Digital Identity , Governance & Risk Management , Privacy
Facebook's Election-Related Data Collection Criticized
Privacy Advocates Question the Effort to Help Stop Fake NewsSome privacy activists and cyber lawyers are criticizing Facebook's new requirement in India that users who are posting content related to elections or national security verify their identity by sharing either their driving license, passport or PAN card. The social media company's move is designed to help limit the spread of fake news.
See Also: An Identity Security-first Approach to the Evolving Threat Landscape
Critics are concerned about the potential misuse of this data in light of Facebook's track record for exposing private information, including the Cambridge Analytica scandal. They are questioning whether the government should play a role in making sure this personal information is adequately protected.
"As an overall practice, it can be accepted that you are verifying your users. But doing it only for elections does not serve any purpose," says Vicky Shah, a Mumbai-based cyber lawyer. "What is the motive behind collecting such information only for users posting election content or matters related to national security? I do not see any logic behind it."
Facebook apparently has not received formal authorization form the government of India or the election commissioner to require this additional personal information, Shah says.
Facebook did not immediately respond to a request for comment.
Government's Role
Some security experts suggest that the government should have primary responsibility for curbing the spread of fake news, rather than social media companies. For example, they say Computer Emergency Response Team, India, or CERT-In, should play a lead role.
"As the motive of these large social media companies is profit, it's futile to expect them to self-regulate and address issues of the election," says C.N. Shashidhar, founder of Bangalore-based SecurIT Consultancy. "The government should have proactively entrusted the task to NTRO [National Technical Research Organization], CERT-In or other technically qualified body and provide them with requisite human resources to perform the tasks necessary."
What is Facebook Asking For?
Shah says that Facebook in its accounts settings states that users who are posting any political ads, or content related to politics or national issues, will have to either furnish their passport, driving license, PAN card or election card as proof of identity.
Facebook has also said that an encrypted copy of the ID will be stored for a year. The social media giant says this information will be used for improving their automated systems for detecting fake IDs and related abuse.
If a user decides not to permit Facebook to store information for a year, the social media firm will, by default, save only a photo ID in encrypted form for 30 days.
"We need the IDs to make sure you are based in India by checking your information and activity on Facebook," the company says in a notification on its website. "In addition, we will ask you to provide a postal address or arrange for someone to visit home."
Shah says Facebook is not providing enough information about how it will use the identification information it's requesting.
"No information has been provided on how these IDs will help improve Facebook's automated systems," he says. "Facebook would say it's a business secret or algorithm that cannot be shared. But, without any explanation, I find this highly irrelevant."
Data Protection and Privacy Concerns
Shah argues that Facebook does not need to collect ID information for those posting election-related content because it can use its logs to track who is posting what and from where.
"It does not really need this ID information. And in this case, the user is liable even if there is a misuse of data since Facebook is not promising security of data," Shah contends. "I am not against Facebook asking users to authenticate themselves. But [it should be a] general practice with proper permission taken from relevant authorities. One can't just have these measures during elections."
Earlier this month, the election commissioner of India had a meeting with the India heads of Facebook, Twitter and WhatsApp to discuss curbing the spread of fake news. Details of the meeting were not revealed.
"The strategy of the ECI to approach the wrongdoers like WhatsApp, Twitter and Facebook is primarily flawed because these very organizations have been proven to misuse user privacy to further their commercial agenda," Shashidhar says. "These are commercial organizations, which, despite having the technical resources, will give priority to commercial interests in the form of ads or sponsorship revenue. WhatsApp is a different animal altogether. Anybody can post content on it, and since it's encrypted end-to-end, the government agencies will not be able to decipher the source of the content."
The Ministry of Electronics and IT and the election commissioner of India did not immediately reply to a request for comment on Facebook's strategy.
Current Law Inadequate?
Pavan Duggal, attorney at Supreme Court of India and cyber law practitioner, says that given the threats of foreign interference in the Indian election and the spread of fake news on social media looming large, the current IT Act is inadequate for safeguarding privacy.
"Against the absence of a dedicated cybersecurity law independent of the IT Act to take the social media organizations to task or legally punish them for the misuse of information sourced, the government has to create an exclusive nodal agency which can work with the government and legal authority to be made responsible to tackle social media under the provisions of the law," Duggal says.
Impact on Election Security
Security experts are worried that a nation-state could get their hands on the ID data collected by Facebook and use it to target individuals for specific ads or fake news.
"There is a lot at stake here, and the government of India or the election commissioner must take up the matter urgently," Shah says. "Privacy of individuals cannot be compromised under the guise of elections."
In the meantime, Facebook says it has removed 687 pages and accounts linked to individuals associated with an IT cell of the Congress party, the main opposition party. It said these accounts were part of coordinated networks and were removed not because of fake news, but due to "inauthentic behavior." But Facebook did not clarify what it meant by inauthentic behavior.
(Geetha Nandikotkur, managing editor Asia and Middle East, contributed to this article)