Connect with us

Features

Technical Overview of Online Safety Act

Published

on

Eng. Rohana Palliyaguru
Former Chief Operating Officer,
Sri Lanka Computer Emergency Readiness Team

In 2018, “EUROPOL” headquartered in Hague, Netherlands, a key organization established to prevent and combat serious internationally organized crimes, cybercrime and terrorism, had clearly defined the difference between cyber-dependent crimes and cyber-enabled crimes . As defined by them, any crime that can only be committed using computers, computer networks or other forms of information communication technology was named as cyber-dependent crimes and traditional crimes facilitated by the Internet and digital technology were categorized as cyber-enabled crimes. So, there are two categories of cybercrimes and these definitions are internally accepted.

Illicit intrusion and hacking into computer networks, disruption of computer functionality with the spread of viruses or other malware and Distributed Denial of Service (DDoS) attacks which can paralyze service delivery by computers are some examples for cyber-dependent crimes.

Some Cyber-enabled crimes are child sexual exploitation, fraud/scams,blackmail, extortion etc.

In the Sri Lankan context, Computer Crime Act No. 24 of 2007 has already provided necessary legislative provisions for tackling most of the cyber-dependent crimes.

Issues related to content such as defamation, harassment, misinformation, impersonation occur not only through online means but also through the use of other traditional means (electronic or print media). Hence, such things fall under cyber-enabled crimes. Sri Lanka has adequate laws to cobat such cyber-enabled traditional crimes. If not, the relevant legislation should be amended accordingly. It is not appropriate to make separate laws for such crimes considering only internet media, and doing so becomes very suspicious.

Hence, the objective of the Online Safety Act itself is problematic.

Also, naming the Act as Online Safety Act is also meaningless because its scope is very narrow. Otherwise it should be drafted in such a way to cover both types of cybercrimes mentioned above. But it is not so. Only provisions related to cyber-enabled crimes are mentioned in this act. These are often content related issues. Since the Act has given priority to regulating social media, I think it is appropriate to change its name to Social Media Regulation Act.

While drafting this Act, it appears that no inputs from information technology experts had been obtained as many of the provisions included are not practical. For example, provisions sought to be enforced through global Internet intermediaries are not enforceable because the Sri Lankan market is too small for them to bother about and we do not have the bargaining power necessary to ensure enforcement. This should have been pointed out by IT expert but that does not seem to have happened. If the global service providers decide to exit the Sri Lankan market due to those provisions, it will severely affect the country’s economy as well as social harmony.

This Online Security Act will have a huge impact on the freedom of expression of Sri Lankan citizens. The power to determine false/true statements and declare them as prohibited has been given to five people in a population of 21 million. These five who cannot be considered politically independent will be nominated and appointed by the President with the approval of the Constitutional Council. This will have a major impact on the independence and impartiality of the commission as the President is empowered to nominate politically biased loyalists at will. The power to remove them at any time has also been given to the President. Reasons for doing so has not bee specified in the Act itself. Affected members are only given an opportunity to state their case at a hearing and there is no appeal process.

As disqualification for appointment as a member of the commission, the Act mentions financial or other interest of such a member that may adversely impact the implementation of the commission’s functions. But there is no mention of required political independence of such members. It is essential that such a member cannot have a conflict of interest with Internet service providers, social network service providers, Internet intermediaries, but that is not mentioned here.

Although the Commission has been entrusted with wide powers and duties, there are many practical obstacles to carrying them out. It appears that the provisions have been included without adequate technical study or consultation. These practical problems will arise with implementation and the results will experience in the future.

The extent to which Internet Service Providers (ISPs) and Internet Intermediaries will comply with orders of the commission directly depends on the bargaining power we have as a country. We do not have the bargaining power of India, Japan or China. Our population of about 21 million is not a huge market that wields such influence. Also, global Internet intermediaries that provide various services have already introduced community standards to regulate the contents on their platforms which are currently in operation. Through that, they have also implemented a certain level of regulation in their platforms. It is unlikely that they will agree to carry out directives of a commission in a small country going beyond global community standards they have introduced.

ISPs only provide access to the Internet and are not concerned or responsible for its content or what users browse through the connection. It is therefore ludicrous to issue directives to the ISPs to provide opportunities to affected parties to respond to content deemed prohibited by a commission here. The ISPs have no control over such matters.

Persons making prohibited statements must be specifically identified before being notified to stop making such statements. Who is going to do that ? Also, in order to specifically identify a particular person it is essential to obtain privacy related data from the relevant social media service provider or Internet intermediary. Since every global service provider is obliged to protect the privacy of their users (via privacy policies), it is doubtful that they would override their privacy policies and provide that information to the commission.

The commission can issue notices to the Internet intermediaries to remove prohibited content from their online platform or block the content to users in Sri Lanka.But as I mentioned above, they will remove or block them only if the content is contrary to their policies. In such a case, the commission can only block the whole platform (eg: facebook) through Internet service providers in Sri Lanka. This is unfair to all users in Sri Lanka and as a result there is a danger that internet intermediaries may also withdraw from providing services to our country.

When internet intermediaries have the ability to automatically check whether some content violates their community standards through complex processes using modern technology such as artificial intelligence (AI algorithms), how far will they accept the recommendations made by the commission to remove prohibited statements?This should be thought of practically.

It has been proposed to maintain an online portal containing information to give the public an understanding of the falsity of a certain statement. This is funny because the public can get more information from lot of other independent sources and come to their own conclusions than referring to the information provided via this portal.

A team with expertise in information technology is required to carry out investigations that may be necessary for the execution of the Commission’s powers and duties. Who is going to do this? Does the Commission have a permanent internal investigation team?

It is not practical to register Global Internet Intermediaries in such a manner as may be specified by the rules made by this Act. We are a bankrupt country without enough market or bargaining power to enforce such provisions. Therefore, this provision should be reconsidered.

In order to specifically identify a person who has made a false statement, it is essential to obtain personally identifiable information (PII) from Internet intermediaries. How practical is this? As I mentioned above, will they provide the information requested by the Commission? Even if that is granted, how can the legal action be taken if the person is outside Sri Lanka? Will ISPs in overseas provide relevant data to the Commission for investigations?

Also, a fact that is true at one moment may be false at another. Even if a provocation or riot occurred on the basis of a truthful statement, it is also possible that the commission later defines it as a false statement because of the riots.

Disruption of a religious assembly by a true statement may later become a false statement because of the fact that the incident did not occur. For example, the Easter bomb attack may not happen because of a statement spread predicting it can happen on that day and disturbs religious gatherings. But since the bomb blast did not happen, later the above statement can be interpreted as a false statement justifying that it was made purposely to disturb the said religious meetings.

Outrage of religious feelings is a very sensitive matter and there should be a balance of freedom of expression and its limitations. One’s beliefs regarding a religion may be contrary to another’s and how should the right to express it be? For example, is it an insult to a religion and a false statement to declare that there is no one called God?

Cheating doesn’t just happen online. Other traditional methods are also widely used for that. Therefore, it is more appropriate to introduce a law that is common to all or to update an existing law rather than make legal provisions limited to online media.

Impersonating doesn’t just happen online either. This fraud can also be done by using fake documents. Therefore, the existing laws should have been updated to cover online methods as well.

The provisions of this Act regarding child abuse should have been made by updating other existing Acts such as the Child Protection Act, and not by highlighting them as an offenses due to the medium of the Internet. Online techniques are just one plaform through which child abuse occurs.

Although it is possible to obtain an order requiring disclosure of information relating tho those making statements using a fake online account or bot, as I have mentioned several times above, it is doubtful to what extent Internet intermediary service providers will cooperat due to their existing privacy policies. If there was an international law in this regard, this may have been easy.But we know from past experience that obtaining privacy related information through cyber security conventions is not practical.

This Act exempts ISPs from liability in case something is uploaded or interfered with by a third party. It is not necessary to say this because it is not their responsibility. As stated earlier, if those who drafted the Bill had recognized the role of Internet service providers, such a provision would not have been provided.

Global Internet Intermediary Service Providers will not take action on content unless it violates existing community standards. It is also unlikely that they will appear in our courts to resolve content related issues.

I feel that it is required to re-think whether those global Internet intermediaries agree to the various conditions stipulated in Section 29 of the Act. Internet intermediary service providers are well aware that fake online accounts and organized counterfeiting occur through their platforms. But, they have not taken drastic measures to ban them completely, often to protect freedom of expression and individual identity. They also do not hesitate to cancel such accounts if they violate their community standards. It is unlikely that they will implement the Commission’s directives to ban fake accounts.

Finally, it must be mentioned that this is not an Act introduced with the broad objective of creating security online, but one aimed at controlling content on the Internet. In the future, we can experience the impact of this on the freedom of expression of the people as well as the economy and social activism.



Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Features

Coercive laws recipe for future misrule

Published

on

by Jehan Perera

The NPP government is going after powerful figures from the past and present who have engaged in corruption, fraud and criminal activity in a way that no previous government in Sri Lanka has done. Former ministers, politicians and senior state officials are among those facing investigations and legal proceedings. The government has placed before Parliament a document listing 50 cases involving corruption, fraud and other crimes. These include not only financial offences but also cases relating to the Easter Sunday attacks, the killings of Lasantha Wickrematunge and Wasim Thajudeen, the disappearance of Prageeth Ekneligoda and attacks on journalists Keith Noyahr and Upali Tennakoon.

The significance of this effort is that it can demonstrate that nobody is above the law, regardless of political connections or social standing, which will help restore public confidence in institutions that have long been distrusted. It could also recover public resources, improve the investment climate and strengthen the foundations for a more prosperous and just Sri Lanka. When criticised for focusing on the past and not the present, the government position is that these investigations were initiated under earlier governments, particularly between 2015 and 2019, and that it is now allowing investigators to proceed to deal with the backlog without political interference.

But there is an aspect of the government’s approach that is less justifiable. While pursuing past wrongdoing by powerful individuals, it is also advancing a triumvirate of draft laws that could give the state sweeping powers over citizens, organisations and dissent in the present and future. The draft Prevention of Terrorism legislation, the Prevention of Organised Crimes Bill and the NGO Registration and Supervision Bill raise serious questions about the over-centralisation of power. Each of these laws strengthens the powers of the state while weakening the rights and safeguards that protect people from their misuse and thus questions the basic rights of people in democracy where ‘the power of the people is vested in the government’. This is a recipe for future misrule rather than the rule of law. As the well-known saying goes, power corrupts and absolute power corrupts absolutely.

Proposed Laws

The real test of system change, for which the government obtained an overwhelming mandate, requires not only a government willing to hold others accountable, but one prepared to subject itself to the same principles of legality, transparency and restraint. The three proposed laws that are particularly important in this regard are the Protection of the State from Terrorism Bill, the Prevention of Organised Crimes Bill and the NGO Registration and Supervision Bill. Each of these draft laws has been presented as serving a legitimate purpose. Preventing terrorism, combating organised crime and ensuring that NGOs do not facilitate money laundering or terrorist financing are proper responsibilities of the state. Sri Lanka has international obligations in these areas, and no responsible government can disregard them. However, the existence of a legitimate objective does not justify every means adopted to achieve it.

The proposed Protection of the State from Terrorism Bill illustrates the problem. Although its definition of terrorism draws on a model developed by a former United Nations Special Rapporteur, the Human Rights Commission of Sri Lanka has warned that the definition of terrorism extends beyond the model and could bring legitimate political protest, trade union action and civil disobedience within the scope of counter-terrorism legislation. Its concerns also include prolonged detention, inadequate judicial oversight and restrictions on access to legal counsel. These are objections that go to the heart of the relationship between the citizen and the state. The government cannot credibly promise to protect democratic freedoms while creating powers that could be used to restrict them. It is necessary for the government to reassess the draft through transparent consultation and revise provisions that could criminalise legitimate dissent.

The Prevention of Organised Crimes Bill raises similar concerns. It is presented as giving effect to the United Nations Convention against Transnational Organised Crime, which Sri Lanka ratified in 2006. The Centre for Policy Alternatives (CPA) has argued that the convention does not require many of the bill’s provisions. The proposed law extends to a broad range of offences, permits detention orders lasting up to a year, makes confessions to police admissible for purposes of legal evidence, and introduces extensive surveillance powers. A law intended to dismantle criminal networks should not create a parallel system of exceptional powers that could be applied far beyond organised crime. Nor should safeguards developed through years of experience with abuses under the Prevention of Terrorism Act be weakened through legislation bearing a different name. The government should review whether or not existing laws could be used effectively to control these crimes or whether each exceptional power is necessary.

Civil Society

The proposed NGO Registration and Supervision Bill presents another test of the government’s intentions. The government may reasonably seek transparency in the finances of organisations receiving public or foreign funds, including measures to prevent money laundering and terrorist financing. It seeks to justify its overreach on the grounds of meeting the internationally mandated requirements of the Financial Action Task Force (FATF) for the Asia-Pacific region. But these objectives do not justify placing civil society and NGOs under excessive administrative control when even the FATF ranks them as low to medium risks. The draft bill would require registration and renewal, impose extensive obligations on organisations and empower authorities to suspend or deregister them on broadly framed grounds. It is important to redraft provisions that confer excessive discretion over registration, renewal, suspension and deregistration of NGOs.

Among the concerns raised by United Nations human rights special rapporteurs with regard to the draft NGO law are provisions requiring organisations to align with government policies and restrictions that could affect advocacy, dissent and freedom of association. The implications extend well beyond organisations that engage directly with the government. Community groups, human rights organisations, independent researchers and organisations working on reconciliation or accountability could find their activities constrained by uncertainty over how these provisions might be interpreted. Organisations that criticise government policies are not thereby working against the country. Their freedom to do so is part of what distinguishes a democracy from a system in which the government determines which opinions and activities are acceptable.

The government has generated considerable public goodwill through its pursuit of corruption and criminality. It should not assume that this goodwill gives it an unlimited mandate to strengthen the coercive powers of the state. The NPP knows from its own history that governments can treat dissent as a threat and use the machinery of the state against their opponents. There is still time to correct the drafts through transparent public consultation, narrow definitions of offences, meaningful judicial control over detention and surveillance, and effective remedies against arbitrary decisions. A government that pursues corruption while weakening safeguards against state abuse risks undermining its own achievements. Besides bringing to light the abuse of power by previous governments, the NPP government needs to build a system in which no future government can abuse power in the belief they can get away with it.

Continue Reading

Features

Quality assurance without quality enhancement: The irony of university QA

Published

on

By Ramya Kumar

According to the Quality Assurance Council (QAC) of the University Grants Commission (UGC), quality assurance (QA) refers to “the means (i.e. the policies, attitudes, actions, procedures, etc.), by which an institution can guarantee with confidence and certainty, that the standards and quality of its educational provision are being maintained and enhanced”.

An expansive structure has been in place since 2005 to govern and implement QA processes within the state university system. The QAC is the focal point at the UGC that implements external reviews of state universities and institutes. Each university has its own Centre for Quality Assurance (CQA) tasked with performing QA in line with QAC directives. Faculties, in turn, have Internal Quality Assurance Cells (IQAC) performing their own QA; they are answerable to the CQA.

The big question is whether this all-encompassing top-down QA system, that in many ways undermines the internal dynamics of university governance, actually supports universities to enhance the quality of education. This article highlights some concerns.

Top-down check-box activities

The QAC conducts external reviews of universities and degree programmes. A review team appointed by the UGC (who may or may not have experience in the institution/programme in question) examines the self-evaluation report submitted by the said institution/programme. The team then conducts a site visit to verify the claims made in the university’s self-evaluation report, clarify issues identified during the desk review, and examine how QA procedures operate in practice. The team holds meetings with the university administration, members of the Council and Senate, Deans, Heads of Departments, academic and non-academic staff, students, and others. Following the visit, a draft report is submitted to the relevant institution/programme for comment before final publication. The reviewed institution/programme then prepares and publishes an action plan addressing the recommendations, with subsequent monitoring of progress.

There are some worthy QA initiatives under implementation, such as improving facilities for students with disabilities and strengthening mechanisms to address sexual- and gender-based violence. However, for the most part, QA activities have little to do with improving the quality of education. They are mostly preoccupied with monitoring faculty and department websites, digital transformation, student feedback, subject evaluation, course evaluation, peer evaluation, and, more recently, staff appraisal. These activities, which consume an inordinate amount of time—so precious at understaffed universities—have become check-box activities completed to generate evidence for the next review. Below is an excerpt of a conversation between two academics (1 and 2) that conveys how QA plays out at universities (reproduced with permission).

1: … .it’s like social media you know, like posting things on Facebook or twitter or Instagram. When people do a lot of social media, everything they do, they do thinking, “okay I’m going to post it in this way… this I have to put on my Instagram.” QA is a little like that… everything is considered in light of, “ah we can use this for the review, as evidence… for example very recently we were encouraged to have all the things that we do in our department in the faculty newsletter so then they can put in the review. Every little thing has to be noted down….

2: And with pictures and all…

1: At the very least it has to be written so that you have written evidence .. you can’t be doing something for the sake of doing something or because it is good for the department … and sometimes people tell me “oh yea that’s a good idea we can fit that under this x, y section of the review..”

2: Yea, and nobody really thinks about the actual outcome… whether it’s actually helping anyone..

1: I also find that a lot of the words that we used in different ways have now been co-opted to the QA discourse ..including quality.. I can’t actually say what I want as an “outcome”, for example, that the outcome of this workshop is that my students “think about” … then I am told “ah but no that’s not one of the Bloom’s taxonomy words, “think about”.…

2: And the worst part is these medical and agriculture people, these types of people go around spreading it like some kind of gospel!

1: Yea, this cookie cutter way of doing things, they think is the height of innovativeness or creativity, when actually it is so mundane … for me the most awful thing about it is like some fungus of mundanity has taken over through QA reviews.

2: yea, when you say QA, my mind closes off immediately and I stop listening…

Auditing everything but power

QA leaves out crucial aspects of university governance. For instance, there is no review or assessment of the “quality” of university administrations under Criterion 1 or the integrity of procedures governing the promotion of academic staff under Criterion 6 of the institutional reviews.

The majority in the Council—the university’s executive and governing body, which is responsible for selecting the Vice-Chancellor (VC)—are appointed in ad hoc fashion. Apart from the Ex-Officio members in the Council (VC, Deans, etc.), and the two members elected by the Senate, the remainder are appointed by the UGC with no formal consultation or vetting procedure. The VC appointment process described in UGC Circular No. 03/2023 exemplifies how an ostensibly technical process can become entangled in political sycophancy. The Registrar invites applications for the position of VC through advertisement. Applicants must submit a curriculum vitae, a statement of vision for the university and supporting documents. The University Council appoints a three-member Search Committee of senior academics to encourage “eminent persons” to apply, while the UGC appoints a former VC from another university to “observe” the selection process.

A Special Meeting of the University Council is convened. Candidates are interviewed and must make a presentation to the Council Members, followed by questions. Each Council member “gives marks” for seven prescribed criteria: strategic focus (20%), effective leadership (20%), holistic thinking/conceptual skills (10%), academic and research excellence (15%), personal integrity (10%), professional communication (10%) and managerial competence (15%). Marks are averaged, and the Council recommends three candidates to the UGC in rank order. The UGC-appointed observer separately submits a confidential report on the selection process.

This procedure is expected to guarantee quality, but does it? Applications are submitted to the Council Members, who have been appointed on questionable bases, and who are expected to review the applications and give scores, based on objective assessments. But, in reality, most Council Members are manipulated by VC candidates, who often have personal ties with them. The UGC-appointed observer usually has no genuine interest in the outcome. And there is no way for anyone to actually question the Council’s decision once it is made. Although the highest-ranked candidate may ultimately be appointed, the selection remains a political decision made by the President, who retains the discretion to appoint any one of the three.

External reviews also do not look into the promotions of academic staff, except to scrutinise whether there are policies and procedures in place to govern promotion. Academic staff may apply for promotion to Professor once they satisfy the prescribed eligibility requirements, which typically include the period of service, academic qualifications, research and publication achievements, teaching experience, and contributions to the university and wider community. Applications are evaluated against specified criteria, with research output and academic contributions assessed through documentary evidence and expert evaluation. Under the UGC’s scheme for Professors, two experts from outside the applicant’s institution assess specified aspects of research and knowledge dissemination. Again, beneath this technical process, which is externally evaluated, lies a problematic points-based scheme that can be manipulated and abused with impunity.

Rethinking university QA

Like the VC election process and the schemes of promotion for academic staff, QA reviews are open to manipulation. Before a review, there is a chaotic rush to complete evidence gathering and reporting. Academics leave all other work aside, including at times their teaching, to focus on completing documentation and preparing reports. The standardised criteria in the review manuals and scoring sheets often do not reflect differences in disciplines and institutional contexts. But this does not really matter because any serious problems experienced by institutions or programmes are hastily brushed under the carpet to conceal any evidence that could taint the review. The goal is to obtain an A or at least a B grade at whatever cost.

QA may result in positive change if it moves beyond top-down check-box activities towards internally designed and owned processes encompassing all aspects of university governance, led by departments and faculties, and supported by adequate resources. The current QA system needs to be dismantled and replaced by procedures that are accountable, not to the UGC, but to our students and the communities we serve.

(Ramya Kumar is attached to the Department of Community and Family Medicine, Faculty of Medicine, University of Jaffna)

. Kuppi is a politics and pedagogy happening on the margins of the lecture hall that parodies, subverts, and simultaneously reaffirms social hierarchies.

Continue Reading

Features

Down Memory Lane — the Grand 20th Edition!

Published

on

Down Memory Lane: Ready to sing again

Yes, Down Memory Lane, the beloved Sing-Along concert series that first struck a chord, way back in 1997, returns for its landmark 20th edition this Saturday, 17th October, at the beautiful Bolgoda Grand Resort, Moratuwa town centre.

Having celebrated its glorious 25th anniversary with the show in 2023, this milestone 20th concert promises to be even more special.

The organisers, the ever-popular Moratuwa Arts Forum, are pulling out all the stops to present yet another unforgettable evening, brimming with camaraderie, fellowship, and pure nostalgia.

Get ready for two-and-a-half hours of non-stop singing as veteran vocalists, from the Moratuwa Arts Forum, will take the stage to lead and inspire the happy audience to sing, sing and sing to their hearts’ content.

The repertoire? Absolutely magical, according to the organisers.

Veteran Arun Dias Bandaranaike: Will handle the evening’s proceedings / Priya Peiris: Event Conceptor

Around 40 golden oldies — from timeless English vintage evergreens and hits from the 50s to the 90s, to toe-tapping calypsos, soulful American plantation melodies, rousing cowboy and Dixieland favourites, aa well as cherished Sinhala standards. All to be sung with much gusto!

This year’s dedicated organising committee comprises Brian Coorey (Chairman), Priya Peiris (Event Conceptor), Hiran Fernando, Suranga Fernando, Viranjan Perera, Hemka Fernando and Neelesh Silva. Guidance and support comes from Moratuwa Arts Forum President Sarana Guneratne and Secretary Chandani Silva.

Adding his signature charm to the evening, as Master of Ceremonies, will be the veteran Arun Dias Bandaranaike.

Don’t miss this landmark celebration of music and memories!

For further details, contact Hiran Fernando on 0772636446 or WhatsApp 0783636446.

Continue Reading

Trending