 Welcome everyone from SFLC.IED for a two-day event on encryption. For the first panel today decrypting the encryption debate is the right to encrypt a part of right to privacy. We have a distinguished set of experts and a prolific moderator who are bound to make you think deeper about the issue. The focus of this panel is to look at the fundamental right to privacy in light of the encryption debate from a national and international perspective. But before we dive deep into the discussion, a brief introduction about SFLC.IED, Software Freedom Law Center India is a digital rights organization based out of New Delhi, which fights for an open, equal, secure and free internet. We take immense pride in calling ourselves the defender of digital freedom. I would now like to invite the moderator of the day, Ms. Mishy Chaudhary, founder of SFLC.IED and a technology lawyer to kick off the discussion with a special thanks. Over to you, Mishy. Thank you Radhika and thank you SFLC.IED for putting this together. Good morning, good afternoon and good evening wherever you are joining from. Some of our panelists are joining from different parts, not only of the world, but also in transit from one city to the other from the airport. Encryption, unless you have deliberately trying to avoid the cacophony of TV news and you must have heard it in one form or the other, especially in India where chat messages, private messaging services are now ubiquitous, they're already here. But here we are again about this topic. I think that every decade we are bound to discuss this over and over again. Over the last 30 years, national governments all around the world have repeatedly proposed fatally defective digital encryption policies. The same once, time and again, learn nothing, forget everything appears to have been their motto. Now hardly for the first time, the government of India has also begun another cycle. Digital encryption infrastructure holds the commercial and financial internets together. Without the same encryption algorithms and common facilities, we cannot provide secure communication protocols for the financial markets or secure e-commerce or afford individual private means of researching, cogitating and communicating with one another across the world. When governments propose to make individual short messages traceable or to limit the use of industrial strength encryption by individuals emailing one another or whatever other interventions in privacy are set to be necessary for law enforcement or security of the state, the technical and legal weaponry winds up threatening to destroy the security of their financial markets and the basic instruments of e-commerce on which national economic growth and social development depend. So policy does not move progressively. Here, here, our surprise policy does not move progressively towards a safer and more private digital society, but in a destructive cycle of recurrent amnesia in which bad ideas are resurrected only to die again of the conflict between the political mythology and technical reality. So to discuss exactly this political mythology and technical reality in a world where Apple is rolling back the neural hash technology, where India's parliament wants people to introduce traceability, where the government of India has already introduced something called information technology intermediary guideline rules, which are a kitchen sink of everything. I think at such a moment, every country in the world is grappling with the issue that when digital communications are the way they are, what does the right to privacy mean and does right to encrypt our communication and to be able to speak to one another outside the earshot of the state or the companies, is that a right that we can actually have and enforce. So Software Freedom Law Center, India has been working for a year now on a report in terms and they've organized round table, they've organized variety of discussions as well as file litigation, etc. Today is the launch of that report. Day after tomorrow is also the Global Encryption Day. This is a run up to that event. As some of you have always followed our work, you already know that the great smartness of our team is that we always speak to people who are smarter than us to understand what and how we can actually protect the digital freedoms we work for. That's why we have this fantastic panel today. Some of the people you've already seen speak on these issues or at various other fora, including our own. Many of these people are deeply involved in one form or the other of law, technology or the politics around encryption. So it's my very great pleasure to introduce them all. I will not spend time reading out these exhaustive bios of all the panelists. We'll make them available so that you know who we are talking about and who these people are. I am going to start with giving everybody at least three minutes for opening remarks and once all the panelists have had a chance to make an opening statement, we will do a round of question and answers for each and panelists would be answering those questions. I'm going to start with Mr. Siddharth Lutra. Mr. Lutra is joining us right now from an airport lounge. He's a senior advocate at the Supreme Court of India. I have had the great privilege of briefing Mr. Lutra in the very starting of my career very early on and I thought that if I ever run into trouble I need to know who this person is because he would be able to tell me what exactly we can do now or what the future looks like. Mr. Lutra was also the additional Solicitor General of India and in from 2012 to 2014 his speciality in criminal law in India is well known and I don't need to tell you why he is and why it matters what he has to say about this topic. So if we could hear from you Mr. Lutra just your opening remarks for three to four minutes that would be great and later on if we can I can ask you a question before you dash off to catch your flight that would be great so over to you Mr. Lutra. Good evening and I'm sorry for this peculiar situation but life and airlines have their own way of functioning. The issue of encryption and the protection of personal data is a heavily politically loaded issue on the one hand we have these great purported needs of law enforcement some genuine needs and purported need and on the other hand we have the right to privacy which is a very crucial right unfortunately for us increasingly we find in nations such as India privacy is getting trumped by larger powers given to investigating agencies to instrumentations of the state to access our private information and this is after the Putta Swami judgment. The fact is that these matters are pending before the Supreme Court but the whole debate about encryption and decryption and the need for encryption and decryption to ensure that crime on the internet cyber crime is contained law enforcement is protected the security of the state argument is upheld but all of these have to be seen in the larger interest as to citizens' rights to be able to express themselves and the ability of the state to curb dissent because increasingly we are finding the use of harsh laws the use of Indian penal code offences such as sedition and other provisions which are backed by data obtained sometimes surreptitiously sometimes under lawful orders in terms of the information technology act but this debate is underway. There are also now rules that are framed which are aligned a larger axis and a few years ago the Supreme Court also came down in the context of rape gang rape and child pornography and said you need to frame regulations well the government has come out with regulations but perhaps they go much further than they show the fact is that what we need is a lawful mechanism a constitutionally valid mechanism and we need a serious rule look at a very famous constitution bench decision which is Purnmal a Purnmal is an interesting case because in five judges in 1974 said whatever material is seized even if it is irregularly obtained evidence that will be accepted and used that position is to be determined and re-examined today and there is a great need for re-examination because we can't have a situation post puttaswamy where privacy can be diluted in this mechanism so therefore i'm not going to go much deeper but just to add a couple of lines to say that decryption and decryption also raises issues of self-incrimination a constitutionally protected fundamental right and we can't really compare it to handwriting samples voice samples blood samples it really means a breach of article 20 and therefore if that is the case there needs to be a larger debate there needs to be legislative look and judicial oversight is one aspect of the matter but there clearly needs to be a judicial recognition that there has to be a balance between these rights so i'll end with my little talk now i'll try and join for the question-answer session but i think i'm in call to get on to the fight and i'll try and join from there thank you thank you mr. Lutra i just i'm gonna then take the opportunity to just do a follow-up here with you um it was very interesting that you do mention for people who are joining us from the u.s in evidence law about fruits of the poisonous tree thing which you talked about that evidence from an illegal search or seizure which would be a tainted source and inadmissible is not what we are talking and hearing and you've talked about that i after puttaswamy judgment because you said um we have to re-examine the issue um so puttaswamy also says that state is not only restrained from committing an intrusion upon the right of privacy but also obligated to take necessary measures to protect the privacy of an individual however as you already said the context seems to be that state itself is coming and trying to say in order to protect either the security of the state or other considerations we need to go beyond all of that have we seen enough of the cases in your experience where um evidence perhaps um has not been collected or has had an issue because it was encrypted because when we see it in public everybody comes up and says law enforcement is not able to do its job but how much of truth is there behind that statement i really couldn't catch the last part of your question so i wanted to ask you first about just the comment um about the obligation of the state to take necessary measure to protect the privacy right and the other about the evidence and is it true that when law enforcement comes and says that investigation can't be carried out because a lot of evidence is encrypted how much of weightage is there to that argument okay i'll just tell you in a minute and then i think i need to run the problem is the state has whatever laws have been put in place it's not just poor and well we have consistently diluted statutory safeguards and even the recent judgment of the supreme court arjun panditra in the context of certification of electronic courts is a dilution of the pv anwar principle which requires a threshold test so it's time that this there has to be a legislative change judges will interpret the law and today judges are more and more sensitive to state interest and that's something which needs remedying but that's an issue of judicial outlook meanwhile it is the duty of the state now and i believe it is important for any constitution republic that the state must bring in legislation and make sure that we are our rights are protected so that's about what i would say and that that's a feeling of the state and it's time for citizens to rise up to the cause can i now thank you thank you for joining us and safe travels all right um so i'm gonna now um just bring in mr chidambram here who's the member of parliament uh from the sivaganga constitution seen Tamil Nadu and um also the co-founder of the Chennai chapter of the young entrepreneurs organization and i think that mr chidambram you've um uh been involved in the it committee um if you can tell us a little bit about what the thinking of this parliament seems to be where are we going is will india ever get a data protection law or we'll keep going in circles and what does the business um think about all the regulatory structure which is being established by the state here thank you mishi and after siddhartha's laid the ground um i don't want to repeat myself but as he said you know that he ended his uh his uh comments by saying the citizens need to rise up you see there is no clamor for privacy rights among the people of india and um politically speaking you know as politicians who who seek electoral validation nobody asks us so bad for privacy because privacy as you and i see it or as people in this panel and this audience see it is not how the general population sees it they have other battles to fight and privacy is very very low down their uh you know priority list so there is no political pressure for any government to safeguard privacy in spite of the government of the courts guaranteeing it as a fundamental right that being so i can't see this parliament particularly under this government giving any value to privacy because this government believes in a super state this government believes in a you know in a very paternalistic state with the state knows better in this government which this is a government which is run by a political party which values the collective over the individual so i really do not see any kind of legislative push to safeguard the the concerns which we seem to be raising in this panel or by people like us and i also do not see any pressure from the electorate to make this as one of the priority issues in order to choose uh uh you know the new government or a new parliament whenever the time comes so we will be fighting battles you know pressure groups interested group this is a cause worth fighting for but we will be fighting battle only in the margin this won't take the centrality of politics and i cannot see this parliament or this government you know getting this data protection bill because the previous chairman of the drafting committee has become a minister they have a new chairman who was just going to we're going to get stuck in the same rigmarole as far as business is concerned Indian business hardly would ever raise its voice against the government large tech companies from overseas yes we'll battle this because encryption is very key to a lot of their standard products which they are rolling out all over the world and they can't customize it to fit Indian laws which want them to decode so there will be some pushback from international companies but i can't see Indian companies or Indian business making this an issue uh with the government of the day on that very encouraging and high note can you tell us a little bit about how you see that you recognize the importance of the right and you have also laid out the state of affairs in terms of what your understanding of the current government stance is then how what do you see is the path forward is there something that we will be we will be sniping we'll be only sniping at the margins as we go along and as Siddharth said judges seem to be more sensitive to the state's interest more than the individual interest now so i don't see dramatic changes or i don't see a dramatic shift towards safeguarding privacy over the interests of this greater state interest or national interest or security concerns so i think we will be fighting an uphill battle in india i i don't think we are going to see the same kind of um uh forever and clamour as you see in the western world for individual rights and privacy because this this whole ethos of this government which propagates this hindu to our brand of politics is to negate the individual and to sort of bring about a collective so it's it's it's it's there is no individual rights i mean there are no individuals here it's only the collective now so when you come to a collective you will negate all these kind of individuals so i can't see this government this parliament or the present polity putting this in the forefront or i i am pessimistic about the changes which we want to bring about and i don't see the courts i'm not i don't also see the courts stepping in because Siddharth is right judges are very very sensitive to the interests of the state over this the interests of the individual if you consistently see how they are ruling about personal liberty and everything like that it is the state which is prevailing over the individual time and again uh from Mr. Chidambaram i'm going to go to Emma and Emma Lanso leads Center for Democracy and Technology's legislative advocacy and amicus activities um she is the director of free expression project and she works to promote law and policy that support internet users free expression rights i have known Emma in her fights for a very long time and i am constantly inspired and i think um Emma we need a little bit more inspiration after Mr. Chidambaram how he has laid out where we are in India right now i one if you can start with your opening statement and also this intersection of how all rights somehow derive from that right to privacy and how end-to-end encryption is now enabling other rights for us as well or to you Emma great thank you so much Michi and thank you to sflc.in for hosting this panel and it's really important discussion discussion today um i did want to speak a little bit in my opening statement about exactly this point about how rights to privacy and rights to freedom of expression are so intricately linked um and how encryption is really essential to enabling both the right to privacy and freedom of expression access to information freedom of opinion online as well um and i think the the kind of the thing to really remember when we're thinking about online communication whether that's email texting um document storage any any of the things that people are using digital communications tools to do are heavily heavily intermediated they have multiple different technology companies technical service providers whether they're your internet access provider the domain name system backbone transit providers um or the the apps that you're interacting with the user facing kind of communications tools there are multiple different links in the chain between you and the person you're sending an email to or you and the photo of a new baby from your cousin that you're seeing on a social media service that means that there are many different points of failure or intervention or inspection and evaluation of the content that you are uploading or sending or accessing and as people are increasingly relying on remote storage of content remote storage whether it's cloud storage providers you know uploading things like your personal notes and documents personal photos that you're actually never intending to share with other people drafts of documents that you're publishing or you're preparing to publish that you would never want to see the light of day because they are the very rough first draft of something so much of this material is increasingly stored with third parties stored with technical intermediaries who provide cloud storage for it and it's not the same as kind of feeling like this draft is safely locked away in the desk in my office where i know no one else will ever see it and along these lines thinking about kind of the relationship to privacy and free expression we know that fear of scrutiny can really lead to a chilling effect on expression when people worry that what they are saying in a private conversation may get exposed when they worry that the the reading lists of what they are looking at whether it's the books they're checking out from the local library or the things that they're searching on an online service provider or online search engine when they worry that those things might be viewed either by governmental intrusion by by kind of government surveillance or increasingly by corporate surveillance by the the sense that there are kind of corporate entities out there tracking and examining and and scooping up information about all of our likes and interests that can really have a a chilling effect on people's willingness to seek out information to form opinions to to form communities and groups and to do anything that might put them at fear of reprisal or social censure or other kinds of negative consequences in their day to day life so online because there are so many potential vulnerabilities in where and how we communicate so many of those places where access could potentially be made by a third party to these very private thoughts and and feelings and expression that that we have and that we're sharing with a limited group of people it is essential that we have access to technologies like strong encryption whether that's end to end encryption in messaging services encryption on cloud storage that means that even the storage provider can't have access to that information if we don't have strong encryption to protect all of this research and reading and access to information that we're doing online we really start to lose that sphere of protection for that kind of that most fundamental rights the freedom of opinion the idea that we can with the privacy of our own thoughts inside our own heads think what we will and engage in self-governance to then be able to engage in democratic governance with the rest of our community that really starts being imperiled so so when I come at these questions of kind of the right to encryption the right to to privacy I really immediately think of how how entwined it is in those free expression and access to information rights um at least in theory the Supreme Court of India somehow agrees with you because they also think that my most of the rights have some way at least some connection to right to privacy so I'm not sure in practice but I very much appreciate the point about how without the freedom to think privately your own thoughts there is no other right which can flow from it I'm going to move on to John Camfield he's the director of global technology strategy and internews and he has created and led multiple innovative digital safety program including founding usable project and co-authoring the safe tag organizational security risk assessment framework um John tell us something very exciting what are the tools you are building for the world you want and and tell me that there is hope in technology if not in policy um there there is a I would argue only hope in technology but I I definitely come from the technologists win I should add um while internews clearly strongly believes in this I'm definitely speaking on my own behalf today just to give myself a little extra latitude in this incredibly exciting topic um I also have the unfortunate value of having tried to work at a started encrypted email startup back in the late 90s during the United States first attempt at crypto war and so as you mentioned earlier this is an ongoing 30 year cycle of bad policy bad technology thought and and we just keep going around the same exact debate in in my view to offer privacy to say that privacy import is important period dot in today means that you must provide into an encryption online because you cannot replicate a private conversation in a room or a closed office door um online without it and there's just no way to nerd harder there's no way to fix the technology in a way that provides all these magical back doors uh access to law enforcement that doesn't completely undermine that right to privacy online and if if we've learned nothing else of the last two years um online conversations are not optional access to the internet access to a safe internet it's not it's not the nice to have in the world especially during this pandemic it is absolutely your requirement of participating in society of being a human of exercising your right of being a member of a democracy you must be online to to exist in this world um at least for for the majority of us and and without a privacy option um that is equivalent to what we enjoy and what we presume we have um it's it's a pathway to a really dark and kind of as as emu was pointing to like constant surveilled world and we're close enough to that and I think we need to pull that I think interestingly in this current realm of the crypto or this current like repeat of the crypto war the focus on these like alternative options of client-side scanning I think we might actually take as a quiet win um because they seem to be accepting that end-to-end might actually be here to stay and there's not a clear path beyond it um obviously that's not globally the case we're still fighting that fight but I think as we see people backing off from saying oh we have to we have to backdoor end-to-end and we see a new line of debate around we have to work around end-to-end I actually think that's a very much more positive path not that I'm a fan of client-side scanning um but I think that opens the door to different conversations of what are the things that we still that law enforcement still has access to what are the metadata that is just irrevocably there and like there are very few tools that can even considered working around that um what are the tools that are replicated in real world that still exists online for investigation and for for all you know all of the various like arms and powers of law enforcement I can get into the tools specifically I think there are a lot of interesting tools out there obviously signal is kind of the the gold standard in its open source it's free it is a a leader in in encryption technology is a tool the the technology behind what you find in whatsapp it's also been integrated in other systems um but it still has and it it has proven its lack of of tracking through having gone through some court cases and revealed everything that they have which is very minimal um but there are also some other tools that are just not quite as broadly out there and are and will be interesting to watch over time with different properties and different levels of centralization great thank you jan I think even in this conversation we'll talk a little bit more about tools I'm going to move on to um Kiran uh Kiran Chandra who's been at um this fight for such a long time um first as a free and open source software developer um but also Kiran serves as the free software movement India's general secretary and founder of Swetcha they've done some incredible work um on the ground uh to not only get um the open source technology in the hands of everyday people but also in spreading the ethos and the values of what open source mission believes in and um um every time one goes and sees what Swetcha is doing one can believe that if um what does it mean that if you can't control your own technology you can't control your own life uh recently Kiran has filed a petition in federal court which is the Delhi High Court uh to investigate and demand from the Indian computer emergency response team uh to investigate large-scale data breaches in the country as a flc.in is assisting Kiran um in this matter and we've had some interesting uh stuff flowing from there Kiran uh welcome to the panel and I look forward to your opening statement please uh Kiran you are on mute there cannot be a video conversation without that sentence and now you've had it yes okay thank you Mishi and uh for a very uh nice introduction about the organization that I work for and uh on this encryption debate yes uh many things have been said uh but I would basically present myself from the community perspective or what the civilians or the commons would like to look at this entire encryption debate as uh since the dawn of the civilization we already will know that a conversation is an elementary activity of human life and that it separates us from all other life beings in other words it is as elementary as breathing air or drinking water the conversations between people have been private by default and communication today is primarily through electronic means and it is no more in the sidelines of the society it is quite central where a large sections of the population a majority of the population is in the digital space the issue of access because of the pandemic also has uh people have been forced to get on to it and not just communicating with each other but also as Emma also has pointed out that sharing moments with friends family colleagues and all of these have gone on to the digital space and now it is supposed to be a natural corollary of extending the existing privacy protection in the real time to the digital or virtual space that is the ideal thing that should have happened and also it is not just communication between just two individuals that we are speaking about but even as a group which is similar to a social or an official or family gatherings which also in the Indian context represents a free assembly and just imagine any existence of an omnipresent ever present third party in all these conversations is nothing but a threat to freedom of assembly and association and it's a gross violation of our human rights and also in these times when we look at the way in which India in particular is transcending and there is a huge push on the globally by the institutions of world bank where all services and services which individuals are attached to like welfare activities or welfare beneficiaries the medical health record systems everything is getting digitized and in the absence of mechanisms of to protect their private information sensitive information it just makes people vulnerable and we need to just know and the government is just coming forward it is continuously as Karthichesambaram has also pointed out that it is continuously postponing the data protection even in the liquidated form that it wanted to present itself in but trying to get a unique health idea now and the data is just going to be we know what happened with the RUJS A2 app when the information that was collected has been completely given over to the different players and the private information of an individual particularly even the prescription that we have which I take it from a doctor is governed by a client doctor and patient privilege and all this sensitive information is now being just accessed without the even the consent or knowledge of an individual so the individual's data is being stored by the agencies stored by the governments being used by government and non-governmental institutions alike and in this digital age particularly the three areas where we have the right to privacy is elementary is one between conversations between individuals between an individual in the group and or between groups or what happens to the data of an individual when it's bound to share it and there needs to be one is consent and also just not consent there should be if you were to provide a consent in the secure storage mechanism and the only way in which it can happen is through encryption as and technologically to protect privacy online encryption is only the means of ensuring it and we all know that once there is encryption the data is shared between only the intended parties and one more interesting thing which Mr. Karthich is brought out is about being very critical of the government but I I am a bit optimistic about the resistance that can be built around all of these issues we are seeing the way in which India is resisting on multiple issues the only thing is awareness and we can't be so harsh on the civilian population of this country which is the largest democracy in the world we have 140 crore or 1.4 billion population bend it or we get digital access to we are not any western society where they had access since the 80s this access the the social lag that has existed or the vein with technology has penetrated people getting used to it is very new but when they all saw that there is a change in the privacy policy of the whatsapp there has been an exodus I think more than the government the peer pressure from the people of people moving away from whatsapp is something that has threatened them I think the awareness aspect of it on the people particularly on these issues is something that now people have opened into it they could be even if we communicate to them there is there is a way in which people would understand it when we just started working in this movement maybe when was that maybe 15 years back one and a decade back when we machine me machine and others were working or getting it to work on many of these issues consumption of technology or information technology or information technology tools was limited to was in the sidelines of the society were educated into the elite who were just consumed now the consumption of pattern of technology or the population that is involved in using this technology has significantly changed and but once properly campaigned among the people and will be able to defeat the institutions yes we did it sometime back on the debate of net neutrality and on the issues of internet.org because we all were in the forefront of those four front of those battles but because I think Mr. Karthi Chidambaram is here my request to the parliamentary committee on IT through him is that we do not know forget about the government because parliamentary committee on IT also we need what we seek is to you to release the videos or livestream the sessions of when you are asking the people to come and respond to if they don't respond that makes the community or the activists on the ground or the organizations on the ground to go to the people educate them tell them that look this is how so-and-so agency is behaving now Facebook doesn't come to me but we can move to the others also yes so yeah I'm finishing it so we want you to request you to livestream the sessions and at the moment in the Indian context I think we should be working towards because there is a judgment and that privacy is a fundamental right we need to have rules and regulations proper rules and regulations framed we say that encryption is the method that should come back to you again before I go to Mr. Chidambaram to ask a little bit more I want to just come back to Emma again Emma can you talk a little bit more about because what I'm seeing is that the these debates might have might be happening at a national level but obviously because internet is such a thing that whatever happens in one country especially a large market like India it's going to have some impact at the places as well and it's not that US hasn't seen the entire earn it whether that was the issue or every time we talk about these things we always hear about child sexual abuse material but what you referred in your opening remarks about now the agencies are trying to deflect or at least bring another aspect in this entire discussion of content motivation we've seen that everybody sees that social media platforms are perhaps not monitoring their platforms or they have been issues either with real life violence which started with discussions online and translated into offline violence there's also been impact on democracies and elections etc but all of these issues get conflated because one company owns several products but that also but we are watching regulations especially in India also the traceability provision is now jammed in somewhere which is supposed to be about content moderation so if you could talk a little bit about that and the international efforts and then later I'm going to come back to Mr Chidambram and ask a question related to what Kiran said and then what Emma's remarks were. Great yes um yeah I think it's it's a really important dynamic to be aware of in the current global debates around encryption so in the 90s and the early aughts there was very much this sense of what governments were asking for was backdoors into encryption technology and this is a bit of the evolution that that John was speaking about that they wanted the ability to essentially insert themselves into real-time communications and that was the the way of quote-unquote breaking encryption of of kind of interfering with the core mathematical guarantees of an encrypted communication um what I've seen in the debates around encryption especially in the past few years is really this sort of merging of all of the the questions and concerns that law enforcement have had for for years and talked about their issue of quote-unquote going dark will they be unable to obtain data and information that they need to to combat crime or to investigate cases in encrypted environments those concerns are being merged with issues around content moderation um the content moderation debates themselves are very complicated and wide-ranging Michi as you were saying they involved everything from concerns about the spread of heinous illegal material like child sexual abuse material concerns about radicalization and terrorist propaganda hate harassment disinformation you name it there's some really difficult issue being discussed in content moderation but what we're seeing right now is is really kind of bringing these two extremely difficult and contentious issues together and kind of merging them and seeing a lot of um the the sort of argument from the the law enforcement side and from a number of politicians that if you have strong intent encryption companies themselves it's not about law enforcement access companies themselves will not be able to stop the spread of material like CSAM on their services they won't be able to intervene when hate speech or harassment or disinformation is circulating on their services so at my organization the center for democracy and technology we wanted to really investigate these claims and we have a paper that just came out last month called outside looking in that examines different approaches to content moderation in end-to-end encrypted systems there's a lot in the paper i won't go into it in in super deep detail but basically we wanted to look at what are approaches to content moderation that actually still preserve the guarantees of privacy confidentiality integrity of messages that you get when you think you're communicating in an end-to-end encrypted way and the the short version of the findings there is traceability things like client site scanning and upload filters really are fundamentally at odds with what we think we are getting as speakers as people communicating in an end-to-end environment they involve third parties having access to information about our communications they have they involve being able to bring other kinds of scrutiny into messages that's just inconsistent with with the promise of end-to-end but there are different efforts including one thing that another researcher at Stanford Rihanna Pfefferkorn found in a survey that she did user reporting is actually still a really important way of doing content moderation across a wide variety of different kinds of content types users are often the ones who most understand if they are experiencing harassment or hate speech and there is a i'm not saying that user reporting is operating perfectly on systems and different platforms today obviously not but there is still a really core value proposition to user reporting that is a place where all kind of online content platforms whether they're encrypted or not could be working on improving how to make that a more useful more effective tool for users to be able to help control their own experiences and get information to platforms that they need to be able to intervene and restrict content cancel accounts you know do what they need to to combat abuse and there's also a lot of work that can be done in the area of metadata analysis looking not inside the contents of the communications but at other features about the the sharing of messages that are outside the kind of encrypted envelope of the communication that has its own set of trade-offs as well the more content that is considered quote-unquote metadata the more you can potentially learn about who a person is communicating with what their patterns of communication are that can end up being sensitive information but there are definitely services out there including WhatsApp that have done a lot of work trying to see what they can do with metadata analysis that keeps the content of communications encrypted but still enables them even to find things like patterns of people sharing CSAM on their services so I think there's a lot more to explore in that area of technical approaches that keep all of the privacy safeguards that that we as users expect and hopefully increasingly just demand of service providers while still actually making sure service providers can respond to abuse and can fight you know some of the the worst kind of content abuses that are out there great thank you for at least shedding some light on how these days at least security agencies and political and politicians who can't find technical or legal solutions come up with political solutions or conflate everything. Mr. Chidandram, I'm going to ask you a question about something I understand what you said about the government but we also saw that there was an ad hoc committee which was constituted on online pornography. Mr. Jayran Ramesh from the congress party heads that committee and one of the recommendations they also made of the fact that technological measures were to include the traceability requirement which is mostly to say break this end-to-end encryption tell us who the originator of the information is and why it was cited was online pornography is a problem CSAM is a problem mostly and as Emma was talking there are other methods whether it is users who can flag it or there are various other things which we can analyze what I want to say is as users what we see is when one of these parties is in power and when you're in the opposition obviously the positions differ but if we see the recommendations from this committee or another one everybody is telling everyone that you cannot have these private conversations these spaces to use these days WhatsApp or signal to talk to each other to think our thoughts which may not be thoughts which are acceptable to one side or the other but everybody is trying to break that so as a user when we watch you all the lawmakers and we think that each side is going to just play politics how do we think about where this issue is going what should we be doing and what are the answers coming which are technical so as I said you know I'll first answer what Kiran wanted to know in our committee meetings can't be live streamed because as the law stands today they are in they're not open to the public or they're not we can't even give an interview about what happened in the meeting so live streaming at the moment as the law stands these are not Senate hearings of the US so they you know they're not not similar at all while we have power to you know summon officers to come before us and before us and we give a report to parliament the meetings are not open to the public that being that you see I'm not surprised that committee who says that you know pornography is a big issue so we need to have end to end we need to have a decryption for that you have to understand there is no clamour I mean that's the answer the answer is in what I said earlier there is no electoral pressure on us to put this as a priority as part of our agenda when we go and seek mandate from the people there is no clamour until that happens no issue will ever get solved I don't think you should leave it to the wisdom of the politicians to come up with a futuristic law which will which will which will take care of these concerns because at the moment it is not an electoral issue even after Pegasus he don't hear anything no no Pegasus is not I mean who talks about Pegasus today Pegasus is an issue I mean I represent the rural constituency I mean I I I spend a fair amount of time there I've never had an an an an an voter come up to me and ask me what are you going to do about Pegasus is so worried are they cloning a phone the only thing I could sort of twist I mean I as a proper as my own campaign propaganda I say that they have spent one crore rupees to clone each phone and they've used thousand crores which they could have spent for something else I have to spin it like that so privacy I am being very candid I mean I as somebody who's been in electoral politics directly for 25 years even though I'm only I'm serving my first term in parliament I've been a campaign manager I've been in party politics for 25 years I the concerns which which are coming from the electorate are very different from the concerns we article it and that's why that it's not a priority it will not be a priority and I'm not surprised that any of these committees or any both political parties including mine and the BJP will behave the same because we are advised with the same set of bureaucrats who'll always say you know the the interests of the state are far more important we need to curb you know drug trafficking or child pornography or whatever it is and we'll all fall into the same trap I mean I can't see dramatically different thinking coming unless there is pressure from the electorate all right so we're hearing that there's not much pressure from the electorate there are of course I think Indian Twitter seems like it is the world but thank you for that candor no Twitter Twitter is a very way to Twitter is definitely not reflective of Indian politics or Indian society I mean it is very upper class upper caste it's economically you know well off it's not reflective in fact I would say Facebook is perhaps more reflective of India in a greater sense than Twitter so don't don't get carried away by opinions Twitter so all those who get trolled by Twitter don't take it too seriously either it's really not the opinion of India so Mr. Chidangram are we saying that the digital India will only have an agenda of putting everybody's online in one form of the other where government will collect data and send it to others but we will never have real protection or any legislation or judiciary coming for us I mean judiciary must evolve its thinking over a period of time I can't see that happening immediately at the moment what the government means by digital India is they're asking you to transact digitally that's what they're trying to do they're not ever saying that what you transact will be private you know they're saying please transact don't go physically to write a check anymore do it online that's all they're trying that is what digital India by this government means it is it does not say that what you purchase will be will be private or what you what your what your preferences will be private that's not what they say all right I'm going to come to John now John Mr. Chidangram is being very candid and I appreciate it but I am also wondering then if my solution is not going to be with our legislators then tell us that there are end user and community driven encryption and collaborative services which are which make privacy enhancing technology what are the examples you talked about signal what are the other examples or what are the things which people can do in order to actually build those kind of resistant tools I think many people in India Mr. Chidangram is right may not care about what privacy is but they do like to use WhatsApp and if we can just make sure that more and more encryption is ubiquitous and prevalent in everybody's tools if everything is secure then we don't have to teach them ever because everybody's secure so tell tell us more about those kinds of things which we can do so that we can code right to privacy ourselves and hack it ourselves yeah I think that's an incredibly important point like the the tools I'm most excited about are a decade away from being like exciting to most people in the world but the fact that WhatsApp and iMessage and all these massive platforms turned on end-in encryption using solid technology it goes from zero to billions of people suddenly enjoying end-in encryption technology without really thinking about it without worrying about it and honestly it really just backs off what people presume is actually happening which is they're having a private conversation with their friends using an app and the fact that that suddenly that's a lot closer to matching their expectations of who can read that how is that getting scanned how is that being surveilled you know historically that would be a open game for both corporate and government surveillance but the fact that now it's suddenly locked away in an actually private chat is is frankly amazing I do think looking forward and for people who want to kind of get involved with this there are tons of interesting tools out there and paths in you don't have to be a you know expert cryptographer or even a coder to help build and support tools localization lab is a nonprofit that works to make sure that if a tool gets developed in India or in the United States or in Sri Lanka or Australia or wherever it gets developed it's translated into multiple other local languages around the world and so it can be accessible and readable wherever and usable simply secure is another organization that really focuses on design and user experience and both of these organizations I think would welcome volunteers supporting that and being interested and even just if you're using a tool even if you're using signal and you have a weird problem they have open lines of communication where you can say hey this thing is weird I don't understand what happened and that it's a great way to just contribute of like if you get a lot of people suddenly saying something is not working right or doesn't make sense the tool will adapt and that's the beauty of kind of open source um back to WhatsApp for a second they got a lot of slack not too long ago for someone reporting harassment inside their tool and you know it got revealed that if someone reports their harassment to WhatsApp like these encrypted emails or chats are visible to WhatsApp yes if someone forwards them and reports them they are visible they're visible to people it's just like any other private conversation if someone's recording it or has like the paper letter and shares it that works that's actually I think great I think that's a good system we must be able to report harassment we must be able to report these things in centralized systems or deal with them in decentralized systems and so I the more we can encourage massive platforms to adopt trusted hard to break slash unbreakable end-to-end I think that's the biggest pathway for technological success that said we also have to continue pushing the envelope is what is possible like signals great I use it every day I'm used I have it open on my phone right now it's one of my most used apps and I I trust it and I trust how it's being developed and how open it is kind of inherently based on how well they responded to law enforcement and how open they are technically but it is still centralized service they could theoretically run out of money their servers could be seized or shut down and I do think we need to look more towards decentralized tools that don't rely on any one thing working Guardian has an entire project sorry Guardian project runs tools in a second wind or viento framework there's the briar project which also does a lot of peer-to-peer mesh type things but also adds encryption and then there are some other tools that would run on top of the tour network or replicate tour like networks that are exciting and pushing those not only reduces the reliance on anyone honestly country from shutting down servers or anyone project from getting trapped by like something breaking or something taking over their their connectivity or blocking their ability to continue working it also addresses kind of a another issue near and near my heart of what do we do when the internet itself is shut down or censored and how do we work around that while maintaining also this this value of privacy and so I think that is a very difficult technical problem to solve and it means the tools are a little bit rough a little hard to use but I think that's like the bleeding edge of where we'll be going in terms of tool development and so anyone who's interested in that please like get in touch and I'll point you at one of these amazing projects thank you I think we're coming almost up to the hour I just want to start with the trying to just wrap this conversation up by taking some of the questions as well as making some and I'll and John we go from you to and then to Kiran there are two aspects I think there are questions where people are talking about if and I think they want the panelists to talk a little bit about security or terrorism vis-a-vis encryption somebody's talked about the recent attacks in Kashmir or the use of tech savvy technologies by terrorists to attack or plan activities or criminals and I generally think that to solve one problem we can't make the entire world insecure it's the same thing about telephones it's the same thing about cars or it's roads about people who are going to use it for some nefarious activities will always use any tool for that purpose that doesn't justify making the entire world insecure and robbing people based rights off their basic rights but John the only I think the policy debate about encryption has a significant international dimension because of the international nature of the communication networks as well as the trade globalization and national security dimensions these are not situations which only India's facing or anyone else is facing all countries are trying to grapple with the situation they try to come out in public and make whenever it is Apple or such a big company it makes for good press and they try to play in a black and white way our privacy versus security apple versus fbi etc but how can we all coordinate national efforts at a global scale to reach some reasonable solutions and I know you with internews has worked in many countries if you have any inputs and I'm going to ask that question to each of the panelists if there are things you want to talk about what is happening globally and how can we all coordinate I understand there's a lot of pessimism but if and a lot of things look dark right now but we won these wars earlier we can perhaps win them again so give me more hope and give me actual days and some inputs about how to fight the fight starting with John then Kiran then Emma and ending with Mr. Chatham no I mean I think it literally is because we've been fighting the same fight in different countries around the world for so long I think it truly is simply we need to coordinate we need to talk and we need to be able to bring the receipts from the previous fights why did the clipper chip you know die on the vine why did the US finally allow strong not even in the end encryption but strong SSL level encryption in the late 90s why did Apple prevail against the FBI you know what are the successes there what are the fights going on right now in the UK on privileged access and and blocking and age verification personal verification sharing these tactics what has worked what's the sticking point I think I think Emma could probably fill in much better than I can hear because the debate right now is definitely evolving into different different asks and different things driving it with the the combination of these other of terrorism of CSAN of other horrific things that we need to to deal with but we could also like ban guns and bombs we can ban cameras the the technologies are our tools and digital technology specifically is really hard to limit you know it is free speech code code is just language at the end of the day and once it's out there you can't just say oh we're not going to produce this anymore oh we're going to like track who's making gunpowder like the code is is there and and we have to like move forward with that as opposed to trying to say you know any one country could ban it and has will again but that doesn't stop it so how do we actually deal with this as a democracy how do we move forward as a as a global community to make good policies that actually work and also help us achieve and and limit these horrors and I think I think there are paths forward but I don't I don't think any of them involve killing and an encryption great thank you I'm going to request everybody to just keep your comments very brief and we have a nice nugget at the end of this as well so Kiran to you please yeah I think I agree with John that we need to be talking quite frequently there should be some kind of a coordination globally between the communities in building technologies and also the way in which also in terms of solidarity about how these battles are being fought and so on but as far as the Indian context is considered when we began this movement we had two decades back it was very difficult for us to even go and convince people on the certain issues of copy left licensing to the dangers of software patents etc but now relatively the access to the people access to the people itself was an issue then but now people understand the but they have the access they understand digital technology so I think I'm a bit more optimistic because now we have the number the large number of people who are using these technologies the which we have if we are in a position to communicate and talk to them and explain to them what this is and I'm a bit more optimistic about winning the battles more often yes of course the only change is how the government is going to respond to yes I think that's a different question altogether but I'm pretty sure that there have been instances particularly when there were a certain set of rules that were released the government took it back the same regime took it back on the encryption aspect of it so we know that there are instances where this government also can be hit back on these issues so I'm very I think this is a time that we need to have even in the Indian context we need to have more coordination among the organization and the activists and I think awareness is something that needs to be created on these issues great thank you Kiran over to you Emma thank you Mishi I I'm happy to be maybe the most optimistic person on the panel partly because I get to tell you all about one opportunity for actually increasing coordination and trying to get more information about the benefits of encryption out to a much broader set of society than just those on twitter is the upcoming global encryption day so global encryption day is tomorrow october 20th 2021 and it is a project of the global encryption coalition which is a broad coalition founded by cdt my organization the internet society global partners digital and now with dozens and dozens of organizations around the world who are really trying to do some of this coordination that um that john and kiran have been talking about to to share information share tactics share ideas how can and really to to respond to the excellent points that uh mr. Chidambram was making about if the broader population doesn't demand privacy doesn't demand access to encryption then it's never going to become a political priority and we won't get the political and the legislative protection for access to encryption that those of us who spend all of our time thinking and studying these issues know that we so desperately need we have a great set of protections articulated in international human rights law about the positive obligations of state to ensure privacy and the limits on government ability to restrict freedom of expression um we have so many of the the technical pieces the kinds of um applications the kinds of technologies that people could use to really protect their communications and enjoy their rights to privacy and free expression freely online um but we do need that political element and that means we need people to know about it and to care so the theme of global encryption day tomorrow is make the switch it's really calling on people you don't have to do much but just consider make a switch to one of these different technologies that john was talking about maybe it's signal maybe it's whatsapp there are a lot of different options out there um and the the goal is just to get more people using encrypted services so that they become ubiquitous so that they become things that people are familiar with so that there's pressure on the service providers to make them as user friendly as possible as responsive to individuals needs as possible and as we do that we can really start kind of growing the suite of people in the world who are protected by encryption and hopefully kind of help people understand in that very kind of gradual way this is something that matters to me this is something that's important and it's something that i i want my political leaders to care about too all right so here is to the political leader um mr tibandro i think co-opt people unlike us i mean not people from our comfort zone and our backgrounds and you need to leverage the social media for that yes um all your speakers said that more and more people are on social media they are on they are using more of these apps they are transacting more digitally so it's not as if they're not they're not part of that environment but they're not making privacy they're not making encryption an issue use social media make this into a political campaign you will get traction at some point of time you know out out political parties and out political leaders who don't make this an issue promote people who who who bat for this cause so that's the only way you have to you have to co-opt the general population and make this part of the political conversation and the political demands from political parties and political parties the only thing political parties want to do is actually to win elections and how do we win elections by getting more people to support us and how do we get more people to support us by echoing their sentiments and giving their sentiments a form and a shape to to become actual laws and action so so that's really where you need to leverage you know if you are citizens and activists like you should leverage the social media and start co-opting people and making this mainstream conversation and not something which is confined to very light circles and in you know in in in in closed doors um great so use the services which currently seem to be actually spying on us for data collection but to get your own point across also there is a remark in the chat here also about the fact that in India has a telegraph act which is an existing law in phone tapping and viral tapping is regulated by this act um telegraph act is used for a variety of reasons phone tapping um despite the fact that no the traditional nobody has those landlines anymore now and the laws were made in 1996 we haven't actually kept up with laws and even when rules are made under these acts or telecom suspension rules it's very hard for the executive to follow them we see the state police is using various other methods etc um we see we have numbers which are old numbers about at least 9000 phone tapping orders which are being issued and they're not reviewed but considering what information is coming out about Pegasus or other various ways in which evidence law in this country operates where a police guy shows up at your um house and just seizes all the devices and takes everything without any real basis and even an illegal search or seizure evidence is admissible i think we have to do a lot more legislative reform um as um a special treat are you going to play a recorded statement by somebody who could not join us because uh west coast timing is really hard and i'm very grateful to um Emma and john to be here um david k who was um who is a professor of law at the university of california arabine uh and teaches international human rights law david to all of us has been such an inspiration for a very long time he served as a un special repertoire on the promotion and protection of the right to free freedom of opinion and expression from 2014 to 2020 uh ensured that diverse voices became part of his reports um and he he also serves as an independent chair of the global network initiative um we have a video from david to talk about this issue he couldn't join us unfortunately and radhika will play that video and post that i will just tell you a little bit about um the release of the report and then um we will wrap that up so please bear with me as every as radhika and the team plays the video uh from from david hello i'm david k i teach law at the university of california urvine in southern california and for six years from 2014 to 2020 i served as the united nations special repertoire on freedom of opinion and expression uh first of course i want to thank sflc.in for all of its work on issues of freedom of opinion and freedom of expression in the digital age i relied tremendously on your work for for six years and continue to be a big consumer of of your reporting and of the other work that you do i know that you're talking about encryption uh over these couple of days and my first report to the un to the human rights council came in 2015 and in that um in that first report i concluded by saying that encryption and anonymity and the security concepts behind them provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age and i wanted to say two quick things and not take up too much time because i know you have a great panel uh which again i'm sorry that i i cannot join you but the two things that i want to say are are this first we often talk about encryption as protecting the privacy of communications i think that's a kind of limited way of thinking about encryption but one thing that is interesting about that formulation is that it brings in two human rights in just a few words the privacy of communications from the perspective of privacy everybody enjoys the right not to be subject to arbitrary and unlawful interference with their privacy with their home with their correspondence and so forth and that's guaranteed in article 17 of the international covenant on civil and political rights a treaty to which india of course is a party and which is binding on over 170 states worldwide so on the one hand you have this protection against arbitrary and unlawful interference with privacy but that privacy is also a gateway particularly in the digital age to the enjoyment of the fundamental rights to freedom of opinion and freedom of expression article 19 of the iccpr in its first paragraph protects the right to freedom of opinion without interference of any kind it's an absolute right and of course in the digital age so much of our opinion is embedded in online space whether it's our browsing or our sharing of information whether it's our learning whether it's our storing in the cloud of our our research or our work or our opinions or whatnot the digital age is a very is very much a space in which freedom of opinion needs to be protected and encryption and the privacy that comes with it protects that kind of right article 19 paragraph two also protects as is famous everyone's right to seek receive and impart information and ideas of all kinds regardless of frontiers and through any media and the third paragraph of article 19 says that when it comes to restrictions on freedom of expression there's restrictions on that right to seek receive and impart information and ideas that it's critical it's essential it's required for the state to demonstrate that it is meeting the famous three-part test right of legality uh necessity and proportionality and legitimacy in any restriction and when it comes to encryption we know that that provides not only the private space for communication it provides the space to seek information to browse to receive information to download to impart information to communicate with others whether it's in the in a private space or more publicly and encryption provides that kind of right and we're facing a moment I think as we have faced for many many years really for a couple of decades a few decades now increasing interference and efforts to interfere with the right to privacy through restrictions on encryption and I think that it's important for us always to remember that encryption isn't simply math it isn't simply a set of digital tools that we use in order to keep our communications private it is a pathway to the enjoyment of fundamental rights to freedom of opinion to freedom of expression to association and assembly to non-discrimination and so much more and so I want to of course congratulate SFLC for engaging in this important debate and also say that it is important that others join in this debate participate in it and that governments moving forward respect the way in which encryption provides for fundamental rights in a digital age again I'm sorry that I can't be with you and thank you very much for giving me the opportunity to say these few words thank you bye bye well as you can see that David and why he was so effective as the special repertoire obviously anyone who says good things about SFLC.in and already becomes my favorite person because I have a bias and I'm very happy with that bias but jokes apart I do think that there a point which almost everyone made is that there are no rights which can be exercised if you think that somebody's constantly watching over you and that somebody can be state because state is extremely powerful and state can interfere with our civil liberties like nobody else can there is an aspect of all this interference in terms of private data collection which is surveillance capitalism which we didn't talk much about but there is an element of that however those are not paramateria they can't be equated because they're not the same the powers of a private company are very different from the powers of the state. I will say that today is the launch of our report on encryption it's called decrypting the encryption debate in India we couldn't resist the decrypting part but decrypting the encryption debate in India political mythology and technical reality politicians because they like to make broad statements and Mr. Chidambram will forgive me for making such a broad statement about politicians in general but because they like to pitch security versus privacy or say everything that they are doing is for our favor but all of us are now somehow engaged by the use of WhatsApp or the use of e-commerce or financial transactions that we actually transact online we know that encryption is in our lives and it is important we don't want anybody to be stealing our health data our financial data or be the middle man watching what I say to X person or Y person and I know it becomes it comes in news when a film star gets into trouble for their WhatsApp chats but that's an opportunity to learn more and to ensure that we can have those thoughts which may offend some people and may please other people but we can only develop our own thinking and our own personalities if we have that freedom to think. This report which sflc.in is releasing just now as we speak shows how India has entered another cycle of the same zombie ideas of controllable encryption technical backdouring of systems on which far more depends than the needs of law enforcement and discriminatory treatment of individuals constitutionally protected right to privacy in the hope that financial and commercial speech can somehow be more tenderly treated than those exercising protected constitutional rights it examines what are the international debates what is happening around the world who's pretending to do what and what can actually be done various litigation which has been filed including by sflc.in themselves or WhatsApp what's happening in Australia what's the UK government doing what the Europeans are thinking about and ultimately what the Americans are selling the entire world it it takes you through a whirlwind tour but it also goes very deeply into what India is currently looking into and what are the right recommendations so here is hoping that some of it at least the executive summary the recommendations and the conclusions are simple enough if you don't want to do a deep technical dive that one can at least understand more and there is there is frequently asked questions on the website there are videos people are putting out this extremely interesting panel we'll be doing another one and simple digital security trainings which sflc.in always does if you're concerned about it we don't judge you because we think education cannot be imparted with judgment so we can handhold you through all of these things and use various ways to spread the word spread the word get involved you use it every day you don't want other people to be interfering so talk to us and I am extremely extremely grateful to this wonderful panel all of you Mr Chidambram Mr Lutra who's not here Emma Kiran John who joined us thank you so much to the sflc.in team everybody from the lawyers to the technical staff to the communication staff everybody's a big team so I'm not going to name everybody but thank you for all the work you do thank you for your patience thank you for your candor and joining us truly appreciate it hope we have we have continue to have different conversations continue to have important conversations but different conversations and don't run in circles thank you very much and our wonderful partner news click without whom we wouldn't be here this is my brain which is obviously failing me thank you news click as well thank you very much bye bye