Jammu and Kashmir Internet access whitelists

“Anatomy of Internet shutdowns”: Panel discussion at Nullcon 2020

March 9, 2020

Prateek Waghre, Research Analyst, The Takshashila Institution was a speaker in a panel discussion at Nullcon on March 8, 2020 about a study carried out jointly with Rohini Lakshané of The Bachchao Project. In the discussion entitled “Anatomy of Internet Shutdowns”, Waghre spoke about the study on usability testing of the whitelist issued for Internet access in Jammu and Kashmir.

Details about the study may be accessed here: http://thebachchaoproject.org/even-the-301-whitelisted-sites-in-jammu-and-kashmir-are-not-entirely-accessible-an-analysis

Details about the session here: https://nullcon.net/website/media-track.php. Nullcon is an annual conference held in India on the topic of cybersecurity.

Submission to MHA regarding whitelist for Internet access in Jammu and Kashmir

February 20, 2020

The Bachchao Project and The Takshashila Institution made a joint submission to India’s Ministry of Home Affairs (MHA) based on our findings of a usability testing exercise conducted on the whitelist issued for Internet access in Jammu and Kashmir in January 2020. A copy of the submission has been uploaded here along with a summary of the questions raised by our findings.

The findings are available on Zenodo: https://zenodo.org/record/3635885

To,
Shri Ajay Kumar Bhalla,
Home Secretary,
Ministry of Home Affairs,
Dated: February 19, 2020

Dear Sir,

Subject: Jammu and Kashmir Internet Whitelist

This communication is with reference to orders issued by the Home Department, Government of Jammu and Kashmir (dated January 14, 18, 24 and 31) regarding the Temporary Suspension of Telecom Services and enforcement of a whitelist of websites available for internet access in Jammu and Kashmir.

We have conducted a usability analysis of the 329 entries in the whitelist with the following results.

20% of the entries were practically usable.
23% of the entries were partially usable.
47% of the entries were not usable in any meaningful way.
10% of the entries could not be analysed as the information provided was inadequate/ incorrect.

The analysis demonstrated that this whitelisting approach is not technically feasible, especially for a large population, nor is it practically workable. It also simultaneously raised questions about the whitelisting exercise as a whole, which need to be urgently addressed by the Ministry of Home Affairs.

What were the process and criteria applied to select these specific URLs/ services/ websites to be on the whitelist?
What were the process and criteria applied to reject some services provided by the government from the whitelist?
What were the process and criteria, if any, to reject websites and services that are similar to those whitelisted and those that provide the same or comparable services?
How were the residents of Jammu and Kashmir informed about this whitelist, that these specific services/ websites had become accessible?
Were recommendations sought from the Telecom Regulatory Authority of India (TRAI) with regard to the violation of Net Neutrality? If so, what recommendations did TRAI put forward?
What were the criteria for blocking VPN services?
What, if any, technical testing was conducted to ensure smooth operation of the whitelisted websites?
What, if any, was the review process put in place for the list?
In view of all the above questions, how will the authorised government officers “ensure implementation of these directions in letter and spirit,” as stated in paragraph 7 of the order dated January 14?

We have enclosed a document containing the following information for your perusal.

Executive summary
Background note
Summary of results
Questions with supporting information

The document also includes three addenda (in case further details are required).

Addendum 1: Detailed write-up about the method of testing, its limitations, our observations based on our findings, and questions and comments about the role of ISPs in implementing the whitelist.
Addendum 2: The test results and observations for each of the 301 entries in the whitelist contained in the order dated 24 January.
Addendum 3: The test results and observations for new entries made to the whitelist specified by the order dated January 31. The new entries had to be analysed separately since this order removed the ‘Field’ column resulting in a change in categorisation of the entries.

We seek your response(s) to the 9 questions listed in the submission.

Copies to:

Shri Amit Shah, Minister for Home Affairs
Shri Ravi Shankar Prasad, Minister for Communications, Minister for Electronics and Information Technology
Shri Anshu Prakash, Secretary to the Department of Telecommunications
Shri Ajay Sawhney, Secretary to the Ministry of Electronics and Information Technology
Shri Shaleen Kabra, Principal Secretary to the Government, Home Department, Government of Jammu and Kashmir
Shri R. S. Sharma, Chairman, Telecom Regulatory Authority of India (TRAI)
Shri Sanjay Dhotre, Union Minister of State for Communication, and for Electronics and IT

—
Prateek Waghre
Research Analyst,
The Takshashila Institution

Rohini Lakshané
Director, Emerging Research,
The Bachchao Project

Questions about whitelist for Internet access in Jammu and Kashmir

Submissions citing analysis of whitelist for Internet access in Jammu and Kashmir

February 9, 2020

A representation prepared by the Internet Freedom Foundation and submitted to the Jammu and Kashmir government references an analysis and prepared by Rohini Lakshané (The Bachchao Project) and Prateek Waghre (The Takshashila Institution). An abridged version of the submission can be found here: Foundation for Media Professionals approaches J&K Govt seeking compliance with SC judgement. It references “Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis” published by Medianama on January 28, 2020.
The Bachchao Project and The Takshashila Institution made a joint submission to India’s Ministry of Home Affairs (dated February 19. 2020) based on our findings of a usability testing exercise conducted on the whitelist issued for Internet access in Jammu and Kashmir in January 2020. A copy of the submission has been uploaded here along with a summary of the questions raised by our findings: http://thebachchaoproject.org/submission-to-mha-regarding-whitelist-for-internet-access-in-jammu-and-kashmir
- This submission was made separately to the Parliamentary Standing Committee on Informational Technology in February 2020.
An interlocutory application filed with a PIL in the Supreme Court seeking restoration of 4G Internet access in Jammu and Kashmir cites the study “Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis“. For details, see Annexure A-3, IA of Writ Petition (Civil) (Diary No.) 10817 of 2020, Foundation for Media Professionals v. Union Territory of Jammu and Kashmir and Anr. and “Application Filed In SC To Show Impact Of Internet Curbs On Life In J&K During COVID-19 Lockdown” (dated April 15, 2020).

[Podcast] All Things Policy: The Dark Side Of The Kashmir Whitelist

January 29, 2020

Rohini Lakshané (of The Bachchao Project) and Prateek Waghre (of The Takshashila Institution) spoke with Anirudh Kanisetti on this podcast about their analysis of the 301 entries whitelisted for Internet access in Jammu and Kashmir in January 2020. This episode is a part of the All Things Policy series of The Takshashila Institution. The detailed analysis and test results were published on Medianama — Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis.

Podcast URL: https://ivmpodcasts.com/all-things-policy-episode-list/2020/1/29/ep-250-the-dark-side-of-the-kashmir-whitelist

Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis

January 29, 2020

The article “Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis” written by Rohini Lakshané (The Bachchao Project) and Prateek Waghre (The Takshashila Institution) was published on Medianama on January 28, 2020.

https://www.medianama.com/2020/01/223-analysis-of-whitelisted-urls-in-jammu-and-kashmir-how-usable-are-they

Archive URL: https://web.archive.org/web/20200128191547/https://www.medianama.com/2020/01/223-analysis-of-whitelisted-urls-in-jammu-and-kashmir-how-usable-are-they

Excerpt

The Supreme Court made a judgement on January 10, 2020 directing the Central government to review the total suspension of Internet services in Jammu and Kashmir imposed since August 5, 2019 and to restore essential services. In response, the government of Jammu and Kashmir issued a whitelist comprising 153 entries on January 18, and increased the number of entries to 301 on January 24. What would the experience of an ordinary resident of Jammu and Kashmir be like under the whitelist arrangement? We conducted a preliminary analysis to empirically determine whether the 301 whitelisted websites and services would be practically usable and found that only 126 were usable to some degree. Before we delve further into the questions the list raises, the role of ISPs, and analyse the list itself, it is pertinent to understand the background and context in which an ordinary resident of Jammu and Kashmir may access the Internet…

Tweet thread: Preliminary analysis of second whitelist for Internet access in Jammu and Kashmir

January 29, 2020

Dataset: https://zenodo.org/record/3629633

In continuation of the tweet thread from: Preliminary analysis of first whitelist for Internet access in Jammu and Kashmir

Detailed analysis published on Medianama — Even the 301 whitelisted sites in Jammu and Kashmir are not entirely accessible: An analysis, January 28, 2020

Tweet thread

Update on the Kashmir Whitelist

As promised – the detailed write-up and results (all 301 entries on the whitelist) for the tests @aldebaran14 and I did is up now, on @medianama https://t.co/THh09BbeMJ (1/n) https://t.co/lIiwIPv6ta

— Prateek Waghre (@prateekwaghre) January 28, 2020

126 websites on the whitelist were either usable or partially usable.
31 had to be eliminated for various reasons (duplicates, no URLs, indeterminate URLs, invalid URLs). That leaves 144 which were not usable. As I said earlier, this is subjective to some extent. (2/n) pic.twitter.com/DDZUnshYyK

— Prateek Waghre (@prateekwaghre) January 28, 2020

The new set included search engines. Searches worked, though only results from websites on the whitelist were actually accessible. We classified them as ‘partially’ usable. Indian subdomains were not included but Canadian, French-Canadian versions of some were (3/n)

— Prateek Waghre (@prateekwaghre) January 28, 2020

7 more streaming (audio and video) services were added too (with hostnames this time). Only 1 of them worked (suspend disbelief for a second and imagine that 2G will actually allow this) (4/n)

— Prateek Waghre (@prateekwaghre) January 28, 2020

The official websites for some apps like Notability and Kinemaster were on the list. Of course, the apps themselves cannot be downloaded since app stores are not allowed. Installed versions will likely not work (depends on whether the app is designed to use the same hostname) 5/n

— Prateek Waghre (@prateekwaghre) January 28, 2020

74 websites categorised as “news” (60) and “Technology Updates” (14) were included too. There were affected to varying degrees. Audio/Video did not work for almost all of them (CDN/Youtube). (6/n) pic.twitter.com/BItmmDHT0T

— Prateek Waghre (@prateekwaghre) January 28, 2020

Our method did have some limitations, and there maybe be better/smarter ways to do this. We’ll continue to explore and are also willing to work with anyone who wants to collaborate. (7/7) pic.twitter.com/T8PjdK2aQR

— Prateek Waghre (@prateekwaghre) January 28, 2020

#KashmirInternetShutdown: @aldebaran14 and @prateekwaghre examine the feasibility of implementing the list of 301 websites whitelisted in Kashmir. They look at:

🌏Which sites work, which don’t
🌏Technological constraints with the order@medianama https://t.co/wBYqbzVvdT

— Aditi Agrawal (@Aditi_muses) January 28, 2020

🌏Role of ISPs

They have also created a sortable database of all the parameters they used to judge the efficacy of this order. Find it here: https://t.co/Nj8YI33C2C

— Aditi Agrawal (@Aditi_muses) January 28, 2020

Tweet thread: Preliminary analysis of first whitelist for Internet access in Jammu and Kashmir

January 28, 2020

Rohini Lakshané (The Bachchao Project) and Prateek Waghre (The Takshashila Institution) conducted a preliminary analysis of whitelist comprising 153 entries issued by the Home Department, Government of Jammu and Kashmir on 18 January 2020, to empirically determine whether the whitelisted websites and services would be practically usable for an ordinary resident. The Twitter thread published here shines a light on the method of testing and the signficant findings. A detailed write-up will be published soon. The dataset comprising test results is licensed and can be accessed here: https://zenodo.org/record/3627665

Thread on the Kashmir Whitelist.

Earlier this week @aldebaran14 and I analysed the 153 websites on the whitelist as per the 18th Jan Order and found that ~80 were not ‘practically usable’. We wanted to understand how these websites will work/look under this whitelist regime(1/n)
— Prateek Waghre (@prateekwaghre) January 25, 2020

So we setup Chrome with an extension to allow access only to the hostnames listed in the order. Now, there are limitations with this method. We did not test on a 2G network. We could not carry out actual transactions and the assessment of usability is a bit subjective (2/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

We looked for whether the website was visually affected, if the images loaded, if the login section was accessible and the main function(s) of the website still worked along with some general navigation to see what was affected (3/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

In perusing the list we found typos, duplicate entries, entries without actual hostnames and some that were indeterminate. After removing these, we were left with 134. Of these we found ~80 websites were not practically usable. Why? (4/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

Well, the way most websites are designed, a lot of content comes from subdomains, CDNs. They also have 3rd party content like analytics services, ads, various libraries that manage the UI etc. None of this worked because there were not on the whitelist (5/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

So most of the websites were broken. Here is an example of https://t.co/lrODnoKXrm. We also pulled a request map to highlight how much content comes from other domains. Different websites were affected to varying degrees depending on how they were designed (6/n) pic.twitter.com/IvNOAXjsjG

— Prateek Waghre (@prateekwaghre) January 25, 2020

In case of https://t.co/VZism9Q7nA, we found that though the page was still (sort of) readable, the search feature was unresponsive. The train status feature took us to another link, which of course, was not the on the whitelist. (7/n) pic.twitter.com/CCsuk5L8OA

— Prateek Waghre (@prateekwaghre) January 25, 2020

For the ones classified as banking websites, we found that only 2 of the 15 on the list had accessible login pages (eg. For SBI bank, the whitelisted domain was https://t.co/puxIdFlslj, but to login you need to go to https://t.co/Owwg9o3Qth which was not on the list) 8/n

— Prateek Waghre (@prateekwaghre) January 25, 2020

The inclusion of streaming services seems absurd because:
1) 2G
2) Most of them use CDNs for delivering video content (as I said earlier, these are not on list).
3) No actual hostnames were given – how does the ISP know what to allow? Are they expected to analyse the apps? (9/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

We excluded these and ‘Jio Chat’, so in reality (esp. over 2G) the number of unusable websites maybe higher than what I said earlier in thread.
Of the ones that worked, 25 were minimally impacted (mainly had textual information). 30 were ‘partially usable’ (10/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

We ended the exercise with more questions than answers. Some of them are:
1) On what basis are these (and future) domains selected?
2) Why are some some sites on the list while others in the same category are not?
3) How will ISPs actually implement this? (11/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

I know the list was updated to approx 300.Haven’t read through it in detail,but a cursory glance was enough to spot duplicates and strange entries (trying hard not to judge).I would love to test the new ones, sadly, we’re caught up with other stuff over the next few days. (12/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

We’ve also done a detailed write-up that we’re hoping to publish soon. Both @aldebaran14 (credit to her for kicking this off) and I are also happy to release the spreadsheet that we recorded our analysis on, in case anyone wants to build off it. (13/n)

— Prateek Waghre (@prateekwaghre) January 25, 2020

Correction for #8. The whitelisted domain for SBI is www_onlinesbi_com (I’ve replaced the . with _ because twitter drops the www automatically)

— Prateek Waghre (@prateekwaghre) January 25, 2020