted now.

Currently the disputing registrar in EU is taking a stand that they will not collect the admin contact and technical contact details and no registrant details are to be made available under WhoIs search because such details are not required for delivering the service.

Domain Name Registration is a Commercial Activity

Registering a domain name is not a fundamental right of a person in which the Privacy right is embedded. It is a commercial decision that a person takes so that the content of the website can be used for some benefit either directly as in an E Commerce Website or indirectly through advertisement generation or brand building.

Hence when an individual books a domain name there is no fundamental right of privacy under which the domain name registrant should be allowed to hide himself and use the services. If this argument is extended, no Government should collect details of promoters and directors of a company because the personal details of the promoters and directors gets recorded and made available to a number of reasons to a number of authorities.

Hence the decision of the German Court was incorrect and there is no reason why GDPR should impinge on activities such as IP address displays on E Mails and WhoIs data in case of domain names.

In fact providing the contact details and ownership particulars of a website is a necessary disclosure under law in India. Hiding the IP address of the sender of an e-mail by email service providers such as Google is an open assistance to criminal activities. Present remedies such as contacting a relationship manager by Police through a notice is causing delay in investigations and impeding Cyber Crime prevention.

The demand of GDPR on the ICANN activities is a symptom of a larger malaise where criminals who want to hide are taking over the current transparent systems of administration and in the long run will seriously damage the law enforcement. As a result Cyber Crimes will increase, Cyber Terrorists will use EU as their base to launch attacks on the world.

Hence we should oppose the move of the German Court and demand from ICANN that all domain name registrations from EU registrars should be immediately transferred to other registrars for which a new “Domain Name Transfer Auction” can be arranged by ICANN to redistribute the domain names presently under the control of EU registrars to other registrars.

The EU registrars may exit from the business and develop an internal EU only internet system where they can introduce anonymous domain name registrations similar to the numbered Swiss Bank system. Just as the Swiss authorities benefited from the global black money, now EU can benefit from the darkweb activities which can effectively run as EU-Internet.

If we donot take a firm stand on this, gradually EU registrars may take over the business from the registrars from the rest of the world since there is a majority community who would like to hide and throw stones at others. If these masked stone pelters keep working along with the genuine domain name registrants, then there will be no value for honest web operators.

Remedy in India

While there is an economic fight going on between US and EU which is using GDPR as a weapon, India is being caught in the cross fire since a good part of Indian IT business provides services to US companies who in turn provide services to EU. Indian companies also have a part of their business with EU directly. Under both categories, GDPR is trying to impose itself as if it is the law applicable in India.

There is also the impending Indian Data Protection Act (IDPA) and the pressure of the Aadhaar related demands on Privacy protection which is clouding the judgement of many experts.

Media as usual does not understand the real issues and is only interested in TRP based reporting.

If therefore IDPA becomes a replica of GDPR like what UK has shamelessly done in drafting UK DPA, there will be many in the media patting Justice Srikrishna and his team to say “Wow, India is as great as EU in drafting Privacy law” .

But the law makers should put the interest of the country ahead of the temporary headlines in news papers that may praise them while drafting the Indian DPA.

Some time back there was discussion in India that websites have to be registered with the Government. Now to move into the GDPR suggested regime of “Anonymously registered domain names” is a step which would be a significant departure from the earlier thinking.

The Ministry of Home Affairs, in the Central Government is responsible for maintenance of Law and Order in the country along with the State Governments. It is clear that Cyber Crimes is a matter of increasing concern to the MHO not only because there is an increasing digital push to the commercial activities but also because the mis-application of certain laws such as privacy laws.

I urge the MHO to be aggressive and take up with the Justice Srikrishna Committee that under no circumstance, Cyber Security should be compromised in drafting the Privacy Law. The Supreme Court should also take a stand in the interest of the security of the county rather than a misplaced importance on anonymous Cyber transactions for protecting Privacy.

I am sure there are enough experts in India who are so committed to Privacy that they would not mind “Masked cyber stone pelters” being protected  in the garb of human rights while those who get hit are not considered to having any human rights. They would all hail GDPR and push Indian authorities to adopt a “Cyber Criminal Friendly Indian Data Protection Act”.

But I fondly hope that Justice Srikrishna would resist such pressure and suggest a law that is fair on honest people and donot err on the unsafe side.

Naavi

GDPR has changed the landscape of Cyber Laws by redefining the priorities of Cyber Laws. So far the concern of the society was mostly on “Preventing Damage to a Citizen” through Cyber Crime laws. This was achieved by defining certain actions as “Contraventions” and/or “Offences” and imposing a “Civil Liability to pay compensation” or treat it as a “Criminal Offence” in which the perpetrator of the crime will “Pay penalty to the Government and face imprisonment”.

“Unauthorized Access” to data was therefore considered as a Cyber Crime and if the person who caused a wrongful loss through an act which contravened the law was asked to pay compensation for which the victim had to prove the extent of damage suffered. If the unauthorized access was intentional and had a “Malicious intent”, it was considered as a “Crime punishable with imprisonment and fine”. Criminal action was a state action and intended to be a deterrent. Civil action was meant to recover the loss suffered by the victim.

When unauthorized access was accompanied by “Data Theft”, “Data Deletion”, “Data Modification”, “Impersonation”, “Cheating”, “Profit making” etc, the crime was considered a higher order crime and the punishment could be harsher. But the civil damages always were based on the actual loss suffered by the victim which he was supposed to prove during the trial.

The Cyber Crime laws focused on providing deterrent punishments that were commensurate with the gravity of the crime and easy grievance redressal procedures through fast court systems, simplified procedures etc.

India provided such measures through ITA 2000 in which “Adjudication” was provided as a fast Court system to compensate the victims of cyber crimes. ITA 2000 was a representative of the first generation of Cyber Crime laws where the target was to provide protection to a victim of Cyber Crime.

Out of necessity, the first generation Cyber Crime laws did address the responsibilities of an “Intermediary” and need for the intermediary to take suitable “Due Diligence” steps to make it harder for criminals to benefit and if they do, provide suitable evidence to the law enforcement to bring the culprits to book. Section 85 and Section 79 in ITA 2000 were meant for this purpose.

In the second generation of Cyber Crime laws represented by ITA 2008 (Amended version of ITA 2000) apart from defining more Cyber Crimes, were fundamentally different from ITA 2000 since there was a greater emphasis on the role of “Information/Cyber Security”. For example, ITA 2008 introduced data protection clauses such as Sections 43A and 72A providing civil and criminal penalties if “Personal/Sensitive personal data” is not protected adequately by a data processor, which term included the Data Controller or Data Consumer or a Data Collecting agent. There were also Data Retention provisions under Section 67C, Regulatory powers to different authorities under Sections 69, 69A ,69B and 70B which represented the requirements of national security and law enforcement requirements.

ITA 2008 was stringent enough in terms of “Non Compliance” but the penalties were not in the form of huge financial penalties that the regulator would collect but in the form of huge imprisonment terms that the act provided for.

GDPR and UK DPA 2018 represent the third generation of Cyber Laws where more than the crime itself, prevention is considered as a greater responsibility and intermediaries will be subject to penalties that could be crippling.

GDPR raises a concern about the power of a “Supervisory Authority” to pursue penalties arising out of non compliance to the extent of 4% of Global turnover of an undertaking which has no relation to the actual damage that the data subjects might have suffered due to the non compliance.

ITA 2008 on the other hand has upto 7 years punishments in the case of Sections 69 and 69A, 3 years under Section 69B and 1 year under 70B. The penalties were in the range of upto Rs 1 lakh or left unstated.

Though the criminal punishments under ITA 2008 are huge, the Courts would evaluate the crime and arrive at the actual punishments both in terms of the imprisonment and the fine. Indian Courts provide enough opportunity for the accused to seek justice based on the actual facts of a case.

However, GDPR has now placed a power to impose a billion dollar fine on an executive and even in cases in which the non compliance can be technical and may not result in significant damage to the citizens whose privacy right is what the act tries to protect.

It appears as if the “Non Compliance” of a regulatory provision is a greater offence than an actual Cyber Crime in which some body is cheated of a million dollar.

This is a wrong prioritization in the justice system where the “Failure to implement Crime prevention” is considered a bigger crime than what the “Criminal” has committed.

An example is to impose an imprisonment of life term to a Security guard who forgot to lock the gates of the godown from which the thief stole some valuables while the thief himself is punishable for an imprisonment of two or three years.

EU authorities may justify their action by stating that the penalty provision in EU is just an enabling provision and would not be imposed in a manner that is unfair.

But there was no need to place such a stringent provision without any checks and balance?. It would have been better to leave the larger amount of penalty to the Courts instead of the executive. GDPR has failed in this regard to have a fair legislation.

We may recall that ITA 2008 has placed a Rs 5 crore cap on the power of the Adjudicator and left the higher penalties to the discretion of the Courts. But EU did not provide for such checks and balances before indicating a threatening level of penalties.

It appears that the Regulators have started considering the penalty provisions as an opportunity for “Profiteering” rather than as a deterrent.

This could well be the tendency of the new generation of Privacy Protection Laws which are actually one part of Cyber Crime laws applicable only to the mis-use of one type of data called “Personal data”. Every data theft is also a cyber crime and there is already a legal penalty for the same. The administrative fines are just one of the penalties that may be imposed on an intermediary in respect of a Cyber Crime and should not ideally be more damaging than the punishments meant for the cyber crimes.

Let’s forget the European Laws since EU is unmindful of the damage they are doing to their own business fabric through such crazy penalties. India is now considering its own Data Protection Law which Justice Srikrishna is in charge of drafting.

We need to watch and see whether Justice Srikrishna Committee would be falling into the trap set by GDPR and the UK DPA 2018 and make data protection legislation over power the Cyber crime laws or keep it as a subordinate law to the Cyber Crime law as it should normally be.

Many suggestions have been made to the Committee in this regard and we need to watch the developments so that India can show to the world of how to frame data protection laws which are fair to all stake holders.

India should also remember that GDPR is a terrorist friendly and Criminal friendly regulation and India cannot afford to toe its line. Hence Right of Erasure must be avoided and Right to restriction and correction should be moderated with appropriate data retention protections. These are required in the interest of national security which GDPR has ignored but we cannot.

Naavi