India’s New Cybercrime Volunteer Program Raises Mass Surveillance Fears

PUNE, India — India’s Ministry of Home Affairs recently launched a “cybercrime volunteers” program on the National Cyber Crime Reporting portal, where citizens can report “unlawful content” online without prior verification of their identity.

While the program has already begun recruiting citizens in the northern state of Jammu & Kashmir and the north-eastern state of Tripura, Indians anywhere in the country can currently register themselves to volunteer. The program, which is set to be rolled out across India, has raised fears of mass surveillance, violation of free speech, and the right to privacy.

The National Cyber Crime Reporting portal, under the broader Indian Cyber Crime Coordination Center, is the government’s “citizen-centric initiative” to report cybercrimes online. So far, more than 700 police districts and more than 3,900 police stations have been connected with this portal, India’s Ministry of Home Affairs said.

The Coordination Center and the National Cyber Crime Reporting portal was inaugurated by India’s Home Minister Amit Shah in January 2020 with an estimated cost of INR 415.86 crore ($56.8 million), to deal with cybercrimes.

The “cybercrime volunteers’ program” calls for “Good Samaritans” to register as unlawful content flaggers “for facilitating law enforcement agencies in identifying, reporting and removal of illegal/unlawful online content”.

The definition of unlawful content under the cybercrime volunteers’ program is split into seven broad categories. These include [content] against sovereignty and integrity of India, disturbing communal harmony, and “content aimed at disturbing public order”.

“The definition of unlawful content as given under the program is so wide and vague, the volunteers that are registering under this have a lot of discretion,” Anushka Jain, associate counsel at the digital rights advocacy group Internet Freedom Foundation, told Zenger News.

“The program doesn’t have any legal basis or standard operating procedures in place. We don’t know how this program is going to function, what will happen once a person has flagged content and what will be the next step,” she added.

The Ministry of Home Affairs did not respond to queries on the program.

Press releases from the police forces in the north-eastern state of Tripura and the northern Union territories of Jammu & Kashmir say cyber volunteers will help identify unlawful content, like “anti-national activities” and “radicalization”, without disclosing the actions that will be categorized as such.

The releases also shed some light on the other two types of volunteers: Cyber awareness promoter and cyber expert. The former creates awareness about cybercrime among citizens including vulnerable groups like women and the elderly. The expert will deal with domains like cybercrime forensics and cryptography.

The cybercrime volunteers’ program has also raised concerns over the nature of the identification and reporting of unlawful content. Lateral or peer-to-peer surveillance means citizens will keep an eye on each other, with the state outsourcing a part of the maintenance of law and order to ordinary citizens.

“The use of lateral surveillance tools or technologies by ordinary citizens for observing and reporting threats in the neighborhood normalizes the ‘culture of suspicion’, thus creating potential social distrust,” according to a research paper on lateral surveillance by The Centre for Internet and Society.

Lateral surveillance programs already exist on a small scale in India. India’s most populous state of Uttar Pradesh has a C-Plan app “for keeping a tab on anti-social elements and is designed to receive input from certain identified individuals in villages across the state,” and Hyderabad’s Hawk Eye encourages citizens to report traffic violations and crimes among others, the paper says.

India was recently downgraded from ‘Free’ to ‘Partly Free’ by the U.S. government-funded non-profit, Freedom House.

“With India’s decline to Partly Free, less than 20 percent of the world’s population now lives in a Free country, the smallest proportion since 1995,” states the report. “As repression intensifies in already unfree environments, greater damage is done to their institutions and societies, making it increasingly difficult to fulfill public demands for freedom and prosperity under any future government.”

While the cyber volunteer program doesn’t specify what happens after a complaint, there are 10 terms and conditions for citizen volunteers, which ask for “strict confidentiality”, barring which the volunteers will be de-registered.

“Volunteers are strictly prohibited from using the name of the Ministry of Home Affairs or claim to have an association with the Ministry of Home Affairs on any social media or public platform,” the government notification reads.

Indians who register as a “cyber volunteer unlawful content flagger” don’t need prior verification, but cyber awareness promoters and cyber experts will require to fulfill the Know Your Customer compliance under the program. Know Your Customer is a verification process to ascertain the authentic identity of a person.

Under the tab that defines unlawful content, citizen volunteers have been advised to study Article 19 of the Indian constitution. Article 19 deals with the right to freedom and guarantees Indian citizens six fundamental freedoms, including the right to freedom of speech and expression.

“Because there is no Know Your Customer or verification required, there is nobody you can put the liability on if somebody is going through as targeted harassment. How will you even catch hold of that person? And because there’s no verification, the Ministry of Home Affairs can say we don’t know. How will you even know who did it?” Internet Freedom Foundation’s Jain said.

“The Internet Freedom Foundation has said this program should be recalled, a legal framework should be in place and this should be done by people who understand free speech and what is legal and illegal. There will be a chilling effect online before saying anything because someone will report it,” she said.

The program has also raised concerns around the right to privacy, which is a fundamental right under the Indian constitution.

“For a state to impose any restriction on the citizens’ fundamental right to privacy, the test of proportionality as laid down in the Puttaswamy judgment must be satisfied,” Akriti Gaur, a lawyer and technology policy researcher, told Zenger News.

Under the judgment, a nine-judge bench of the Supreme Court of India held unanimously that the right to privacy was a constitutionally protected right in India, as well as being incidental to other freedoms guaranteed by the Indian Constitution.

“In the case of the volunteer portal, essential law enforcement activities of the state cannot be outsourced to private citizens,” she added. “Further, requirements like sovereignty, harmony, etc are very vague. This move could easily involve the policing of citizen activity on the basis of subjective morality rather than legality.”

India recently took steps to regulate the internet.

Last week, it revamped its information technology rules to bring social media platforms, streaming platforms and digital media under its ambit. Despite calls for the government to have discussions with stakeholders on the new rules, it said the rules were finalized after inputs. The “cybercrime volunteers’ concept” was also introduced without any notification and is already in practice.

“If you look at both [these steps] together, what’s happening is the government has taken the step of trying to regulate the internet,” Jain said.

“There is a need for regulation, especially with regard to fake news and misinformation and the government needs to take steps, but this needs to be done based on the discussions in the parliament. And laws should be passed after the discussions have taken place and the discussions should also have the option of stakeholders responding to these rules.”

While the flagging of the unlawful online content might be a welcome step, the conversion rate of complaints into actual First Information Reports with the police is minuscule.

“The National Cyber Crime Reporting portal received 33,152 cyber-crime incidents till August 2020 on its portal, but 790 First Information Reports were filed,” Kishan Reddy, the Union Minister of State for Home Affairs, told the upper house of the parliament.

This means only 2.4 percent of complaints actualized into legal complaints with the police.

“The offenses included into the scope of this program are already cognizable and can be reported to the police by any person,” wrote the Internet Freedom Foundation in an email to India’s Home Minister Amit Shah in February 2021. “Therefore, there is ongoing confusion as to the necessity of this program as well as the need to create a special class of volunteers.”

(Edited by Uttaran Dasgupta and Gaurab Dasgupta. Map by Urvashi Makwana.)