Skip to content

Aarey Milk Colony, spread over 1,259 hectares of land, is an extension of Sanjay Gandhi National Park. In 1949, the land we know as Aarey was given to the Dairy Development Board of Maharashtra to shift the cattle sheds from the city to Aarey. Since then this area has been known as Aarey Milk Colony. Aarey has 27 tribal hamlets; in terms of flora and fauna, it has leopards and numerous species of birds, animals, insects, butterflies, snakes, herbs, shrubs and trees (which number more than 4 Lakh 80 thousand).

In November 2014 , morning walkers, cyclists and other regular visitors to Aarey Milk Colony found notices put up, announcing that 2298 trees in Aarey would be felled for construction of the carshed for Metro3. Citizens came together to protest against this mass felling of trees. Thus was born the Save Aarey Movement.

In December 2014 angry citizens for the first time gathered in Aarey Picnic Point area to protest against this unnecessary destruction of the city's ecology. 1200 + citizens came together again in February 2015, creating a human chain along Marine Drive. Post this event, the Chief Minister of Maharashtra announced appointment of an Expert Committee to explore other options for location of the Metro3 carshed .

The Expert Committee had 6 members; four Bureaucrats and two environmental experts from IIT and NEERI. Both the environmentalists put a dissenting note in the Committee's report, holding that Aarey is an ecologically sensitive area and rich in biodiversity. The proposed carshed location is the floodplain of the Mithi River, and construction in this area can lead to flooding in Andheri. Hence the carshed location should be shifted out of Aarey, they said .The other options for the carshed location suggested by the expert members were Kanjurmarg and Backbay in Colaba.

The Detailed Project Report prepared in 2011 for the Metro 3 Line also mentions three other options (along with the option of 33 ha land in Aarey) for the Metro 3 Carshed location: the ground in Bandra Kurla Complex, 26 Ha of land in Kalina, the Mahalaxmi Race Course. Mumbai Metro Rail Corporation ( MMRCL) always claims that the 33 ha land area in Aarey is the only suitable location for the Metro 3 Carshed.

In 2015 the NGO, Vanashakti, along with citizens, filed a petition in National Green Tribunal (NGT) praying that Aarey be declared a forest and an Eco-Sensitive Zone. NGT on 19th August 2015, ordered status quo in Aarey pending final decision on the case. MMRCL, in August 2017 started dumping debris in the Metro 3 Carshed area in Aarey, along with excavation and mud filling activities in the area. This was in contempt of Court orders and was highlighted at the NGT. On 14th May 2018, NGT again ordered against any dumping of debris, land reclamation and Tree Felling in Aarey pending final decision in the case. But MMRCL continues to violate court orders. They have cordoned off more area in Aarey on the opposite side of the carshed area and have started land reclamation. What initially started as destruction of 33 ha of forest land is now leading to destruction of a much bigger area. Citizens lodged complaints in Aarey Police Station against these violations of court orders. MMRCL has also evicted Adivasis from Prajapur Pada in Aarey to SRA Buildings. This is in violation with Tribal Rights. Adivasis have filed a petition in Mumbai High Court.

On 20th September 2018 Judges from NGT's Principal Bench decided that this matter of declaring Aarey a Forests does not come under NGT's jurisdiction and NGT directed the petitioners to withdraw application and approach the right Authorities. This has happened after 3 and 1/2 years long proceedings in National Green Tribunal.

Through an RTI in 2017, Vanashakti found a letter written by the Divisional Manager of Sanjay Gandhi National Park( SGNP). This letter indicates that Aarey Milk Colony was of a much larger area earlier, and that 2076 ha of land from Aarey Milk Colony was Transferred to SGNP in 1969. But the forest department claims that they do not have any land records related to Aarey Milk Colony.

The forest department, in 2015, had submitted a draft proposal to the Ministry of Environment and Forest (MOEF) to declare Aarey Milk Colony as an Eco Sensitive Zone. MMRCL moved an application with the MOEF and got 165 ha of land (1.65 sq km) from Aarey denotified from the Eco Sensitive Zone. The MOEF denotified an area of 1.65 sq km from the ESZ in December 2016. This decision has been challenged by Vanashakti in NGT through a different petition.

Already, a large part of Aarey Forest has been lost to different projects and construction activities. Citizens fear that with the entry of the Metro 3 carshed, better described as a railway service centre, the rest of this forest, spreading over 1259 ha, will be lost to construction activities for ever.

Mumbai City is already sinking because of the destruction of its water bodies, wetlands and mangroves. Loss of Forest area and destruction of the floodplain of the Mithi River in Aarey will lead to further destruction of the city and flooding in more new areas in Mumbai. Lakes , supplying drinking water to Mumbai are also located in Forest Areas. Vihar lake on the border of SGNP and Aarey.

The air quality of Mumbai will be seriously hit if 4000 full grown trees are removed from its last remaining green space,the Aarey forests. .

A Movement that started with the news of felling of 2298 trees has brought out more shocking details. MMRCL floated a tender document for felling of 3384 trees in Aarey Milk Colony in 2017. And number of trees that are in line for sacrifice is still increasing. Tribals have lost their homes and livelihood. Floodplain of Mithi River has been damaged and this city will finally lose 1.65 sq km of forest areas to construction activities if this Carshed is not shifted out of Aarey. Facts finding team of Citizens have also found letters that speak about Government granting 3 FSI on 33 ha (82.5 acres) of Aarey land. A design layout prepared by MMRCL for the Carshed area also has marked an area on 33 ha land for realestate prooject.

Citizens of Mumbai needs to decide what is more important for them. A peaceful and happy life in a place requires, Fresh Air, Good supply of Drinking water , accessible open spaces and flood free roads .

In a Costal city like Mumbai, when the entire world is suffering from the consequences of Global Warming a place like Aarey becomes extremely crucial for survival of the city.

When a village decides to wash roads with water during drought, because the Chief Minister is to visit.

Yavatmal: Roads in drought hit Yavatmal district were washed with water because the Chief Minister Devendra Fadnavis was going to visit! Thousands of liters of water was wasted in order to do this.

The Chief Minister was to visit Sarul village in Babhulgaon taluka. The whole village was decorated in preparation for his arrival. The village gram panchayat office, school and dispensary were decorated. However the public works department decided to wash the road with drinking water.

In many villages in drought struck Yavatmal, it is a struggle to find drinking water. In such a situation, they wasted water by pouring it on the roads using tankers - not once, but four times!

 

Translated from report in Marathi on ABP Majha

Not sure how to do this, given that this is a data free hatchet job by Manu Joseph. So it isn't like he is claiming that his absurd claims are backed by data to begin with. Still, because I'm irritated enough, doing a limited take down of yet another attempt to trivialize the gravity and causes of farmer suicides with the Parliament in session (during or just before Parliament sessions is the season for hatchet jobs on farmers - probably to improve acceptance for anti-farmer policies coming up?).

All quotes from Manu Joseph's fantasy piece on farmer suicides in the Hindustan Times.

If an active cricket ground exists, it would be watered on most days, or it would die. So why this fuss before the tournament? Also, the calls for the cancellation of matches are comical for a simple reason — it is on the days of the matches that the grounds are not heavily watered.

Frankly, I agree with Manu Joseph that there are bigger problems than cricket in the face of drought. For example, the state allocation of water prioritizing industry over domestic consumption in blatant disregard for law or rights and a court limits (not cuts off, mind you) water to breweries long after people have spent months making careers out of seeking water to survive. However, the idea that a cricket ground consumes less water when there is a match is ignorance of the highest order, because he seems to think that facilities for a crowd of spectators and worse, media and teams camping out (who in our VIP culture won't be assigned a couple of buckets a day) don't consume water and all the water in a cricketing event is actually only the water poured on a lawn.

At this point, Manu Joseph dismisses the first veteran of his piece. Sunil Gavaskar.

Sunil Gavaskar, whose relationship with the BCCI, it is reported, has collapsed and whose lucrative contract with the board may end, wrote in his column, “The issue of drought is one such where many lives are at stake.” (True). “I am no expert on ground and pitch preparation…” (True) “…

What Manu Joseph does not realize is that Manu Joseph is no expert on ground and pitch preparation either and does not bother with any disclaimers about his lack of knowledge. Probably because it would involve not writing this absurd piece to begin with. Gavaskar may not be an expert on ground and pitch preparation, but Gavaskar knows cricketing events and probably realizes they are not as water free as Manu Joseph's piece is fact free.

This is a mystifying exaggeration — the suggestion that if matches are held in three cricket grounds in Maharahstra the lives of farmers would be at risk. But it is a popular view.

Absolutely no explanation for why Manu Joseph calls this an exaggeration. No mention of available water that people are ignoring and dying as a hobby. No mention of how much difference in water consumption there would actually be and what constitutes exaggerated. Absolutely no evidence anywhere that Manu Joseph has been to drought hit areas, studied so much as what drought means to reach his expert opinion. Manu Joseph has water in his tap and people are making too much of a fuss. And we actually have newspapers giving space to this entitled garbage. An interesting question of how editorial decisions happen in corporate media. Forget the stand taken by an article, but do newspapers no longer require claims to be backed by evidence?

It is not a popular view, BTW. Most people hate it. 60 kilometers from the heart of Bombay, I get half an hour of water - non-potable - a day. I earn enough to make ends meet and have the luxury  of home delivery for drinking water. Men, women, kids from our oh-so-posh looking society are routinely found at a water filtration gig round the corner, filling 10 liter cans for 3 rupees and ferrying the water home. I am nowhere near the officially drought hit regions of Maharashtra, where taps have run dry right after the monsoon and people have been ferrying water for MONTHS already. Perhaps Manu Joseph would like to ferry water for a week in an air conditioned car before calling these concerns exaggerated or merely popular opinion (as opposed to his fact free expert opinion, I suppose).

Perhaps the fact that many of the deaths from drought are from drowning may prove Manu Joseph's point that there is plenty of water and people are making a fuss? There are kids drowning in the silt in water reservoirs. Falling into wells. Kids who aren't in school to begin with, because they are needed to find and bring water home, right along with the adults. How many of these kids will need to search harder, walk farther? How many adults will die of heat stroke and heart attacks as the search for water makes them wander more in temperatures regularly over 40 degrees? There is already risk of water riots as desperation grows. How many of the quests for water will be made longer with tankers supplying water to desperate localities moved to lucrative providing for cricketing events? [link added because hours after I write this, an expose shows how water for the distressed gets sold to whoever can pay for it]

There is much veneration of farmers in India by those who are not farmers. These are the very people whose greatest fortune was that their grandfathers or fathers ejected their progeny from the agrarian economy.

There is also much dismissal of the plight of farmers in India by those who are not farmers. These are the very people whose greatest fortune is to be so comfortable in life as to see no difference in resources spent on entertainment and food. A lot of these overnight experts are those who find their agricultural know-how based on specific facts and arguments cherry picked and promoted by industries who would prefer to marginalize farmers. Who lack any basic knowledge on the subject to know when they are being fed handpicked bullshit or how they can verify it. Whose world view is so limited to their personal experience that they have little but contempt for anyone wanting attention or sacrifices or even inconvenience for problems that they don't face.

[Ignoring the exhibition of incompetence on diet except for one line, because it will derail the main track of this piece here. If you are interested, comment away and I'll do a separate piece on this other glorious piece of logic.]

The human body does not require rice and wheat. In fact it does very well without grain.

I challenge Manu Joseph to provide details of one meal that someone under our poverty line could afford that does not involve grains or meat (asked to give up just before this quote). Because dear friend, if rural India could afford a diet of nuts, they wouldn't be desperately running after water tankers, they'd order home delivery like you and me. And if you think people can survive without grains or meat or nuts - wait.... lemme guess. you're talking of a desk jockey lifestyle like yours without much need for energy? Cabbage your way out of that paunch? BTW, vegetable growing needs more water 🙁 Ask me. I have 3 balcony gardens for food and watering in summer is a pain. The grasses grow much easier than these lush beauties (I assume you know grains grow on grasses).

There is more, but I'm bored now. Ending with this masterpiece of propaganda (the art of repeating a falsehood till it starts sounding true)

Let me repeat an assertion this column made earlier while arguing that farmer suicides are primarily a depression story where poverty only plays a role:

“In a country where most people can be termed ‘farmers’, it is not anomalous that most people who kill themselves would be ‘farmers’. In fact, what is anomalous is that a huge majority of farmers who commit suicide are male. If both official and activist statistics are considered, it would appear that women in impoverished farming communities are among the least likely Indians to commit suicide. Activists who ascribe social, economic and political reasons for suicides would never be able to explain why.’ In most nations of the world, including India, the number of men who commit suicide is several times more than the number of women. this pattern is reflected in the gender ratio of ‘farmer suicides’.

Not just activists, any sane person can't get this logic. That depression is the cause of suicide, but not loans or policies and political maliciousness. I mean, why would you be depressed if your months of physical labour resulted in loss? Why would you be depressed if you couldn't repay loans? Why would you want policies to cover your risks? This logic can only come from someone living in a "normal" where hardwork is not necessary to survive, a good way of dealing with loans you don't repay is pulling strings to get them restructured and bailouts are necessary to save jobs, so not like you want any favors.

No matter how many times you repeat it, fact is, most people in India are not farmers. This bogus statistic is based on some expert claim made by another columnist on economics who found his agricultural gene just before a Parliamentary session with a GM food decision coming up and has been copied by every overnight agricultural columnist whose sole agricultural writings come when policy decisions are up for grabs and have never spoken to the family of a farmer who committed suicide or, for that matter, laid feet on agricultural soil for their journalism. Not seen a single person who actually has knowledge of the subject ever buy this nonsense.

The reason for that is that the IDIOT interpreted 54% of Indian population being sustained by the agricultural SECTOR (this includes everything from distributors of pesticides to tractor mechanics and wholesalers of grain) as farmers. Whereas, the fact is that the farmer suicide problem is largely between small and marginalized farmers, whom we are losing rapidly, even as the number of suicides increases in a shrinking population. But this bogus argument remains popular among subsequent idiots who don't verify the bullshit they are fed with when they have propaganda to peddle. You are not the first, and you will not be the last. The activist types don't give a fuck, but bogus data pisses me off, so I suppose I must call this out every time I see it.

Disclosure: Not commenting on the comment about P. Sainath because conflict of interest. I am happy to share that since yesterday, I am on the payroll of the People's Archive of Rural India founded by Sainath, which sadly now will seem like I am defending him in situations like these, when it would just be objecting to rubbish before.

Note: I normally reference and provide data for my posts, but I believe a fact free article at least requires a rebuttal where you have to do the hard work yourself to verify things I say and discover a hundred more horrors I didn't say.

11

The following is a first person account by Md Hasanujjaman, M Phil in English, University of Hyderabad of the brutality unleashed by the police against the students and faculty of University of Hyderabad.

12592585_483706081815349_7432427043187641619_n
VC Apparao resumes office at the face of the report of the two-member fact finding committee that stated the university should have handled the incident more “sensitively” -

I am one of the arrested students in connection with the protest against the VC of UoH. I belong to a minority community of West Bengal. My family is financially backward. Here I would like to narrate the police brutality on me and my fellowvictims in police van on the way from UoH to Miyapur Police Station on 22nd March. Before coming to UoH I was naive about the problems in the society. I had no idea of the pathetic and dehumanized condition of the dalits and the adivasis. I was hardly aware of the dangerous consequences of caste system in the Indian society. But coming to UoH I began to understand the real picture of the caste system which leads to utter discrimination and dehumanization of the dalits. I saw that this caste system makes the lives of the dalits extremely miserable. Realizing my responsibility as an independent and right thinking citizen of this country I found that the caste system is a tool of dehumanization and therefore it must be annihilated. I stood against this discrimination of the caste system and thus, I aligned with the movement which Rohith Vemula was part of.

Rohith Vemula being a dalit, was institutionally discriminated and forced to take his own life. The ‘Vice Chancellor prof Appa Rao Podile’ directly perpetrated in the institutional social boycott against the five dalit students including Rohith. Following the suicide of Rohith, the VC was booked under the SC/ST Prevention of Atrocities Act according to whose provision the accused must have been arrested within 24 hours from the lodging of FIR. However the FIR was lodged on 18th January, 2016 and till date he has not been arrested. This is a gross violation of the constitutional provision. Instead he returned to the university and attempted to illegally reclaim his ‘vice chancellorship’ on the 22nd March, early morning.

huc-police-action-759
Central Reserve Police Force (CRPF) and other security personnel unleashed brutal physical and sexual assault on students and teachers protesting against VC resuming office for Justice for Rohith

On the same day that is on 22nd March I went to attend a PreSubmission Seminar in the department of English, School of Humanities, at exactly around 2.00pm. Coming out of the department at around 3.00pm I saw that the peacefully protesting women and men teacher and students were being dragged and beaten up mercilessly by the police. The police were chasing and lathicharging on the protesters indiscriminately. It was obnoxious to see that the protesters are beaten up for raising voice against the injustice. It was a day of police violence on the democratic and peaceful protesters. I saw one student losing his sense and was rushed to a hospital. Many students got their clothes torn due to the brutal manhandle and lathicharge. But it was most painful to see that the women students and teachers being mercilessly beaten up by the police. They were thrashed on their private parts. I also witnessed female teachers being manhandled/molested by the police. It was a violation of women's rights as the women students and teachers were molested by the male police. Dr Tathagata Sengupta, an assistant professor of Mathematics was beaten up too.

It was a threatening moment in my life. I never saw such police violence in front of my eyes. I could not restrain myself from speaking against the police and as a result I was the next to be victimized. However, the police brutality actually began when one teacher, one film maker and the sixteen students including me were chased and dragged into a police van. I was standing near the ‘Goodwill canteen’ which is around 250 meter away from the VC`s lodge where the protests were happening. Standing there itself I could see students and teacher being dragged into the police van. But I never thought that I would also be a victim of the police brutality. Suddenly, one police chased me and caught the collar of my shirt. I pleaded not to apprehend me as I did not commit any crime except the fact that I stood for the Justice for Rohith and supported the students’ movement for justice. I feel that I was targeted because I questioned the police on their face that why Rohith did not get justice even after more than three months; why the accused for Rohith's murder has not been punished; on what ground the VC has come to take charge of the university. Instead I was beaten up and thrashed hard and pushed into the police van.

This inhuman and brutal torture continued on all of us for around 50 minutes on the way from UoH to the Miyapur Police Station. Dragging me into the van the police forcefully pushed me down into a corner seat. Before getting hit I quickly looked at a fellow victim Subhadeep Kumar and asked him what might happen to me as for the first time my life I got into a police van. He assured me that nothing will happen as I did not commit anything wrong. I could not turn my face to have a look at the rest of the victim in the van. Again the police hit me on shoulder. I pleaded not to hit me but the police pulled my hair and punched me hard on my back. Another police hurried at me snatched my mobile and spectacle. But when I pleaded to give me back the spectacle as I have serious eye problem, the police boxed on my right eye saying that why despite being visually challenged did I spoke against the police. Whenever I tried to look at my fellow companions who were beaten up black and blue, the police hit me and cowed me down not to raise my head again. I heard my fellow friends shrieking in pain as they were mercilessly thrashed and hit. Those who had beard and looked liked ‘Muslims’ were beaten up specifically as the police suspended them to ‘like’ terrorists. The sounds of slapping and hitting still haunt my mind and I feel the pain. Professor K Y Ratnam was also a victim of the police brutality. A filmmaker, Moses Abhilash too was unlucky to be a victim of the brutality. Abhilash was just shooting the videos of police lathicharge which the police did not want the public to see. The police beatings left wounds on my body. When I requested for water they gave me the water only to be ready to get beaten up again. The physical assault was extremely systematic and cruel. At that moment I doubted whether I was at all a human being. While beating up, the police also unleashed verbal abuse on all of us at extreme level. During the journey of police brutality from the UoH to Miyapur P. S., the police were continuously abusing us with the most vulgar and objectionable language. “M***d, b**d, chu**a, bho**ke” and etc were the common words they were throwing at us. They called us Pakistani ISI agents and alleged that we are spending Indian money and supporting Pakistan and threatened us to send us to Pakistan. They called us antinational alleging that we are conducting “beef festival”, “kiss of love” events on “Afzal Guru’, “Yakub Memon’. They said that they were taking revenge on us for their hard work on duty. They also assaulted our departed friend Rohith Vemula saying that he was a ‘bastard’, ‘spoiled child’ and people are unnecessarily paying attention to his death. They used extremely antiwomen, derogatory, and sexist comments. They said that they would rape our mothers and sisters and also they vowed to bring them here and take their naked videos. They also threatened to do the same with our women friends in the university. Hearing these comments I feel that the safety of the women is at great risk and I also feel that the posting of police poses direct threat to women teachers, students and workers in the campus. Their comments and attitudes were dangerous as far as the safety and security of women is concerned at large in the society. It is appalling to think what the police remarked against the women.

hcu-police-brutality.jpg.image.784.410
The language police used against women protestors : "Tu kahaan ki rehne wali hai? Itti kaali hai! Aa tere ku sabak sikhata hoon! (Where are you from? You are so dark. Let me teach you a lesson)"

After brutal torture in the police van we were subjected to harassment in Miyapur P. S. After reaching there at Miyapur we all of us were made to sit on a dirty and spaceless corridor. The police humiliated us by making our respected teacher Prof K Y Ratnam sit on the same dirty floor. The police lectured us about moral and ethical correctness. They behaved with us very rudely while taking our detail information and pictures. On asking about our release the police told us that everything is in hand of their “BIG BOSSES” and they also said that the Gachibowli police have already decided our fate. We were kept awake throughout the night by putting light on in front of eyes and playing songs and videos. When we requested to let us sleep they laughed at us. The next day, a Subinspector of Miyapur P.S. called me for interrogation and he took all my information in detail including my family, relatives’ information. He also took the photos of my PAN, Aadhaar and university ID cards. He also took the phone numbers of my relatives checking my mobile. He abused me very badly and threatened me that in future if something happened in the university, I will be a target even if I do not commit any crime.

Thereafter we were secretly taken to Balanagar Police Station where we were again harassed both physically as well as mentally. The police made us sit in a dirty and suffocating room. Professor Ratnam was again humiliated by making him sit at the feet of the police who was sitting on a chair and giving us pedantic lecture on nationalism and education as to how we should develop our society. This is the same subinspector of Miyapur P.S. who abused me in vulgar language and giggled his teeth and lied to me when I asked him where we were taken to. He also mocked at me by calling me “team leader” and “mastermind”. I don't know his motive for calling such things. But I am apprehensive of my Muslim identity as he was targeting me. I was also not allowed to inform my worried family or friends about my whereabouts.
From Balanagar P.S. we were taken to ‘Government Area Hospital’ secretly. We were shocked to know that we were taken to a hospital. I had wounds and pain caused by the police brutality the previous day. But I had no reason to expect any medical treatment. In the hospital I was forced to stand in the queue for treatment. The doctor gave me “fit to be produced at court” certificate despite my critical health condition. I also saw Professor K Y Ratnam`s Blood Pressure reading to touch around 220 mark in the BP machine. After the “treatment” the Gachibowli CI J. Ramesh forced me to sign the arrest papers at around 9.00 pm on 23 March whereas actually I was arrested by the police at 5.30pm on 22 March. When I tried to raise objection the Gachibowli CI J.Ramesh threatened me that not signing the arrest papers would amount to additional cases against me. I was denied any interaction with any legal expert on these serious issues. When I politely asked him “Sir, my career would be shattered if my future is tarnished by filing cases against me”, he aggressively threatened me saying “shut your mouth up otherwise I will file more cases against you”. I do not know how to express the fear generated in me by J Ramesh. After medically certifying me “fit to be produced at court” I was again confined in the police van. It was suffocating and scorching hot. I requested the police to let me stand out of the van until it moves. But the police as usual again threatened us. I was very hungry as I did not get anything to eat throughout the day. The police did not bother to hear any of my problems. Then I was taken to the honourable Magistrate at around 11.40 pm. But the Gachibowli police Naveen and Bhupathi did not allow me to appear at the honourable Magistrate to narrate my suffering and wooes. At the Magistrate's order I was sent to Cherlapally Central Prison. Coming to the prison my health further deteriorated. I called a prison physician for treatment. He gave me a general painkiller injection and some medicine for the wounds and pain caused by the police on 22 March. But he did not give me any proper health treatment as I needed the most. It still pains me to remember that in prison the doctor was not allowed inside and therefore, I had to take an injection through the window. I also failed to have an eye check as 22 March as the police hit me on my right eye. The police action threatened my life and also the hopes of my family. I feel helpless, hopeless and unsafe. The police filed false cases against me and others with the deliberate intention to destroy our future and our lives. The police terrorized us throughout the first 33 hours to ensure that we do not again protest against the government and its agencies. They kept us saying that we should only study and not get involved in politics. They wanted to create a fear in us so that before protesting we will remember the trauma of the police brutality. This poignant memory will always be haunting my life.
Md Hasanujjaman
M Phil in English,
University of Hyderabad

3

The government of India doesn't seem to be interested in getting security vulnerabilities fixed. A CS engineer, Bhavyanshu Parasher, has been spending his time understanding the current security standards deployed by the government of India in most of its data-critical apps and websites. Last year, in September, he disclosed a security flaw in Prime Minster Narendra Modi's web API that exposed user identifiable information like e-mail addresses and also that there was no proper authentication check for API endpoints. During that disclosure, he faced challenges because it was difficult for him to get in touch with concerned authorities. He mentioned on his blog that e-mail address mentioned on Google's Play Store were not working. We had to contact @buzzindelhi (the handle used by BJP's Arvind Gupta on Twitter) to help him get in touch with the concerned authorities.

"The e-mail address provided on Google's Play Store returned a response stating “The email account that you tried to reach is over quota”. Had to get in touch with authorities via Twitter."

Now, the same thing is happening again. He wants to disclose vulnerabilities in two major applications deployed by the Government of India but he is struggling to get in touch with the concerned authorities. He has published a post on his blog about it though he has not mentioned the specifics of the vulnerabilities yet, as he is hoping the government will patch them before he discloses them. However, this may be rendered moot, as our searches showed that at least one of the vulnerabilities has already been publicly disclosed, but not by Bhavyanshu. That security flaw is in an unpatched version of server software and there is a CVE assigned to it. Fix has been rolled out but developers are not aware of any of this. But then why wouldn't it be so? UIDAI website still uses SSLv2 and SHA1 encoding in a world where SSLv2 has been phased out for over a decade now, and even free SSL certificates like the one used on this site come with SHA2 encoding because SHA1 isn't considered secure. You can go to the UIDAI website and check this for yourself in your browser details for the SSL certificate.

UIDAI ssl fail
UIDAI SSL fail

Bhavyanshu sent emails on March 24 and then again on April 4, but he hasn't received any response. This time @buzzindelhi isn't showing much enthusiasm in getting the vulnerabilities fixed either. In response he just directed him to the public Twitter handle of Akhilesh Mishra (Director, myGov). Hardly an acceptable process for initiating discussion about security breaches!

https://twitter.com/buzzindelhi/status/714658965703958528

One would expect Mr. Mishra to contact Bhavyanshu immediately, but the truth is that even he isn't interested.There is, as yet, no reply from him.

It is cases like these which make the whole concept of Digital India look ugly. There are no dedicated e-mail addresses for security response teams. Official e-mail addresses don't work and the apps are poor on security. It is a goldmine for unethical hackers and a complete deterrent for ethical hackers who would like to help the government fix security leaks. There is no way for the researchers to get in touch with the concerned authorities. A concept like Digital India, without guaranteed user data security and user privacy, should not be promoted by the Government of India as it puts many people at risk.

Considering the complete lack of interest in securing the vulnerabilities, we cannot provide too many details. However, people looking to exploit government data would already have found these and would be using them by now. This isn't exactly rocket science. What data is vulnerable? Let us just say that I have seen e-mail addresses, Aadhaar numbers (where provided) and street addresses and can confidently say that a malicious hacker could write a script that replicates the data for all profiles. And before you think that such things are not done, just today, Madhu Menon posted a link to the hacked and leaked Turkish citizenship database.

A similar database of MyGov.in users could prove devastating to BJP, given that their supporters are disproportionately more likely to have signed up. And while Bhavyanshu stresses that he would not do it, it isn't outside the realm of belief that more malicious hackers not just could, but definitely would. And there seems to be no way to prevent this short of raising a public stink, because a government that claims to be interested in a Digital India does not seem to have the foggiest on digital security and the need to have developer teams rapidly rolling out fixes in the event vulnerabilities are found.

"Seems like the government doesn't have dedicated security team for projects that need immediate attention to security flaws. Instead, people who wish to disclose vulnerabilities have to rely on Twitter handles to get in touch with them. I am doing a lot of volunteer work like this because I like the concept of Digital India but I don't want it without data security and privacy. I have written a web app that will help eliminate this communication gap between researchers and authorities but whom to contact? Who are the concerned authorities after all? Don't give me another Twitter handle!" , Bhavyanshu told me when asked about the current status of vulnerability disclosure. He also pointed us to privacy policy of MyGov and why people should push government for better data security.

The page for MyGov.in on HackerOne - a bug bounty program by security leaders of top internet companies like Facebook, Microsoft and Google (that rewards hackers for finding and reporting vulnerabilities so that they can be fixed) says it all "There are no known guidelines for reporting potential security vulnerabilities to this organization." Even the fact that the app has no known process for reporting vulnerabilities is an immediate flag. It tells hackers that there is no one keeping an eye on it or worried about security. The most beginning programmer puts a working address on Google Play for contacting the developer. Yet, the official application of the largest democracy in the world fails to do it.

Contrast this with the Hack The Pentagon challenge that is actively rewarding hackers to break in and expose security vulnerabilities so that they can be fixed. This is the country where, a few days ago, our Prime Minister gave a speech at the nuclear summit on April Fool's Day explaining the need to fight terrorists using 21st century technology with modern technology.

Yet, his government seems supremely unconcerned about unauthorized access to confidential information. As the UK just saw, in a country that uses technology extensively, a security breach can be used as an attack vector, when hackers hack into the water supply and change the composition of chemicals put into the tap water. A more famous example to recall could be the Stuxnet worm that damaged Iran's nuclear facilities. Yep. Code resulting in real time damage to equipment. We have, in the past seen that banks too can be hacked. We have seen that election equipment can be rigged. What will it take for us to wake up before our money, our vote, our voice and even our physical location is compromised?

It is completely insane to push for a Digital India and inaugurate three websites a month without having the requisite push to secure the data that will now be vulnerable to theft, or facilities to access. If Digital India must be, then it must be preceded by a culture of taking technology seriously or the whole country will inevitably suffer.

MyGov privacy policy claims to protect user identifiable information. Below are the excerpts from their policy page.

1. "MyGov do not sell or share any personally identifiable information volunteered on this site to any third party (public/private). Any information provided on MyGov will be protected from loss, misuse, unauthorized access or disclosure, alteration, or destruction. MyGov gather certain information about the User, such as Internet protocol (IP) address, domain name, browser type, operating system, the date and time of the visit and the pages visited. MyGov make no attempt to link these addresses with the identity of individuals visiting our site unless an attempt to damage MyGov has been detected."
(https://mygov.in/simple-page/terms-conditions/)

2. "Please note that MyGov do not share any personally identifiable information volunteered on this site with any third party (public/private). Any information provided to this website will be protected from loss, misuse, unauthorized access, disclosure, alteration, or destruction."
(https://mygov.in/mygov-faq/)

Turns out that like many other things, this privacy policy is a jumla as well.